Medium GH-200 practice questions

Your organization builds a container image in CI and generates a build provenance attestation with the actions/attest-build-provenance action. Before a production deployment job pulls and runs the image, the security team requires the deployment runner to cryptographically confirm that the image was built by your organization's repository and not tampered with. Which command should the deployment job run to enforce this?

A workflow has a 'build' job that compiles a binary into the ./dist directory, and a separate 'deploy' job that needs that compiled binary. The two jobs run on different runners. The deploy job declares 'needs: build'. Which approach correctly makes the compiled binary available to the deploy job?

Your Node.js CI workflow installs dependencies and produces a compiled bundle in dist/. You want two things: (1) speed up repeated dependency installs across workflow runs by reusing node_modules, and (2) make the compiled dist/ bundle downloadable by team members from the completed run's summary page for the next 30 days. Which approach correctly satisfies both requirements?

A Node.js project uses actions/cache to speed up dependency installs. The team wants the cache to be keyed on the exact hash of package-lock.json, but if no exact match exists (for example after a dependency bump), they want the runner to restore the most recent previous cache for the same OS rather than starting from an empty cache. Which configuration achieves this?

Your team maintains an internal action that formats and validates JSON configuration files. It must run identically on GitHub-hosted ubuntu, windows, and macos runners, must start with minimal overhead (no container pull), and its logic is complex enough that the team wants to write and unit-test it in TypeScript rather than orchestrating existing shell commands. Which action type best fits these requirements?

You maintain a composite action that runs a linter and then, only when the linter step fails, uploads a diagnostic report. In the action.yml you add a step with `uses: actions/upload-artifact@v4` and want it to execute regardless of prior step outcome but only when the linting step specifically failed. The linting step has `id: lint`. Which configuration on the upload step correctly achieves this within a composite action?

You are packaging a reusable set of shell steps as a composite action inside a repository at the path .github/actions/deploy-helper/. A teammate consuming the action with uses: ./.github/actions/deploy-helper reports the error 'Can't find 'action.yml', 'action.yaml' or 'Dockerfile' under ...deploy-helper'. You confirm the folder contains a file named composite-action.yml with valid metadata and runs.using set to 'composite'. What is the correct fix?

You are authoring a composite action that formats code. The action.yml declares an input named `target-path` with a default of `.`. Inside a `run` step in the composite action, you need to reference the caller-supplied value of this input to pass it to a CLI command. Which syntax correctly references the input inside the composite action's run step?

You are authoring a composite action for your organization. The action.yml defines a `runs.using: composite` block with several `run:` steps that execute build commands. When a teammate consumes the action in a workflow, the run fails immediately with the error: "Error: Required property is missing: shell". What must you change in the action.yml to resolve this?

You are authoring a composite action that installs a custom CLI tool into a temporary directory and needs subsequent steps in the calling workflow's job to be able to invoke the tool by name without specifying its full path. The install step downloads the binary to $HOME/.mytool/bin. Which approach inside the composite action's action.yml correctly makes the binary available to later steps?

You are authoring a composite action that runs a shell script to compute a build hash, and you need to expose that hash as an output of the action so calling workflows can reference it via steps.<id>.outputs.build-hash. In the run step you have the value in a shell variable $HASH. Which combination correctly wires this up in the action's metadata and script?

Your team's CI workflow runs on every push to feature branches. Developers frequently push several commits in quick succession, and you notice that multiple redundant workflow runs pile up and consume runner minutes. You want each new push to a given branch to automatically cancel any still-running workflow for that same branch, while runs on different branches continue independently. Which workflow configuration achieves this?

Your organization maintains a private repository named `.github` that contains a workflow template (a `.yml` file plus its `.properties.json`) in the `workflow-templates/` directory. A developer on a private application repository within the same organization wants to use this template to scaffold a new workflow. Where and how does the developer access this non-public organization workflow template?

A workflow defines a build job with the following strategy: ```yaml jobs: build: strategy: fail-fast: false matrix: os: [ubuntu-latest, windows-latest] node: [18, 20] runs-on: ${{ matrix.os }} steps: - run: npm test ``` In the Actions UI run summary, one job shows a red X while the other three are green. The failing job is named `build (windows-latest, 20)`. Your teammate insists the failure is caused by the Node version because "20 is the last value shown." How should you interpret this job name to identify the failing variant?

Your security team wants every new repository in the organization to start with a GITHUB_TOKEN that has read-only access to repository contents by default, so that individual workflows must explicitly opt into any write scopes they need. Which configuration achieves this least-privilege baseline across the org without editing each workflow file?

A workflow run for your CI pipeline shows a red X on the 'build' job. When you open the run summary page in the GitHub UI, an annotation reads 'Process completed with exit code 1' but does not indicate which command failed. Your team needs to pinpoint the exact command and error message that caused the failure. Which action gives you the most direct path to that information?

A scheduled workflow named 'nightly-report.yml' has been failing every night and flooding your team's notifications. The workflow will be needed again once an upstream dependency is fixed next quarter. Your team lead asks you to stop the runs immediately while keeping the file in the repository and preserving all past run history for auditing. Which action in the Actions UI best satisfies these requirements?

Your platform team wants a single, centrally maintained CI definition. When they publish a new version, all consuming repositories should immediately pick up the change on their next run without any of those repos editing files. The consuming repos invoke it by referencing its path and a ref. Which mechanism satisfies these requirements?

You are authoring a Docker container action stored at the root of a repository. Your action.yml declares 'runs.using: docker' and needs to build the image from a Dockerfile located in the same directory as action.yml. You want GitHub to build the image at runtime from your source rather than pulling a pre-built image from a registry. Which 'image' value in action.yml achieves this?

Your team maintains a Docker container action used across several repositories. To speed up job startup, you want the action to pull a pre-built image from GitHub Container Registry (ghcr.io) instead of building the Dockerfile on every run. Which value should you set for the `runs.image` key in the action's action.yml?

You are authoring a Docker container action. Inside the entrypoint script (a bash script that runs as the container's ENTRYPOINT), you need to expose a value called build-id so that subsequent steps in the consuming workflow can reference it via steps.<id>.outputs.build-id. Which mechanism inside the container script correctly sets this step output?

A teammate asks you to retrieve the build artifact named 'app-bundle' from a workflow run that completed 95 days ago. Your organization uses the default artifact retention setting. When you open the run in the GitHub UI, the Summary page no longer lists any artifacts under the 'Artifacts' section, and the API call to list artifacts for that run returns an empty array. The workflow logs, however, clearly show the 'Upload artifact' step succeeded at the time. What is the most accurate explanation and next step?

A teammate reports that a workflow run from three days ago produced a build artifact named 'release-bundle', but the run's UI page no longer shows a download link under the Artifacts section. You need to retrieve that artifact programmatically for an audit. Assuming the artifact has not exceeded its retention period, which approach correctly downloads it via the GitHub REST API?

A teammate reports that a nightly workflow named 'build-and-package' produced a broken installer. You know the workflow completed three hours ago but you only have the workflow file name, not the specific run. Using the GitHub REST API, what is the correct sequence to retrieve and download the artifact produced by that latest completed run?

A platform engineer is building an internal dashboard that must automatically archive the complete log bundle (a ZIP of all job logs) for every completed workflow run in a repository. They want to fetch these logs programmatically rather than clicking through the GitHub UI. Which REST API request retrieves the downloadable log archive for a specific workflow run?