GH-200 Sample Questions Answers

The GET /repos/:owner/:repo/actions/runs/:run_id/logs API endpoint is used to retrieve the logs of a specific workflow run identified by run_id. This is the correct method for downloading logs from a workflow run.

The runs-on keyword allows you to specify the operating system and other labels for the runner. By specifying self-hosted, windows, and x64, you are targeting a self-hosted Windows runner that matches these criteria, which aligns with the custom configuration of your self-hosted runner.

GitHub provides the ACTIONS_STEP_DEBUG setting specifically for increasing the verbosity of workflow step logs. To enable it, create a repository secret or repository variable named ACTIONS_STEP_DEBUG and assign the value true. GitHub states that if both a secret and a variable with this name exist, the secret takes precedence. After the setting is enabled, newly triggered or re-run workflows display additional debugging events in their step logs. Simply defining ACTIONS_STEP_DEBUG under the workflow ' s env or defaults section does not activate GitHub ' s step-debugging mechanism. There is also no supported --actions-step-debug workflow invocation flag. For deeper runner-level diagnostics, GitHub provides the separate ACTIONS_RUNNER_DEBUG setting. Therefore, option C is the documented method for step debug logging.

================

The GITHUB_REF environment variable specifies the branch or tag that triggered the workflow. It contains the full reference to the branch or tag, such as refs/heads/main for a branch or refs/tags/v1.0 for a tag.

Creating a separate repository for each custom action allows you to manage the versioning independently for each action. This approach provides flexibility, as each action can be updated, tested, and versioned separately, avoiding potential conflicts or dependencies between different actions.

Since the self-hosted runner is configured on a Linux VM and the script is written in PowerShell, you can invoke the script using the pwsh (PowerShell Core) shell in a run step in the workflow. This ensures that the script runs as-is on the Linux runner, as PowerShell Core (pwsh) is cross-platform and supports Linux.

The first image shows a workflow trigger with an option for the test suite, and the chosen YAML configuration matches this interface. Specifically, the test suite input is defined with type: choice and includes the option value: functional, which aligns with the visible UI elements in the first image.

The run keyword is used to execute command-line programs and scripts on a GitHub Actions runner. When several commands must execute within the same workflow step, YAML ' s literal block indicator (|) can be placed after run: and the commands written on separate indented lines. GitHub ' s workflow syntax explicitly demonstrates this pattern with npm ci followed by npm run build. The shell keyword does not contain commands; it specifies which shell should interpret the commands supplied through run. Therefore, options B and C misuse the shell property. Option D also lacks the YAML literal block notation required to represent the multiple command lines as the value of run. Option A correctly executes both commands sequentially within the same shell process and is the documented syntax.

================

GitHub workflow commands use the syntax ::command parameter=value::{message}. For an error annotation without file-location metadata, echo " ::error::There was an error " is valid because error is the workflow command and the text following the second :: is the message. GitHub also supports parameters such as file, line, and col, making option C valid for associating the error annotation with a specific source-code position. Option A incorrectly places the actual text in a message= parameter while leaving no message after the command separator. Option D also uses invalid workflow-command syntax because error=... is not the command format GitHub defines. Therefore, according to the current GitHub Actions workflow-command specification, the two valid commands are B and C.

================

To scope a secret to a specific repository, you can create a new secret with a name like MyRepo_SuperSecret in the secrets section of the MyRepo repository ' s settings. This ensures that the secret is specific to that repository and can be used within its workflows.

The GITHUB_REPOSITORY environment variable contains the owner and repository name in the format owner/repository. It is automatically provided by GitHub Actions and can be used to reference the repository in workflows.

GitHub Marketplace is used to discover, share, and publish reusable automation, including GitHub Actions created by GitHub, vendors, and the community. Option C best describes this role. Marketplace does not exist only for billing, so option B is too narrow and incorrect. Option A is also wrong because Marketplace does not merely restrict third-party actions to public repositories; action usage is governed by repository, organization, or enterprise Actions policies. Option D is false because Marketplace does not bypass repository permissions or automatically deploy workflows into repositories. In exam terms, Marketplace is part of the automation reuse and action discovery domain: developers use it to find trusted or verified actions rather than building every integration manually. GitHub documents Marketplace as a place to publish and share actions with the community.

