[solumos]

The implied fix to the “unusable secure system” is forking the checkout action to your org and referencing it there.

[hiatus]

That's not a fix though is it? Git tools are already on the runner. You could checkout code from public repos using cli, and you could hardcode a token into the workflow if you wanted to access a private repo (assuming the malicious internal user doesn't have admin privileges to add a secret).