GH-200: GitHub Actions is GitHub's intermediate certification for building and running CI/CD with GitHub Actions. It covers writing workflows, troubleshooting runs, building custom actions, managing Actions across an enterprise, and securing automation. GitHub rewrote the exam objectives in January 2026: they now cover YAML anchors, immutable actions and SHA pinning, OIDC for cloud deployments, artifact attestations and job summaries. Most DevOps job descriptions in India now ask for GitHub Actions alongside Jenkins or Azure DevOps.
This guide follows Microsoft Learn's GH-200 study guide: all five skill areas with weights, example workflows, a 5-week plan and 20 original practice questions.
Quick facts (Microsoft Learn, November 2026)
| Item | Detail |
|---|---|
| Exam | GH-200: GitHub Actions |
| Level | Intermediate |
| Time | 100 minutes; proctored; may include interactive components |
| Passing score | 700 |
| Languages | English, Spanish, Portuguese (Brazil), Korean, Japanese |
| Valid for | 2 years; GitHub is moving to Microsoft's recertification process |
| Practice | Free Practice Assessment on Microsoft Learn |
| Price | Set by the country where you take the exam; scheduled through Pearson VUE |
Microsoft's GitHub Actions page says certifications that expire before the new recertification process launches get a 6-month extension. Read the official GitHub Actions certification page and study guide before booking.
Who should take GH-200?
- DevOps engineers and freshers aiming for DevOps or cloud roles.
- Developers who maintain build and release pipelines.
- Platform teams that run self-hosted runners and govern Actions for an organisation.
Pair it with a cloud certification such as AZ-400 or AWS DOP-C02.
Skills measured and weights
| Skill area | Weight |
|---|---|
| Author and manage workflows | 20–25% |
| Consume and troubleshoot workflows | 15–20% |
| Author and maintain actions | 15–20% |
| Manage GitHub Actions for the enterprise | 20–25% |
| Secure and optimize automation | 10–15% |
1. Author and manage workflows (20–25%)
- Triggers: scheduled, manual (
workflow_dispatchwith typed inputs), webhook and repository events; passing inputs and secrets to reusable workflows withworkflow_call. - Structure: jobs, steps, conditions and
needs; environment variables and workflow commands; service containers for databases and queues; matrix with include/exclude, fail-fast and max-parallel; YAML anchors and aliases; contexts and${{ }}expressions; editor tooling. - Execution and outputs: caching and artifacts with retention; passing data with
GITHUB_OUTPUT,GITHUB_ENVand job outputs; job summaries withGITHUB_STEP_SUMMARY; status badges; environment protections.
name: ci
on:
push: { branches: [main] }
pull_request:
permissions:
contents: read
jobs:
test:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
python: ["3.11", "3.12"]
services:
postgres:
image: postgres:16
env: { POSTGRES_PASSWORD: test }
ports: ["5432:5432"]
options: --health-cmd pg_isready --health-interval 5s
steps:
- uses: actions/checkout@<full-commit-sha> # pin third-party and core actions to a SHA
- uses: actions/setup-python@<full-commit-sha>
with: { python-version: "${{ matrix.python }}", cache: pip }
- run: pip install -r requirements.txt && pytest -q
- run: echo "### Tests passed on Python ${{ matrix.python }}" >> "$GITHUB_STEP_SUMMARY"2. Consume and troubleshoot workflows (15–20%)
- Read triggers and effects from configuration and logs; diagnose failed runs; expand YAML anchors when reading a file; map matrix jobs to their axes and rerun one variant.
- Find logs and artifacts in the UI and through the API; download artifacts.
- Use organisation workflow templates and reusable workflows. Know the difference between a starter workflow (a copied scaffold), a reusable workflow (a central, versioned definition called with
workflow_call) and a composite action (packaged steps). Know disabling vs deleting a workflow.
3. Author and maintain actions (15–20%)
- Action types: JavaScript, Docker container and composite; immutable actions and version pinning.
- Required files and metadata (
action.yml: inputs, outputs,runs); workflow commands inside actions. - Distribution: public, private or GitHub Marketplace; semantic versioning and release tags.
4. Manage GitHub Actions for the enterprise (20–25%)
- Govern reusable components and templates; control which actions and workflows can be used; organisation policies.
- Runners at scale: GitHub-hosted vs self-hosted, IP allow lists and networking, runner groups, troubleshooting, preinstalled software and installing extra tools.
- Secrets and variables at organisation, repository and environment level; managing them through the REST API.
5. Secure and optimize automation (10–15%)
- Environment protection rules and required reviewers.
- Trustworthy Marketplace actions; pin third-party actions to full commit SHAs; allow and deny lists.
