GitHub Actions practice questions
GitHub · GH-200 · 300 questions
Original practice questions for GitHub Actions.
This course contains the use of artificial intelligence.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Domain 1: Workflow Fundamentals & Syntax · 115 questions
- Which YAML key do you use at the top level of a workflow file to specify what events trigger the workflow?
- Which of the following is REQUIRED inside every job definition in a GitHub Actions workflow?
- When using the workflowdispatch trigger, which input type allows the user to choose from a predefined list of values?
- Which cron expression in a GitHub Actions schedule trigger runs a workflow every day at midnight UTC?
- Which expression accesses the name of the event that triggered the current workflow run?
- What is the difference between 'uses:' and 'run:' in a workflow step?
- In a GitHub Actions workflow with jobs 'build', 'test', and 'deploy', how do you ensure 'deploy' only runs after both 'build' and 'test' succeed?
- Which expression correctly skips a step unless the workflow was triggered by a push to the 'main' branch?
- You define 'NODEENV: production' under the workflow-level 'env:' block. How do you reference this value in an expression inside a step's 'if:' condition?
- What is the default shell used by 'run:' steps on a GitHub-hosted Windows runner?
- Which trigger must a reusable workflow define to be callable from another workflow?
- In a matrix strategy with os: [ubuntu, windows] and node: [16, 18], which key removes the ubuntu+node16 combination specifically?
- By default, if one job in a matrix strategy fails, what happens to the remaining matrix jobs?
- Which configuration cancels any in-progress workflow run for the same branch when a new push triggers a new run?
- How do you pass a value from one job to a dependent job in GitHub Actions?
- What is the current supported method to set a step output in GitHub Actions?
- Why is 'pullrequesttarget' considered higher risk than 'pullrequest' when used with secrets?
- The 'workflowrun' trigger fires when another workflow completes. Which filter lets you run only when the triggering workflow succeeded?
- How do you configure a push trigger to only run when files in the 'src/' directory change?
- Which YAML syntax allows a 'run:' step to span multiple shell commands across multiple lines?
- Which of the following correctly uses a GitHub Actions expression to set an environment variable in a step?
- Which status check function ensures a step runs even if a previous step failed?
- What is the default timeout for a GitHub Actions job if 'timeout-minutes' is not specified?
- A step has 'continue-on-error: true'. If the step fails, what is the job's conclusion?
- Where must workflow YAML files be located within a GitHub repository to be recognized by GitHub Actions?
- Which GitHub Actions expression function converts an object to a JSON string for debugging output?
- What does the 'hashFiles()' function return when used as a cache key?
- Job 'build' produces an output named 'image-tag'. Job 'deploy' depends on 'build'. Which expression accesses the image-tag value in 'deploy'?
- At what levels can you set the 'permissions:' block in a GitHub Actions workflow?
- Which GitHub Actions trigger allows external systems to trigger workflows via the GitHub REST API?
- Which operator is used in GitHub Actions expressions to check if a string contains a substring?
- A step has 'id: get-version' and outputs to $GITHUBOUTPUT. How do you reference its 'version' output in a later step?
- How can you create a dynamic matrix where the list of values is determined by a previous job?
- Which workflow command creates an annotation that appears in the GitHub Actions log and PR review?
- How do you set an environment variable that persists for all subsequent steps in the same job?
- What is the purpose of the $GITHUBPATH environment file?
- In a matrix strategy, what does the 'include:' key do when it matches an existing combination?
- What is the maximum number of jobs allowed in a single GitHub Actions workflow run?
- How do you trigger a workflow only when a semantic version tag (e.g., v1.2.3) is pushed?
- A workflow job has been running for 45 minutes but appears stuck in a loop. What is the fastest way to stop it from the GitHub UI?
- Which context is NOT available during the 'if:' condition evaluation at the job level?
- For a pullrequest event, what does 'github.sha' contain?
- Which 'env:' scope takes precedence when the same variable name is defined at workflow, job, and step levels?
