You can also print them to console in quadruple base64 in reverse, the trick is getting away with it.

Not in many enterprisey CI systems you can't, those frequently have hermetic build environments.

Nothing makes me want to quit software more than enterprisey CI systems.

I think GitHub is correct that the bypass itself is not a vulnerability, but just like the little tooltip on GitHub's "create secret gist" button, GitHub can do a better job clarifying at the "Actions permissions" section.