GH-200 sample questions with answers

GH-200 sample questions

GitHub Actions (GH-200), GitHub / Microsoft.

1. Question 1

   Domain: Author and manage workflows

   Which context gives a workflow access to configuration variables defined at the organization, repository or environment level?

   1. vars
   2. env
   3. secrets
   4. github
   Show the answer

   Answer: A. vars

   Configuration variables created in settings (or through the API) are exposed through the vars context, for example ${{ vars.DEPLOY_REGION }}. The env context holds variables defined in the workflow itself with the env key, and secrets holds encrypted secrets, not plain configuration variables.

   Checked against: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#vars-context

2. Question 2

   Domain: Author and manage workflows

   A developer adds on: workflow_dispatch to a new workflow file on a feature branch and pushes it. In the Actions tab, the workflow never shows a "Run workflow" button.

   What is the most likely reason?

   1. workflow_dispatch only shows the button when at least one input is declared
   2. Manual runs are limited to repository administrators, who see the button in Settings
   3. workflow_dispatch workflows can only be started from the REST API, not the UI
   4. The workflow file must be on the default branch for the button to appear
   Show the answer

   Answer: D. The workflow file must be on the default branch for the button to appear

   GitHub shows the Run workflow button only when the workflow file with a workflow_dispatch trigger exists on the default branch; after that you can choose another branch to run it on. Inputs are optional, so a workflow without inputs is still manually runnable, and users with write access, not just admins, can dispatch it.

   Checked against: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow

3. Question 3

   Domain: Author and manage workflows

   A nightly job uploads a large debug bundle that is only useful for a few days. How can it keep that artifact for 5 days without changing the repository-wide retention?

   1. Set timeout-minutes: 7200 on the job that uploads the bundle
   2. Set retention-days: 5 in the with inputs of actions/upload-artifact
   3. Add expire-after: 5d at the top level of the workflow
   4. Set the variable ACTIONS_ARTIFACT_RETENTION to 5 in the repository
   Show the answer

   Answer: B. Set retention-days: 5 in the with inputs of actions/upload-artifact

   actions/upload-artifact accepts a retention-days input that overrides the default for that artifact only, as long as it does not exceed the repository or organization limit. timeout-minutes limits job run time, and neither expire-after nor that variable is a recognised setting.

   Checked against: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/remove-workflow-artifacts

4. Question 4

   Domain: Consume and troubleshoot workflows

   Workflow templates are stored in an organization's internal .github repository. In which repositories can members use them?

   1. All repositories in the organization, including public ones
   2. Private repositories only
   3. Internal and private repositories only
   4. Only the .github repository itself
   Show the answer

   Answer: C. Internal and private repositories only

   Templates are available to repositories with the same or more restricted visibility than the template repository: a public .github repository serves all types, an internal one serves internal and private repositories, and a private one serves private repositories only.

   Checked against: https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#workflow-template-availability

5. Question 5

   Domain: Consume and troubleshoot workflows

   A step fails with an unhelpful message and you want the extra debug output that actions and the runner emit for each step.

   What should you set before re-running?

   1. A secret or variable named ACTIONS_STEP_DEBUG with the value true
   2. A secret or variable named ACTIONS_RUNNER_DEBUG with the value true
   3. The job key debug: true under the failing job
   4. An environment variable RUNNER_LOG_LEVEL=trace in the workflow
   Show the answer

   Answer: A. A secret or variable named ACTIONS_STEP_DEBUG with the value true

   ACTIONS_STEP_DEBUG enables step debug logging, which shows ::debug:: output and extra detail in the step logs; ticking "Enable debug logging" when re-running turns on debug logging for just that attempt. ACTIONS_RUNNER_DEBUG instead produces runner diagnostic logs that are added to the downloadable log archive.

   Checked against: https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging

6. Question 6

   Domain: Author and maintain actions

   A JavaScript action's action.yml has runs: using: node24 and main: index.js. The repository contains index.js and package.json but node_modules is excluded by .gitignore. Workflows using it fail with Cannot find module '@actions/core'.

   What is the recommended fix?

