Clarify when private actions can be referenced directly

[WilliamK112]

Fixes #34562.

Summary

• clarify that the checkout-and-local-reference pattern is not the only option
• point readers to the existing docs for allowing access to internal and private actions
• keep the existing example for cases where checking out the private repository is still needed

Validation

• git diff --check
• verified the linked docs sections exist in content/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository.md

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
actions/reference/workflows-and-actions/workflow-syntax.md	fpt ghec ghes@ 3.20 3.19 3.18 3.17 3.16 3.15 3.14	fpt ghec ghes@ 3.20 3.19 3.18 3.17 3.16 3.15 3.14

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates workflow syntax documentation to clarify when private/internal actions can be referenced directly, while keeping the checkout-and-local-reference example for cases where it’s still required.

Changes:

• Adds guidance that internal/private actions can sometimes be referenced directly when access is allowed.
• Links to existing settings documentation for enabling access to internal/private components.
• Reframes the existing example as one approach for cases requiring checkout + local reference.

[Copilot]

The section title is now narrower than the guidance immediately under it (which covers internal repositories and eligible private repositories). This mismatch can confuse readers scanning headings. Consider broadening the heading (e.g., internal or private repository) or splitting into a short 'Direct reference' subsection plus the existing checkout-based example.

[Sharra-writes]

This is jumping subjects pretty abruptly with no transition. Can you let me know if this revision makes sense? (I'm a writer not an expert in this.)

Suggested change

The following example shows one way to use an action from a different private repository when you need to check out the repository and reference the action locally. Generate a {% data variables.product.pat_generic %} and add the token as a secret. For more information, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) and [AUTOTITLE](/actions/security-guides/using-secrets-in-github-actions).

If the action isn't in a repository configured to allow access, you need to check out the repository and reference the action locally. Generate a {% data variables.product.pat_generic %} and add the token as a secret. The following example shows this method for referencing an action. For more information, see [AUTOTITLE](/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) and [AUTOTITLE](/actions/security-guides/using-secrets-in-github-actions).

[Sharra-writes]

@WilliamK112 Thanks for taking this on! I've just left one updated wording suggestion that I'd like your opinion on to make sure that I'm using the terminology correctly and that it still makes sense.