GH-200 Cheat Sheet 2026: Quick Reference
Organized by what you're trying to do, not by exam domain — the YAML key or setting that solves it, plus a pattern table for spotting the right answer fast.
Exam Snapshot
Microsoft does not publish an exact question count or price for GH-200 — only duration and passing score are official (price is set by country/region). Third-party trackers commonly cite ~60 scored questions plus 10-15 unscored pretest items; treat that as an estimate, not a confirmed figure.
Every row below traces to Microsoft's GH-200 skills-measured page or GitHub's Actions documentation, both checked September 7, 2026 — not carried over from a generic template.
What You're Trying to Do → Where It Lives in the YAML
| Task | Do this | Watch out for |
|---|---|---|
| Run a workflow on a timer | on.schedule.cron | Cron is UTC; GitHub does not guarantee the exact minute under load |
| Let someone trigger a run manually with typed inputs | on.workflow_dispatch.inputs | Supports string/boolean/choice types, required flags, and defaults |
| Share one workflow definition across many repos | workflow_call (reusable workflow) | Central, versioned, invoked with inputs: and secrets: — not copied |
| Give new repos a one-time starting point | Starter workflow template | Copied once, then independent — edits don’t propagate back |
| Run the same job across OS/runtime combinations | strategy.matrix with include/exclude | fail-fast stops all jobs on first failure; max-parallel caps concurrency |
| Pass a value from one job into a job that depends on it | job outputs + needs context | Step outputs (GITHUB_OUTPUT) must be surfaced as job outputs first |
| Write a readable summary of what a run did | GITHUB_STEP_SUMMARY | Renders as Markdown directly in the Actions run UI |
| Reuse the same YAML block in several places in one file | YAML anchors/aliases (&, *, <<) | Native YAML feature, not GitHub-specific — reduces copy-paste drift |
| Authenticate to a cloud provider with no stored secret | permissions.id-token: write + OIDC federation | Exchanges GitHub’s OIDC token for a short-lived cloud token; removes the stored secret entirely |
| Lock a third-party action to something that can’t change under you | Pin to a full commit SHA, not @v4 or @main | Aligns with 2026 immutable-actions enforcement on GitHub-hosted runners |
| Investigate one failing variant without rerunning the whole matrix | Rerun individual matrix jobs from the run UI | Correlate the job name back to its matrix axis values first |
| Restrict which actions an org’s repos are allowed to run | Org-level action allow/deny policy | Applies regardless of what an individual repo’s settings say |
| Scope a secret so it only applies to production deploys | Environment secrets (not repo or org secrets) | Gated behind environment protection rules and required approvals |
| Get software onto a runner that isn’t preinstalled | setup-* action, package manager, or custom runner image | Check the runner image’s release notes/toolcache before assuming it’s missing |
If the Question Says X, Think Y
| If the scenario says... | Think... |
|---|---|
| A long-lived cloud credential is stored as a secret and security wants it gone | OIDC + id-token permission, not "rotate the secret more often" |
| The same YAML steps are duplicated across many jobs in one file | YAML anchors/aliases — not a reusable workflow (that’s for cross-repo sharing) |
| Many separate repos need identical CI and someone has to keep updating all of them | A reusable workflow via workflow_call, not a starter workflow |
| A matrix job fails but the run shows success or hides other failures | Check fail-fast — it cancels remaining jobs on first failure, which can mask a second, unrelated failure |
| A workflow uses a popular third-party action pinned to @main or a bare version tag | Security risk — pin to a full commit SHA instead |
| A fork’s pull_request run needs write access to secrets it shouldn’t have | pull_request from a fork does not get secrets by default; pull_request_target does, and misusing it is a common trap |
| A step needs a value another job already computed | needs: <job> plus that job’s outputs — not an environment variable set in a different job |
Common Mistake: Confusing GITHUB_TOKEN Scope With OIDC
Candidates who know both features individually still miss questions that combine them. GITHUB_TOKEN is scoped to the repository the workflow runs in and expires when the job finishes — it authenticates to GitHub itself, not to a third-party cloud provider. OIDC federation (permissions: id-token: write) is the separate mechanism for proving identity to Azure, AWS, or GCP without a stored secret. A question describing "removing a stored Azure secret" is always pointing at OIDC, never at reusing GITHUB_TOKEN for something it was never scoped to do.