   1. Add a pre: npm install step to action.yml so dependencies download when the action starts
   2. Add a setup-node step to every consuming workflow before the action is used
   3. Change runs.using to composite so the runner installs npm dependencies automatically
   4. Bundle the code and its dependencies into one file (e.g. with ncc) and point main at it
   Show the answer

   Answer: D. Bundle the code and its dependencies into one file (e.g. with ncc) and point main at it

   The runner does not install dependencies for JavaScript actions; the action must ship them, either by committing node_modules or, as GitHub recommends, compiling code and modules into a single file such as dist/index.js. pre: runs another JavaScript file, not a shell command, and setup-node in the consumer changes nothing inside the action.

   Checked against: https://docs.github.com/en/actions/tutorials/create-actions/create-a-javascript-action

7. Question 7

   Domain: Author and maintain actions

   You release version 1.4.0 of your action and want users who reference @v1 to receive it automatically, while others can pin an exact version.

   Which release practice supports this?

   1. Delete the previous v1.3.x tags so that @v1 resolves to the newest release
   2. Rename the default branch to v1 and merge each release into it
   3. Create the v1.4.0 release tag and move the v1 major tag to the same commit
   4. Publish 1.4.0 as a new repository and redirect the old repository name
   Show the answer

   Answer: C. Create the v1.4.0 release tag and move the v1 major tag to the same commit

   GitHub recommends semantic version release tags plus a major version tag that is updated to the latest compatible release. Deleting old tags breaks users pinned to them, and GitHub Actions does not follow repository redirects for actions, so renaming or moving the repository breaks consumers.

   Checked against: https://docs.github.com/en/actions/how-tos/create-and-publish-actions/release-and-maintain-actions

8. Question 8

   Domain: Manage GitHub Actions for the enterprise

   The platform team wants a central security-scan workflow to run and pass on pull requests in all of the organization's repositories before merging, without copying the file into each repository.

   Which feature provides this?

   1. A workflow template in the .github repository marked as mandatory
   2. A branch protection rule in each repository listing the template name
   3. An organization ruleset with the "Require workflows to pass before merging" rule
   4. An organization secret that triggers the workflow on every pull request
   Show the answer

   Answer: C. An organization ruleset with the "Require workflows to pass before merging" rule

   Rulesets can require a workflow from a central repository to run and pass before merging, targeted at many repositories at once. Templates are only copied when someone chooses them and cannot be made mandatory, and secrets do not trigger workflows.

   Checked against: https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-workflows-to-pass-before-merging

9. Question 9

   Domain: Manage GitHub Actions for the enterprise

   A workflow in private repository app-a calls octo-org/shared-ci/.github/workflows/test.yml@v1. shared-ci is also private in the same organization. Runs fail because the called workflow cannot be accessed.

   What must be configured?

   1. Grant app-a's GITHUB_TOKEN contents: read on shared-ci with a permissions block
   2. In shared-ci's Actions settings, set Access to allow repositories in the organization
   3. Add secrets: inherit to the calling job so it can read shared-ci
   4. Make shared-ci a template repository so its workflows become reusable
   Show the answer

   Answer: B. In shared-ci's Actions settings, set Access to allow repositories in the organization

   Reusable workflows in a private repository can be called by other repositories only when the Access policy in that repository's Actions settings explicitly allows it. The permissions key cannot grant access to another repository, and secrets or template status do not affect workflow access.

   Checked against: https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#access-to-reusable-workflows

10. Question 10

    Domain: Secure and optimize automation

    A deployment job must exchange a GitHub OIDC token for short-lived cloud credentials instead of using long-lived keys stored as secrets.

    Which permission must the job have to request the OIDC token?

    1. contents: write
    2. actions: write
    3. deployments: write
    4. id-token: write
    Show the answer

    Answer: D. id-token: write

    Requesting the OIDC JSON Web Token requires id-token: write; it does not give write access to any repository resource. The other scopes control repository contents, workflow runs and deployment records, and none of them allows fetching an OIDC token.

    Checked against: https://docs.github.com/en/actions/concepts/security/openid-connect