It's bad if you're concerned about your data being used for training, sure. But I don't think any worse than e.g. running Claude or Codex locally.
I think the only solution there is self-hosted inference (either local, or on your own cloud servers with open weights).
That's the bit that's common, I say it's worse because it has to actually check out the full source on their server. i.e. similar to if you used Claude locally, plus used third-party CI like Circle instead of Actions.