Review this PR benchmark workflow

Situation

GPT-5.3 generated a workflow that benchmarks pull requests and posts a result to Slack.

Environment

The repository accepts fork pull requests. Benchmark results are useful before merge, and the workflow has access to the same notification secret used by internal CI.

Select suspicious lines in the terminal to flag them before submitting your verdict.

pending review

name: Benchmark PR

on:
  pull_request_target:
    branches: [main]

jobs:
  benchmark:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}
      - run: npm ci
      - run: npm run benchmark
      - run: |
          curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
            -H "Content-Type: application/json" \
            -d "{\"text\":\"Benchmark done for ${{ github.event.pull_request.title }}\"}"