GH-200 Study Guide
A curated learning path for the GH-200 exam: the best documentation, videos, blog posts and tutorials for every exam objective.A curated learning path for the GH-200 exam: the best documentation, videos, blog posts and tutorials for every exam objective, in the order worth studying them.
GitHub Actions
Exam at a Glance
GH-200 measures whether you can automate software development with GitHub Actions: writing and troubleshooting workflows, building and publishing your own actions, managing GitHub Actions across organizations and enterprises, and keeping that automation secure and efficient. Several objectives ask you to interpret workflow configuration and logs, so expect to read workflow YAML and decide which trigger, keyword, context, or setting meets a requirement, and at which level (step, job, workflow, repository, organization, or enterprise) it belongs.
| GH-200 | GitHub Actions |
|---|---|
| Certification | GitHub Actions |
| Level | Intermediate (GitHub DevOps exam) |
| Prerequisite | None; no prerequisite certification is listed |
| Exam length | 100 minutes |
| Questions | Not stated on the certification page; the number and format mix can vary |
| Passing score | 700 out of 1000 |
| Question formats | Not listed for this exam; the certification page notes it may include interactive components |
| Microsoft Learn access | Not available on GitHub exams |
| Skills measured version | January 2026 |
| Renewal | Valid for 2 years; GitHub is moving to Microsoft's recertification process, which will let you renew without retaking the full exam |
| Cost | Depends on your country or region; shown when you schedule |
What the Exam Covers
The exam has five domains. Authoring workflows and managing GitHub Actions for the enterprise carry the most weight, consuming and troubleshooting workflows and authoring actions come next, and securing and optimizing automation carries the smallest share. None of them is small enough to skip, so plan to cover every domain.
Author and manage workflows — 20-25%
Triggers for scheduled, manual, webhook, and repository events, choosing scope, permissions, and events, workflow_dispatch inputs and passing inputs and secrets to reusable workflows, jobs, steps, conditions, and job dependencies, workflow commands and environment variables, service containers, matrix strategies, YAML anchors and aliases, contexts and expressions (including when they are evaluated and how to keep secrets out of logs), editor tooling, caching and artifacts with retention, passing data between jobs and steps, job summaries, status badges, and environment protections.
Consume and troubleshoot workflows — 15-20%
Identifying triggers and effects from configuration and logs, diagnosing failed runs with logs and run history, reading YAML anchors and aliases, interpreting matrix expansions and re-running individual matrix jobs, locating workflows, logs, and artifacts in the UI and through the API, downloading and managing artifacts, consuming organization and reusable workflows and non-public workflow templates, telling workflow templates, reusable workflows, and composite actions apart, and disabling versus deleting workflows.
Author and maintain actions — 15-20%
Identifying and implementing JavaScript, Docker container, and composite actions, troubleshooting action execution and errors, required files, directory structure, and metadata, workflow commands inside actions, distribution models (public, private, and GitHub Marketplace), publishing to GitHub Marketplace, and versioning and release strategies.
Manage GitHub Actions for the enterprise — 20-25%
Defining and governing reusable components and templates, controlling access to actions and workflows within the enterprise, organizational use policies, configuring and monitoring GitHub-hosted and self-hosted runners, IP allow lists and networking, runner groups and runner troubleshooting, preinstalled software on hosted runners and installing more at run time, and defining, scoping, and managing encrypted secrets and variables at organization, repository, and environment level, including through the REST API.
Secure and optimize automation — 10-15%
Environment protections and approval gates, choosing trustworthy Marketplace actions, mitigating script injection, the GITHUB_TOKEN lifecycle and granular permissions compared with personal access tokens, OpenID Connect federation instead of long-lived cloud secrets, pinning third-party actions to full commit SHAs, enforcing action usage policies, artifact attestations and provenance, and caching, retention, and scaling strategies for performance and cost.
