GH-200 GitHub Actions Exam Questions and Answers

The best design is to use environment-scoped secrets with the same secret name, such as DEPLOY_KEY, in separate environments such as DevCloud and TestCloud. This lets the same reusable deployment logic reference one consistent secret name while the selected environment supplies the correct value. Option A is invalid because GitHub secret names should not be designed around dotted property access, and reusable workflows should not parse secret names dynamically. Option C introduces unnecessary marketplace dependency and weak secret handling. Option D is also wrong because GitHub secrets are opaque strings; ${{ secrets.DEPLOY_KEY.DevCloud }} is not valid secret property access. Reusable workflows can define and receive named secrets through the secrets mapping.

Self-hosted runners can have default labels and custom labels. These labels are used in the runs-on field to route workflow jobs to runners that match the required criteria. When multiple labels are specified, the runner must match all listed labels before GitHub Actions can assign the job to that runner. Therefore, option A is correct. Option B is false because labels are especially important for self-hosted runners. Option C is incorrect because GitHub does not require the runner IP address as a routing label. Option D is also incorrect because workflows target runners by labels or runner groups, not by hostname. This topic validates runner selection, self-hosted runner configuration, and workflow job routing.

================

The GITHUB_REPOSITORY environment variable contains the owner and repository name in the format owner/repository. It is automatically provided by GitHub Actions and can be used to reference the repository in workflows.

GitHub Actions provides the concurrency mechanism for preventing overlapping workflow runs or jobs that share the same concurrency group. A workflow can define a concurrency group associated with a deployment target so that only one matching deployment is running at a time. The deployment job should also reference the target GitHub environment, such as production, so GitHub can associate the job with that deployment environment and apply its deployment controls. GitHub ' s documentation specifically describes using concurrency to ensure that an environment has a maximum of one deployment in progress at a time. GitHub does not provide the mutex configuration described in options A, B, and F, and concurrency is not configured simply by assigning the numeric value 1. Therefore, specifying the concurrency scope together with the target environment is the appropriate solution.

================

The action.yml file defines the inputs and outputs for a GitHub Action. This file contains metadata about the action, including the required inputs and outputs, as well as other configurations like the action ' s description, runs, and environment setup.

GitHub allows an organization to restrict workflows so that they use only actions and reusable workflows available within that organization. When such a policy is enforced, external third-party actions and Marketplace actions can be prevented from running. Custom actions intended for internal reuse should therefore be stored in repositories owned by the organization. GitHub also allows private or internal repositories containing actions to be made accessible to other repositories in the same organization or enterprise. The .github repository has special organization-wide uses, such as workflow templates, but it is not the mandatory distribution location for all custom actions. A third-party repository or the public Marketplace would conflict with an organization-only policy. Therefore, distributing the actions through organization-owned repositories is the appropriate approach.

================

The GITHUB_TOKEN is automatically provided by GitHub in workflows and can be used to authenticate API requests to GitHub, including publishing packages to GitHub Packages.

The GITHUB_TOKEN is also used to authenticate API requests for actions like creating issues, commenting, or interacting with pull requests within the same repository.

Using a corporate secret store like HashiCorp Vault provides a secure, centralized location for sensitive information. GitHub Actions can then retrieve and store the token securely during deployment by setting it as an environment variable, ensuring the token remains secure and accessible at runtime.

Storing the token as an organizational-level encrypted secret in GitHub ensures it is accessible across multiple repositories, minimizing management overhead. GitHub Actions can then use this secret during deployment by setting it as an environment variable, allowing the microservice to access it securely at runtime.

The best way for an enterprise to control which GitHub Actions run is by creating a list of approved actions as an enterprise policy. This approach restricts workflows to only use the actions that are explicitly allowed, ensuring security and compliance within the organization.

The needs context is used to reference the outputs of jobs that are dependencies of the current job. In this case, needs.job1.outputs.output1 correctly accesses the output of output1 from the job job1 in the dependent job.

To scope a secret to a specific repository, you can create a new secret with a name like MyRepo_SuperSecret in the secrets section of the MyRepo repository ' s settings. This ensures that the secret is specific to that repository and can be used within its workflows.