Actions Contexts Quick Reference
| Context | What it gives you |
|---|---|
| github | Repository, ref, event payload, and workflow run metadata |
| runner | Info about the machine executing the job (OS, temp dir, architecture) |
| env | Environment variables defined at workflow, job, or step scope |
| vars | Configuration variables (non-secret) at org/repo/environment scope |
| secrets | Encrypted secrets — automatically masked in logs when referenced |
| inputs | Values passed via workflow_dispatch or workflow_call |
| matrix | The current combination of matrix axis values for this job |
| needs | Outputs and result status from jobs this job depends on |
| strategy | Metadata about the matrix/parallel execution strategy itself |
| steps | Outputs and outcome of previous steps within the same job |
GH-200 Glossary
| Term | Definition |
|---|---|
| GITHUB_TOKEN | An ephemeral, auto-scoped token GitHub issues per workflow run — not a substitute for a personal access token (PAT), which is long-lived and user-scoped |
| Starter workflow | A template you copy once from the Actions tab; becomes an independent file with no ongoing link to the source |
| Reusable workflow | A versioned workflow file invoked from another workflow via workflow_call — the source stays authoritative |
| Composite action | A packaged sequence of steps exposed as a single reusable action, distinct from a reusable workflow |
| Immutable action release | GitHub's 2026 enforcement making a published action version's content permanently fixed once released, closing the door on a tag being silently repointed |
| Artifact attestation | Signed, verifiable provenance metadata (aligned with SLSA) proving what built an artifact and how |
GH-200 Quick Answers
How is this different from the GH-200 study guide?
The study guide explains the five domains in narrative form with an hour-by-hour plan. This page skips narrative and organizes by task instead.
Does Microsoft publish an exact GH-200 question count?
No — only the 100-minute duration and 700/1000 passing score are official. Third-party trackers cite ~60 scored plus 10-15 unscored questions, unconfirmed by Microsoft.
What's the real difference between a starter workflow and a reusable workflow?
A starter workflow is copied once and becomes independent. A reusable workflow stays centrally defined and is invoked live via workflow_call.
Can I print this GH-200 cheat sheet?
Yes — every table here is plain HTML, so a browser print or "print to PDF" renders cleanly.
MSCertQuiz sells practice-exam access for GH-200 and other GitHub and Microsoft certifications; this reference was built by the same team that maintains the question bank behind it.
Version Pinning: What Each Reference Actually Locks
Every "pin this action" question comes down to one of four reference types, and they don't all lock the same thing. Knowing the difference is what separates a right answer from a plausible-sounding wrong one on the security domain.
| Reference type | Example | What it actually locks |
|---|---|---|
| Branch | @main | Nothing — moves every time the publisher pushes a commit. Highest risk. |
| Floating tag | @v4 | Nothing guaranteed — a publisher can repoint a major-version tag to a new release at any time, immutable releases or not. |
| Immutable release | v4.2.1 (2026 rollout) | That specific release's content, once published — but only if you reference the release itself, not a tag that might move to a different release. |
| Full commit SHA | @a1b2c3d... | Exactly one commit's content, permanently. The exam's expected answer whenever a question asks how to "guarantee" what code runs. |
Where to Go Next
The domain breakdown and hour-by-hour plan behind this reference.
A timed mock exam to check whether this cheat sheet actually stuck.
Browse every Microsoft and GitHub certification MSCertQuiz covers.
Full exam details and the complete 500-question practice bank.
Reviewed the reference? Now test it under pressure.
Start with free GH-200 questions covering every table above.
Start Free GH-200 Practice