GH-200 decision sheets

• Distributing an action: private vs public vs Marketplace
• Pinning an action: commit SHA vs tag vs branch
• Docker vs JavaScript vs composite actions
• Org defaults: runner group and secret repository access
• pull_request vs pull_request_target for fork pull requests
• Reusable workflows: nesting limit and passing a value to the caller
• GitHub-hosted vs self-hosted runners: when self-hosted is safe
• Runners behind an IP allow list: which type reaches internal resources