Deleting artifacts from repositories manually will free up storage space. Artifacts are typically stored for a limited time by default, but manual cleanup can help manage space.

Configuring the artifact and log retention period allows you to control how long artifacts and logs are retained in your repository. By shortening the retention period, you can prevent unnecessary accumulation of data and manage storage more effectively.

Required reviewers is a protection rule where you can specify that certain individuals or teams must review and approve the workflow run before it can proceed. This is used to enforce approvals before certain steps or environments are accessed.

Wait timer is a protection rule that introduces a delay before a workflow can proceed to the next stage. This is useful for adding time-based constraints to the deployment process or ensuring that certain conditions are met before a workflow continues.

The GitHub context exposes the short name of the branch or tag through github.ref_name. For a workflow triggered from a branch named feature-branch, the expression github.ref_name == ' feature-branch ' evaluates to true, allowing the job to run. GitHub also provides github.ref, but that value normally contains the complete Git reference, such as refs/heads/feature-branch, rather than only the short branch name. The properties github.branch_name, github.ref.name, and github.branch.name shown in the other options are not valid GitHub context properties. GitHub evaluates a job-level if expression before sending the job to a runner, making this an appropriate mechanism for conditional deployment execution. Therefore, option B uses the correct context property and comparison syntax.

================

GitHub officially defines three major custom-action types: JavaScript actions, Docker container actions, and composite actions. There is no separate native Python action type. A Docker container action is appropriate when the implementation is written in Python because the container can package the Python runtime, application code, dependencies, and required operating-system components together. GitHub states that Docker container actions can use any base Docker image and therefore any programming language. This provides a predictable execution environment independent of the software preinstalled on the runner. JavaScript actions specifically execute packaged JavaScript using a supported Node.js runtime. Composite actions primarily combine multiple workflow steps and commands. For a self-contained custom action implemented in Python with its runtime and dependencies packaged alongside it, the Docker container action is the correct choice.

================

The publish-npm job includes the JS-DevTools/npm-publish action, which is used to publish an npm package to an npm registry.

The publish-npm job has the needs: build directive, meaning it will only run after the build job successfully completes.

For a composite action, commands are defined inside the runs.steps section of the action metadata file. When a specific command must execute from a particular folder, the correct key is working-directory, and it must be applied at the individual run step level. Option D is correct because it keeps using: " composite " at the runs level and applies working-directory: ${{ inputs.dir }} directly to the step that runs the script. Option A is incorrect because directory is not a valid GitHub Actions run-step key. Option B incorrectly places directory at the runs level. Option C uses the right keyword but places it at the wrong level. This tests composite action metadata syntax and correct step-level execution configuration.

The best design is to use environment-scoped secrets with the same secret name, such as DEPLOY_KEY, in separate environments such as DevCloud and TestCloud. This lets the same reusable deployment logic reference one consistent secret name while the selected environment supplies the correct value. Option A is invalid because GitHub secret names should not be designed around dotted property access, and reusable workflows should not parse secret names dynamically. Option C introduces unnecessary marketplace dependency and weak secret handling. Option D is also wrong because GitHub secrets are opaque strings; ${{ secrets.DEPLOY_KEY.DevCloud }} is not valid secret property access. Reusable workflows can define and receive named secrets through the secrets mapping.

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub’s OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.

A workflow becomes reusable when its on configuration includes the workflow_call event. This event declares that the workflow can be invoked by another workflow rather than only being started by ordinary repository events. Inputs and secrets can also be defined beneath workflow_call so the caller can provide values to the reusable workflow. workflow_run has a different purpose: it starts a workflow in response to another workflow running or completing. pull_request responds to pull-request activity, while check_run responds to GitHub Checks activity. GitHub ' s official reusable workflow documentation explicitly states that a reusable workflow must contain on: workflow_call. Therefore, workflow_call is the required keyword when defining a workflow intended to be called from other workflows.

