The correct option is Grant selected repositories or organizations access to the private repository that hosts the actions and reusable workflows.

This approach lets you keep the source private while enabling reuse across teams. You centralize the actions and reusable workflows in one repository and explicitly grant access to only the repositories or groups that need them. Teams can then reference the shared items by repository and ref so you avoid duplication and ensure updates are propagated from a single source of truth.

GitHub supports reusable workflows and actions sourced from a private repository when you configure access for selected repositories. This fits the goal of reuse across multiple projects without exposing the code publicly and it simplifies maintenance since you version and secure everything in one place.

Use a public repository to host the actions and restrict access with branch protection is incorrect because public visibility exposes the code to everyone. Branch protection controls how changes are made but it does not restrict who can view the repository contents.

Copy the action and workflow files into each consumer repository and reference them locally is incorrect because it creates duplication and maintenance overhead. Updates would require synchronized changes across many repositories which leads to drift and inconsistency.

Package the actions as Docker images in a private container registry and pull them from workflows is incorrect for this need. Container actions still require an action definition in a repository and this does not address reusable workflows. It also adds credential and image management without solving the sharing and versioning model that private repositories already provide.

Full AWS Practitioner Certification Question