shiplight

This is a CI failure-triage workflow configuration, not evidence of malware by itself. Its delegated workflow receives repository write permissions and sensitive credentials, so review the referenced workflow implementation and replace or verify the `<sha>` placeholder as a valid immutable commit pin before relying on it.