================

The GITHUB_TOKEN is automatically provided by GitHub in workflows and can be used to authenticate API requests to GitHub, including publishing packages to GitHub Packages.

The GITHUB_TOKEN is also used to authenticate API requests for actions like creating issues, commenting, or interacting with pull requests within the same repository.

GitHub Actions defines custom environment variables with the YAML env mapping. YAML mappings use a colon between each key and value, so MY_VARIABLE: my-value beneath env: is the correct syntax. The env key can appear at workflow, job, or step scope depending on how broadly the variable should be available. Options A, B, E, and F either use an unsupported key or the wrong assignment syntax. environment is associated with deployment environments when used in GitHub Actions workflow syntax; it is not the key for declaring ordinary environment variables. The vars context is used for configuration variables created through repository, organization, or environment settings, but var: is not the workflow syntax shown here. Therefore, option C correctly defines the requested custom environment variable.

================

Self-hosted runners can have default labels and custom labels. These labels are used in the runs-on field to route workflow jobs to runners that match the required criteria. When multiple labels are specified, the runner must match all listed labels before GitHub Actions can assign the job to that runner. Therefore, option A is correct. Option B is false because labels are especially important for self-hosted runners. Option C is incorrect because GitHub does not require the runner IP address as a routing label. Option D is also incorrect because workflows target runners by labels or runner groups, not by hostname. This topic validates runner selection, self-hosted runner configuration, and workflow job routing.

================

Using a corporate secret store like HashiCorp Vault provides a secure, centralized location for sensitive information. GitHub Actions can then retrieve and store the token securely during deployment by setting it as an environment variable, ensuring the token remains secure and accessible at runtime.

Storing the token as an organizational-level encrypted secret in GitHub ensures it is accessible across multiple repositories, minimizing management overhead. GitHub Actions can then use this secret during deployment by setting it as an environment variable, allowing the microservice to access it securely at runtime.

The repository_dispatch event allows you to trigger a workflow in response to external activity. It is commonly used when you need to trigger a workflow from outside GitHub, such as from another system or service, by sending a request to the GitHub API. This event provides flexibility to integrate with various external systems and trigger workflows in a GitHub repository.

GitHub Actions uses the special GITHUB_OUTPUT environment file to define output parameters for a workflow step. The required format is name=value, appended to the file. Therefore, writing action_color=purple to $GITHUB_OUTPUT correctly creates an output named action_color. The step should also have an id if another step needs to reference the value through the steps. < id > .outputs context. GITHUB_ENV serves a different purpose: it creates environment variables for subsequent steps in the same job. The add-mask workflow command masks sensitive values in logs, while debug writes diagnostic information. Neither defines an output parameter. GitHub ' s current workflow-command documentation explicitly identifies GITHUB_OUTPUT as the supported environment file for setting step outputs.

================

GitHub allows an organization to restrict workflows so that they use only actions and reusable workflows available within that organization. When such a policy is enforced, external third-party actions and Marketplace actions can be prevented from running. Custom actions intended for internal reuse should therefore be stored in repositories owned by the organization. GitHub also allows private or internal repositories containing actions to be made accessible to other repositories in the same organization or enterprise. The .github repository has special organization-wide uses, such as workflow templates, but it is not the mandatory distribution location for all custom actions. A third-party repository or the public Marketplace would conflict with an organization-only policy. Therefore, distributing the actions through organization-owned repositories is the appropriate approach.

================

The matrix configuration specifies two variables: color and animal. The color variable has 2 values (green and pink), and the animal variable has 2 values (owl and magpie). This would result in 4 combinations (2 color values × 2 animal values). Additionally, the include section introduces two more combinations (color: blue and animal: owl; color: pink and animal: magpie).

The correct syntax for referencing a versioned action is owner/repository@ref. Therefore, to use version v1 of actions/javascript-action, the workflow step must use actions/javascript-action@v1. The @v1 portion is the ref, which can represent a tag, branch, or commit SHA depending on how the action publisher releases the action. Option A incorrectly treats the version as part of the repository path. Option B invents a separate version: key, which is not how action versions are selected. Option C changes the repository name and does not specify a ref. In GitHub Actions syntax, uses selects an action, and version selection is part of the action reference itself. GitHub examples use the uses: owner/action-name@ref form.

