GitHub Foundations Study Guide 2026: Complete Exam Prep
Everything you need to pass the GitHub Foundations certification — all 7 exam domains, a study plan, and what actually shows up on test day.
Quick Summary
- • GH-900 is a Foundations-level exam with 75 questions, 120 minutes, 700/1000 passing score
- • Covers GitHub basics, repositories, collaboration, modern development, project management, security/admin, and the GitHub community
- • Practical Git and GitHub experience significantly accelerates preparation
- • Exam cost: $99 USD
What is the GitHub Foundations Certification?
GitHub Foundations is GitHub's entry-level certification that validates foundational knowledge of GitHub, Git version control, collaboration workflows, and the GitHub ecosystem. It is part of the GitHub Certifications program, owned and operated by GitHub (a Microsoft subsidiary).
The certification is designed for developers, DevOps engineers, and anyone who works with code repositories, pull requests, and software development workflows on GitHub. Unlike Microsoft's Azure exams, GitHub Foundations is priced lower at $99 USD and targets a broad developer audience rather than enterprise IT professionals.
It covers everything from basic Git commands and repository management through to GitHub Actions, GitHub Copilot, and security best practices — making it a comprehensive baseline for anyone in a modern software development environment.
| Detail | Information |
|---|---|
| Certification | GitHub Foundations |
| Credential Earned | GitHub Certified: Foundations |
| Number of Questions | 75 questions |
| Time Limit | 120 minutes |
| Passing Score | 700 out of 1000 |
| Exam Price | $99 USD |
| Exam Level | Foundations |
| Prerequisites | None |
GH-900 Exam Domains & Weightings
GitHub Foundations covers seven domains. Repositories and collaboration together account for roughly half the exam.
Domain 1: Introduction to Git and GitHub
~10%- • Git fundamentals — version control concepts, distributed vs. centralized VCS
- • Core Git commands — init, clone, add, commit, push, pull, fetch
- • Git objects — blobs, trees, commits, tags
- • GitHub vs. Git — what GitHub adds on top of Git
- • GitHub account types — personal, organization, enterprise
- • GitHub plans — Free, Pro, Team, Enterprise
Domain 2: Working with GitHub Repositories
~25%- • Repository creation — public vs. private, initialization options (.gitignore, README, license)
- • Branches — creating, switching, merging, deleting, branch protection rules
- • Commits — writing commit messages, amending commits, commit history
- • Merging strategies — merge commit, squash and merge, rebase and merge
- • Tags — lightweight vs. annotated tags, releases
- • GitHub repository insights — contributors, traffic, dependency graph
- • Forking vs. cloning — when to use each
Study tip: Know the three merge strategies and when each is appropriate. Squash for clean history, rebase for linear history, merge commit to preserve branch topology.
Domain 3: Collaboration Features
~25%- • Pull requests — creating, reviewing, approving, requesting changes, merging
- • Issues — creating issues, labels, milestones, assignees, issue templates
- • GitHub Discussions — structured conversations separate from issues
- • Code review — line comments, suggestion blocks, review approval workflows
- • @mentions and notifications — managing GitHub notification settings
- • GitHub Wikis — repository documentation
- • GitHub Pages — static site hosting from repositories
Domain 4: Modern Development
~10%- • GitHub Actions — workflows, triggers (push, pull_request, schedule), jobs, steps, runners
- • GitHub Actions marketplace — using community and official actions
- • GitHub Codespaces — cloud-based development environments, devcontainer.json
- • GitHub Copilot — AI-powered code completion, chat, CLI
- • GitHub Packages — hosting and consuming packages (npm, Docker, Maven, NuGet)
Domain 5: Project Management
~5%- • GitHub Projects — board views, table views, roadmap views
- • Project automation — auto-adding issues/PRs, status field automation
- • Milestones — tracking progress toward goals
- • GitHub Insights — contributor statistics, code frequency
Domain 6: Privacy, Security, and Administration
~10%- • Repository permissions — read, triage, write, maintain, admin
- • GitHub Advanced Security — code scanning, secret scanning, Dependabot
- • Dependabot — dependency alerts, security updates, version updates
- • Branch protection rules — required reviews, status checks, signed commits
- • Organization security settings — 2FA requirements, SSO with SAML
- • CODEOWNERS — automatically requesting reviews from code owners
- • Audit log — tracking organization activity
Domain 7: Benefits of the GitHub Community
~15%- • Open source concepts — contributing to open source projects, forking, upstream/downstream
- • InnerSource — applying open source practices within an organization
- • GitHub Sponsors — supporting open source maintainers financially
- • GitHub Marketplace — discovering and purchasing GitHub Apps and Actions
- • GitHub Student Developer Pack and GitHub Education
- • Contributing guidelines — CONTRIBUTING.md, code of conduct, issue templates
Ready to test yourself?
Try 40 Free GH-900 Practice Questions
Scenario-based questions with detailed explanations. No credit card required.
Start Free Practice →How Hard is GH-900?
GitHub Foundations is one of the more accessible certifications in the GitHub/Microsoft ecosystem. Developers who use GitHub daily for code collaboration often find the core content familiar. The main challenge is the breadth — 75 questions covering everything from basic Git commands to GitHub Actions, Copilot, security features, and open source practices.