The full bullet-level list lives in the official study guide. Treat it as your checklist:
The Official GH-200 Study Guide
How This Maps to CertiAce Practice Modules
The CertiAce question bank is organized by the seven modules of the official Automate your workflow with GitHub Actions learning paths on Microsoft Learn (Part 1 and Part 2), so you can drill each area in isolation. CertiAce GH-200 practice questions are single-choice and multiple-select only. YAML anchors, job summaries, status badges, retention, script injection, SHA pinning, and artifact attestations have no module of their own in the course, so they are folded into the modules below:
| CertiAce practice module | Skills-measured areas it mainly serves |
|---|---|
| Automate development tasks by using GitHub Actions | Author and manage workflows (workflow anatomy, triggers and filters, workflow_dispatch inputs, repository_dispatch, conditions), Consume and troubleshoot workflows (disabling versus deleting, organization workflow templates), and Author and maintain actions (comparing action types) |
| Build continuous integration workflows by using GitHub Actions | Author and manage workflows (matrix strategies, service containers, contexts, variables, environment files, outputs, caching, artifacts, job summaries, workflow commands, YAML anchors, expressions) and Consume and troubleshoot workflows (reading triggers and effects, diagnosing failures with logs, debug logging, and re-runs, finding logs and artifacts in the UI and API) |
| Build and deploy applications to Azure by using GitHub Actions | Author and manage workflows (deployment triggers, environments, concurrency, status badges, retention) and Secure and optimize automation (environment protection rules, approval gates, OpenID Connect instead of a stored cloud secret) |
| Automate GitHub by using GitHub Script | Author and manage workflows (script steps that use the event payload and run conditionally) and Secure and optimize automation (least-privilege GITHUB_TOKEN permissions, keeping untrusted input out of scripts) |
| Leverage GitHub Actions to publish to GitHub Packages | Author and manage workflows (workflows that publish packages and container images) and Secure and optimize automation (token permissions, package access for workflows, artifact attestations) |
| Create and publish custom GitHub actions | Author and maintain actions (action types, action.yml metadata, toolkit functions and workflow commands, troubleshooting, distribution, GitHub Marketplace, versioning and releases) and Secure and optimize automation (pinning to full commit SHAs, trust signals) |
| Manage GitHub Actions in the enterprise | Manage GitHub Actions for the enterprise (enterprise and organization policies, sharing private actions and reusable workflows, workflow templates, hosted, larger, and self-hosted runners, runner groups, networking, preinstalled software, secrets and variables) and Secure and optimize automation (default token permissions, fork pull request policies, retention) |
The Azure deployment module's CertiAce questions stay on the GitHub side (deployment workflows, environments, protection rules, and OpenID Connect), as the skills list does, and do not test Azure services. GitHub Script is not named in the skills list: treat its module as practice for writing workflow steps, granting the token only the permissions a step needs, and keeping untrusted input out of scripts.
Where GH-200 Fits
| Certification | What it validates | When to take it |
|---|---|---|
| GH-900: GitHub Foundations | Foundational knowledge of Git, GitHub, and collaborating on GitHub | Optional first step if you are new to GitHub |
| GH-200: GitHub Actions (this exam) | Automating software development with GitHub Actions, from workflows and custom actions to enterprise management and secure automation | You are here |
| GH-100: GitHub Administration | Administering GitHub Enterprise: identities and access, governance, security features, Actions, and usage | A next step if you administer the organizations, policies, and runners your workflows depend on |
| GH-500: GitHub Advanced Security | Securing code, secrets, and dependencies with GitHub's security features | A next step if you own secure development practices |
| GH-300: GitHub Copilot | Using GitHub Copilot effectively and responsibly | A next step if you bring Copilot into your development workflow |
| GH-600: GitHub Certified: Agentic AI Developer | Operating, integrating, and governing AI agents in development workflows, with GitHub as the control plane | A later step if you run coding agents inside your GitHub workflows |
GH-200 has no prerequisite certification, and the other GitHub certifications above do not list one either. GH-900 is not required, but the GH-200 audience profile expects familiarity with GitHub repositories and CI/CD, so GH-900 is a natural first step if you are new to GitHub. If you already build workflows on GitHub, go straight to GH-200. GH-100 is the closest companion: one of its five domains is managing GitHub Actions across an enterprise.
