I mean technically GitHub could intercept the exec syscall, but given that the shell allows executing other programs that call fork and exec, you can't really b

I mean technically GitHub could intercept the exec syscall, but given that the shell allows executing other programs that call fork and exec, you can't really block it (and why would you, really). Highly likely that exec would work.