I've found a workaround that unlocks arbitrary action. See PR https://github.com/apache/calcite/pull/2318 The idea is to clone the action via git clone, and then use the "local" folder as the action source.
As of now, we need only burrunan/gradle-cache-action and AdoptOpenJDK/install-jdk, so my suggestion would be to ask infra to allow those actions, and apply the workaround if the approval takes too long. Vladimir
