I was more thinking along the lines of having FOSS repos that are primarily used by me but which can accept external pull requests by anybody with a Github account.

I like the idea of running my own machine for CI but I don’t like the idea of having to become knowledgeable about avoiding exploits.

Just self host an open source runner like woodpecker and you’ll never have to move again

How painful is the setup and general maintenance/security?

I’m considering the idea but I just don’t want to deal with people abusing exploits in the actions that give them access to my LAN.