GH-200 GitHub Actions Exam Question and Answers

Dockerfile: The Dockerfile is required for Docker container actions. It defines the environment for the action, specifying the base image, dependencies, and any commands to set up the action’s runtime inside the container.

action.yml: The action.yml file is required for all GitHub Actions, including Docker container actions. It contains metadata about the action, including the inputs, outputs, and the runtime environment (which in this case is Docker, defined under runs.using).

GitHub Marketplace is used to discover, share, and publish reusable automation, including GitHub Actions created by GitHub, vendors, and the community. Option C best describes this role. Marketplace does not exist only for billing, so option B is too narrow and incorrect. Option A is also wrong because Marketplace does not merely restrict third-party actions to public repositories; action usage is governed by repository, organization, or enterprise Actions policies. Option D is false because Marketplace does not bypass repository permissions or automatically deploy workflows into repositories. In exam terms, Marketplace is part of the automation reuse and action discovery domain: developers use it to find trusted or verified actions rather than building every integration manually. GitHub documents Marketplace as a place to publish and share actions with the community.

Documentation is critical when distributing custom GitHub Actions because users need to understand what the action does and how to use it correctly. A good README or marketplace description explains the action’s purpose, required inputs, outputs, permissions, and expected behavior. This directly supports option B. Documentation should also include practical usage examples, such as a workflow snippet showing the uses: syntax and required with: inputs, which supports option C. Option A is incorrect because documentation does not create a README inside the consuming workflow; the action author provides documentation in the action repository. Option D is also incorrect because documentation does not automatically generate workflow auto-completion. This topic tests custom action publishing and usability best practices.

================

The GITHUB_ACTOR environment variable indicates the name of the person or app that initiated the workflow. This variable is automatically provided by GitHub in the workflow and can be used to identify the user or application triggering the workflow.

The correct trigger must use the pull_request event because the workflow is based on activity on a pull request. The specific activity is a label being added, so types: [labeled] is required. The deployment must target the releases branch, so the branch filter must be branches: - ' releases ' . The workflow must also run only when files under the apps folder change, so paths: - ' apps/** ' is the correct recursive path filter. Option A is invalid because pull_request_label is not a GitHub Actions event. Option B uses the wrong event, pull_request_review. Option C uses an incorrect branch/path combination. GitHub workflow syntax supports event activity types, branch filters, and path filters together.

GitHub Actions defines custom environment variables with the YAML env mapping. YAML mappings use a colon between each key and value, so MY_VARIABLE: my-value beneath env: is the correct syntax. The env key can appear at workflow, job, or step scope depending on how broadly the variable should be available. Options A, B, E, and F either use an unsupported key or the wrong assignment syntax. environment is associated with deployment environments when used in GitHub Actions workflow syntax; it is not the key for declaring ordinary environment variables. The vars context is used for configuration variables created through repository, organization, or environment settings, but var: is not the workflow syntax shown here. Therefore, option C correctly defines the requested custom environment variable.

================

For a composite action, commands are defined inside the runs.steps section of the action metadata file. When a specific command must execute from a particular folder, the correct key is working-directory, and it must be applied at the individual run step level. Option D is correct because it keeps using: " composite " at the runs level and applies working-directory: ${{ inputs.dir }} directly to the step that runs the script. Option A is incorrect because directory is not a valid GitHub Actions run-step key. Option B incorrectly places directory at the runs level. Option C uses the right keyword but places it at the wrong level. This tests composite action metadata syntax and correct step-level execution configuration.

Required reviewers is a protection rule where you can specify that certain individuals or teams must review and approve the workflow run before it can proceed. This is used to enforce approvals before certain steps or environments are accessed.

Wait timer is a protection rule that introduces a delay before a workflow can proceed to the next stage. This is useful for adding time-based constraints to the deployment process or ensuring that certain conditions are met before a workflow continues.

For a run step in a composite action, GitHub Actions supports the working-directory property to specify the directory in which the command executes. The property belongs to the individual step, alongside properties such as run and shell. The generic keyword directory is not part of GitHub Actions metadata syntax. Composite actions declare runs.using: composite, after which runs.steps defines the reusable sequence of commands or actions. An input such as inputs.dir can therefore be referenced through an expression and assigned to working-directory. GitHub ' s action metadata reference explicitly defines runs.steps[*].working-directory as the supported property for controlling the execution directory of a composite-action command. Therefore, option B is the valid implementation.