GitHub Actions supports the use of service containers, which allows you to spin up a PostgreSQL database (or any other service) in a Docker container during your workflow. You can pull a PostgreSQL image from Docker Hub, and the container will automatically be available to your workflow job. This method requires no additional infrastructure and is easy to configure and maintain, as you simply define the container in the workflow file.

GitHub self-hosted runners maintain diagnostic information locally in the _diag directory beneath the runner installation directory. The runner application creates Runner_*.log files containing information about startup, connectivity, registration, updates, and general runner activity. Job-specific execution details are written to Worker_*.log files in the same diagnostic directory. These logs are therefore the primary source when investigating intermittent connection or execution problems. GitHub ' s troubleshooting documentation explicitly directs administrators to inspect the _diag directory and also provides connectivity-check scripts for diagnosing communication failures. The other options describe mechanisms that are not the documented standard procedure: there is no general repository-settings feature for downloading the runner ' s local diagnostic archive, and the suggested generic --debug and DEBUG=true mechanisms are not the prescribed runner troubleshooting method.

================

The key is required because it uniquely identifies the cache. It is used to store and retrieve cached data. When creating or restoring a cache, you need to define a key that will be used to identify the cache.

The path is the file path on the runner that you want to cache. This is where the cached files or dependencies are located and should be specified to tell GitHub where to store or retrieve the cache from.

The $GITHUB_ENV environment variable is used to set environment variables that persist across steps in a workflow job. By echoing FOO=bar into $GITHUB_ENV, the variable FOO will be available in subsequent steps within the same job.

GitHub recommends versioning actions with stable references so consumers can deliberately select the code they want to execute. A full commit SHA is the most reliable and secure reference because it identifies one immutable Git commit; GitHub specifically identifies a full SHA as the safest option for stability and security. Tags are also a standard action-release mechanism. Action authors commonly create semantic-version tags such as v1.0.1 and maintain a major-version tag such as v1 so consumers can receive compatible fixes. By contrast, consuming an action directly from its default branch can introduce unexpected changes whenever that branch moves. An organization or repository name identifies where the action lives but does not by itself provide version stability. Therefore, commit SHA and tag are the two appropriate choices.

================

Actions stored in private repositories within the organization can be reused across all repositories by referencing them in workflows. This ensures a centralized way of maintaining custom actions.

Encrypted secrets can be accessed across repositories in the same organization, making it easy to store sensitive data (like API keys or tokens) securely while allowing multiple workflows to access them.

Workflow templates allow you to create reusable templates for workflows that can be shared across repositories within the organization. This makes it easier to standardize processes and automate them across multiple projects.

The correct solution is to create an organization-level Actions secret. This minimizes administrative effort because the secret can be managed once at the organization level and made available to all repositories or selected repositories through an access policy. Option D gives the correct navigation path: organization page, Settings, Secrets and variables, then Actions. Option A would require duplicating the secret in every repository, increasing maintenance overhead and risk of inconsistent values. Option B is wrong because personal developer settings do not centrally expose a secret to all organization repositories. Option C is incomplete because the current GitHub path places Actions secrets under “Secrets and variables,” not just a generic “Security > Secrets” location. GitHub documents organization secrets and the repository access policy model for sharing them.

Environment secrets are scoped to GitHub Actions environments and can be protected by environment protection rules. If an environment requires reviewers, a job that references that environment cannot access its environment secrets until the required approval is granted. This makes option A correct. Option B is incorrect because environment secrets are made available to jobs that reference the protected environment, not selectively to only one specific step by default. Option C is not the purpose of environment secrets; they are not specifically for connecting to GitHub Enterprise Server. Option D is also incorrect because GitHub environment secrets do not automatically pull from Azure Key Vault without additional integration or custom workflow logic. This topic covers environment protection, secrets, and deployment governance.

================