Sharing actions and workflows from your private repository
You can share an action or reusable workflow without publishing them publicly.
Warning
If you make a private repository accessible to GitHub Actions workflows in other repositories, outside collaborators on the other repositories can indirectly access the private repository, even though they do not have direct access to these repositories. The outside collaborators can view logs for workflow runs when actions or workflows from the private repository are used.
To allow runners to download these actions, GitHub passes a scoped installation token to the runner. This token has read access to the repository, and automatically expires after one hour.
Sharing actions and workflows from your private repository
Store the action or reusable workflow in a private repository. For more information, see About repositories.
On GitHub, navigate to the main page of the private repository.
Under your repository name, click Settings.
In the left sidebar, click Actions, then click General.
To grant access to other private repositories, in the Access section at the bottom of the page, select Accessible from repositories owned by 'USERNAME' user.