This is safe as a public repository because:
- Only I can see GitHub Actions secrets
- Only those who have write access to the HEAD branch (main) can make pull requests (currently none)
- Workflows are currently not run from pull requests from public forks (approval is needed for each pull request from a public fork)
Additionally, the secret API key used only gives minimal permissions to Cloudflare. An account takeover would not be possible even if it is leaked.