The correct options are JavaScript entry file such as main.js or index.js, Action metadata file action.yml or action.yaml, and Container action Dockerfile.
The Action metadata file action.yml or action.yaml is mandatory because it declares inputs and outputs and it instructs GitHub how to run the action. Both JavaScript and container actions rely on this metadata to execute correctly.
For a JavaScript action the JavaScript entry file such as main.js or index.js is the script that the runner executes as directed by the metadata. GitHub expects a committed distributable script, so the entry file must be present in the repository.
For a container action the Container action Dockerfile defines how to build the image and what command to run, which makes the Dockerfile required for the action to work.

The enterprise Actions policy is the centralized place where enterprise owners enforce which actions and reusable workflows are permitted across all organizations in GitHub Enterprise Cloud. From this scope you can require that only actions and reusable workflows hosted within the enterprise are allowed to run, and this policy flows down to organizations and repositories to ensure consistent enforcement.

Job outputs are used to pass data from one job to another in a workflow. A job can produce output values (like variables or files), which can be referenced by subsequent jobs using the needs keyword and ${{ steps.step_id.outputs.output_name }} syntax.
Artifact storage allows data (such as files or results) to be saved by a job and then retrieved by another job in a later step. This is commonly used for passing large amounts of data or files between jobs.

Example: Using versioned actions
steps:
# Reference a specific commit
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3
*-> # Reference the major version of a release
- uses: actions/checkout@v4
# Reference a specific version
- uses: actions/[email protected]
# Reference a branch
- uses: actions/checkout@main
Reference:
https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax

The best way for an enterprise to control which GitHub Actions run is by creating a list of approved actions as an enterprise policy. This approach restricts workflows to only use the actions that are explicitly allowed, ensuring security and compliance within the organization.