Free Practice Questions for GitHub Actions Expert (GH-200) Certification

Configure workflows to run for scheduled, manual, webhook, and repository events Choose appropriate scope, permissions, and events for workflow automation Define and validate workflow_dispatch inputs (types, required, defaults) and pass inputs to reusable workflows via workflow_call with inputs and secrets mapping

Use jobs, steps, and conditional logic Implement dependencies between jobs Use workflow commands and environment variables Use service containers (services:) for dependent services (databases, queues); configure ports, health checks, and container options Use strategy and matrix to generate job variations (OS, language/runtime versions); apply include/exclude; control fail-fast and max-parallel; optimize matrix size for cost and performance; account for runner image changes (Ubuntu 20.04 deprecation, Windows Server 2025 migration for windows-latest) Implement YAML anchors and aliases (&, * and merge <<) to reuse repeated mappings/steps within a single workflow file Use predefined contexts (github, runner, env, vars, secrets, inputs, matrix, needs, strategy, job, steps, github.event, github.ref) to access workflow, repository, and runtime metadata; understand immutable actions behavior and version pinning requirements Evaluate expressions with ${{ }} referencing contexts; distinguish static (workflow parse) vs runtime evaluation; prevent secret leakage in logs and expressions Leverage editor tooling (GitHub Actions VS Code extension / YAML schema completion, metadata IntelliSense, validation) to author and maintain workflows efficiently

Configure caching and artifact management; apply retention policies via REST APIs (logs, artifacts, workflow runs) at org/repo level Pass data between jobs and steps (artifacts, outputs, environment files via GITHUB_ENV and GITHUB_OUTPUT, reusable workflow outputs) Generate job summaries using GITHUB_STEP_SUMMARY for rich Markdown reports (test results, coverage, links) Add workflow status badges and environment protections

Identify workflow triggers and effects from configuration and logs Diagnose failed workflow runs using logs and run history Expand and interpret YAML anchors, aliases, and merged mappings when analyzing workflow configuration Interpret matrix expansions, correlate job names to matrix axes, analyze failures across variants, and selectively rerun individual matrix jobs

Locate workflows, logs, and artifacts in the UI and via API Download and manage workflow artifacts

Consume organization-level and reusable workflows Consume non-public organization workflow templates Use starter workflows (public and private/non-public templates); customize and adapt; distinguish from reusable workflows and composite actions Differentiate starter workflows (copy scaffold, independent after creation) vs reusable workflows (central versioned definition invoked via workflow_call) vs composite actions (encapsulated step logic) Contrast disabling and deleting workflows

Identify and implement action types (JavaScript, Docker, composite); understand immutable actions rollout on hosted runners and implications for version pinning and registry sources Troubleshoot action execution and errors

Specify required files, directory structure, and metadata Implement workflow commands within actions

Select distribution models (public, private, marketplace) Publish actions to the GitHub Marketplace Apply versioning and release strategies

Define and manage reusable components and templates Control access to actions and workflows within the enterprise Configure organizational use policies

Configure and monitor GitHub-hosted and self-hosted runners Apply IP allow lists and networking settings Manage runner groups and troubleshoot runner issues Identify preinstalled software/tool versions on GitHub-hosted runners (image release notes, toolcache) and install additional software at runtime (setup-* actions, package managers, caching, container images, custom self-hosted images)

Define and scope encrypted secrets and variables at the organization, repository, and environment levels Access and use secrets and variables in workflows and actions; manage secrets and variables programmatically via REST APIs

Use environment protections and approval gates Identify and use trustworthy actions from the Marketplace Mitigate script injection (sanitize/validate inputs, least-privilege permissions, avoid untrusted data in run:, proper shell quoting, prefer vetted actions over inline scripts) Understand GITHUB_TOKEN lifecycle (ephemeral, scoped), configure granular permissions, contrast with PAT; restrict write scopes Use OIDC token (id-token permission) for cloud provider federation to eliminate long-lived cloud secrets Pin third-party actions to full commit SHAs; align with immutable actions enforcement on hosted runners; avoid floating @main/@v* without justification Enforce action usage policies (organization/repository allow/deny lists, required reviewers for unverified actions) Generate and verify artifact attestations / provenance (e.g., SLSA, build metadata) and integrate into deployment verification

Configure caching and artifact retention for efficiency; apply retention policies programmatically via REST APIs Recommend strategies for scaling and optimizing workflows