GH-200 practice test

Triggers for scheduled, manual, webhook and repository events, dispatch inputs and passing them to reusable workflows, jobs and conditional logic, dependencies, service containers, matrices with include and exclude, YAML anchors, the predefined contexts and when expressions are evaluated, caching and artifacts, passing data between jobs, job summaries, badges and environment protections.

Working out which trigger fired and why, diagnosing a failed run from its logs and history, reading expanded anchors and matrix jobs, rerunning one variant, finding logs and artifacts in the interface and through the API, and telling starter workflows, reusable workflows and composite actions apart.

JavaScript, Docker and composite action types and when each fits, the metadata file and directory structure, workflow commands inside an action, troubleshooting one that fails, and the distribution decisions: public against private, publishing to the marketplace, versioning and release strategy.

Distributing reusable components and templates, controlling which actions may be used, organisation policies, hosted and self-hosted runners, runner groups, IP allow lists, what is preinstalled and how to add to it, and encrypted secrets and variables scoped at organisation, repository and environment level.

Environment protections and approval gates, judging an action's trustworthiness, script injection and least privilege, the token's lifecycle and granular permissions against a personal access token, OIDC federation instead of long-lived cloud secrets, pinning to commit SHAs, allow lists, artifact attestations, and the caching and retention decisions that govern what this costs.