This demonstrates that the lint.yml workflow using pull_request_target
checks out attacker-controlled code and runs bundle install, which
evaluates the Gemfile as Ruby code — enabling arbitrary code execution.

Informational only — no destructive actions.