- What does 'github.actor' contain in a workflow run triggered by a GitHub App?
- Before pushing a workflow file, which tool can you use locally to validate the YAML syntax?
- In a matrix strategy, how is the job name displayed in the GitHub Actions UI by default?
- What does the GITHUBEVENTPATH environment variable contain?
- Who can manually trigger a workflowdispatch event on a private repository?
- Which commit message string, when included in the HEAD commit message, prevents GitHub Actions from triggering push and pullrequest workflows?
- The 'workflowrun' trigger has a 'branches:' filter. What does it filter?
- In a reusable workflow's on.workflowcall.inputs block, what happens if a caller doesn't provide a 'required: true' input?
- You want to trigger a workflow only when a specific label 'deploy' is added to a pull request. Which configuration is correct?
- Can workflow-level 'env:' values reference other context variables like 'github.ref'?
- How do you set the working directory for a specific 'run:' step to a subdirectory?
- The 'issues' event has activity types like 'opened', 'edited', 'closed', 'labeled'. If no 'types:' filter is specified, which activity types trigger the workflow?
- Which expression pattern provides a fallback value when an input might be empty?
- What is the maximum size of a single step output set via $GITHUBOUTPUT?
- You want to prevent concurrent deployments to production but not cancel in-progress deployments when a new one queues. Which concurrency configuration achieves this?
- In a reusable workflow called via workflowcall, how do you access the inputs passed by the caller?
- Which expression determines if a workflow is running in a private repository?
- What is the minimum interval for schedule triggers in GitHub Actions?
- Which expression correctly checks whether the current branch name contains the substring 'release'?
- Job 'deploy' lists 'needs: [build, test]'. Which expression correctly runs 'deploy' only when both 'build' and 'test' concluded successfully?
- A job named 'prepare' writes a JSON array of OS names to an output called 'os-list'. Which strategy block correctly builds a matrix from that output?
- You want every 'run:' step in a single job to execute with working directory './services/api' without setting 'working-directory' on each step. Where do you configure this?
- Which pair of github context properties correctly identifies both the event type that started the run and the full git ref for the commit?
- You need a cleanup job that runs when the workflow is cancelled mid-flight, but not on a normal successful completion. Which job-level condition is appropriate?
- A production deploy job must share a concurrency group named 'prod-deploy' so only one production deployment runs at a time, and queued deploys should wait rather than cancel the active one. Which job configuration is correct?
- Which two expression functions return a boolean used to test string prefixes or suffixes? (Choose two)
- You add a workflowdispatch input named 'forcedeploy' that should appear as a checkbox in the 'Run workflow' UI. Which input type must you use?
- A step has 'id: unit' and 'continue-on-error: true'. The step fails. What is the difference between 'steps.unit.outcome' and 'steps.unit.conclusion'?
- A job sets 'env: TARGET: staging'. Which syntax correctly references TARGET inside a step 'if:' condition?
- A matrix defines os: [ubuntu-latest, windows-latest] and node: [18, 20]. You need to add one extra combination of os: macos-latest with node: 20 without expanding macos across all node versions. Which key adds only that combination?
- Which expression uses the format function to produce the string 'build-42' when github.runnumber is 42?
- A workflow file must be invokable both manually from the Actions UI and as a reusable workflow from other repositories' workflows. Which 'on:' configuration supports both entry points?
- You want a cache key that changes when either package-lock.json or .npmrc changes. Which hashFiles call is valid?
- Why can you NOT use the 'jobs' context inside a job-level 'if:' condition to inspect another job that already finished?
- According to GitHub Actions syntax rules, which form is valid for a step-level if condition?
- By default, matrix jobs use fail-fast behavior. What does setting 'strategy.fail-fast: false' change?
- Jobs 'lint' and 'test' both list 'needs: [build]'. Job 'deploy' must run only after both 'lint' and 'test' succeed. Which 'needs' declaration is correct on 'deploy'?
