In my experience, yes. Provided it is done with a known git binary etc.

Best to containerize workflows like this with hash-locked deps so they can be easily verified by others even far in the future with any OCI compatible toolchain.