> If your users have to resort to this they are not getting the appropriate support they need.

I don't see where this follows from. "private repos" and "testing" implies "local testing" for me. If that implication does not hold, the development workflow is seriously screwed. (Don't tell me there is no money for a local test setup when you have dedicated IT security.)

And in my experience, more often than not, it is screwed because someone decided to use some other flashy tool without realizing the security implications.

If you really, really need to poke holes into your firewall can easily that with ssh to a cheap vm hosted at your trustworthy hoster. If ssh ain't enough, nc and socat are your friends.