Files in the folder .github/workflows are explicitly welcome to receive security vulnerability alerts.
This project is a demonstration of GitHub Actions and contain example application that will not be actively maintained. Even automated GitHub Analysis are disabled to reduce noise.
Note: if you are a software developer and want to submit code refactoring (likely to be a new example bootstrapping example) your pull request will be welcome.
On this specific project, feel free to open a public GitHub issue, including mentioning with @ the previous developers.
As an alternative (for example, if you are using this in some project or know some other project using this as reference) you can try to discuss by email with some previous developers. Look by their email on GitHub profile or other places.