================

GitHub Actions supports the env key at three workflow syntax scopes: the workflow ' s top level, an individual job, and an individual step. A top-level env value is available to steps across all jobs in the workflow. jobs. < job_id > .env limits variables to the steps of one job, while jobs. < job_id > .steps[*].env limits them to a particular step. When the same variable name is defined at several levels, the most specific definition takes precedence while that scope executes. GitHub Actions does not define a generic stage scope, and defaults is used for default settings such as the shell or working directory rather than as another env scope. Likewise, runner level is not a workflow-file env scope. Therefore, step, top, and job levels are correct.

================

Self-hosted runners are appropriate when GitHub-hosted runner limits or environment restrictions do not meet the workload requirement. GitHub-hosted runner jobs have a 6-hour job execution limit, while self-hosted runner jobs can run for up to 5 days, so jobs that must run longer than 6 hours require self-hosted runners. Self-hosted runners also let an organization control the machine, operating system, software, hardware, and network location. Therefore, if a workflow job needs to install or access software from the local network, a self-hosted runner is the correct choice. macOS and Windows runners are available as GitHub-hosted options, and GitHub Actions minutes apply to GitHub-hosted usage, not self-hosted runner execution.

Organization starter workflow templates must be stored in a special workflow template directory so that they appear in the GitHub Actions “New workflow” interface. The correct location is .github/workflow-templates, typically in the organization’s .github repository. Therefore, option C is correct. Option A, .github/workflows, is where active workflow files are stored inside a repository so they can be triggered by events. It is not the correct location for organization-level starter templates. Option B is not a valid GitHub Actions workflow template directory. Option D is incorrect because storing the file in each repository’s root does not publish it as a reusable starter workflow template. This checks workflow template reuse and organization automation standardization.

================

The workflow_dispatch event is used to manually trigger a workflow run in GitHub Actions. You can specify this event in the workflow file to allow users to manually trigger the workflow from the GitHub UI, often with optional input parameters.

GitHub Actions provides the debug workflow command for writing debug-level messages to the workflow log. The command syntax is ::debug::{message}, so option B correctly sends the message to the runner through standard output. To make these debug messages visible in workflow logs, step debug logging must also be enabled using ACTIONS_STEP_DEBUG=true. Option A refers to a nonexistent $DEBUG_MESSAGE environment file. Option C uses add-mask, which instructs GitHub to redact a value from logs rather than print diagnostic information. Option D writes a value to GITHUB_OUTPUT, which creates a step output instead of a debug message. GitHub documents the Bash syntax with echo " ::debug::message " , making option B the supported workflow-command format.

================

Scheduled workflows in GitHub Actions are triggered at specified times, and they run on the latest commit of the branch that triggers the workflow. This means the workflow will run on the most recent commit on the branch that was active at the time the scheduled event occurs.

The first image shows a workflow trigger with an option for the test suite, and the chosen YAML configuration matches this interface. Specifically, the test suite input is defined with type: choice and includes the option value: functional, which aligns with the visible UI elements in the first image.

A Docker container action is ideal for custom actions that require specific environments or dependencies, such as Python. By creating a Docker container, you can define the environment with the necessary Python version and dependencies, and your Python code can run inside that container.

The $GITHUB_OUTPUT file is used to pass data from one step to another in GitHub Actions. The echo command appends the key-value pair to this file, which sets the output variable (MY_OUTPUT) for the current step.

Searching the GitHub Marketplace for verified actions published by the cloud provider is the quickest and safest approach. Many cloud providers offer verified GitHub Actions that are maintained and optimized to interact with their services. These actions typically come with the correct configurations and best practices, allowing you to get started quickly without reinventing the wheel.

The correct native GitHub Actions method for passing files between jobs in the same workflow is artifact storage. Workflow artifacts are designed to persist files produced by one job so they can be downloaded and used by another job later in the workflow. Job outputs are better suited for passing small values, strings, IDs, flags, or metadata between jobs, not full files. Caching is intended to speed up repeated workflow runs by reusing dependencies or build outputs; it is not the proper mechanism for transferring job-produced files. An external blob store can work architecturally, but it is not the native GitHub Actions method. Therefore, artifact storage is the best and most exam-aligned answer for passing files between jobs.

