GH-200 GitHub Actions Exam Questions and Answers

GitHub self-hosted runners maintain diagnostic information locally in the _diag directory beneath the runner installation directory. The runner application creates Runner_*.log files containing information about startup, connectivity, registration, updates, and general runner activity. Job-specific execution details are written to Worker_*.log files in the same diagnostic directory. These logs are therefore the primary source when investigating intermittent connection or execution problems. GitHub ' s troubleshooting documentation explicitly directs administrators to inspect the _diag directory and also provides connectivity-check scripts for diagnosing communication failures. The other options describe mechanisms that are not the documented standard procedure: there is no general repository-settings feature for downloading the runner ' s local diagnostic archive, and the suggested generic --debug and DEBUG=true mechanisms are not the prescribed runner troubleshooting method.

================

The runs-on keyword allows you to specify the operating system and other labels for the runner. By specifying self-hosted, windows, and x64, you are targeting a self-hosted Windows runner that matches these criteria, which aligns with the custom configuration of your self-hosted runner.

The correct minimal syntax for declaring an output in GitHub Actions is by using the foo key under outputs, and associating it with a value (in this case, Some value). This is the simplest form to define an output in a workflow or action.

The $GITHUB_OUTPUT file is used to pass data from one step to another in GitHub Actions. The echo command appends the key-value pair to this file, which sets the output variable (MY_OUTPUT) for the current step.

The correct GitHub Actions context property for the short branch or tag name that triggered the workflow is github.ref_name. A job-level if: condition can use this context to control whether the job runs. Therefore, if: github.ref_name == ' feature-branch ' correctly limits the deploy job to the feature-branch branch. The other options use invalid context paths such as github.ref.name, github.branch_name, and github.branch.name; these are not recognized GitHub Actions properties. In exam terms, this question validates knowledge of workflow expressions, GitHub context variables, and conditional job execution. The important distinction is that github.ref contains the full ref path, while github.ref_name provides the branch or tag name directly.

================

Scheduled GitHub Actions workflows use the schedule event beneath the workflow ' s on key. Each schedule is represented by a cron entry, which makes option A the valid structure. GitHub scheduled workflows use POSIX-style five-field cron syntax, and scheduled execution is interpreted in UTC by default. In the expression 45 7 * * 3,6, 45 represents minute 45, 7 represents 07:00 UTC, the two asterisks allow every day of the month and every month, and 3,6 specifies Wednesday and Saturday. Consequently, the workflow is scheduled for 07:45 UTC on both requested weekdays. Options B and D incorrectly place cron directly beneath on, while option C does not use the required schedule list containing a cron entry.

================

Using a commit hash is the safest method because it references a specific point in time in the repository’s history. This ensures that the action is locked to that exact version and will not be affected by any future changes or modifications to the codebase. Even if the action is updated later, your workflow will continue using the specific commit you referenced.

The best way for an enterprise to control which GitHub Actions run is by creating a list of approved actions as an enterprise policy. This approach restricts workflows to only use the actions that are explicitly allowed, ensuring security and compliance within the organization.

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub’s OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.

GitHub allows an organization to restrict workflows so that they use only actions and reusable workflows available within that organization. When such a policy is enforced, external third-party actions and Marketplace actions can be prevented from running. Custom actions intended for internal reuse should therefore be stored in repositories owned by the organization. GitHub also allows private or internal repositories containing actions to be made accessible to other repositories in the same organization or enterprise. The .github repository has special organization-wide uses, such as workflow templates, but it is not the mandatory distribution location for all custom actions. A third-party repository or the public Marketplace would conflict with an organization-only policy. Therefore, distributing the actions through organization-owned repositories is the appropriate approach.

================

The workflow_run event is designed to trigger one workflow based on the execution or completion of another workflow. The deployment workflow can therefore specify the build workflow under on.workflow_run.workflows and use the completed activity type without changing the original build workflow. One important detail is that workflow_run fires when the specified workflow completes regardless of whether it succeeded or failed. If deployment must occur only after a successful build, the deployment job should additionally use a condition such as github.event.workflow_run.conclusion == ' success ' . workflow_dispatch is a manual trigger, repository_dispatch is normally used for externally generated custom events through the GitHub API, and workflow_exec is not a GitHub Actions workflow event. Therefore, workflow_run is the correct trigger.

================

To scope a secret to a specific repository, you can create a new secret with a name like MyRepo_SuperSecret in the secrets section of the MyRepo repository ' s settings. This ensures that the secret is specific to that repository and can be used within its workflows.

Job outputs are used to pass data from one job to another in a workflow. A job can produce output values (like variables or files), which can be referenced by subsequent jobs using the needs keyword and ${{ steps.step_id.outputs.output_name }} syntax.

Artifact storage allows data (such as files or results) to be saved by a job and then retrieved by another job in a later step. This is commonly used for passing large amounts of data or files between jobs.

First, the dataset should be encrypted before being stored. This ensures that the data is protected when stored in a repository.

The encrypted dataset can be stored in a GitHub secret, ensuring it is securely kept and not exposed publicly.