A composite action is identified by its action metadata file. In action.yml or action.yaml, the runs section must define using: " composite " . This tells GitHub Actions that the action is a composite action made from one or more reusable workflow steps. Option A is incorrect because Dockerfile and package.json files do not identify a composite action; they are usually associated with Docker or JavaScript-based projects. Option C is wrong because repository naming has no technical meaning in action classification. Option D is also wrong because an init.sh file is merely a script and does not define the action type. GitHub’s metadata syntax states that composite actions require runs.using to be set to composite.

The correct trigger must use the pull_request event because the workflow is based on activity on a pull request. The specific activity is a label being added, so types: [labeled] is required. The deployment must target the releases branch, so the branch filter must be branches: - ' releases ' . The workflow must also run only when files under the apps folder change, so paths: - ' apps/** ' is the correct recursive path filter. Option A is invalid because pull_request_label is not a GitHub Actions event. Option B uses the wrong event, pull_request_review. Option C uses an incorrect branch/path combination. GitHub workflow syntax supports event activity types, branch filters, and path filters together.

Comprehensive Explanation:

Maintaining a custom GitHub Action in a dedicated repository improves discoverability, version management, and maintainability. Option D is correct because a standalone repository makes the action easier for other developers and the GitHub community to discover, document, and consume through GitHub Marketplace.

Option E is also correct because separating the action from application code allows independent semantic versioning, release management, and updates without affecting application releases.

Option A is incorrect because repository separation does not automatically provide secret-sharing capabilities. Option B is incorrect because a dedicated repository narrows rather than widens the scope of the codebase for developers maintaining the action. Option C is incorrect because an action still requires an action metadata file, typically action.yml or action.yaml.

These practices support modular, reusable, and independently maintained automation components.

Official Reference: GitHub Docs — Managing custom actions

A JavaScript action is identified in its action metadata file by the runs.using runtime value. In older exam-style content, this is commonly shown as node16; in current GitHub documentation, supported JavaScript runtimes have moved forward, but the principle remains the same: JavaScript actions declare a Node.js runtime under runs.using and specify the main JavaScript file under runs.main. Option A is not reliable because a repository can contain package.json without being a JavaScript action. Option B is unrelated because workflow files do not define the action type. Option C is naming-based and has no technical meaning. GitHub metadata syntax defines runs.using as the runtime for JavaScript actions.

The action.yml file is the metadata file in a custom GitHub Action that defines the main entry point, including information such as the inputs, outputs, description, and the runs key that specifies the main entry point (e.g., a script or a Docker container).

The workflow_run event is designed to trigger one workflow based on the execution or completion of another workflow. The deployment workflow can therefore specify the build workflow under on.workflow_run.workflows and use the completed activity type without changing the original build workflow. One important detail is that workflow_run fires when the specified workflow completes regardless of whether it succeeded or failed. If deployment must occur only after a successful build, the deployment job should additionally use a condition such as github.event.workflow_run.conclusion == ' success ' . workflow_dispatch is a manual trigger, repository_dispatch is normally used for externally generated custom events through the GitHub API, and workflow_exec is not a GitHub Actions workflow event. Therefore, workflow_run is the correct trigger.

================

The key is required because it uniquely identifies the cache. It is used to store and retrieve cached data. When creating or restoring a cache, you need to define a key that will be used to identify the cache.

The path is the file path on the runner that you want to cache. This is where the cached files or dependencies are located and should be specified to tell GitHub where to store or retrieve the cache from.

The GITHUB_REF environment variable specifies the branch or tag that triggered the workflow. It contains the full reference to the branch or tag, such as refs/heads/main for a branch or refs/tags/v1.0 for a tag.

The check_run event is triggered when a check (such as a code quality check) completes, including when the status of a check changes. By adding this event as a trigger, you can initiate a follow-up workflow when the code quality integration finishes its checks.

Comprehensive Explanation:

Option C best represents the intended security architecture: maintain the action in a private repository, restrict its consumers, and reference it using a full-length commit SHA. SHA pinning ensures subsequent changes to branches or version tags do not silently change the action code executed by workflows.