The GITHUB_REPOSITORY environment variable contains the owner and repository name in the format owner/repository. It is automatically provided by GitHub Actions and can be used to reference the repository in workflows.

If a workflow depends on an external service that is down, disabling the workflow temporarily will prevent it from running and sending requests to the service, thus avoiding failed requests or unnecessary retries.

If a workflow is causing a negative impact on external services by generating too many requests or incorrect data due to a bug, temporarily disabling the workflow will stop this behavior while the issue is fixed.

The run keyword executes commands using the default shell unless a different shell is specified. Since the commands shown are Python statements, the step must define shell: python so GitHub Actions interprets the script using Python instead of Bash, PowerShell, or another default shell. Option D is therefore correct. Option A is invalid because with: is used to pass inputs to actions, not to define the interpreter for a run command. Option B would execute the text as Bash and fail because import os is not Bash syntax. Option C only changes the working directory and does not change the shell. This exam topic checks workflow syntax, shell selection, and step-level command execution.

================

To use a starter workflow provided by your organization, you need to go to the Actions tab in the repository and select New workflow. This option allows you to either create a new workflow or select from a list of available workflow templates, including starter workflows provided by your organization.

GitHub Actions on GitHub Enterprise Server often requires an internet connection, especially for accessing actions from the GitHub Marketplace or third-party actions unless they are manually synced to the server.

To use third-party actions on GitHub Enterprise Server, GitHub Connect can be used to establish a connection between the server and GitHub.com, enabling access to third-party actions.

Third-party actions can also be manually synchronized to the GitHub Enterprise Server, making them available for use in workflows.

GITHUB_WORKSPACE is a default environment variable in GitHub Actions that points to the directory on the runner where your repository is checked out. This variable allows you to access files within your repository during the workflow.

To target a specific self-hosted runner, the job must use runs-on with labels that match that runner. A self-hosted runner normally has the self-hosted label plus default labels and any custom labels you assign. Since the runner is labeled runner1, the workflow should specify both self-hosted and runner1: runs-on: [self-hosted, runner1]. GitHub Actions will then route the job only to a self-hosted runner matching all specified labels. Option A targets a different custom label. Option B is malformed and also mixes a self-hosted label with a GitHub-hosted runner label. Option D targets any self-hosted runner, not specifically runner1. GitHub documents that an array of runs-on labels requires a runner matching all listed labels.

GitHub automatically creates a GITHUB_TOKEN for workflow jobs so the workflow can authenticate to GitHub without requiring a separately maintained personal access token for many repository-scoped operations. A common use is making authenticated REST API, GraphQL API, or GitHub CLI requests against resources that the token has permission to access. The token ' s capabilities are governed by the workflow ' s permissions configuration and the repository or organization policy. It is not an SSH credential for connecting to a runner, and it is not required merely to read encrypted repository secrets that GitHub makes available through the secrets context. Likewise, simply invoking a public Marketplace action does not inherently require explicitly passing GITHUB_TOKEN. Therefore, making authenticated GitHub API calls is the correct use described by option A.

================

Caching is ideal for files that change rarely, such as dependencies or build outputs, as it speeds up subsequent workflow runs by reusing previously cached files instead of re-downloading or rebuilding them.

Artifacts are used for persisting files produced during a job that need to be used in later jobs or after the workflow has ended, allowing them to be downloaded or referenced later.

Environment secrets are scoped to GitHub Actions environments and can be protected by environment protection rules. If an environment requires reviewers, a job that references that environment cannot access its environment secrets until the required approval is granted. This makes option A correct. Option B is incorrect because environment secrets are made available to jobs that reference the protected environment, not selectively to only one specific step by default. Option C is not the purpose of environment secrets; they are not specifically for connecting to GitHub Enterprise Server. Option D is also incorrect because GitHub environment secrets do not automatically pull from Azure Key Vault without additional integration or custom workflow logic. This topic covers environment protection, secrets, and deployment governance.