Before You Start
The exam is written for people with expertise in automating software development workflows with GitHub Actions, and its audience profile expects familiarity with CI/CD, GitHub repositories, GitHub Packages, and integrating third-party services. Check yourself against this table. Anything unfamiliar is where your preparation should start:
| Area | You should be comfortable with |
|---|---|
| Everyday GitHub | Repositories, branches, pull requests, issues, and releases |
| YAML | Mappings, lists, multi-line strings, and indentation, read without an editor's help |
| CI/CD | What continuous integration and continuous delivery are, and how builds, tests, and deployments fit together |
| Scripting | Running Bash or PowerShell commands, setting environment variables, and reading exit codes |
| Packages and containers | What a package registry and a container image are, and how a build publishes to one |
| Accounts and organizations | How personal accounts, organizations, and an enterprise account relate to each other |
Step-by-Step Study Plan
How long you need depends on where you start. Treat these estimates as planning guidance and adjust them to your starting knowledge and weekly study hours:
| Your starting point | Suggested prep time |
|---|---|
| You write and maintain GitHub Actions workflows weekly | 2 to 4 weeks |
| You use GitHub daily but are new to GitHub Actions | 4 to 8 weeks |
Step 1: Read the Official Study Guide
Skim the full skills-measured list once, and mark every bullet you could not explain to a colleague. That marked-up list is your personal syllabus: everything else in this plan exists to clear it. The January 2026 update changed the exam significantly (objectives were added, removed, moved, and reworded), so check any older material against the current list before relying on it. Most questions cover generally available features, but commonly used preview features may also appear.
Step 2: Schedule Your Exam
Choose a realistic target date after reviewing the skills list and your available study time. A date on the calendar turns studying into a countdown, so pick one using the prep-time table above and plan backwards from it. You schedule through Pearson VUE and can take the exam online or at a test center.
The exam is offered in English, Spanish, Portuguese (Brazil), Korean, and Japanese. If the exam is not available in your native language, check the English as a Second Language accommodation and arrange any approved extra time before booking.
Certification and Exam Details Page
Step 3: Work Through the Official Learning Paths
Complete both Automate your workflow with GitHub Actions learning paths on Microsoft Learn, Part 1 and Part 2. The CertiAce practice modules follow the same seven modules. Take notes on concepts you cannot explain in simple terms, and run every example workflow in your own repository as you go. GitHub's documentation changes faster than the training modules (the GitHub Script unit, for example, still shows an early release of the action and calls github.issues.createComment, while the documentation's examples call github.rest.issues.createComment), so when a unit and docs.github.com disagree, go with the documentation. If you prefer instructor-led training, course GH-200T00 is available on Microsoft Learn.
Automate your workflow with GitHub Actions Part 1 of 2
Automate your workflow with GitHub Actions Part 2 of 2
Step 4: Watch a Full Video Course
Microsoft Learn's GH-200 video series covers the official course in five episodes plus a short course preview: an introduction to GitHub Actions, pipelines with triggers, runners, and environments, extending workflows with workflow templates and custom actions, and organization and enterprise configuration for workflows and runners. It follows the course rather than the skills list bullet by bullet, so keep your marked-up list next to it. Watch it alongside or after the learning paths, and later rewatch the episodes on your weakest areas: a second pass is much faster than the first and surprisingly effective.