- Job 'notify' has 'needs: [deploy]' and should run even when 'deploy' fails, but only when the failure was a real failure (not a skip). Which job-level 'if' condition is most appropriate?
- A step has 'id: smoke' and 'continue-on-error: true'. The step's command exits with code 1. A later step uses 'if: steps.smoke.outcome == 'failure''. What happens?
- A job sets 'timeout-minutes: 30'. One long-running step sets 'timeout-minutes: 10'. After 10 minutes the step is still running. What occurs?
- A workflow sets 'defaults.run.shell: bash' and 'defaults.run.working-directory: ./app' at the workflow level. A step overrides only 'working-directory: ./tools'. Which shell does that step use, and where does it run?
- Job 'package' has a step 'id: meta' that writes 'version=1.4.2' to $GITHUBOUTPUT. Job 'publish' has 'needs: [package]'. What must 'package' declare so 'publish' can read the version via needs?
- strategy.matrix defines os: [ubuntu-latest, windows-latest] and node: [18, 20]. You need to drop only windows-latest + node 18, and add one extra job ubuntu-latest + node 22. Which keys accomplish this?
- You need a 'cleanup' job that runs after 'build' whether build succeeds, fails, or is cancelled. Which condition is required?
- A step should run only when the workflow is triggered from a branch whose ref name contains 'hotfix/'. Which expression is correct?
- Production deploys must never run two at once for the same environment, but an in-progress deploy must finish even if a newer run is queued. Which concurrency block is correct?
- You want a nightly build at 02:15 UTC and also on pushes that touch 'services/' only. Which 'on:' configuration matches?
- A single workflow file must be callable as a reusable workflow and manually triggerable with an environment input. What belongs under 'on:'?
- Why might a job-level 'if: ${{ secrets.DEPLOYKEY != '' }}' fail to behave as authors expect?
- A step must export a multi-line PEM certificate as a step output named 'cert'. Which approach follows current GitHub Actions guidance?
- A matrix has 12 combinations. You want at most 3 matrix jobs running at once, and remaining jobs should continue even if one combination fails. Which strategy settings are required?
- Which two statements about job 'needs' graphs are true? (Choose two.)
- Job 'page-oncall' should run only when the workflow was cancelled (for example, a user cancelled a long deploy). Which if condition targets that case?
- Job 'discover' outputs a JSON array of package names as 'packages'. Job 'build' should matrix over that list. Which pattern is correct?
- An organization wants developers to start new repositories with a ready-made CI workflow. Where must organization workflow templates live so the GitHub UI offers them when creating a new workflow?
- What is the primary effect of enabling an organization required workflow that targets selected repositories?
- In a monorepo, you want the frontend CI workflow to run only when files under apps/web/ change on push. Which trigger configuration is correct?
- A pull request workflow should cancel older runs for the same PR when new commits are pushed. Which concurrency configuration is most appropriate?
- Which set of workflow commands creates annotations at notice, warning, and error severity levels in GitHub Actions logs?
- Two steps in the same job both append Markdown tables to the job summary. What is the correct way to ensure both tables appear on the run summary page?
- What is the purpose of adding a problem matcher (for example via ::add-matcher::) in a GitHub Actions job?
- A JavaScript action’s main step must pass a temporary directory path to its post cleanup script. After set-output/save-state deprecation, which mechanism should main use?
- A step must place a multi-line TLS certificate into an environment variable for later steps in the same job via $GITHUBENV. Which pattern is correct?
- You want every run: step in a job to execute with working-directory: backend unless a step overrides it. Where should you set this most efficiently?
- Job build sets a step output version via $GITHUBOUTPUT. Job release needs that value. Which configuration correctly exposes and consumes it?
- Job deploy should run only when job test succeeds, but job notify should run if test fails or succeeds (not when cancelled). Which pair of if: expressions is appropriate?
