That depends on the license. Music is also available on Youtube without authentication requirements but I don’t think you can just download those and do whatever you want with them.

Everything Herb Sutter says about the popularity of C++ should be taken with a huge grain of salt.

I was more thinking along the lines of having FOSS repos that are primarily used by me but which can accept external pull requests by anybody with a Github account.

I like the idea of running my own machine for CI but I don’t like the idea of having to become knowledgeable about avoiding exploits.

Just self host an open source runner like woodpecker and you’ll never have to move again

How painful is the setup and general maintenance/security?

I’m considering the idea but I just don’t want to deal with people abusing exploits in the actions that give them access to my LAN.