There are a lot of subtle pitfalls as well. Like no default timeouts, excess permissions etc.

I wrote about it in detail https://ashishb.net/tech/common-pitfalls-of-github-actions/ And even created a tool to generate good configs http://github.com/ashishb/gabo