Whose concurrent jobs are used when running GitHub actions on a pull request?

Usage limits, billing, and administration - GitHub Docs mentions that there are 20 concurrent jobs for free users.

When Alice sends a Pull Request to Bob’s repository (or to a repository in Charlie’s organization), whose concurrent jobs are used? I was always assuming Alice’s (as he started the action) but a small test in Test Pull Request :-) by schierlm · Pull Request #1 · thibaultduponchelle/parallel-runners · GitHub makes me think otherwise.

Background was some discussion if there are any incentives for bad actors to run actions by creating a pull request instead of running the action in their own forks (assuming there are no additional secrets available to the actions in either case). In my opinion there were none as the action limits would count for the bad actor anyway. But in case the action limits count for Bob or Charlie, there is definitely an incentive in Pull Request spam (as currently seen by some users and even picked up by media.

1 Like

Media link in second post due to 2 links limit:

Previous discussion in the comments here:

This forum is abandoned. Nobody even pointed out this link:

Which does not really answer the question but lets me assume that my findings are correct.

Also I think this “solution” throws the baby out with the bathwater. But if nothing better is available, we have to live with it.