================

The run keyword is used to execute command-line programs and scripts on a GitHub Actions runner. When several commands must execute within the same workflow step, YAML ' s literal block indicator (|) can be placed after run: and the commands written on separate indented lines. GitHub ' s workflow syntax explicitly demonstrates this pattern with npm ci followed by npm run build. The shell keyword does not contain commands; it specifies which shell should interpret the commands supplied through run. Therefore, options B and C misuse the shell property. Option D also lacks the YAML literal block notation required to represent the multiple command lines as the value of run. Option A correctly executes both commands sequentially within the same shell process and is the documented syntax.

================

The correct solution is to create an organization-level Actions secret. This minimizes administrative effort because the secret can be managed once at the organization level and made available to all repositories or selected repositories through an access policy. Option D gives the correct navigation path: organization page, Settings, Secrets and variables, then Actions. Option A would require duplicating the secret in every repository, increasing maintenance overhead and risk of inconsistent values. Option B is wrong because personal developer settings do not centrally expose a secret to all organization repositories. Option C is incomplete because the current GitHub path places Actions secrets under “Secrets and variables,” not just a generic “Security > Secrets” location. GitHub documents organization secrets and the repository access policy model for sharing them.

The appropriate way to test a JavaScript action is to invoke that action from a GitHub Actions workflow and verify its behavior on an actual runner. GitHub ' s JavaScript-action documentation specifically demonstrates testing a newly created action by creating a workflow that references and executes it. This exercises the action ' s metadata, inputs, JavaScript entry point, runner behavior, outputs, and failure handling in the same environment where consumers will use it. @vercel/ncc or another bundler can package JavaScript and its dependencies into a distributable file, but bundling is not itself a functional test. A JavaScript action also does not need to be converted into a Docker container. Finally, actions/debug-javascript is not the documented mechanism for testing JavaScript actions. Therefore, option B provides the correct testing approach.

================

The GitHub context exposes the short name of the branch or tag through github.ref_name. For a workflow triggered from a branch named feature-branch, the expression github.ref_name == ' feature-branch ' evaluates to true, allowing the job to run. GitHub also provides github.ref, but that value normally contains the complete Git reference, such as refs/heads/feature-branch, rather than only the short branch name. The properties github.branch_name, github.ref.name, and github.branch.name shown in the other options are not valid GitHub context properties. GitHub evaluates a job-level if expression before sending the job to a runner, making this an appropriate mechanism for conditional deployment execution. Therefore, option B uses the correct context property and comparison syntax.

================

GitHub allows an organization to restrict workflows so that they use only actions and reusable workflows available within that organization. When such a policy is enforced, external third-party actions and Marketplace actions can be prevented from running. Custom actions intended for internal reuse should therefore be stored in repositories owned by the organization. GitHub also allows private or internal repositories containing actions to be made accessible to other repositories in the same organization or enterprise. The .github repository has special organization-wide uses, such as workflow templates, but it is not the mandatory distribution location for all custom actions. A third-party repository or the public Marketplace would conflict with an organization-only policy. Therefore, distributing the actions through organization-owned repositories is the appropriate approach.

================

For a JavaScript action using the official @actions/core toolkit, core.setFailed(error.message) is the documented method for reporting an exception and marking the action as failed. setFailed() logs the supplied message and sets a failing exit code so GitHub records the action and associated check run as unsuccessful. Neither core.setException() nor core.action.setException() exists in the supported @actions/core API, and action.setError() is likewise not the documented error-handling method. The source PDF visibly contains the first three choices but crops the final distractor; the missing fourth choice was reconstructed from the matching public GH-200 question listing, while the correct answer itself was independently verified against GitHub ' s official documentation. GitHub ' s JavaScript-action example uses this exact catch pattern.

================

The check_run event is triggered when a check (such as a code quality check) completes, including when the status of a check changes. By adding this event as a trigger, you can initiate a follow-up workflow when the code quality integration finishes its checks.

You can enable specific actions for the organization by identifying them and providing version control, ensuring only trusted versions are used in workflows.

GitHub-verified actions can be enabled at the enterprise level, providing an extra layer of security by ensuring that only trusted actions are available to workflows.

Actions can be published to an internal marketplace, allowing organizations to share reusable actions securely within their enterprise without exposing them to the public.