Option A violates the private repository requirement. Option B permits organization-wide consumption rather than restricting usage to the intended repositories. Option D uses semantic version tags, which can be moved to different commits and therefore provide weaker protection against unexpected code changes.

The runs-on keyword allows you to specify the operating system and other labels for the runner. By specifying self-hosted, windows, and x64, you are targeting a self-hosted Windows runner that matches these criteria, which aligns with the custom configuration of your self-hosted runner.

The Actions tab on the main page of the repository is where you can find detailed information about the workflow runs, including step failures and build logs. You can review the status of each job and step within the workflow, see the failure messages, and access logs for debugging.

The correct syntax for referencing a versioned action is owner/repository@ref. Therefore, to use version v1 of actions/javascript-action, the workflow step must use actions/javascript-action@v1. The @v1 portion is the ref, which can represent a tag, branch, or commit SHA depending on how the action publisher releases the action. Option A incorrectly treats the version as part of the repository path. Option B invents a separate version: key, which is not how action versions are selected. Option C changes the repository name and does not specify a ref. In GitHub Actions syntax, uses selects an action, and version selection is part of the action reference itself. GitHub examples use the uses: owner/action-name@ref form.

GitHub Actions supports the env key at three workflow syntax scopes: the workflow ' s top level, an individual job, and an individual step. A top-level env value is available to steps across all jobs in the workflow. jobs. < job_id > .env limits variables to the steps of one job, while jobs. < job_id > .steps[*].env limits them to a particular step. When the same variable name is defined at several levels, the most specific definition takes precedence while that scope executes. GitHub Actions does not define a generic stage scope, and defaults is used for default settings such as the shell or working directory rather than as another env scope. Likewise, runner level is not a workflow-file env scope. Therefore, step, top, and job levels are correct.

================

The correct solution is to create an organization-level Actions secret. This minimizes administrative effort because the secret can be managed once at the organization level and made available to all repositories or selected repositories through an access policy. Option D gives the correct navigation path: organization page, Settings, Secrets and variables, then Actions. Option A would require duplicating the secret in every repository, increasing maintenance overhead and risk of inconsistent values. Option B is wrong because personal developer settings do not centrally expose a secret to all organization repositories. Option C is incomplete because the current GitHub path places Actions secrets under “Secrets and variables,” not just a generic “Security > Secrets” location. GitHub documents organization secrets and the repository access policy model for sharing them.

Required reviewers is a protection rule where you can specify that certain individuals or teams must review and approve the workflow run before it can proceed. This is used to enforce approvals before certain steps or environments are accessed.

Wait timer is a protection rule that introduces a delay before a workflow can proceed to the next stage. This is useful for adding time-based constraints to the deployment process or ensuring that certain conditions are met before a workflow continues.

GitHub ' s REST API provides a dedicated Download workflow run logs endpoint. The request uses the HTTP GET method and the path /repos/{owner}/{repo}/actions/runs/{run_id}/logs. GitHub responds with a redirect to an archive containing the log files for that workflow run. The endpoint requires the repository owner, repository name, and workflow run ID. For private repositories, the caller must authenticate with appropriate repository or Actions read permissions. A POST request is not used because retrieving logs is a read operation. The artifacts endpoint manages workflow artifacts rather than workflow execution logs. Therefore, option A exactly matches the current GitHub REST API endpoint documented for downloading the log archive associated with a workflow run.

================

GitHub permits deletion of a workflow run after the run has completed. GitHub ' s current documentation also states that a workflow run may be deleted when it is more than two weeks old. Therefore, option A is a correct general statement and option C is incorrect because GitHub does not impose a 30-day minimum. Deleting a workflow run also does not require repository administrator access; GitHub specifies that write access to the repository is sufficient, which eliminates option D. Option B is too broad because an actively pending or queued workflow run is not generally treated the same as a completed run for immediate deletion. Removing a workflow run also removes its associated logs, which is relevant when managing workflow history or sensitive output. Therefore, option A is the correct selection.

================

The workflow_dispatch event is used to manually trigger a workflow run in GitHub Actions. You can specify this event in the workflow file to allow users to manually trigger the workflow from the GitHub UI, often with optional input parameters.

