Hi,
it could be great to support the SHA and/or Tags to get the policy from specific commit or tag.

I was facing GitHub caching "challenge" during the evaluation of this approach to replace long term credentials like PAT.
and couldn't get quickly updated version of the policy to see if new version works or not.
It was confusing that changes I was testing were not applied on Actions run due to cache invalidation delays on GitHub side.

It also will improve security as we will be able to point to specific SHA, moreover the repo with policies could have own lifecycle with releases to get the tags as well (in case if tags protection via Rulesets is used).