GH-200 Video Series (Microsoft Learn on YouTube)
Step 5: Get Hands-On Practice
GH-200 rewards people who write and debug workflows every week: the objectives are about choosing the right trigger, keyword, context, or setting, and about reading what a workflow did and why. GitHub Actions usage is free for public repositories that use standard GitHub-hosted runners, so a public repository on a free account supports many of the core exercises, including environments with required reviewers. Aim for hands-on time with:
- Writing a workflow that runs on push and pull requests with branch and path filters, on a schedule, and manually with typed workflow_dispatch inputs
- Chaining jobs with needs and conditions, and passing values between steps and jobs with outputs and environment files
- Building a matrix with include and exclude, then re-running a single failed matrix job and turning on debug logging
- Adding a service container for a database, caching dependencies, uploading and downloading artifacts, and writing a job summary
- Moving repeated jobs into a reusable workflow that takes inputs and secrets, and comparing it with a composite action and a workflow template
- Creating a JavaScript, Docker container, or composite action with an action.yml file, tagging a release, and pinning a consuming workflow to a full commit SHA
- Setting least-privilege GITHUB_TOKEN permissions, and rewriting an inline script so untrusted input reaches it through an environment variable
- Adding an environment with required reviewers, publishing a container image to GitHub Packages, and generating an artifact attestation for a build
- Registering a self-hosted runner, routing a job to it with labels, and finding the preinstalled software list for a GitHub-hosted runner in the job log
Write your workflows in an editor that validates them, such as the GitHub Actions extension for Visual Studio Code: the skills list names editor tooling, and schema validation catches indentation and keyword mistakes before you push.
Some objectives need more than a free account. Enterprise policies, enterprise runner groups, and sharing private actions and reusable workflows across an enterprise need an enterprise account: a GitHub Enterprise Cloud trial gives you one without a payment method, with up to three new organizations, but it does not include larger runners. Larger runners, and with them static IP addresses and Azure private networking, need the GitHub Team or GitHub Enterprise Cloud plan, and OpenID Connect needs a cloud provider account where you can configure the trust. Learn those topics from the official documentation if you cannot try them yourself.
Setting up a trial of GitHub Enterprise Cloud
GitHub Skills offers free, interactive exercises that run inside GitHub repositories, including creating your first workflow, testing with continuous integration, reusable workflows, workflow artifacts, writing a JavaScript action, and publishing Docker images.
Step 6: Benchmark Your Knowledge
Use CertiAce to benchmark your readiness module by module. The practice modules map to the exam domains as shown above, so use the module mapping and the topics behind your missed questions to identify the skills-measured areas to revisit. Microsoft also offers a free official practice assessment. Aim for consistent performance across every module, not one lucky high score.
Free Official Practice Assessment
Step 7: Take the Exam
The day before, review only your weak topics: no brand-new material. On exam day, read each question for what it is truly asking: many GH-200 scenarios turn on where a keyword or setting lives (step, job, workflow, repository, organization, or enterprise) or on which event started a run and with what permissions, so settle those first and eliminate the options that do not fit.
Worth knowing before you sit down:
- This is a closed-book exam: Microsoft Learn access is not available on GitHub exams.
- You can take unscheduled breaks, but the clock keeps running and you cannot return to questions you already saw.
- Watch the naming: the skills list says starter workflows, while the GitHub documentation calls them workflow templates (GitHub's own collection still lives in the actions/starter-workflows repository). The documentation has also moved ahead of the January 2026 skills list in places: for third-party actions, the secure use reference now recommends workflow dependency lockfiles, a public preview feature added after the outline, while the skills list asks you to pin third-party actions to full commit SHAs. Learn the outline's practices first and treat newer preview features as background.
