That's the bit that's common, I say it's worse because it has to actually check out the full source on their server. i.e. similar to if you used Claude locally, plus used third-party CI like Circle instead of Actions.