Distributing an action: private vs public vs Marketplace
Verdict: Keep an org-only action in a private repository and grant read access; anyone can reference a public repo directly; Marketplace makes it discoverable to all but requires a public source repo. There is no internal-only Marketplace mode.
| Criterion | Private repository | Public repository | GitHub Marketplace |
|---|---|---|---|
| Visibility | Org members or repos granted read access only | Anyone on GitHub can reference it | Discoverable to the whole community |
| Source repo | Private, never visible outside the org | Public | Must be public |
| Choose when | Internal deployment or compliance logic that must stay hidden | A utility action shared by uses reference | A flagship action for maximum discoverability |
| Extra step | Grant repo access | None beyond a uses reference | Check the publish option and select a primary category in the draft release |
Rules
- Keep an action private and grant access to consuming repos when it must never be visible outside the organisation; Marketplace has no internal-only mode.
- Listing an action on Marketplace requires checking the publish option and choosing a primary category during the draft-release flow.
- The three legitimate distribution models are: reference a public repo directly, share a private repo with granted repos, and publish to Marketplace from a public repo.
Traps
- There is no internal-only Marketplace listing, and Marketplace publishing also requires the source repository to be public.
- A Docker Hub binary or embedding logic into GitHub's runner images are not valid ways to distribute an action.