- Try the GitHub exam sandbox beforehand so the interface holds no surprises: GitHub Exam Sandbox
Additional Learning Resources
| Resource | Type | Why it is useful |
|---|---|---|
| GitHub Actions documentation | Docs | The official home for GitHub Actions, from writing workflows to runners, security, and administration |
| Workflow syntax for GitHub Actions | Reference | Every workflow key, including on, permissions, concurrency, needs, if, strategy, and services |
| Events that trigger workflows | Reference | Each event and its activity types, including the events that run only from the workflow file on the default branch |
| Contexts reference | Reference | What each context holds and where in a workflow you can use it |
| Evaluate expressions in workflows and actions | Reference | Operators, functions such as hashFiles and fromJSON, and the success, failure, always, and cancelled status checks |
| Workflow commands for GitHub Actions | Reference | Annotations, masking, log groups, and the GITHUB_ENV, GITHUB_OUTPUT, and GITHUB_STEP_SUMMARY environment files |
| Running variations of jobs in a workflow | Docs | Matrix strategies with include, exclude, fail-fast, and max-parallel |
| Reusing workflow configurations | Docs | Reusable workflows versus composite actions, workflow templates, and YAML anchors and aliases |
| Dependency caching reference | Reference | Cache keys and restore keys, how a key is matched, and which branches can restore a cache |
| Workflow artifacts | Docs | Sharing files between jobs and keeping them after a run, and when to use artifacts instead of caching |
| Troubleshooting workflows | Docs | Starting points for failed runs: logs, debug logging, triggers, job conditions, and runners |
| About custom actions | Docs | Docker container, JavaScript, and composite actions and when each one fits |
| Metadata syntax reference | Reference | The action.yml keys for inputs, outputs, runs for each action type, and branding |
| Releasing and maintaining actions | Docs | Automated testing and releases, semantic version tags, and keeping major and minor tags current |
| Publishing actions in GitHub Marketplace | Docs | The requirements an action must meet to be listed and the steps to publish it |
| Secure use reference | Reference | Secrets, script injection, third-party actions and pinning, and hardening for GitHub-hosted and self-hosted runners |
| Script injections | Docs | Which context values attackers control and how an inline script becomes injectable |
| GITHUB_TOKEN | Docs | What the token is, how long it lasts, and why events it causes usually do not start new workflow runs |
| OpenID Connect | Docs | Exchanging short-lived cloud tokens instead of storing long-lived cloud secrets in GitHub |
| Artifact attestations | Docs | Build provenance, SLSA levels, and verifying attestations with the GitHub CLI |
| Deployments and environments | Reference | Required reviewers, wait timers, deployment branches and tags, and environment secrets and variables |
| Using secrets in GitHub Actions | Docs | Creating repository, environment, and organization secrets and using them in workflows |
| Enforcing policies for GitHub Actions in your enterprise | Docs | Enterprise policies for allowed actions and reusable workflows, runners, retention, fork pull requests, and workflow permissions |
| Disabling or limiting GitHub Actions for your organization | Docs | Organization settings for allowed actions, self-hosted runners, fork pull requests, and default GITHUB_TOKEN permissions |
| Sharing actions and workflows with your enterprise | Docs | Sharing actions and reusable workflows from internal or private repositories without publishing them |
| Managing access to self-hosted runners using groups | Docs | Organization and enterprise runner groups and which organizations, repositories, and workflows can use them |
| GitHub-hosted runners | Docs | What hosted runners provide, where to find their preinstalled software, and when larger runners apply |
| Publishing and installing a package with GitHub Actions | Docs | Authenticating to GitHub Packages from a workflow with the GITHUB_TOKEN, and how package access works for workflows |
| GitHub Actions extension for VS Code | Tool | GitHub's editor extension: validation and code completion for workflows and expressions, plus run history and logs |
| GitHub Changelog: Actions | Blog | GitHub Actions product updates, useful for spotting renamed, retired, or newly released features |
| GitHub Community: Actions discussions | Community | Ask questions and see how GitHub staff and users explain Actions features |
| Free Official Practice Assessment | Practice | Microsoft's free question-style preview for GH-200 |
Realistic GH-200 exam-style questions with instant feedback and detailed explanations.
Practice GH-200 now