Is it possible to attach someone's github-only package as a dependency?

How would it be possible to attach someone's github-only package (not on CRAN) as a dependency for my own package?

I assume imports are from CRAN directly.

You can use a Remotes fields in DESCRIPTION. devtools knows how to handle it. See the vignette about devtools dependencies

If you do that, you can't publish your package to CRAN. It must live elsewhere. I think it is because CRAN policy does not allow to depends on something on Github. There is a
It is why you'll find the Remotes fields mostly in in-development :package: on github. For example, in dplyr DESCRIPTION you'll find

because current dev version depends on non-cran publish in dev rlang :package:.

This field only indicate where to look for the package. You'll still need to put it in imports as any R package.

There is also a field accepted by CRAN : Additional_repositories. I think it is for package in other CRAN-like repositories.

The ‘Additional_repositories’ field is a comma-separated list of repository URLs where the packages named in the other fields may be found. It is currently used by R CMD check to check that the packages can be found, at least as source packages (which can be installed on any platform).

See Writing R Extensions