5.3.1. Distribution Models and the Marketplace

💡 First Principle: How far an action travels is a function of repository visibility and access settings — same repository, same organization, same enterprise, or the entire world — and each step outward adds an audience you can no longer coordinate with directly.

The models, from narrowest to widest. Same repository: reference it with a relative path, uses: ./.github/actions/setup, which requires an actions/checkout step first because the action's code must be on disk. Private or internal repository, shared within the org/enterprise: enable Settings → Actions → General → Access on the action's repository, then consume it as uses: my-org/my-action@v1 from permitted repositories. Public repository: anyone can consume it by reference even without a Marketplace listing — publishing is about discoverability, not permission. Marketplace: a listing with documentation, categories, and a verified-creator badge for organizations GitHub has verified.

Publishing is a UI flow from the repository's releases page ("Publish this Action to the GitHub Marketplace"), gated on the requirements above, and the README becomes the listing's documentation. Consumers then find it in search, and — importantly for enterprises (3.1.2) — the verified creator status is a policy tier organizations can allow wholesale.

For internal reuse patterns, remember two constraints from earlier phases: a private action repository must have Access enabled or consumers get a resolution 404 (5.1.3), and organization policy may block Marketplace actions entirely, in which case internal copies or an allowlist entry are the paths forward.

⚠️ Exam Trap: Referencing an action in the same repository requires actions/checkout to run first — the workspace is empty until then, so uses: ./path cannot resolve. Actions referenced by owner/repo@ref need no checkout; GitHub fetches them independently.

Reflection Question: Your organization wants one shared action used by 60 internal repositories and invisible to the public. Name the repository visibility, the one setting you must enable, and why the Marketplace is irrelevant here.