GH-900 cheat sheet — every exam topic on one page

Understand Git and GitHub basics

Git vs GitHub: Version Control Fundamentals for GitHub Foundations (GH-900)

• Version control records each change with author, time and message, lets you restore or compare any committed version, and lets people work in parallel on branches.
• Only committed content is recoverable: uncommitted edits, a file's life before it was added, and ignored files are not in the history.
• Git is open-source version control software that runs locally without an account; GitHub is a hosting platform that adds pull requests, issues, Actions and access control.
• Commits, branches, merges, diff, log and blame are Git; reviews, approvals, issues and status checks are GitHub.
• Distributed means every clone holds the full history, so local work continues offline and any up-to-date clone can rebuild a lost server.
• A repository is files plus history; the history lives in the hidden .git directory.
• git add stages a snapshot of the file at that moment; git commit records the staging area, locally; git push shares it.
• A commit ID is a hash of the commit's data, so changing even the message creates a new commit with a new ID.
• A branch is a movable pointer; commits on one branch are not on another until merged, and pushing one branch does not push another.
• Fetch downloads into origin/main without changing your branch; pull is fetch plus integrate; merges conflict only when both sides changed the same lines.

Working with GitHub: Accounts, Plans, the GitHub Flow, Markdown, Desktop and Mobile (GitHub Foundations GH-900)

• Personal accounts are people; organizations are shared owners that nobody signs in to; enterprise accounts (Enterprise Cloud and Server) manage policy and billing for many organizations.
• GitHub recommends one personal account per person. Employer access comes from organization membership; removal ends access to the organization's private repositories (and deletes private forks of them) but leaves your account and repositories alone.
• Features follow the repository owner's plan: Pro upgrades a personal account's private repositories, Team upgrades an organization's, and Enterprise adds SAML SSO, SCIM, internal repositories and the enterprise account.
• Enterprise Cloud is hosted by GitHub (optionally with data residency on GHE.com); Enterprise Server runs on the customer's own infrastructure.
• GitHub flow: branch from the default branch, commit and push, open a pull request, address review comments with more commits, merge, delete the branch.
• Draft pull requests get feedback and checks but GitHub blocks merging until they are marked ready. Revert a merged pull request through a new pull request instead of rewriting history.
• Markdown essentials: fenced code blocks with a language identifier, - [ ] task lists,  images with relative paths, #42 and owner/repo#42 references, @user and @org/team mentions.
• A mention notifies only people with read access to the repository (and organization membership for organization-owned repositories).
• Alerts ([!NOTE] to [!CAUTION]) highlight, <details> hides until clicked, Mermaid draws diagrams from text, and HTML comments never render.
• GitHub Desktop is a GUI for local Git work on Windows and macOS; GitHub Mobile is for notifications, reviews and sign-in approvals on a phone; scripts use GitHub CLI.

Work with GitHub repositories

GitHub Repository Management: README, CODEOWNERS, Templates and Insights (GH-900)

• README is the project's front page; if several exist, GitHub shows .github first, then the root, then docs. A profile README lives in a public repository named after your username.
• Without a LICENSE, default copyright applies: others can view and fork a public repository on GitHub but have no right to reuse the code. There is no default license from .github.
• CONTRIBUTING explains how to contribute and is linked when people open issues and pull requests; CODE_OF_CONDUCT covers behaviour, SUPPORT covers help, SECURITY covers supported versions and private vulnerability reporting (documentation only).
• CODEOWNERS requests reviews automatically: last matching pattern wins, the copy on the pull request's base branch applies, owners need write access, and drafts get no requests. Requiring owner approval is a separate protection setting.
• Default community health files come from a public .github repository and apply only where a repository lacks its own file of that type; a repository's own issue templates replace the whole default set.
• A repository generated from a template starts with one commit and no link to the template; only the default branch unless Include all branches, and no Git LFS files. A fork keeps history and can send pull requests.
• Renaming the default branch retargets open pull requests, moves protection and redirects file URLs, but local clones must be updated by hand.
• Browser uploads take files up to 25 MiB, Git pushes up to 100 MiB, and anything larger needs Git LFS.
• Insights: Pulse summarises a period, Contributors shows commits per person, Traffic (push access, 14 days) shows visitors; on GitHub Free, repository graphs are public-repository only. The dependency graph lists dependencies and dependents; Enterprise Cloud organizations get dependency insights.
• Stars bookmark (and can be grouped into public lists) while watching controls notifications; archive a finished repository to make it read-only but still viewable, forkable and reversible.

Collaborate using GitHub

GitHub Collaboration Tools: Issues, Pull Requests, Discussions, Notifications and Pages (GH-900)

• Issues are for actionable work with an owner and an end; discussions are for questions, ideas and announcements; pull requests propose and review a code change.
• Q&A discussion categories let a comment be marked as the answer; Announcement categories let only maintain/admin users start threads; people with triage access can convert an issue into a discussion.
• Reviews are submitted as Comment, Approve or Request changes; a suggested change on a line can be committed by the author from the pull request page.
• Closing keywords (close/fix/resolve forms) in a pull request description close issues only on merge into the default branch; repeat the keyword per issue and use OWNER/REPO#N for other repositories.
• A keyword in a commit message closes the issue but does not list the pull request as linked; manual links from the Development sidebar need write access, and only the issue side can reach another repository.
• Issue templates live in .github/ISSUE_TEMPLATE (config.yml sets blank_issues_enabled and contact_links); pull_request_template.md goes in the root, docs/ or .github/; a public .github repository supplies defaults only to repositories without their own.
• review-requested: finds pull requests waiting on a reviewer, reviewed-by: those already reviewed, and no:assignee finds unowned items; up to ten people can be assigned.
• Watch with Participating and @mentions to hear only what involves you, Custom to add event types such as Releases, and Ignore to drop everything; Save keeps a notification indefinitely.
• Secret gists are unlisted, not private: anyone with the URL can view them, and a public gist cannot be made secret.
• Wikis need 500+ stars and restricted editing to be indexed; GitHub Pages sites are public unless privately published from an Enterprise Cloud organization.