- A reusable workflow defines on.workflowcall.inputs.releasetype as a string choice among patch, minor, and major for callers. How should callers pass the value?
- You have strategy.matrix.os: [ubuntu-latest, windows-latest]. You need one additional job that runs ubuntu-latest with an extra experimental: true flag without rewriting the whole matrix by hand. Which key adds that combination?
- The workflow sets permissions: contents: read at the top level, but one job must push a release tag. What is the least-privilege fix?
- A flaky integration step occasionally hangs. You want that step to fail after 15 minutes without changing the job’s overall 60-minute default budget unless the hang occurs. Which key should you set on the step?
- Which two expressions correctly evaluate string checks commonly used in job if: conditions? (Choose two.)
- A matrix builds six OS/runtime combinations. You want every combination to finish even if one fails, so you collect full results. Which strategy setting is required?
Domain 2: Runners & Execution Environments · 42 questions
- What does 'ubuntu-latest' resolve to when used as a runs-on value for GitHub-hosted runners?
- When registering a self-hosted runner at the repository level, where do you find the registration token?
- You have a self-hosted runner with custom labels 'gpu' and 'production'. Which runs-on value correctly targets this runner?
- What is the primary security benefit of using ephemeral (just-in-time) self-hosted runners?
- What is the purpose of runner groups in GitHub Actions?
- How do you run all steps of a job inside a specific Docker container in GitHub Actions?
- In a GitHub Actions job that uses a PostgreSQL service container, how does the job connect to the database?
- Where can you find the complete list of software pre-installed on GitHub-hosted runners?
- Which context property identifies the operating system of the runner during a workflow run?
- What type of GitHub-hosted runners provides more CPU and RAM than the standard 2-core machines?
- What is the purpose of Actions Runner Controller (ARC) in a Kubernetes environment?
- After registering a self-hosted runner, what command starts the runner to listen for jobs?
- When diagnosing self-hosted runner issues, which secret enables verbose runner infrastructure logging?
- What environment variable points to the directory where tool installations (Node.js, Python, Java) are cached on GitHub-hosted runners?
- How can you find the IP address ranges used by GitHub-hosted runners to configure firewall allowlists?
- How many GitHub Actions minutes are included for free on public repositories?
- What is a key network limitation of GitHub-hosted runners that organizations with strict network policies must address?
- What directory does the GITHUBWORKSPACE environment variable point to?
- A self-hosted runner carries labels 'self-hosted', 'linux', and 'gpu'. Which runs-on value requires the runner to match all listed labels?
- A job defines a service container with key 'redis'. From a step running on the job's runner (not inside a job container), how do you typically reach Redis on port 6379?
- Which runs-on label selects a GitHub-hosted runner using the latest Ubuntu image GitHub provides for standard hosted runners?
- Which two properties of the 'runner' context are commonly used when composing OS-aware cache keys? (Choose two)
- You need every step of a job to run inside 'node:20-bookworm' instead of directly on the hosted VM filesystem. Which job key configures this?
- Which statement correctly contrasts RUNNERTEMP and GITHUBWORKSPACE on a GitHub-hosted runner?
- What is a defining characteristic of GitHub-hosted larger runners compared with standard GitHub-hosted runners?
- In a GitHub Organization, what is the primary purpose of placing self-hosted runners into a runner group with repository access controls?
- A self-hosted runner has labels 'self-hosted', 'linux', 'x64', and 'gpu-a100'. Which runs-on value targets only runners that have the gpu-a100 label (among matching hosts)?
- Your organization enabled GitHub-hosted larger runners for heavy builds. How do jobs typically select a larger runner?
- A job defines a Redis service container. Which configuration correctly maps port 6379 and waits for the service to be ready?
- A job sets 'container: node:20' and a service 'postgres'. From a step inside the job container, which hostname should connect to PostgreSQL?
- Administrators placed production self-hosted runners in a runner group named 'prod-runners' visible to selected repositories. How should a workflow job request a runner from that group?