The encryption key needed to decrypt the dataset should also be stored in a GitHub secret to maintain security during the workflow, allowing access only when needed.

GitHub secrets are defined at different levels: organization, repository, and sometimes at the workflow level. If a secret is defined at both the organization level and the repository level, the repository-level secret will take precedence. So, if the value of the secret differs between these levels, the workflow will use the value from the repository level instead of the organization level.

Workflow commands are special commands that allow you to interact with the runner, set environment variables, output values, add debug messages, and perform other tasks within the workflow. These commands are used to modify the environment or influence the behavior of the GitHub Actions runner.

Setting a debug message using ::debug:: command sends a message to the logs, helping with troubleshooting and providing insight into the workflow run.

Setting output parameters using ::set-output sends data from a job step to subsequent steps or jobs, which can be used later in the workflow.

Self-hosted runners are appropriate when GitHub-hosted runner limits or environment restrictions do not meet the workload requirement. GitHub-hosted runner jobs have a 6-hour job execution limit, while self-hosted runner jobs can run for up to 5 days, so jobs that must run longer than 6 hours require self-hosted runners. Self-hosted runners also let an organization control the machine, operating system, software, hardware, and network location. Therefore, if a workflow job needs to install or access software from the local network, a self-hosted runner is the correct choice. macOS and Windows runners are available as GitHub-hosted options, and GitHub Actions minutes apply to GitHub-hosted usage, not self-hosted runner execution.

A workflow becomes reusable when its on configuration includes the workflow_call event. This event declares that the workflow can be invoked by another workflow rather than only being started by ordinary repository events. Inputs and secrets can also be defined beneath workflow_call so the caller can provide values to the reusable workflow. workflow_run has a different purpose: it starts a workflow in response to another workflow running or completing. pull_request responds to pull-request activity, while check_run responds to GitHub Checks activity. GitHub ' s official reusable workflow documentation explicitly states that a reusable workflow must contain on: workflow_call. Therefore, workflow_call is the required keyword when defining a workflow intended to be called from other workflows.

================

To prevent reaching the storage limit for GitHub artifacts and packages, you should manage and clean up artifacts and packages stored in repositories owned by your organization. This includes deleting unnecessary artifacts and managing the lifecycle of packages, as they contribute directly to your organization ' s storage quota.

GitHub Actions on GitHub Enterprise Server often requires an internet connection, especially for accessing actions from the GitHub Marketplace or third-party actions unless they are manually synced to the server.

To use third-party actions on GitHub Enterprise Server, GitHub Connect can be used to establish a connection between the server and GitHub.com, enabling access to third-party actions.

Third-party actions can also be manually synchronized to the GitHub Enterprise Server, making them available for use in workflows.

Actions stored in private repositories within the organization can be reused across all repositories by referencing them in workflows. This ensures a centralized way of maintaining custom actions.

Encrypted secrets can be accessed across repositories in the same organization, making it easy to store sensitive data (like API keys or tokens) securely while allowing multiple workflows to access them.

Workflow templates allow you to create reusable templates for workflows that can be shared across repositories within the organization. This makes it easier to standardize processes and automate them across multiple projects.

Creating a separate repository for each custom action allows you to manage the versioning independently for each action. This approach provides flexibility, as each action can be updated, tested, and versioned separately, avoiding potential conflicts or dependencies between different actions.

For JavaScript custom actions, the metadata file supports lifecycle scripts through the runs section. The correct key for a script that runs before the main action entrypoint is pre, and the correct conditional key for controlling whether that pre-script runs is pre-if. Therefore, option B is the only valid metadata structure. GitHub Actions does not use start, start-if, before, or before-if as action metadata keys. Option C is also invalid because pre-if only defines a condition; it cannot contain both a condition and a script reference in one line. In GitHub Actions exam terms, this tests custom action metadata, JavaScript action lifecycle hooks, and conditional execution before the main action logic.

================

GitHub explicitly recommends keeping an action in its own repository when the action is intended for other people to use. One advantage is discoverability: a dedicated repository makes the action easier for other developers and the GitHub community to locate and understand. Another major advantage is independent versioning. The action can be tagged, released, maintained, and upgraded without coupling its release lifecycle to unrelated application code. GitHub additionally notes that a dedicated repository actually narrows , rather than widens, the code-base scope for developers maintaining the action, making option D incorrect. Separate repositories do not provide a mechanism for sharing secrets with users, and an action still requires action metadata such as action.yml or action.yaml. Therefore, easier discovery and independent versioning are the two correct benefits.

================

The best design is to use environment-scoped secrets with the same secret name, such as DEPLOY_KEY, in separate environments such as DevCloud and TestCloud. This lets the same reusable deployment logic reference one consistent secret name while the selected environment supplies the correct value. Option A is invalid because GitHub secret names should not be designed around dotted property access, and reusable workflows should not parse secret names dynamically. Option C introduces unnecessary marketplace dependency and weak secret handling. Option D is also wrong because GitHub secrets are opaque strings; ${{ secrets.DEPLOY_KEY.DevCloud }} is not valid secret property access. Reusable workflows can define and receive named secrets through the secrets mapping.

