Seems this guy spoke about how to protect GitHub Actions Repositories a couple of days ago:

https://jessehouwing.net/protect-the-repository-hosting-your-github-action/