- Which two statements correctly contrast GitHub-hosted and self-hosted runners? (Choose two.)
- A job must run inside a private image 'ghcr.io/acme/ci-node:20'. How do you supply registry credentials for the job container?
- You must compile a native ARM64 binary on GitHub-hosted infrastructure that provides ARM runners. What should drive runs-on selection?
- A job must run steps inside a private image registry.example.com/ci/python:3.12. How do you supply registry credentials for the job container?
- Your enterprise hosts GPU self-hosted runners in a runner group restricted to selected private repositories. What happens when a workflow in a non-allowed private repo targets those runner labels?
- A job defines services.redis with image redis:7. How should steps in the job typically reach Redis?
- A workflow compiles a large native codebase and exceeds CPU/memory on standard GitHub-hosted runners. What is a supported way to obtain more powerful GitHub-hosted compute?
- Besides repository allow lists on runner groups, which operational practice most reduces risk when self-hosted runners execute workflows that build untrusted pull requests?
- Which two statements about job-level container: configuration are true? (Choose two.)
- Your organization enabled a larger GitHub-hosted runner pool exposed through a runner group. Which runs-on form targets that pool using the group selector (when configured that way)?
- When a job uses container.image, how do steps typically access the repository files checked out by actions/checkout?
Domain 3: Actions, Marketplace & Reuse · 44 questions
- Which fields are REQUIRED in an action's 'action.yml' metadata file?
- What is a key difference between a composite action and a reusable workflow?
- When 'actions/checkout@v4' is used without any 'with:' parameters on a push event, what does it check out?
- From a security standpoint, what is the most secure way to reference a third-party action?
- What does the 'Verified creator' badge on a GitHub Marketplace action indicate?
- How do you reference a local action stored in '.github/actions/setup-env' within the same repository?
- In an action.yml for a JavaScript action, which 'runs.using' value specifies Node.js 20?
- In a Docker container action's action.yml, what do the 'args:' field values correspond to in the Docker context?
- When calling a reusable workflow, what does 'secrets: inherit' do?
- In an action.yml, what is the purpose of the 'branding:' block?
- How do you pass an output value from a reusable workflow back to the caller workflow?
- What is the correct syntax to call a reusable workflow from a different repository?
- In a JavaScript action's action.yml, what is the purpose of the 'post:' field under 'runs:'?
- In a composite action's action.yml, what additional field is REQUIRED for each 'run:' step that is NOT required in regular workflow run steps?
- Which of the following is a limitation of reusable workflows?
- What is the maximum nesting depth for calling reusable workflows from other reusable workflows?
- What does 'persist-credentials: false' do in actions/checkout?
- In a JavaScript action using @actions/core, which function marks the action as failed?
- In a composite action, how do you reference an input named 'deploy-env' inside a run step?
- When publishing a new version of a GitHub Action to the Marketplace, what is the recommended way to maintain the major version tag (e.g., v2) pointing to the latest minor/patch?
- In action.yml for a composite action, which 'runs' configuration is required?
- When authoring a reusable workflow, where do you declare the outputs that callers can read after the reusable job finishes?
- A repository stores a composite action in '.github/actions/notify-slack'. Which uses value references it from a workflow in the same repository?
- Which two top-level keys are required in every action.yml metadata file? (Choose two)
- A reusable workflow lives in 'octo-org/workflows/.github/workflows/build.yml@v1'. What must be true for a private caller repository in the same org to use it?
- In a JavaScript action, which @actions/core API reads an input defined in action.yml as 'api-key'?
- A workflow references 'uses: docker/login-action@v3'. What does the '@v3' portion select?
- Which capability is supported by reusable workflows but NOT by composite actions?
- Security requires immutable third-party action references. Which uses: line best meets that requirement?
- In a composite action, a step with 'id: prep' sets an output 'version'. How do you expose 'version' to workflows that use the action?
- You need a reusable unit that runs several shell steps, shares the runner workspace, and avoids building a container image. Which action type fits best?