GitHub composite actions use the inputs context to access parameters supplied by the calling workflow. Therefore, ${{ inputs.count }} retrieves the value 5.

To expose a step output, the action must write a name=value pair to the file identified by $GITHUB_OUTPUT. The command echo " summary=Processed $count items " > > " $GITHUB_OUTPUT " creates the output named summary.

The action metadata must then map this step output to the composite action ' s declared output using ${{ steps.build.outputs.summary }}. The internal step identifier must match the actual id: build.

The calling workflow can subsequently access the value through ${{ steps.report.outputs.summary }} because report is the caller ' s step identifier.

GitHub Actions routes jobs to self-hosted runners by using runner labels. Custom labels representing required capabilities, such as the operating-system version and Xcode version, can be created and assigned to the appropriate runner. The workflow then specifies those labels in runs-on. When multiple labels are supplied, GitHub requires an eligible runner to match all specified labels, so runs-on: [self-hosted, macos-10.15, xcode-11.2] targets the intended runner configuration. Runner groups are primarily an access-control and organizational mechanism and are not represented by the ${{ groups.* }} expression shown in option B. The Xcode/macOS versions in this exam scenario are historical, but the runner-label routing principle remains current. GitHub documentation confirms custom labels and cumulative runs-on label matching.

================

A composite action allows you to bundle multiple steps into a single reusable action within a workflow. It is composed of multiple run steps or other actions and can be reused across workflows, making it the perfect choice for bundling a series of steps.

The correct syntax includes specifying the job (example-job), the runner (ubuntu-latest), and the necessary step (npm install -g bats) within the workflow. This ensures that the package is installed properly during the execution of the job.

While Docker can run on various operating systems, Linux is often the most common and preferred OS for containerized workloads. Docker works well on Linux and is a widely-used platform for running containers.

For container jobs to run on a self-hosted runner, Docker must be installed and properly configured on the runner. Docker is required to build and run containerized workloads in a GitHub Actions workflow.

The $GITHUB_ENV environment variable is used to set environment variables that persist across steps in a workflow job. By echoing FOO=bar into $GITHUB_ENV, the variable FOO will be available in subsequent steps within the same job.

GitHub-hosted runners automatically handle patching, meaning they will be kept up to date with the latest security updates and software patches for both the runner environment and the underlying operating system.

GitHub-hosted runners support Linux, Windows, and macOS, giving you flexibility to run workflows on different operating systems without needing to manage your own self-hosted runners.

A Docker container action is ideal for custom actions that require specific environments or dependencies, such as Python. By creating a Docker container, you can define the environment with the necessary Python version and dependencies, and your Python code can run inside that container.

The smallest scope for an environment variable is within a step. Environment variables defined within a step are only accessible to that particular step, which makes it the smallest scope for a variable in a GitHub Actions workflow.

A workflow can be triggered by multiple events either by using array syntax, such as on: [push, pull_request], or by configuring each event separately when filters or activity types are needed. Option C is valid because both push and pull_request are supported workflow events. Option E is also valid because it configures two event triggers: push filtered to the main branch and release filtered to the created activity type. Option B is invalid because commit is not a GitHub Actions workflow event. Option A wrongly puts environments under on. Option D defines branch filters without an event. Option F uses initiate, which is not a valid event. GitHub documents both multiple-event array syntax and separate event configuration for filters.

Self-hosted runners are appropriate when GitHub-hosted runner limits or environment restrictions do not meet the workload requirement. GitHub-hosted runner jobs have a 6-hour job execution limit, while self-hosted runner jobs can run for up to 5 days, so jobs that must run longer than 6 hours require self-hosted runners. Self-hosted runners also let an organization control the machine, operating system, software, hardware, and network location. Therefore, if a workflow job needs to install or access software from the local network, a self-hosted runner is the correct choice. macOS and Windows runners are available as GitHub-hosted options, and GitHub Actions minutes apply to GitHub-hosted usage, not self-hosted runner execution.

The $GITHUB_OUTPUT file is used to pass data from one step to another in GitHub Actions. The echo command appends the key-value pair to this file, which sets the output variable (MY_OUTPUT) for the current step.