The neat part is you can do whatever you want in a GitHub action, corporate policy be damned. So:

git clone <tmate / banned action git URL> cd <the action> Run the action start point.

Apparently this is a feature, not a security risk.

https://blog.yossarian.net/2025/06/11/github-actions-policie...