GitHub ActionsStudy guide
The intermediate certification for automating workflows and CI/CD with GitHub Actions (GH-200).
About GitHub Actions (GH-200)
GitHub Actions (GH-200) is a Associate-level certification from GitHub. This page organizes the exam scope into a 5-chapter, 12-section study guide and lets you check your understanding with exam-style practice questions. A good flow is to read the chapters below in order, then test yourself via "Practice questions."
Exam domains (approximate weighting)
- Author and manage workflows~24%
- Consume and troubleshoot workflows~18%
- Author and maintain actions~18%
- Manage GitHub Actions for the enterprise~25%
- Secure and optimize automation~15%
Weights are approximate guidance for the live exam. Each domain is covered in detail in the chapters and sections below.
Official exam information: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/gh-200
1Author and Manage Workflows
- 1.1Workflow Triggers and Events
Design when and on what a workflow runs. Understand scheduled, manual (workflow_dispatch), webhook, and repository events; defining workflow_dispatch inputs; passing inputs and secrets to reusable workflows via workflow_call; and choosing appropriate scope and permissions for each event.
- 1.2Workflow Structure, Matrix, Contexts, and Expressions
Understand jobs and steps, job dependencies (needs) and conditionals (if), choosing runners, workflow commands and environment variables, service containers, parallel job expansion via strategy/matrix (include/exclude, fail-fast, max-parallel), YAML anchors/aliases, and the github/env/matrix/needs contexts with ${{ }} expression evaluation.
- 1.3Managing Execution and Outputs — Cache, Artifacts, Outputs, and Job Summaries
Understand how to pass data between jobs/steps (artifacts, $GITHUB_OUTPUT, $GITHUB_ENV, reusable-workflow outputs), dependency caching, Markdown job summaries via $GITHUB_STEP_SUMMARY, status badges, environment protections, and managing retention of logs/artifacts/runs via REST APIs.
2Consume and Troubleshoot Workflows
- 2.1Interpreting Results and Troubleshooting
Read configuration and logs to understand what triggered a run and what happened, and diagnose failed runs from logs and run history. Understand expanding YAML anchors/aliases, reading matrix expansions (mapping job names to axes), analyzing failed variants and re-running individual jobs, and accessing logs/artifacts in the UI and via API.
- 2.2Templates and Reuse — Starter, Reusable Workflows, and Composite Actions
Understand org-level workflow templates (starter workflows) vs reusable workflows (workflow_call), using non-public (organization-internal) templates, the differences among starter workflows, reusable workflows, and composite actions, and the difference between disabling and deleting workflows.
3Author and Maintain Actions
- 3.1Creating Custom Actions — Types, Metadata, and I/O
Understand the three action types (JavaScript, Docker container, composite) and how to choose, the required files and metadata in action.yml (inputs, outputs, runs, branding), using workflow commands within actions, and troubleshooting action execution errors.
- 3.2Distributing, Publishing, and Versioning Actions
Understand action distribution models (public, private, Marketplace), publishing to the GitHub Marketplace, and versioning/release strategies using tags, releases, a major-version tag, and commit-SHA pinning, plus the concept of immutable actions on hosted runners.
4Manage GitHub Actions for the Enterprise
- 4.1Governing Actions and Workflows
Understand how an enterprise/organization defines and manages reusable components and templates, controls which actions/workflows may run (allow/deny lists, allow only verified actions, required reviewers for unverified actions), and configures organizational use policies.
- 4.2Managing Runners at Scale
Understand GitHub-hosted vs self-hosted runners and when to use each, runner groups for access control, IP allow lists and networking, identifying preinstalled software/tool versions and installing more at runtime, and monitoring/troubleshooting runners.
- 4.3Encrypted Secrets and Variables
Understand the scope and precedence of encrypted secrets and variables at organization, repository, and environment levels, referencing and masking them in workflows and actions, and managing them programmatically via REST APIs.
5Secure and Optimize Automation
- 5.1Security Best Practices
Understand mitigating script injection, the GITHUB_TOKEN lifecycle and least privilege vs PATs, OIDC for cloud federation (eliminating long-lived secrets), pinning third-party actions to SHAs and choosing trustworthy actions with usage policies, artifact attestations/provenance, and environment approval gates.
- 5.2Optimizing Performance and Cost
Understand efficiency via caching and artifact retention, applying retention policies via REST APIs, and strategies for scaling and cost-optimizing workflows—concurrency, matrix size, concurrency groups, runner selection, conditionals, and path/branch filters.