Always pin GitHub Actions to a specific SHA1 because if you use a third-party GitHub action like for example "conda-incubator", then you might be vulnerable to an attack in the future if the "conda-incubator" user deletes their account or changes their GitHub username from "conda-incubator" to "conda-incubator-ng" and some other random person registers the "conda-incubator" account and starts to publish malicious code packaged as a GitHub action at conda-incubator/setup-miniconda@master. If you had instead pinned your GitHub Action to a specific SHA1, then you know you'll always use that same particular version/snapshot of the action (due to git having content-addressable storage). In practice, if a large number of people have pinned for example conda-incubator/setup-miniconda@master, then github will add extra protection for that account so they wouldn't just allow it to be deleted and re-registered.
    - name: Set up Miniconda using master branch
      uses: conda-incubator/setup-miniconda@master

For an open source project (where you don't trust the PR authors, and where PRs typically come from repo forks), you can use trigger on: pull_request because in this case GitHub will run any newly added CI yml from the PR with a read-only token and no access to secrets. This essentially gives the PR author full shell access to the runner machine, so you absolutely cannot useful stateful selfhosted runners running inside your private network for this, each PR CI run should start in a essentially "factory reset" state and run inside a sandbox. Typically artifacts and caches might still persist across CI runs, but careful security audits are needed to ensure that this happens safely. The one thing that the PR author can "steal" is the compute itself (i.e. by uploading a crypto miner invokes by the PR CI yml). To mitigate this GitHub has added an extra "require approval for first-time contributors" gate as a default.
how to escape commit messages before they are sent to slack?
      - name: Escape commit message
        run: |
            echo "SAFE_COMMIT_MSG=$(echo ${SAFE_COMMIT_MSG:1:-1} | tr -d '\n')" >> $GITHUB_ENV
        env:
          SAFE_COMMIT_MSG: ${{ toJSON(github.event.head_commit.message) }}

      - name: Send success notification
        if: success()
        uses: ./.github/actions/slack
        with:
          message: '🎉 Code successfully merged! Commit: ${{ env.SAFE_COMMIT_MSG }}'
        env:
          SLACK_APP_TOKEN: ${{ secrets.SLACK_APP_TOKEN }}
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}