Some workflows refer to actions using relative paths in another repo (i.e. Microsoft)

[fproulx-boostsecurity]

Take this repo
https://github.com/devcontainers/cli/blob/b7fb42b67ee4b7dc11e0e533cff3bb3b12e22134/.github/workflows/build-chat.yml#L22-L49

They actions/checkout another repo, namely microsoft/vscode-github-triage-actions and do npm install, then uses: that follow often use actions built from that.

Basically severals dozens of highly value Microsoft repos use this pattern…
https://github.com/search?q=%28org%3Amicrosoft+OR+org%3Adotnet+OR+org%3Adevcontain[…]2Fworkflows%5C%2F%2F++NOT+is%3Aarchived+NOT+is%3Afork&type=code

build-chat.yml
https://github.com/[devcontainers/cli](https://github.com/devcontainers/cli)|devcontainers/clidevcontainers/cli | Added by GitHub
10:04

So much so that those in that microsoft repo are NEVER used like uses: microsoft/vscode-github-triage-actions@... they are 100% used like this ^

[fproulx-boostsecurity]

In the doc https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-an-action-inside-a-different-private-repository-than-the-workflow