- A maintainer force-moves the 'v3' tag of a third-party action to a new commit that adds telemetry. Workflows using '@v3' will:
- A composite action lives at '.github/actions/setup-build-tools' in the same repository as the workflow. Which uses: value references it?
- Which two approaches correctly provide secrets to a called reusable workflow? (Choose two.)
- In action.yml, an input 'region' is marked 'required: true' and also has 'default: us-east-1'. What should authors understand?
- Workflow A calls reusable workflow B, which calls reusable workflow C. What is true about further nesting?
- A caller workflow must give a reusable workflow access to the same repository secrets without listing each secret name. Which configuration is correct?
- A composite action must expose an output named bundle-path to the caller workflow. Where is the output declared, and how is its value produced at runtime?
- An enterprise wants many internal repositories to call a private composite action without publishing it to the public Marketplace. Which approach is appropriate?
- You are packaging a multi-step setup sequence as a shareable action inside action.yml. Which runs.using value indicates a composite action?
- In action.yml, input region is optional for callers but should default to us-east-1 when omitted. Which declaration is correct?
- A repository calls its own reusable workflow file at .github/workflows/build.yml. Which uses: form is valid for a same-repo reusable workflow on a release tag v1.4.0?
- Which two statements correctly contrast composite actions and reusable workflows? (Choose two.)
- When authoring a Docker container action, which action.yml configuration correctly points at a Dockerfile in the action repository?
Domain 4: Security & Secrets Management · 47 questions
- What is GITHUBTOKEN and how is it made available in a GitHub Actions workflow?
- At which levels can secrets be defined in GitHub for use in Actions?
- What happens if a secret value accidentally appears in workflow step output?
- What is the main advantage of using OIDC tokens to authenticate with cloud providers like AWS instead of storing long-lived credentials as secrets?
- Which workflow permission is required to request an OIDC JWT token from GitHub?
- What does GitHub Secret Scanning's 'push protection' feature do when a secret is detected?
- Which environment protection rule requires a specific team member to approve a deployment before it proceeds?
- Which GitHub Actions event trigger is recommended for CodeQL analysis to scan code on every PR?
- How do you configure Dependabot to automatically update GitHub Actions versions in your workflows?
- What is the default permission level of GITHUBTOKEN when the repository's 'Workflow permissions' setting is set to 'Read and write permissions'?
- What hostname do you use to push Docker images to GitHub Container Registry?
- Which workflow best practice reduces the risk of injection attacks through untrusted user input in 'run:' steps?
- Which of these is a recommended security hardening practice for GitHub Actions workflows?
- What GitHub Actions permission scope allows a workflow to approve pull requests?
- By default, when a pullrequest workflow runs from a forked repository, are secrets available?
- When configuring AWS to trust GitHub Actions OIDC tokens, the 'sub' claim can filter which workflows can assume the role. Which is an example of a valid sub claim for a specific branch?
- Which permission allows a workflow to create and update check runs on a pull request?
- When does a GITHUBTOKEN expire?
- In a dependabot.yml configuration for GitHub Actions, which key groups multiple action updates into a single PR?
- GitHub recommends setting 'Workflow permissions' to what default for new repositories?
- A security audit identifies that a workflow uses 'uses: third-party/action@v2'. What is the security concern and recommended fix?
- Can GITHUBTOKEN bypass branch protection rules to push directly to a protected branch?
- How do you pass a specific secret to a reusable workflow without using 'secrets: inherit'?
- Which authentication approach lets a GitHub Actions workflow obtain short-lived cloud credentials from AWS, Azure, or GCP without storing long-lived cloud access keys as GitHub secrets?
- A public repository receives a pull request from a fork. For the pullrequest event, what is the default availability of repository secrets to the workflow run?
- A workflow only needs to read repository contents and packages; it must not write to issues or pull requests. Which permissions block best follows least privilege for GITHUBTOKEN?
