GH-200 GitHub Actions Exam Questions and Answers

A matrix strategy allows you to define different versions of a programming language (or any other environment setting) and run tests on each version simultaneously. This is particularly useful for testing code compatibility across different versions of a language.

A matrix strategy can also be used to test code on multiple operating systems (e.g., Windows, macOS, Linux) by defining these operating systems as matrix variables. This enables cross-platform testing within the same workflow.

The check_run event is triggered when a check (such as a code quality check) completes, including when the status of a check changes. By adding this event as a trigger, you can initiate a follow-up workflow when the code quality integration finishes its checks.

Environment secrets are scoped to GitHub Actions environments and can be protected by environment protection rules. If an environment requires reviewers, a job that references that environment cannot access its environment secrets until the required approval is granted. This makes option A correct. Option B is incorrect because environment secrets are made available to jobs that reference the protected environment, not selectively to only one specific step by default. Option C is not the purpose of environment secrets; they are not specifically for connecting to GitHub Enterprise Server. Option D is also incorrect because GitHub environment secrets do not automatically pull from Azure Key Vault without additional integration or custom workflow logic. This topic covers environment protection, secrets, and deployment governance.

================

The best design is to use environment-scoped secrets with the same secret name, such as DEPLOY_KEY, in separate environments such as DevCloud and TestCloud. This lets the same reusable deployment logic reference one consistent secret name while the selected environment supplies the correct value. Option A is invalid because GitHub secret names should not be designed around dotted property access, and reusable workflows should not parse secret names dynamically. Option C introduces unnecessary marketplace dependency and weak secret handling. Option D is also wrong because GitHub secrets are opaque strings; ${{ secrets.DEPLOY_KEY.DevCloud }} is not valid secret property access. Reusable workflows can define and receive named secrets through the secrets mapping.

GitHub Actions encrypted secrets can be accessed in workflows using the secrets context. You can directly reference the secret within an if: conditional using ${{ secrets.MySuperSecret }} to determine whether a job or step should run based on the secret ' s value.

The correct manual trigger for a GitHub Actions workflow is workflow_dispatch. Defining workflow_dispatch under the on key enables the workflow to be started manually from the GitHub UI, GitHub CLI, or API. Inputs are optional but valid; they allow the user to provide values when manually starting the workflow, so option A is also correct. A schedule trigger is for cron-based automatic execution, not manual execution. workflow_call is used to make a workflow reusable by another workflow; it does not create the manual “Run workflow” button. Therefore, A and C are the correct selections. GitHub’s documentation confirms that manual workflows require workflow_dispatch and can include custom inputs.

Setting a debug message using ::debug:: command sends a message to the logs, helping with troubleshooting and providing insight into the workflow run.

Setting output parameters using ::set-output sends data from a job step to subsequent steps or jobs, which can be used later in the workflow.

Some actions may require a GITHUB_TOKEN as an input to authenticate and perform specific tasks, such as creating issues, commenting on pull requests, or interacting with the GitHub API. In such cases, you would need to explicitly pass the token to the action.

When making an authenticated GitHub API request, the GITHUB_TOKEN is required to authenticate the request. This token is automatically provided by GitHub in the workflow, and it must be explicitly used when interacting with the GitHub API.

Required reviewers is a protection rule where you can specify that certain individuals or teams must review and approve the workflow run before it can proceed. This is used to enforce approvals before certain steps or environments are accessed.

Wait timer is a protection rule that introduces a delay before a workflow can proceed to the next stage. This is useful for adding time-based constraints to the deployment process or ensuring that certain conditions are met before a workflow continues.

The simplest official GitHub Actions action type for running shell commands or shell scripts is a composite action. Composite actions allow an action author to combine one or more run steps and reusable workflow commands in an action.yml file without needing to package a Docker image or write a JavaScript action. Option B is correct because it directly supports shell-based automation. Option A is heavier because Docker container actions require a container image or Dockerfile. Option D is used when the action logic is written in JavaScript and executed with Node.js. Option C is incorrect because “Bash script action” is not an official GitHub Actions action type. This topic checks custom action types and reuse patterns.

GitHub-hosted runners automatically handle patching, meaning they will be kept up to date with the latest security updates and software patches for both the runner environment and the underlying operating system.

GitHub-hosted runners support Linux, Windows, and macOS, giving you flexibility to run workflows on different operating systems without needing to manage your own self-hosted runners.

GitHub Marketplace is used to discover, share, and publish reusable automation, including GitHub Actions created by GitHub, vendors, and the community. Option C best describes this role. Marketplace does not exist only for billing, so option B is too narrow and incorrect. Option A is also wrong because Marketplace does not merely restrict third-party actions to public repositories; action usage is governed by repository, organization, or enterprise Actions policies. Option D is false because Marketplace does not bypass repository permissions or automatically deploy workflows into repositories. In exam terms, Marketplace is part of the automation reuse and action discovery domain: developers use it to find trusted or verified actions rather than building every integration manually. GitHub documents Marketplace as a place to publish and share actions with the community.

