GH-200 GitHub Actions Exam Questions and Answers

The matrix configuration specifies two variables: color and animal. The color variable has 2 values (green and pink), and the animal variable has 2 values (owl and magpie). This would result in 4 combinations (2 color values × 2 animal values). Additionally, the include section introduces two more combinations (color: blue and animal: owl; color: pink and animal: magpie).

Creating workflow templates in the organization’s .github repository allows the organization to standardize workflows and make them easily reusable across multiple repositories. This ensures consistency and simplifies maintenance.

Creating reusable actions and workflows that can be called from other workflows helps modularize and standardize automation tasks. These reusable components can be maintained centrally and called from different workflows across repositories.

The simplest correct choice is a run step. A run step executes shell commands or scripts directly on the runner inside the current workflow job environment. It does not require packaging a JavaScript action, building a Docker container, publishing an image, or creating reusable action metadata. A JavaScript action is appropriate when you are building a reusable Node.js-based action. A Docker container action is useful when the execution environment must be packaged with dependencies, but it adds container overhead. A composite action is useful for reusable sequences of steps, but the question asks only for running a custom script inside the workflow environment. GitHub workflow syntax shows run steps as the native way to execute commands inside a job.

The GITHUB_REF environment variable specifies the branch or tag that triggered the workflow. It contains the full reference to the branch or tag, such as refs/heads/main for a branch or refs/tags/v1.0 for a tag.

The workflow_call event is used to trigger a reusable workflow from another workflow. This allows you to create workflows that can be reused in multiple places within your organization, enabling better modularity and reducing duplication.

You can define environment variables for the entire workflow by using the env key at the top level of the workflow file. These environment variables will be available to all jobs and steps within the workflow.

Environment variables can also be set within the run attribute of a job step, and these variables will be scoped only to that specific step.

You can set environment variables for specific steps within a job by using jobs. < job_id > .steps[*].env, which allows you to define variables that will only be available to that step.

To prevent reaching the storage limit for GitHub artifacts and packages, you should manage and clean up artifacts and packages stored in repositories owned by your organization. This includes deleting unnecessary artifacts and managing the lifecycle of packages, as they contribute directly to your organization ' s storage quota.

The check_run event is triggered when a check (such as a code quality check) completes, including when the status of a check changes. By adding this event as a trigger, you can initiate a follow-up workflow when the code quality integration finishes its checks.

The simplest official GitHub Actions action type for running shell commands or shell scripts is a composite action. Composite actions allow an action author to combine one or more run steps and reusable workflow commands in an action.yml file without needing to package a Docker image or write a JavaScript action. Option B is correct because it directly supports shell-based automation. Option A is heavier because Docker container actions require a container image or Dockerfile. Option D is used when the action logic is written in JavaScript and executed with Node.js. Option C is incorrect because “Bash script action” is not an official GitHub Actions action type. This topic checks custom action types and reuse patterns.

For JavaScript custom actions, the metadata file supports lifecycle scripts through the runs section. The correct key for a script that runs before the main action entrypoint is pre, and the correct conditional key for controlling whether that pre-script runs is pre-if. Therefore, option B is the only valid metadata structure. GitHub Actions does not use start, start-if, before, or before-if as action metadata keys. Option C is also invalid because pre-if only defines a condition; it cannot contain both a condition and a script reference in one line. In GitHub Actions exam terms, this tests custom action metadata, JavaScript action lifecycle hooks, and conditional execution before the main action logic.

================

A. Use the actions/setup-docker action

B. Authenticate to the GitHub Container Registry.

C. Build the container image.

D. Push the image to the GitHub Container Registry

E. Pull the image from the GitHub Container Registry.

The first image shows a workflow trigger with an option for the test suite, and the chosen YAML configuration matches this interface. Specifically, the test suite input is defined with type: choice and includes the option value: functional , which aligns with the visible UI elements in the first image.

First, the dataset should be encrypted before being stored. This ensures that the data is protected when stored in a repository.

The encrypted dataset can be stored in a GitHub secret, ensuring it is securely kept and not exposed publicly.

The encryption key needed to decrypt the dataset should also be stored in a GitHub secret to maintain security during the workflow, allowing access only when needed.

The GITHUB_ACTOR environment variable indicates the name of the person or app that initiated the workflow. This variable is automatically provided by GitHub in the workflow and can be used to identify the user or application triggering the workflow.