- Which two controls can be configured on a GitHub Actions environment to harden production deployments? (Choose two)
- Why is it a bad practice (and often ineffective) to branch on secret values using an if: condition like secrets.FEATUREFLAG == 'true'?
- Which permissions scope must be granted for a job that requests a GitHub Actions OIDC JWT for cloud federation?
- A secret named 'DEPLOYKEY' exists both as a repository secret and as a secret on the 'production' environment with different values. A job sets 'environment: production'. Which value does secrets.DEPLOYKEY resolve to?
- By default, when a workflow uses GITHUBTOKEN to create a commit or open a pull request, what happens regarding additional workflow runs?
- A workflow only needs to read repository contents and write packages. Which permissions block best follows least privilege?
- When configuring a cloud provider to trust GitHub's OIDC tokens, why might you customize the token's subject (sub) claim format?
- The 'production' environment has a wait timer of 15 minutes and required reviewers. When does the deploy job that references environment: production start its steps?
- A pull request originates from a fork of a public repository. The workflow runs on pullrequest. Which statement about secrets is correct by default?
- Which two practices most improve security when consuming third-party Actions? (Choose two.)
- Attackers often try to merge malicious workflow changes. Which control requires designated owners to approve changes under '.github/workflows'?
- A job requests a cloud OIDC token with actions/oidc or cloud login actions. Which permission must be granted?
- Repository secret 'APIURL' is https://staging.example.com. Environment 'production' defines secret 'APIURL' as https://api.example.com. A job sets environment: production. Which value does secrets.APIURL resolve to?
- When configuring OpenID Connect between GitHub Actions and a cloud provider, what is the role of the token audience (aud) claim?
- What does the dependency-review-action (dependency review) primarily enforce on pull requests?
- A workflow runs on pullrequest and includes run: echo "PR title is ${{ github.event.pullrequest.title }}". Why is this dangerous?
- Why must workflows using pullrequesttarget be extremely careful with actions/checkout and secrets?
- Maintainers want outside contributors’ workflows from forks to run only after someone with write access approves the run. Which GitHub Actions security control addresses first-time contributors from forks?
- A production deploy job uses OIDC to assume a cloud role. Which combination best limits which workflow runs may obtain that privileged cloud access?
- Which two practices harden GitHub Actions against secret exposure and untrusted automation? (Choose two.)
- A custom linter produces SARIF. Which Actions-oriented approach publishes those results to GitHub code scanning alerts?
Domain 5: CI/CD Patterns & Optimization · 52 questions
- When using 'actions/cache', what happens if no cache entry matches the primary key?
- Which cache key strategy ensures the npm cache is invalidated when package-lock.json changes?
- Which action pair is used to share build artifacts between jobs in the same workflow?
- What is the default artifact retention period for GitHub Actions on public repositories?
- How do you set the deployment URL shown in the GitHub deployment environment view after a successful deployment job?
- What must you configure in repository settings to prevent merging a PR if the 'CI / build' check fails?
- How do you limit the number of simultaneous jobs in a matrix strategy to 3?
- Which GitHub-hosted runner OS has a billing minute multiplier greater than 1x?
- How do you enable step debug logging in GitHub Actions to get more verbose output?
- Where in the GitHub UI can you see a visual graph of your workflow's job execution and dependencies?
- When using 'actions/setup-node' with 'cache: npm', what files does it use to generate the cache key?
- In a GitHub Actions CI/CD pipeline, what pattern ensures 'deploy to staging' always runs before 'deploy to production'?
- How do you write a Markdown summary that appears on the workflow run summary page?
- Which GitHub CLI command triggers a workflowdispatch event from the command line?
- Using the GitHub REST API, which endpoint lists workflow runs for a specific workflow?
- Which branches can access caches created in a GitHub Actions workflow?
- What is the benefit of using 'Re-run failed jobs' instead of 'Re-run all jobs' after a workflow failure?