A workflow can be triggered by multiple events either by using array syntax, such as on: [push, pull_request], or by configuring each event separately when filters or activity types are needed. Option C is valid because both push and pull_request are supported workflow events. Option E is also valid because it configures two event triggers: push filtered to the main branch and release filtered to the created activity type. Option B is invalid because commit is not a GitHub Actions workflow event. Option A wrongly puts environments under on. Option D defines branch filters without an event. Option F uses initiate, which is not a valid event. GitHub documents both multiple-event array syntax and separate event configuration for filters.

The Actions tab on the main page of the repository is where you can find detailed information about the workflow runs, including step failures and build logs. You can review the status of each job and step within the workflow, see the failure messages, and access logs for debugging.

If a workflow depends on an external service that is down, disabling the workflow temporarily will prevent it from running and sending requests to the service, thus avoiding failed requests or unnecessary retries.

If a workflow is causing a negative impact on external services by generating too many requests or incorrect data due to a bug, temporarily disabling the workflow will stop this behavior while the issue is fixed.

The publish-npm job includes the JS-DevTools/npm-publish action, which is used to publish an npm package to an npm registry.

The publish-npm job has the needs: build directive, meaning it will only run after the build job successfully completes.

You can enable specific actions for the organization by identifying them and providing version control, ensuring only trusted versions are used in workflows.

GitHub-verified actions can be enabled at the enterprise level, providing an extra layer of security by ensuring that only trusted actions are available to workflows.

Actions can be published to an internal marketplace, allowing organizations to share reusable actions securely within their enterprise without exposing them to the public.

GITHUB_WORKSPACE is a default environment variable in GitHub Actions that points to the directory on the runner where your repository is checked out. This variable allows you to access files within your repository during the workflow.

For a composite action, commands are defined inside the runs.steps section of the action metadata file. When a specific command must execute from a particular folder, the correct key is working-directory, and it must be applied at the individual run step level. Option D is correct because it keeps using: " composite " at the runs level and applies working-directory: ${{ inputs.dir }} directly to the step that runs the script. Option A is incorrect because directory is not a valid GitHub Actions run-step key. Option B incorrectly places directory at the runs level. Option C uses the right keyword but places it at the wrong level. This tests composite action metadata syntax and correct step-level execution configuration.

The ::debug:: syntax is used to output debug messages in GitHub Actions workflows. This command will print the message " action successfully debugged " in the debug logs when the workflow runs.

GitHub Actions supports the use of service containers, which allows you to spin up a PostgreSQL database (or any other service) in a Docker container during your workflow. You can pull a PostgreSQL image from Docker Hub, and the container will automatically be available to your workflow job. This method requires no additional infrastructure and is easy to configure and maintain, as you simply define the container in the workflow file.

The correct solution is to create an organization-level Actions secret. This minimizes administrative effort because the secret can be managed once at the organization level and made available to all repositories or selected repositories through an access policy. Option D gives the correct navigation path: organization page, Settings, Secrets and variables, then Actions. Option A would require duplicating the secret in every repository, increasing maintenance overhead and risk of inconsistent values. Option B is wrong because personal developer settings do not centrally expose a secret to all organization repositories. Option C is incomplete because the current GitHub path places Actions secrets under “Secrets and variables,” not just a generic “Security > Secrets” location. GitHub documents organization secrets and the repository access policy model for sharing them.

Workflow files must be stored in the .github/workflows/ directory of the repository. This is the standard location for GitHub Actions workflow files, and workflows in this directory are automatically triggered by events defined in the file, such as pushes, pull requests, or other GitHub events.

Workflow commands are special commands that allow you to interact with the runner, set environment variables, output values, add debug messages, and perform other tasks within the workflow. These commands are used to modify the environment or influence the behavior of the GitHub Actions runner.

Actions can be stored in a separate public repository and referenced in workflows by specifying the repository and action name.

Actions can also be stored in the same repository as the workflow and referenced directly by their path (e.g., ./.github/actions/my-action).

Actions can be packaged as Docker container images and published to Docker Hub. These can then be referenced in workflows by specifying the Docker image.

While Docker can run on various operating systems, Linux is often the most common and preferred OS for containerized workloads. Docker works well on Linux and is a widely-used platform for running containers.

For container jobs to run on a self-hosted runner, Docker must be installed and properly configured on the runner. Docker is required to build and run containerized workloads in a GitHub Actions workflow.

The workflow_call event is used to trigger a reusable workflow from another workflow. This allows you to create workflows that can be reused in multiple places within your organization, enabling better modularity and reducing duplication.