[lixtra]

It’s like putting

curl -sSL https://example.com/install.sh | sh

In your action. For sure happens.

[woodruffw]

Yes; I would also consider that a bad idea. Two wrongs don't make a right (and a different wrong doesn't justify a broken policy elsewhere).

[masklinn]

Being able to filter or disable network access (aside from what github requires on their side to interact with actions) would definitely be useful, but AFAIK that's only an option for self-hosted runners and enterprise accounts.