- When building Docker images in GitHub Actions, which feature of 'docker/build-push-action' speeds up builds by caching Docker layers?
- Which URL pattern generates a GitHub Actions workflow status badge for a specific workflow?
- A deploy job creates a unique preview URL per PR. How should you capture and display this URL in GitHub's deployment environment view?
- What is the maximum size of a single cache entry in GitHub Actions?
- Which actions/cache behavior occurs when the primary key is a cache miss but a restore-key partially matches?
- By default, can 'actions/download-artifact' access artifacts from a different workflow run?
- What is the GitHub-native mechanism to pause a CI/CD pipeline and wait for human approval before proceeding?
- Using the GitHub REST API or CLI, how do you disable a workflow so it no longer triggers?
- In actions/upload-artifact@v4, what happens if two parallel jobs upload artifacts with the same name?
- Which GitHub feature, combined with required status checks, enables automatically merging PRs when all checks pass?
- In actions/download-artifact@v4, what does the 'merge-multiple: true' parameter do?
- Job 'build' uploads an artifact with actions/upload-artifact. Job 'test' in the same workflow needs those files. What must 'test' do?
- A primary cache key is 'Linux-npm-a1b2c3'. Which restore-keys entry best allows falling back to the most recent Linux npm cache when the exact key misses?
- After deploying a preview app, you want the GitHub deployment to show a clickable environment URL. Which job-level configuration surfaces that URL in the GitHub UI?
- Which two practices help ensure pull requests cannot merge until CI has validated them? (Choose two)
- A monorepo workflow should run only when files under 'backend/' change on push. Which trigger configuration implements that path filter?
- Your matrix expands to 12 jobs but the external test service allows only 4 concurrent sessions. How do you limit concurrency of matrix jobs to 4?
- You implement a manual deploy workflow with workflowdispatch. Operators must pick the target environment from staging or production. Which input definition is most appropriate?
- A 'build' job computes whether a deploy is necessary and sets output 'shoulddeploy' to 'true' or 'false'. How should the 'deploy' job skip work when the value is 'false'?
- You want CI on push when application code changes, but not when only Markdown under 'docs/' changes. Which configuration is appropriate?
- You cache npm dependencies with primary key 'npm-${{ runner.os }}-${{ hashFiles('/package-lock.json') }}' and restore-keys starting with 'npm-${{ runner.os }}-'. What happens on a lockfile change?
- Job 'build' uploads artifact 'web-dist'. Job 'deploy' has needs: [build]. How should deploy obtain the files?
- After deploying a preview app, you want GitHub to show the live URL on the environment and still require a reviewer before production. Which combination applies?
- Base matrix is node: [18, 20] on ubuntu-latest. You need one additional job: node 20 on windows-latest with env flag SLOWTESTS=1. What is the cleanest matrix approach?
- Which two techniques most directly reduce average CI minutes without sacrificing correctness? (Choose two.)
- In a monorepo, each service should run the same CI jobs when its directory changes. Which design is most maintainable?
- Feature branch builds restore caches created on the default branch but have limited ability to pollute default-branch caches. Why do teams still prefer saving warm caches from main/default CI?
- Your release workflow should produce a Software Bill of Materials for compliance. Which Actions approach best fits?
- What does progressive delivery mean in a GitHub Actions deployment context?
- How can GitHub Environments help implement a blue-green style deployment workflow in Actions?
- Why do monorepo teams combine path filters with separate workflows per package for CI optimization?
- A cache entry was saved during a workflow on the repository default branch. A later workflow on a feature branch uses the same cache key. What is the expected access behavior?
- A production environment uses a wait timer of 10 minutes as a protection rule. What is the effect on a deploy job that references that environment?
- Which two techniques commonly reduce GitHub Actions feedback time without sacrificing necessary checks? (Choose two.)
- Your CI uploads large integration-test reports on every PR. Storage costs grow quickly. Which upload-artifact configuration most directly limits how long those reports consume artifact storage?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.