The core.warning() function from the @actions/core package is used to create a warning message in the workflow logs. This is an annotation type that informs users about issues that don ' t require failing the build but still need attention.

The pull_request event supports activity-type filtering, including the labeled activity, so a workflow can respond when a label is added to a pull request. The branches filter limits execution according to the pull request ' s target or base branch, while the paths filter limits execution according to changed files. GitHub also states that when branch and path filters are both configured, both conditions must be satisfied . Therefore, a pull request targeting releases, containing a change beneath apps/**, and receiving a label matches option C. pull_request_review concerns review activity rather than labeling, and pull_request_label is not a GitHub Actions workflow event. Option B also uses filters that do not accurately represent the stated exact branch and folder requirement.

================

GitHub Actions supports the use of service containers, which allows you to spin up a PostgreSQL database (or any other service) in a Docker container during your workflow. You can pull a PostgreSQL image from Docker Hub, and the container will automatically be available to your workflow job. This method requires no additional infrastructure and is easy to configure and maintain, as you simply define the container in the workflow file.

The ::debug:: syntax is used to output debug messages in GitHub Actions workflows. This command will print the message " action successfully debugged " in the debug logs when the workflow runs.

A TypeScript-based GitHub Action is implemented as a JavaScript action because TypeScript is compiled or bundled into JavaScript before execution by the GitHub Actions runner. JavaScript actions use an action.yml metadata file whose runs.using value specifies a supported Node.js runtime and whose runs.main property identifies the generated JavaScript entry point, commonly a file under dist. This approach allows the action to run directly on supported Linux, Windows, and macOS runners without requiring a separate Docker container. A composite action is intended primarily to combine reusable workflow steps, while a Bash script action is not a distinct metadata action type. Docker container actions are appropriate when a packaged container environment is specifically required. Therefore, a custom action authored in TypeScript should be packaged and distributed as a JavaScript action.

================

For GitHub Marketplace publishing, the action must meet Marketplace metadata and naming requirements. Option D is correct because the repository must contain a single action metadata file, action.yml or action.yaml, at the repository root for Marketplace listing. Option B is also correct because the action name must be unique and cannot match a GitHub user or organization unless that owner is publishing the action. Option A is false because Marketplace actions must be in public repositories. Option C is incorrect because a repository is expected to contain one marketplace-listed metadata file at the root, not a collection of marketplace actions. Option E is wrong because the name must not match an existing Marketplace category. GitHub documents these Marketplace prerequisites directly.

The workflow_dispatch event is used to manually trigger a workflow run in GitHub Actions. You can specify this event in the workflow file to allow users to manually trigger the workflow from the GitHub UI, often with optional input parameters.

Organization starter workflow templates must be stored in a special workflow template directory so that they appear in the GitHub Actions “New workflow” interface. The correct location is .github/workflow-templates, typically in the organization’s .github repository. Therefore, option C is correct. Option A, .github/workflows, is where active workflow files are stored inside a repository so they can be triggered by events. It is not the correct location for organization-level starter templates. Option B is not a valid GitHub Actions workflow template directory. Option D is incorrect because storing the file in each repository’s root does not publish it as a reusable starter workflow template. This checks workflow template reuse and organization automation standardization.

================

The run keyword is used to execute command-line programs and scripts on a GitHub Actions runner. When several commands must execute within the same workflow step, YAML ' s literal block indicator (|) can be placed after run: and the commands written on separate indented lines. GitHub ' s workflow syntax explicitly demonstrates this pattern with npm ci followed by npm run build. The shell keyword does not contain commands; it specifies which shell should interpret the commands supplied through run. Therefore, options B and C misuse the shell property. Option D also lacks the YAML literal block notation required to represent the multiple command lines as the value of run. Option A correctly executes both commands sequentially within the same shell process and is the documented syntax.

================

The publish-npm job includes the JS-DevTools/npm-publish action, which is used to publish an npm package to an npm registry.

The publish-npm job has the needs: build directive, meaning it will only run after the build job successfully completes.

A matrix strategy allows you to define different versions of a programming language (or any other environment setting) and run tests on each version simultaneously. This is particularly useful for testing code compatibility across different versions of a language.

A matrix strategy can also be used to test code on multiple operating systems (e.g., Windows, macOS, Linux) by defining these operating systems as matrix variables. This enables cross-platform testing within the same workflow.

GitHub Actions defines custom environment variables with the YAML env mapping. YAML mappings use a colon between each key and value, so MY_VARIABLE: my-value beneath env: is the correct syntax. The env key can appear at workflow, job, or step scope depending on how broadly the variable should be available. Options A, B, E, and F either use an unsupported key or the wrong assignment syntax. environment is associated with deployment environments when used in GitHub Actions workflow syntax; it is not the key for declaring ordinary environment variables. The vars context is used for configuration variables created through repository, organization, or environment settings, but var: is not the workflow syntax shown here. Therefore, option C correctly defines the requested custom environment variable.

================