Deleting artifacts from repositories manually will free up storage space. Artifacts are typically stored for a limited time by default, but manual cleanup can help manage space.

Configuring the artifact and log retention period allows you to control how long artifacts and logs are retained in your repository. By shortening the retention period, you can prevent unnecessary accumulation of data and manage storage more effectively.

The run keyword executes commands using the default shell unless a different shell is specified. Since the commands shown are Python statements, the step must define shell: python so GitHub Actions interprets the script using Python instead of Bash, PowerShell, or another default shell. Option D is therefore correct. Option A is invalid because with: is used to pass inputs to actions, not to define the interpreter for a run command. Option B would execute the text as Bash and fail because import os is not Bash syntax. Option C only changes the working directory and does not change the shell. This exam topic checks workflow syntax, shell selection, and step-level command execution.

================

Using a tag is a best practice because tags are immutable and represent a fixed version of your action. By referencing tags, consumers of your action can be assured they are using a stable and specific version of the action, which helps in avoiding issues with breaking changes.

The commit SHA is another reliable way to specify a particular version of an action. By referencing a specific commit SHA, consumers can ensure they are using exactly the code that was written at that moment, avoiding the potential for changes in the future.

GitHub Actions on GitHub Enterprise Server often requires an internet connection, especially for accessing actions from the GitHub Marketplace or third-party actions unless they are manually synced to the server.

To use third-party actions on GitHub Enterprise Server, GitHub Connect can be used to establish a connection between the server and GitHub.com, enabling access to third-party actions.

Third-party actions can also be manually synchronized to the GitHub Enterprise Server, making them available for use in workflows.

The best approach is to use a service container for Redis. Service containers provide temporary supporting services for a workflow job, such as databases, caches, and message brokers, without permanently changing the runner. This is exactly what is needed when Redis is required only during workflow execution and should not affect future jobs on the self-hosted Linux runner. Option A installs Redis directly during the job and can introduce dependency, cleanup, and configuration risk. Option C requires separate infrastructure, which is unnecessary. Option D is incorrect because installing Redis into the runner image makes the runner stateful and harder to maintain. GitHub Actions workflow syntax supports jobs. < job_id > .services for service containers.

The correct trigger must use the pull_request event because the workflow is based on activity on a pull request. The specific activity is a label being added, so types: [labeled] is required. The deployment must target the releases branch, so the branch filter must be branches: - ' releases ' . The workflow must also run only when files under the apps folder change, so paths: - ' apps/** ' is the correct recursive path filter. Option A is invalid because pull_request_label is not a GitHub Actions event. Option B uses the wrong event, pull_request_review. Option C uses an incorrect branch/path combination. GitHub workflow syntax supports event activity types, branch filters, and path filters together.

The key is required because it uniquely identifies the cache. It is used to store and retrieve cached data. When creating or restoring a cache, you need to define a key that will be used to identify the cache.

The path is the file path on the runner that you want to cache. This is where the cached files or dependencies are located and should be specified to tell GitHub where to store or retrieve the cache from.

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub’s OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.

While Docker can run on various operating systems, Linux is often the most common and preferred OS for containerized workloads. Docker works well on Linux and is a widely-used platform for running containers.

For container jobs to run on a self-hosted runner, Docker must be installed and properly configured on the runner. Docker is required to build and run containerized workloads in a GitHub Actions workflow.

In a Docker container action, the action.yml file includes the runs.using field, which is set to docker to specify that the action runs inside a Docker container. This is the key indicator that the action is a Docker container action.

The correct syntax for specifying a cleanup script to be run after the main entry point is executed in a Docker-based GitHub Action is to use the post key. This ensures that cleanup.sh runs after the main script ( main.sh ) has completed.

To use a starter workflow provided by your organization, you need to go to the Actions tab in the repository and select New workflow. This option allows you to either create a new workflow or select from a list of available workflow templates, including starter workflows provided by your organization.

The correct manual trigger for a GitHub Actions workflow is workflow_dispatch. Defining workflow_dispatch under the on key enables the workflow to be started manually from the GitHub UI, GitHub CLI, or API. Inputs are optional but valid; they allow the user to provide values when manually starting the workflow, so option A is also correct. A schedule trigger is for cron-based automatic execution, not manual execution. workflow_call is used to make a workflow reusable by another workflow; it does not create the manual “Run workflow” button. Therefore, A and C are the correct selections. GitHub’s documentation confirms that manual workflows require workflow_dispatch and can include custom inputs.