GitHub Certified: GitHub Actions

The exam covers 4 core domains: (1) Authoring and Maintaining Workflows (~40%, the largest); (2) Consuming Workflows (~20%); (3) Custom Actions Development (~20%); (4) Security and Compliance (~20%). At least 3-6 months of hands-on GitHub Actions experience is recommended — you should be comfortable writing workflows with multiple jobs, matrix strategies, conditional execution, and artifact management. Memorization alone is insufficient as the exam emphasizes practical scenario application.

Yes, YAML workflow syntax is the most critical part of the exam. Essential keywords include: on (triggers: push, pull_request, schedule, workflow_dispatch), jobs, steps, runs-on, uses, with, env, secrets, needs (job dependencies), if (conditional execution), strategy.matrix (matrix builds), continue-on-error, and timeout-minutes. You must also understand ${{ }} expression syntax, context objects (github, env, secrets, steps), and built-in functions (contains, startsWith, toJSON).

Yes, this is a frequently tested area. GitHub-hosted runners are managed by GitHub, using fresh VMs per job (ubuntu-latest, windows-latest, macos-latest) with no maintenance but usage limits. Self-hosted runners are managed by you, ideal for specific hardware, software, or network access needs, with persistent caches and toolchains. Exam topics include: when to choose self-hosted runners, security considerations (never use self-hosted runners on public repos), and runner group/label management.

Reusable Workflows are complete workflow files triggered via workflow_call, supporting inputs and secrets parameters, running on separate runners. Composite Actions bundle multiple steps into a custom Action defined in action.yml, executing on the caller's runner. Common exam scenarios: use Reusable Workflows for sharing CI/CD logic across repositories, use Composite Actions for encapsulating reusable build steps. Also know the 4-level nesting limit for Reusable Workflows.

Security accounts for ~20% of the exam. Key topics: (1) Three levels of Secrets (Organization → Repository → Environment) with ascending priority; (2) Secrets are auto-masked in logs but can still leak via base64 encoding; (3) Environment Protection Rules (Required Reviewers, Wait Timer, Deployment Branches) for controlling production deployments; (4) GITHUB_TOKEN permission scopes and the permissions keyword; (5) OpenID Connect (OIDC) for keyless cloud service authentication.

No, GitHub Actions is an independent certification that directly tests CI/CD and automation workflow expertise. However, if you are unfamiliar with the GitHub platform (repo management, PR workflows, branching strategies), taking Foundations first can help build a solid base. The Actions exam assumes GitHub fundamentals and focuses on workflow authoring, debugging, optimization, and security practices. The two certs target different audiences: Foundations for all GitHub users, Actions for DevOps engineers and CI/CD professionals.