Author and manage workflows

A workflow has a 'build' job that compiles a binary into the ./dist directory, and a separate 'deploy' job that needs that compiled binary. The two jobs run on different runners. The deploy job declares 'needs: build'. Which approach correctly makes the compiled binary available to the deploy job?

Your Node.js CI workflow installs dependencies and produces a compiled bundle in dist/. You want two things: (1) speed up repeated dependency installs across workflow runs by reusing node_modules, and (2) make the compiled dist/ bundle downloadable by team members from the completed run's summary page for the next 30 days. Which approach correctly satisfies both requirements?

A Node.js project uses actions/cache to speed up dependency installs. The team wants the cache to be keyed on the exact hash of package-lock.json, but if no exact match exists (for example after a dependency bump), they want the runner to restore the most recent previous cache for the same OS rather than starting from an empty cache. Which configuration achieves this?

Your team's CI workflow runs on every push to feature branches. Developers frequently push several commits in quick succession, and you notice that multiple redundant workflow runs pile up and consume runner minutes. You want each new push to a given branch to automatically cancel any still-running workflow for that same branch, while runs on different branches continue independently. Which workflow configuration achieves this?

A workflow triggered on the `push` event needs to send a Slack notification that includes only the short branch name (e.g., `feature-login` rather than `refs/heads/feature-login`). Which expression correctly extracts just the branch name for use in a step?

A build step in your workflow generates a multi-line changelog string that a later step in the same job must read as a single environment variable named CHANGELOG. Your teammate wrote the following and it fails because the runner interprets each line as a separate command: echo "CHANGELOG=$CHANGELOG_TEXT" >> "$GITHUB_ENV". What is the correct way to write a multi-line value to GITHUB_ENV?

In a single job, a build step generates a version string and writes it with `echo "VERSION=1.4.2" >> "$GITHUB_ENV"`. A later step in the same job needs to reference this value, and a downstream job listed in `needs` must also consume it. The engineer sets `id: build` on the writing step. Which approach correctly makes the value available to both the later step in the same job AND the downstream job?

Your security team requires that all third-party actions used in workflows be protected against a maintainer force-pushing a malicious commit onto an existing tag. A developer currently references a community action as `some-org/deploy-action@v3`. Which reference change best satisfies the requirement while still guaranteeing the exact code you reviewed will run?

A workflow has three jobs: build, test, and notify. The notify job declares `needs: [build, test]` and should run to post a Slack failure alert whenever either build or test fails, but must be skipped entirely when both succeed. As written, notify never runs when an upstream job fails. Which change makes notify run only on upstream failure?

A build job runs a test suite and you want the workflow run's summary page to display a formatted Markdown table of pass/fail counts after the tests complete. The values are only known at runtime inside a shell step. Which approach correctly writes this table to the run summary?

You maintain a workflow that tests a library across three operating systems (ubuntu-latest, windows-latest, macos-latest) and three Node versions (16, 18, 20) using a matrix. Your team pays for a limited number of macOS runners, so you must (1) skip the combination of macos-latest with Node 16 entirely, and (2) ensure that no more than 2 jobs from this matrix ever run concurrently. Which strategy configuration achieves both requirements?

Your team runs an integration test suite across a matrix of five Node.js versions. Currently, when the test job for one Node version fails, GitHub Actions immediately cancels the still-running jobs for the other versions, so you never see which other versions also fail. You want every matrix combination to run to completion regardless of failures, while keeping the matrix definition otherwise unchanged. Which change to the strategy should you make?

A team builds their application across multiple Node.js versions using a matrix. Their workflow currently defines `node: [16, 18, 20]` running on `ubuntu-latest`. They want to add ONE additional job that runs on `windows-latest` with Node.js 20 and also sets an extra variable `experimental: true` that only applies to that single combination, without altering the existing three Ubuntu jobs. Which matrix configuration achieves this?

Your team runs a matrix build across `ubuntu-latest`, `windows-latest`, and `macos-latest`. After a scheduled nightly run, the Linux jobs suddenly fail because GitHub rolled the `ubuntu-latest` label to a newer runner image that ships a different default Node.js version, breaking a native dependency compile. You need the most reliable fix that keeps builds reproducible while still allowing controlled upgrades. Which approach should you take?

A team runs a build across multiple Node.js versions using a matrix strategy. They want each job to print how many total jobs the matrix generated (for logging purposes) inside a step. Which context and property should they reference in an expression to obtain the total number of jobs created by the matrix?

A workflow has two jobs. The first job, named 'build', generates a version string that the second job, named 'deploy', must reference. The 'deploy' job includes 'needs: build'. Inside the 'build' job, a step with id 'meta' writes the value using 'echo "version=1.4.2" >> "$GITHUB_OUTPUT"'. To make this value available to the 'deploy' job, what must also be configured?

A workflow calls an internal API using a token stored in the repository secret API_TOKEN. A developer wants to derive a shortened 'client key' from the token at runtime (the first 12 characters) and print it to the log for debugging, while ensuring GitHub still masks the full secret. Which approach correctly prevents the full secret from leaking in logs?

Your team maintains a public repository that receives many pull requests from forks. You need a workflow that automatically labels incoming PRs based on which files changed, and the labeling step requires write access to the repository's issues/PRs. A security review flags that using the standard 'pull_request' event does not grant sufficient token permissions for PRs originating from forks. Which trigger and configuration correctly allows the labeling job to run with write access while handling fork PRs?

A workflow only needs to read repository code, build it, and post a comment on the triggering pull request. Your security team requires the automatically provided GITHUB_TOKEN to follow least-privilege principles. Which top-level configuration grants exactly the minimum required permissions?

Your monorepo contains application code under `src/` and documentation under `docs/`. The CI workflow that builds and tests the application is expensive and should only run when application code (or the workflow file itself) changes — never for documentation-only pushes to the `main` branch. Which trigger configuration achieves this most correctly?