- Script injection: never put untrusted input such as PR titles directly into
run:. Pass it through an environment variable and quote it. GITHUB_TOKEN: short-lived and scoped. Set least-privilegepermissions:and prefer it over personal access tokens.- OIDC (
id-token: write) to deploy to AWS, Azure or Google Cloud without long-lived secrets. - Artifact attestations and provenance (SLSA).
- Caching, retention and scaling for cost and speed.
permissions:
id-token: write # request an OIDC token
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@<full-commit-sha>
with:
role-to-assume: arn:aws:iam::123456789012:role/github-deploy
aws-region: ap-south-1
- run: aws s3 sync ./dist s3://my-site-bucket --delete5-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | Triggers, jobs, steps, contexts, expressions, matrix | CI for a Python or Node app across two versions |
| 2 | Caching, artifacts, outputs, summaries, service containers, environments | Build once, deploy to staging, then to production after approval |
| 3 | Reusable workflows, starter workflows, composite, JavaScript and Docker actions | Publish a composite action and call a reusable workflow |
| 4 | Runners, runner groups, secrets and variables, organisation policies, REST API | Self-hosted runner on a cloud VM in a runner group |
| 5 | Security: SHA pinning, script injection, GITHUB_TOKEN, OIDC, attestations; Practice Assessment | OIDC deploy to AWS or Azure with no stored secrets; book the exam |
20 practice questions with answers
These are original practice questions written for this guide, not exam questions.
1. A workflow must run every night at 1:00 AM IST (19:30 UTC). Which trigger?schedule with cron 30 19 * * *. GitHub cron runs in UTC.
2. Testers need a button to start a deployment and choose the environment. What do you use?workflow_dispatch with a typed input such as a choice of environments.
3. Tests must run on three Node versions and two operating systems. What do you use?
A matrix strategy.
4. One matrix variant fails, and you don't want the others cancelled. What setting?fail-fast: false.
5. Integration tests need a PostgreSQL database during the job. What do you add?
A service container under services:.
6. A job must use a value computed in an earlier job. How?
Write it to GITHUB_OUTPUT in a step, expose it as a job output, and read it via needs.<job>.outputs.
7. Twenty repositories share the same deployment steps maintained by one team. What should they call?
A reusable workflow (workflow_call) stored in a central repository.
8. What is the difference between a starter workflow and a reusable workflow?
A starter workflow is copied into a repository and then becomes independent. A reusable workflow is called from a central, versioned definition.
9. Which action type runs on any runner OS and only bundles shell steps and other actions?
A composite action.
10. Which file defines an action's inputs, outputs and how it runs?action.yml (or action.yaml).
11. How should third-party actions be referenced for maximum safety?
By full commit SHA, not a moving tag like @main.
12. A workflow uses ${{ github.event.pull_request.title }} directly inside run:. What is the risk?
Script injection. Pass the value through an environment variable and quote it.
13. How do you make the GITHUB_TOKEN read-only by default?
Set permissions: contents: read (or set the organisation or repository default to read).
14. How can a workflow deploy to Azure without storing a client secret?
OIDC federation: id-token: write plus a federated credential on the Azure identity.
15. Production deployments must wait for a manager's approval. What do you configure?
An environment with required reviewers.
16. Builds need large machines inside the company network. What runners do you use?
Self-hosted runners (or larger GitHub-hosted runners with private networking), organised into runner groups.
17. Only some repositories may use a set of self-hosted runners. How?
Runner groups with repository access restrictions.
18. A secret should be available only to the production deployment job. Where do you store it?
As an environment secret on the production environment.
19. Dependency installs are slow on every run. What helps?
Caching (for example actions/cache or setup actions with cache:).
20. Consumers must verify that a container image was built by your workflow. What do you generate?
Artifact attestations (build provenance).
After GH-200
- Prepare with GitHub Actions interview questions and 55 real-world GitHub Actions questions.
- Read the DevOps engineer career path and see live DevOps jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches DevOps with GitHub Actions, Jenkins, Docker, Kubernetes and Terraform on AWS and Azure. See all courses and the APEX program.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
How long is the GitHub Actions (GH-200) exam?
100 minutes. It is proctored and may include interactive components.
What is the passing score for GH-200?
700.
How long is the GitHub Actions certification valid?
2 years. GitHub is moving to Microsoft's recertification process, and certifications that expire before it launches get a 6-month extension.
Which GH-200 skill areas carry the most weight?
Author and manage workflows, and manage GitHub Actions for the enterprise, at 20–25% each.
When did the GH-200 objectives change?
The exam changed significantly in January 2026, with new objectives such as YAML anchors, immutable actions, OIDC and artifact attestations.
Is there a free practice test for GH-200?
Yes. Microsoft Learn offers a free Practice Assessment for the GitHub Actions certification.
