GitHub Actions Policy Bypass: A Trivial Circumvention of Seemingly Secure Policies

GitHub Actions provides a policy mechanism to restrict the actions and reusable workflows usable within a repository, organization, or enterprise. However, this mechanism is easily bypassed. By cloning the action repository into the runner's filesystem and then using a local path reference to run the same action, the policy is trivially circumvented. This renders the seemingly secure policy ineffective. The author urges GitHub to address this vulnerability to prevent developers from mistakenly believing the policies provide a security boundary that doesn't exist.