The "test dependants" script (linked below) that compiles all reverse dependencies seems dangerous in this era of supply chain attacks. If you use this script, a malicious actor can get arbitrary code running on your CI by simply adding a package that depends on yours on the Rocq opam repository (Rocq opam maintainers can't feasibly review every single line of code of packages that are submitted there). This doesn't give access to a lot if you use the template as-is but it's not difficult to imagine a scenario where an innocent user modifies their CI workflow to access some secrets and bam that's a leak waiting to happen.

The fix is to require an explicit list of packages to test so it's up to each user of this template to vet the packages they add there.