An internal JavaScript action is maintained in a private repository. Approved consumer repositories in the same organization should use it while the implementation remains private. Which two facts are relevant? Select 2.

1. The action repository must allow access from the intended repositories through its Actions access settings.
2. A consumer uses an allowed owner/repository/path reference at an appropriate revision.
3. Give the caller contents: write and assume this bypasses the action source repository access settings.
4. Every consumer must copy the action source into its own default branch before uses can work.
5. Publishing the action on Marketplace is mandatory even for internal reuse.