Why candidates fail GH-900
- • Neglecting the community domain: InnerSource, GitHub Sponsors, and open source contribution concepts are less familiar to daily GitHub users but account for ~15% of the exam
- • Merge strategy confusion: The differences between merge commit, squash and merge, and rebase and merge are frequently tested and often confused
- • GitHub Actions depth: Candidates who only use Actions without understanding workflow structure, trigger types, and runner concepts underperform on this section
- • Permission level details: The five permission levels (read/triage/write/maintain/admin) and what each can do is tested more specifically than many candidates expect
3-Week GH-900 Study Plan
This plan assumes 1–1.5 hours per day. Active GitHub users can often compress this to 2 weeks by focusing on unfamiliar features.
Week 1: Git, Repositories & Collaboration
- Days 1–2: Git fundamentals — core commands, branching, merging, merge strategies
- Days 3–4: Repository management — creating repos, .gitignore, README, licenses, branch protection
- Days 5–6: Pull requests — creating, reviewing, merge strategies, draft PRs, auto-merge
- Day 7: Issues, Discussions, Wikis, Labels, Milestones + practice questions
Week 2: Modern Development, Security & Administration
- Days 1–2: GitHub Actions — workflow syntax, triggers, jobs, steps, runners, marketplace actions
- Days 3–4: GitHub Codespaces, Copilot, Packages — understand what each does and when to use it
- Days 5–6: Security — Dependabot (alerts/updates), code scanning, secret scanning, branch protection, CODEOWNERS
- Day 7: Organization administration — permissions, 2FA, SSO, audit log, GitHub Teams
Week 3: Project Management, Community & Mock Exams
- Days 1–2: GitHub Projects — views, automation, roadmaps; GitHub Insights and milestone tracking
- Days 3–4: GitHub community — open source contributions, InnerSource, GitHub Sponsors, Marketplace
- Day 5: Contributing guidelines — CONTRIBUTING.md, code of conduct, issue/PR templates, GitHub Education
- Day 6: Full 120-minute timed mock exam
- Day 7: Review weak areas + second mock exam. Book exam if scoring 80%+.
Best GH-900 Study Resources
1. GitHub Skills (Free)
GitHub Skills (skills.github.com) provides free interactive courses built directly on GitHub — you complete exercises in real repositories. Courses cover everything from Git basics through GitHub Actions and security features. These are hands-on and directly aligned to the exam content.
2. GitHub Documentation
The official GitHub documentation (docs.github.com) is comprehensive and well-organized. For the exam, focus on the Getting Started, Repositories, Collaborating, GitHub Actions, and Security sections. The documentation is the authoritative source for permission levels, branch protection rules, and Dependabot configuration options.
3. MSCertQuiz Practice Tests
500 GH-900 practice questions covering all seven domains with detailed explanations. Strong coverage of merge strategy scenarios, GitHub Actions workflow structure, permission levels, and community/InnerSource concepts — the areas where most candidates are weakest.
Start free GH-900 practice →4. GitHub Foundations Exam Study Guide (Official)
GitHub publishes an official study guide for the Foundations exam on their certification page. Download it and use it as a checklist — every topic listed is fair game for the 75-question exam. The community and InnerSource topics in the guide are often overlooked by candidates who focus only on technical Git content.
GH-900 Exam Day Tips
Do
- • For merge strategy questions: squash = clean history (1 commit), rebase = linear history (replayed commits), merge commit = preserves branch history
- • For permission questions: triage can manage issues/PRs but not push code; maintain can manage releases but not change settings
- • For Actions questions: identify trigger type first (on: push/pull_request/schedule), then job dependencies
- • Use the full 120 minutes — 75 questions gives you ~1.5 minutes per question, which is adequate if you stay focused
Don't
- • Don't confuse fork (your own copy for contribution) and clone (local copy for development)
- • Don't assume Dependabot alerts and Dependabot security updates are the same — alerts notify; updates create PRs
- • Don't skip the community domain — InnerSource and open source contribution questions appear more than most candidates expect
- • Don't confuse GitHub Discussions (structured conversations) with GitHub Issues (task tracking)
Ready to Practice GH-900?
500 questions across all 7 domains. Practice mode with explanations + timed exam simulation.
Start Free Practice →Related Resources
Top Microsoft Certifications 2026
See how GitHub Foundations compares to Microsoft Azure and M365 certifications.
AZ-900 Study Guide 2026
Azure Fundamentals — a popular companion cert for developers who also use GitHub.
MS-900 Study Guide 2026
Microsoft 365 Fundamentals — pairs well with GitHub Foundations for cloud-focused professionals.
Microsoft Certifications for Career Changers
Best entry-level Microsoft certs for breaking into cloud and tech roles.
Frequently Asked Questions
Is GH-900 a Microsoft certification?
GitHub Foundations is a GitHub certification, not a Microsoft exam. However, GitHub is owned by Microsoft, and GitHub certifications are increasingly recognized alongside Microsoft certifications. The exam is administered through PSI rather than Pearson VUE (used for Microsoft exams), and costs $99 rather than the standard Microsoft $165 exam fee.
Do I need programming experience for GH-900?
Basic familiarity with writing code helps, but GH-900 does not test programming skills. You need to understand what Git commands do and how GitHub workflows operate — not write or debug code. The exam is suitable for project managers, technical writers, and DevOps engineers who use GitHub without being developers themselves.
How long is the GitHub Foundations certification valid?
GitHub certifications are valid for 2 years. To renew, you retake the exam. This differs from Microsoft certifications which offer annual free online renewal assessments.
What comes after GH-900?
GitHub offers three additional certifications above Foundations: GitHub Actions (CI/CD and automation), GitHub Advanced Security (security scanning and Dependabot), and GitHub Administration (enterprise management). If your work is focused on CI/CD pipelines, GitHub Actions is the natural next step. For security-focused roles, GitHub Advanced Security is the logical progression.