GH-200 Exam Dumps - Microsoft GitHub Administrator Questions and Answers

GitHub provides the ACTIONS_STEP_DEBUG setting specifically for increasing the verbosity of workflow step logs. To enable it, create a repository secret or repository variable named ACTIONS_STEP_DEBUG and assign the value true. GitHub states that if both a secret and a variable with this name exist, the secret takes precedence. After the setting is enabled, newly triggered or re-run workflows display additional debugging events in their step logs. Simply defining ACTIONS_STEP_DEBUG under the workflow ' s env or defaults section does not activate GitHub ' s step-debugging mechanism. There is also no supported --actions-step-debug workflow invocation flag. For deeper runner-level diagnostics, GitHub provides the separate ACTIONS_RUNNER_DEBUG setting. Therefore, option C is the documented method for step debug logging.

================

The action.yml file is the metadata file in a custom GitHub Action that defines the main entry point, including information such as the inputs, outputs, description, and the runs key that specifies the main entry point (e.g., a script or a Docker container).

GitHub allows an organization to restrict workflows so that they use only actions and reusable workflows available within that organization. When such a policy is enforced, external third-party actions and Marketplace actions can be prevented from running. Custom actions intended for internal reuse should therefore be stored in repositories owned by the organization. GitHub also allows private or internal repositories containing actions to be made accessible to other repositories in the same organization or enterprise. The .github repository has special organization-wide uses, such as workflow templates, but it is not the mandatory distribution location for all custom actions. A third-party repository or the public Marketplace would conflict with an organization-only policy. Therefore, distributing the actions through organization-owned repositories is the appropriate approach.

================

The GitHub context exposes the short name of the branch or tag through github.ref_name. For a workflow triggered from a branch named feature-branch, the expression github.ref_name == ' feature-branch ' evaluates to true, allowing the job to run. GitHub also provides github.ref, but that value normally contains the complete Git reference, such as refs/heads/feature-branch, rather than only the short branch name. The properties github.branch_name, github.ref.name, and github.branch.name shown in the other options are not valid GitHub context properties. GitHub evaluates a job-level if expression before sending the job to a runner, making this an appropriate mechanism for conditional deployment execution. Therefore, option B uses the correct context property and comparison syntax.

================

GitHub workflow commands use the syntax ::command parameter=value::{message}. For an error annotation without file-location metadata, echo " ::error::There was an error " is valid because error is the workflow command and the text following the second :: is the message. GitHub also supports parameters such as file, line, and col, making option C valid for associating the error annotation with a specific source-code position. Option A incorrectly places the actual text in a message= parameter while leaving no message after the command separator. Option D also uses invalid workflow-command syntax because error=... is not the command format GitHub defines. Therefore, according to the current GitHub Actions workflow-command specification, the two valid commands are B and C.

================

JavaScript action metadata supports the runs.pre property for specifying a script that executes before the action ' s main entry point. The optional runs.pre-if property controls whether that pre-script executes. Therefore, option B uses the correct metadata structure: pre identifies start.js, pre-if supplies the condition, and main identifies the principal action code. GitHub does not define start, start-if, before, or before-if metadata properties. Current GitHub documentation lists newer supported Node.js runtimes, such as Node.js 20 and Node.js 24, rather than the historical node16 shown in this exam item; however, the tested metadata structure remains pre, pre-if, and main. Thus, among the supplied options, B is structurally correct.

Using a commit hash is the safest method because it references a specific point in time in the repository’s history. This ensures that the action is locked to that exact version and will not be affected by any future changes or modifications to the codebase. Even if the action is updated later, your workflow will continue using the specific commit you referenced.

The check_run event is triggered when a check (such as a code quality check) completes, including when the status of a check changes. By adding this event as a trigger, you can initiate a follow-up workflow when the code quality integration finishes its checks.

The most secure option listed is to use OIDC-based integration to obtain short-lived credentials from an external secrets manager or cloud provider. This avoids storing long-lived sensitive values directly in workflow YAML, repository text, or regular environment variables. Options A, B, and C are insecure because they expose or persist sensitive information in places that can be read, logged, committed, or mismanaged. With OIDC, the workflow requests a token from GitHub’s OIDC provider and exchanges it with the trusted external provider for a short-lived credential. This reduces secret sprawl and supports stronger authorization controls. GitHub documents OIDC as a way to avoid duplicating long-lived cloud credentials as GitHub secrets and to use short-lived access tokens instead.

Environment secrets are scoped to GitHub Actions environments and can be protected by environment protection rules. If an environment requires reviewers, a job that references that environment cannot access its environment secrets until the required approval is granted. This makes option A correct. Option B is incorrect because environment secrets are made available to jobs that reference the protected environment, not selectively to only one specific step by default. Option C is not the purpose of environment secrets; they are not specifically for connecting to GitHub Enterprise Server. Option D is also incorrect because GitHub environment secrets do not automatically pull from Azure Key Vault without additional integration or custom workflow logic. This topic covers environment protection, secrets, and deployment governance.

================