SaveMyCert
Log in
5 of 5 free questions left today·for 30 a day
GH-200 · Domain 3

Author and maintain actions practice questions

Author and maintain actions is worth 18% of the GH-200 exam — the 4th-heaviest of the 5 domains. JavaScript, Docker and composite actions: metadata and directory structure, workflow commands, troubleshooting, immutable actions and version pinning, and publishing to the Marketplace. Official weight range 15–20%. 6 fully worked examples are further down this page, answers included.

Exam weight
18%
the 4th-heaviest of the 5 domains
Questions
71
across 2 topics
Free, no account
5/day
a free account allows 30 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 5 domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Author and maintain actions questions, fully explained

Questions from the GH-200 bank mapped to domain 3, with the answer key and the reasoning behind every option. None of them repeat the examples on the main GH-200 practice page.

Question 1Author and maintain actions

A workflow tests a library with a matrix on ubuntu-latest, windows-latest and macos-latest. One step uses the team's own lint action, whose action.yml has runs.using: docker. The Ubuntu jobs pass, but the lint step fails on the Windows and macOS jobs. Linting must keep running on all three systems with the least ongoing effort. What should the team do?

Choose one.

  • a
    Add a step that installs Docker before the lint step on the other two systems

    Container actions are only supported on Linux runners, so installing Docker on Windows or macOS does not make the step run.

  • b
    Add if: runner.os == 'Linux' to the lint step so the other jobs skip it

    This stops the failures but no longer lints on Windows and macOS, which the team requires.

  • c
    Rewrite the lint action as a JavaScript action and release a new version Correct

    JavaScript actions run on Linux, Windows and macOS runners, so the same step works in every matrix leg.

  • d
    Wrap the image in a composite action step that calls docker run on each runner

    macOS runners have no Docker engine and Windows runners run Windows containers, so a Linux image still fails there.

The concept

Docker container actions are supported only on Linux runners; JavaScript and composite actions run on all three operating systems.

Why that’s the answer

The failure is a platform limit, not a configuration error: a container action cannot run on Windows or macOS runners. Installing Docker does not lift that limit, and calling docker run from a composite step fails too because macOS hosted runners have no Docker engine and Windows runners use Windows containers. Skipping the step on non-Linux jobs removes coverage the team needs. Rewriting the logic as a JavaScript action is the one change that runs everywhere without extra per-run setup.

How to reason it out
  1. Note the action type from runs.using: docker.
  2. Recall that container actions run only on Linux runners.
  3. Check whether Docker is even usable on hosted Windows and macOS runners for a Linux image.
  4. Reject the option that drops linting on two systems.
  5. Choose a JavaScript rewrite.

Exam tip: Need an action on Windows or macOS? It must be JavaScript or composite, never a container action.

Create Custom GitHub Actions: JavaScript, Docker and Composite Actions (GH-200) — the lesson that teaches this.

Question 2Author and maintain actions

An organization moves its jobs to self-hosted runners. Some workflows use Docker container actions. Which TWO conditions must a self-hosted runner meet to run those actions? (Select TWO.)

Choose TWO.

  • a
    The runner machine runs a Linux operating system Correct

    Container actions are supported only on Linux runners.

  • b
    The runner is registered at the organization level

    Registration scope controls which repositories can use the runner, not which action types it can run.

  • c
    Docker is installed on the runner machine Correct

    The runner builds or pulls the action's image and starts it with Docker, so Docker must be present.

  • d
    The runner carries a custom label named docker

    Labels only route jobs to runners; no label turns on container action support.

  • e
    The runner machine runs macOS with Docker Desktop

    Container actions are not supported on macOS runners, with or without Docker Desktop.

The concept

Self-hosted runners need Linux and Docker to run Docker container actions.

Why that’s the answer

GitHub's documentation states that to run Docker container actions, self-hosted runners must use a Linux operating system and have Docker installed. Registration level and labels decide where jobs go, not what a runner can execute, and macOS is not a supported platform for container actions.

How to reason it out
  1. Recall the platform limit of container actions.
  2. Recall what the runner uses to start the container.
  3. Discard options about routing and registration scope.

Exam tip: Container actions on self-hosted runners: Linux plus Docker.

Create Custom GitHub Actions: JavaScript, Docker and Composite Actions (GH-200) — the lesson that teaches this.

Question 3Author and maintain actions

A JavaScript action's repository contains src/index.js, package.json and a .gitignore that excludes node_modules. action.yml sets main: src/index.js. Every workflow that uses the action fails at that step with Error: Cannot find module '@actions/core'. Users of the action must not have to add any steps. What should the maintainer do?

Choose one.

  • a
    Keep main at src/index.js, list @actions/core under dependencies and push a new tag

    Listing a dependency does not install it; the runner never runs npm install for an action.

  • b
    Document an npm ci step that callers run before the action reads src/index.js

    That would make every user add a step, which the requirement rules out.

  • c
    Bundle the code and dependencies into one file with ncc, commit it and set main to it Correct

    The runner does not install dependencies for an action. A bundle such as one built with ncc ships everything the code needs in the repository.

  • d
    Move @actions/core into peerDependencies and set main to the index.js in node_modules

    The package is still not present on the runner; peer dependencies are not installed either.

The concept

The runner downloads a JavaScript action's repository as is and runs the file named in main; it never installs npm dependencies.

Why that’s the answer

Because the runner does not run npm install for actions, every module the action requires must be in the repository at the referenced ref. GitHub's guidance is to either commit node_modules or compile the code and dependencies into a single file (for example with @vercel/ncc) and point main at that file. Editing package.json alone changes nothing on the runner, and asking users to install dependencies breaks the stated constraint.