Apply modern development practices

GitHub Actions, Copilot, Codespaces and github.dev: Automation and AI Tools (GH-900)

• GitHub Actions runs workflows when events happen — CI/CD, publishing on release, labelling new issues, scheduled jobs — from YAML files that must live in .github/workflows.
• Event triggers workflow; a workflow's jobs run in parallel by default, each on its own runner, unless needs: makes one wait; steps run in order within a job; actions are reusable units steps call.
• GitHub-hosted runners are fresh, GitHub-maintained Ubuntu/Windows/macOS VMs; self-hosted runners are your own machines for special hardware or software, maintained by you.
• Standard GitHub-hosted runners are free in public repositories; private repositories use the plan's included minutes, then are billed; self-hosted runners use no minutes.
• Copilot suggests code inline from what you type or a descriptive comment (Tab accepts, Esc rejects, Alt+] / Alt+[ cycle); a public code policy blocks matching suggestions or shows references.
• Ask mode answers, plan mode writes a plan, agent mode autonomously edits and runs commands in your IDE, and Copilot cloud agent works in the background on GitHub and delivers a pull request.
• Pick the chat model in the model picker or use Auto; the chat model never changes inline suggestions, and Business members can switch models only if their organization allows it.
• Individual plans (Free, Pro, Pro+, Max) are bought by a person; Copilot Business adds organization policy, content exclusion and audit logs; Copilot Enterprise needs GitHub Enterprise Cloud and is chosen per organization.
• A codespace is a container on a GitHub-hosted VM, opened in the browser, VS Code or GitHub CLI; it stops after 30 idle minutes by default, and stopped codespaces still use storage until deleted.
• devcontainer.json shares the team environment (rebuild to apply; /workspaces survives), dotfiles and Settings Sync personalise it, prebuilds speed it up, and github.dev is the free, compute-free editor for quick edits.

Manage projects with GitHub

GitHub Projects, Labels, Milestones and Insights: Project Tracking (GH-900)

• A project is owned by a user or organization and can hold issues, pull requests and draft issues from many repositories; built-in fields such as Assignees, Labels and Milestone edit the issue itself.
• Table for detail, board for flow, roadmap for time: board columns come from a single select or iteration field, roadmap bars from start and target date or iteration fields.
• Pick field types by behaviour: single select for fixed choices, number for values you sum, iteration for repeating sprints with breaks and @current/@next filters.
• Draft issues live only in the project and need converting to an issue in a repository before they can have labels or a milestone.
• Labels and milestones are repository-scoped; a milestone has a due date and percent complete; a project tracks work across repositories.
• good first issue feeds the contribute page; triage can apply labels without pushing code, write is needed to create them.
• New projects set Status to Done when items close or pull requests merge; auto-add only catches new or updated items, so bulk add the existing backlog.
• Saved replies are personal, reusable comments for issues, pull requests and discussions; templates prefill what others open.
• assignee:@me shows each viewer their own work from one view; a leading hyphen negates; no:assignee finds unowned items.
• Current charts are snapshots, historical charts (default burn up) are trends; the Y-axis can count items or sum a number field; status updates report project health.

Understand privacy, security, and administration

GitHub Security and Access Management: 2FA, Passkeys, Roles and Branch Protection (GH-900)

• Save your 2FA recovery codes: GitHub Support cannot switch off 2FA, and an account recovery request needs a verified device, SSH key or personal access token.
• A passkey replaces both password and 2FA, is phishing-resistant, and is either synced by a cloud service or bound to one device.
• When 2FA is required, members without it stay but are blocked; outside collaborators without it are removed. The secure-methods option also blocks SMS.
• Triage manages issues and pull requests without push; Maintain manages settings without access, branch protection or deletion, which need Admin.
• Personal-account repositories have only owner and collaborators; move to an organization for finer roles.
• Base permissions apply to every member on every repository, never to outside collaborators, and a higher grant wins.
• Child teams inherit their parent's access; secret teams are hidden but cannot be nested.
• Internal visibility shares a repository across an Enterprise Cloud enterprise without making it public.
• Branch protection blocks force pushes and deletion by default, but admins bypass it unless bypassing is disallowed.
• Rulesets layer: the most restrictive version of each rule applies, and a bypass list exempts named actors.

Explore the GitHub community

Open Source on GitHub: Sponsors, Marketplace, InnerSource, Forks and Discovery (GH-900)

• Open source lets anyone read and reuse code under its license; contributors fork and open pull requests, they do not get write access.
• GitHub Sponsors funds developers and organizations through monthly or one-time tiers; personal-account sponsorships carry no fee, organization sponsorships can.
• A FUNDING.yml file in the .github folder on the default branch drives the Sponsor button and lists Sponsors usernames, external platforms and custom URLs.
• Public repositories get free Actions on standard GitHub-hosted runners, self-hosted runners are always free, and larger runners are always billed.
• Follow a user or organization to see their public activity on your dashboard; watch a repository for notifications (Custom can limit it to Releases); star to bookmark.
• GitHub Marketplace lists actions and apps; paid plans are for organization-owned apps that have completed publisher verification.
• InnerSource is open source practice inside a company: internal visibility, CONTRIBUTING guidance, trusted committers and reviewed pull requests.
• Fork to contribute back (linked, full history); generate from a template to start an independent project (fresh history); add topics so people find a repository by subject.