"is it a DoS or a CI runner" 😅 

often projects don't bother setting up caching and just re-download and check out the dependencies constantly

but yes blacklisting or just setting their rate limit to very very slow will send the right message, either way