How to reason it out
  1. Read the error: a required module is missing at run time.
  2. Recall that the runner does not install action dependencies.
  3. Keep the fix inside the action's repository.
  4. Choose committing a bundled file and pointing main at it.

Exam tip: A JavaScript action must ship its dependencies: commit node_modules or a compiled bundle.

Create Custom GitHub Actions: JavaScript, Docker and Composite Actions (GH-200) — the lesson that teaches this.

Question 4Author and maintain actions

A maintainer is writing the runs section of action.yml for a JavaScript action whose compiled entry file is dist/index.js. The action must use the current Node.js runtime that GitHub-hosted runners support. Which runs section is valid?

Choose one.

  • a
    runs: using: javascript main: dist/index.js

    javascript is not an accepted value; using names the Node.js runtime.

  • b
    runs: using: node24 entrypoint: dist/index.js

    entrypoint belongs to Docker container actions; JavaScript actions use main.

  • c
    runs: using: node24 main: dist/index.js Correct

    JavaScript actions set using to a Node.js runtime such as node24 and name the entry file in main.

  • d
    runs: using: node24 image: dist/index.js

    image belongs to Docker container actions and names a Dockerfile or image.

The concept

A JavaScript action's runs section needs using (the Node.js runtime) and main (the entry file).

Why that’s the answer

The metadata syntax for JavaScript actions accepts node20 or node24 in runs.using and requires runs.main. GitHub removed Node 20 from Actions runners in September 2026 and asks maintainers to set node24. entrypoint and image are Docker container action keys, and javascript is not a valid runtime value.

How to reason it out
  1. Identify the action type: JavaScript.
  2. Recall the two required runs keys: using and main.
  3. Check that using names a Node.js version.

Exam tip: JavaScript action = runs.using: node24 + runs.main.

Create Custom GitHub Actions: JavaScript, Docker and Composite Actions (GH-200) — the lesson that teaches this.

Question 5Author and maintain actions

A developer is creating action.yml for a new composite action. Apart from runs, which TWO top-level keys must the file contain? (Select TWO.)

Choose TWO.

  • a
    author

    author is optional.

  • b
    inputs

    inputs is optional; an action can take no inputs.

  • c
    branding

    branding is optional and only styles the Marketplace badge.

  • d
    name Correct

    name is required; it identifies the action, for example in the Actions tab.

  • e
    description Correct

    description is required and gives a short summary of the action.

The concept

Every action metadata file requires name, description and runs.

Why that’s the answer

The action metadata syntax lists name, description and runs as required. author, inputs, outputs and branding are optional, whatever the action type.

How to reason it out
  1. Recall the required top-level keys of action.yml.
  2. Remove runs, which the question already gives.
  3. Select the remaining two.

Exam tip: action.yml must have name, description and runs; everything else is optional.

Create Custom GitHub Actions: JavaScript, Docker and Composite Actions (GH-200) — the lesson that teaches this.

Question 6Author and maintain actions

A JavaScript action declares an input named token with required: true in action.yml. A workflow omits the input, the action runs anyway and fails much later with an HTTP 401 error from the API. Callers must always supply their own token, and the action should stop immediately with a message naming the missing input. What should the maintainer change?

Choose one.

  • a
    Write the metadata value as required: 'true' so the runner validates it

    The runner does not enforce required, whether the value is a boolean or a quoted string.

  • b
    Add default: ${{ github.token }} so an omitted input falls back to that token

    This removes the 401 but silently substitutes the workflow token, while callers must supply their own.

  • c
    Add a deprecationMessage to the input so the runner warns when it is missing

    deprecationMessage is logged as a warning when the input is used, not when it is missing.

  • d
    Read the input with core.getInput('token', { required: true }) in the code Correct

    With required: true, getInput throws an error naming the input when it is empty, so the action stops at once.

The concept

required: true in action metadata documents intent; the action's code must enforce it.

Why that’s the answer

GitHub's metadata reference notes that required: true does not make the run fail when the input is missing. The toolkit's core.getInput with { required: true } throws an error naming the input when its value is empty, which gives the early, clear failure the maintainer wants. A default token changes behaviour the stem forbids, and deprecationMessage serves a different purpose.

How to reason it out
  1. Recall whether the runner enforces required inputs.
  2. Find where the check must live: the action's own code.
  3. Choose the toolkit call that fails on an empty input.

Exam tip: The runner does not enforce required inputs; core.getInput(name, { required: true }) does.

Create Custom GitHub Actions: JavaScript, Docker and Composite Actions (GH-200) — the lesson that teaches this.

What GH-200 domain 3 tests, topic by topic

The official exam guide breaks Author and maintain actions into 2 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published GH-200 practice questions per topic in Author and maintain actions
TopicWhat it coversQuestions
Create, structure and troubleshoot custom actionsOfficial GH-200 study guide, "Author and maintain actions" (skills measured as of January 2026). "Create and troubleshoot custom actions": Identify and implement action types (JavaScript, Docker, composite); understand immutable actions rollout on hosted runners and implications for version pinning and registry sources; Troubleshoot action execution and errors. "Define action structure and metadata": Specify required files, directory structure, and metadata; Implement workflow commands within actions.37
Distribute and maintain actionsOfficial GH-200 study guide, "Author and maintain actions" (skills measured as of January 2026). "Distribute and maintain actions": Select distribution models (public, private, marketplace); Publish actions to the GitHub Marketplace; Apply versioning and release strategies.34
Total71

Revise Author and maintain actions before you drill it

Other GH-200 domains

Author and maintain actions: your questions

Author and maintain actions is domain 3 of the GH-200 exam guide and carries 18% of the scored content — the 4th-heaviest of the 5 domains. On a 60-question paper that works out to roughly 11 questions, though GitHub does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official GH-200 exam guide.