Control access to actions and workflows and configure organisation use policies that restrict which actions may run.

An organisation has set Actions permissions to Allow specified actions and reusable workflows with a short allow list of approved third-party actions. A repository in the organisation defines its own composite action in .github/actions/build and references it from a workflow with a relative path. The team asks whether they must add this internal action to the organisation allow list for the workflow to run. Which statement is accurate?

• AActions defined within the same repository as the calling workflow are always permitted regardless of the allowed actions policy, so the internal composite action runs without any allow-list entry.check_circle Correct
• BThe internal action must be added to the allow list using its owner/repo path, because the select policy evaluates every uses reference identically whether the action is local or fetched from elsewhere.
• CThe workflow must switch to Allow <org> actions and reusable workflows first, because only that policy recognises actions stored inside the organisation's own repositories as trusted internal code.
• DThe team must publish the composite action to GitHub Marketplace and enable the verified creators toggle, because the select policy resolves internal actions only through their Marketplace listing.

Why A is correct: GitHub exempts actions that live in the same repository as the workflow from the allowed actions policy, so a relative-path internal action runs even under the select policy with no allow-list entry needed.

Why B is wrong: Tempting because the policy does screen uses references, but same-repository actions are exempt, so requiring an allow-list entry for a local action misreads how the select policy treats internal code.

Why C is wrong: Tempting because that policy name mentions organisation actions, but the select policy already permits same-repository actions, so changing the whole policy to run one local action is unnecessary.

Why D is wrong: Tempting because Marketplace and toggles relate to permitted sources, but a same-repository action needs no Marketplace listing, and the verified-creator toggle has no bearing on local internal code.