A mitigation for this exact policy mechanism is included in the post. (The point is not directly malicious introductions: it's supply chain risk in the form of

A mitigation for this exact policy mechanism is included in the post. (The point is not directly malicious introductions: it's supply chain risk in the form of engineers introducing actions/reusable workflows that are themselves malleable/mutable/subject to risk. A policy that claims to do that should in fact do it, or explicitly document its limitations.)