An enterprise wants many internal repositories to call a private composite action without publishing it to the public Marketplace. Which approach is appropriate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Private/internal action repos work fine—callers use uses: org/repo/path@ref with access granted. Marketplace is optional, secrets are not an action store, and composites can be shared cross-repo when allowed.
Full explanation below image
Full Explanation
Organizations commonly keep private actions in a dedicated actions repository (or monorepo path) and reference them from many product repos. Access is controlled by repository permissions, internal visibility, or enterprise sharing—not by forcing a public Marketplace listing. Organization Secrets hold credentials, not action source trees. Composite, JavaScript, and Docker actions can all be referenced across repositories when the caller can read the action repo at the pinned ref. Prefer SHA pins for high assurance, document inputs, and version with tags. Same-repo local paths (./.github/actions/...) remain an option when sharing outside the repo is unnecessary.