I really wish people would drop the GHA model because it's so bad and insecure by design. GitLab's CI is miles better and easier to use.

True but GitLab is going to run into the same issues as GitHub, maybe even worse because GitLab doesn't have a trillion dollar multinational benefactor. Public corporation and developer tooling has never boded well, a current look at GitLab reflects this sentiment perfectly.

Which is why we should always champion FOSS for dev tooling as it's the only way a community can have a say in an industry dominated by unregulated tech behemoths.