Skip to content
masterclassBuddyTech Buzz5 fresh blogs · 5:00 AM IST
Start learning

Interview questions with answers

GitHub Actions interview questions and answers

Workflows, jobs, runners, secrets, caching, matrices and OIDC. Open any question to read its model answer; the multiple-choice set marks the right option and explains it.

Subjective
30
Objective
30

Subjective questions 30

1Explain workflows, jobs, steps and runners.Asked almost every time

A workflow is a YAML file in .github/workflows/ triggered by events. It contains jobs, which run in parallel by default on runners (GitHub-hosted VMs or your self-hosted machines). Each job has steps that run shell commands (run) or reusable actions (uses). Jobs share no files unless you pass artifacts or outputs; needs makes one job wait for another.

2How do you handle secrets safely?Asked almost every time

Store them as repository, environment or organisation secrets and reference them as ${{ secrets.NAME }}; they are masked in logs. Give the GITHUB_TOKEN minimal permissions, avoid exposing secrets to pull requests from forks, protect production with environments that need approval, and prefer OIDC to long-lived cloud keys.

3How do you deploy to a cloud without storing long-lived keys?Asked almost every time

Use OpenID Connect: grant the job permissions: id-token: write, configure a trust policy in the cloud (for example an AWS IAM role trusting GitHub's OIDC provider for a specific repository and branch), and use the provider's action (such as aws-actions/configure-aws-credentials) to get short-lived credentials at run time.

4How would you design a CI/CD pipeline with GitHub Actions?Asked almost every time

On pull requests: install with caching, lint, type-check, run unit tests in a matrix, build, and run end-to-end tests, with required status checks. On merge to main: build once, publish an artifact or image, deploy to staging, run smoke tests, then deploy to production through a protected environment with approval, using OIDC for cloud credentials.

5How do you use caching effectively?Asked almost every time

Use actions/cache or the built-in cache option of setup actions (for example actions/setup-node with cache: npm). Key caches on the lockfile hash with restore-keys as fallback, cache dependency stores rather than node_modules when possible, and keep caches under the size limit.

6How do you keep workflows secure?Asked almost every time

Set minimal permissions (default read), pin third-party actions to SHAs, avoid pull_request_target with untrusted code, never echo secrets, use environments with approvals for deploys, use OIDC instead of long-lived keys, review workflow changes in code review, and enable Dependabot for actions.

7How do you speed up workflows?Very often asked

Cache dependencies (actions/cache or the built-in cache of setup-node), run independent jobs in parallel, split tests with a matrix or sharding, use path filters so unrelated changes skip jobs, cancel outdated runs with concurrency, and use larger or self-hosted runners for heavy builds.

8What is a matrix strategy?Very often asked

strategy.matrix runs a job once per combination of values, such as Node 20 and 22 on Ubuntu and Windows. include and exclude adjust combinations, fail-fast controls whether one failure cancels the rest, and max-parallel limits concurrency.

9Reusable workflows vs. composite actions?Very often asked

A reusable workflow (on: workflow_call) is a whole workflow with its own jobs, called from other workflows with inputs and secrets, good for shared pipelines. A composite action bundles several steps into one action used inside a job, good for shared setup such as 'install and cache dependencies'.

10How do you pass data between jobs?Very often asked

Small values: set step outputs (echo "name=value" >> $GITHUB_OUTPUT), expose them as job outputs, and read them with needs.<job>.outputs.name. Files: upload with actions/upload-artifact and download with actions/download-artifact in a later job.

11What does concurrency do?Very often asked

It groups runs by a key (for example the branch) so only one runs at a time; with cancel-in-progress: true a new push cancels the outdated run. It saves minutes and prevents overlapping deployments.

12What are artifacts vs. caches?Very often asked

Artifacts are files produced by a run (builds, test reports) that you upload to share between jobs or download later. Caches speed up repeated work (dependencies) across runs and may be evicted. Do not use caches to pass build outputs.

13How do path filters and conditions save time?Very often asked

on.push.paths and paths-ignore run workflows only when relevant files change. if: conditions skip jobs or steps, for example deploying only on main. In monorepos, tools like dorny/paths-filter decide which packages to test.

14How do you write a custom JavaScript action?Very often asked

Create action.yml declaring inputs, outputs and runs: using: node20 with an entry file, use @actions/core to read inputs and set outputs and @actions/github for the API, bundle dependencies (for example with ncc) and tag releases.

15How do you deploy a static site or app to GitHub Pages?Very often asked

Build in a job, upload with actions/upload-pages-artifact, then deploy with actions/deploy-pages in a job that has pages: write and id-token: write permissions and the github-pages environment.

16How do you handle flaky tests in CI?Very often asked

Track them with test reports, quarantine or fix them, add limited retries in the test runner rather than rerunning whole workflows, make tests deterministic (fixed data, mocked time), and upload traces or screenshots on failure.

17What does GITHUB_TOKEN do?Very often asked

An automatically created, short-lived token scoped to the repository for each job, used to call the GitHub API, push, comment or publish packages. Its rights come from the permissions key; events it triggers usually do not start new workflows, which prevents loops.

18What are environments and protection rules?Often asked

Environments (such as staging and production) hold their own secrets and variables and can require reviewers' approval, wait timers or allowed branches before a job referencing them runs. They give deployment history and gates.

19What security risks exist with pull_request_target?Often asked

It runs with the base repository's permissions and secrets, even for pull requests from forks. Checking out and running the fork's code in it can leak secrets or allow tampering. Use pull_request for untrusted code, and if you need pull_request_target, never run untrusted code in it.

20Why pin actions to a commit SHA?Often asked

Tags such as @v4 can be moved to different code, so a compromised action could run in your pipeline. Pinning to a full commit SHA makes it immutable; tools like Dependabot can still update the pins.

21What are self-hosted runners and their risks?Often asked

Your own machines registered to run jobs, useful for special hardware, private networks or cost. Risks: they persist between jobs, so untrusted code (especially from public forks) can compromise them; use ephemeral runners, isolation and keep them off public repositories.

22How do you build and push Docker images?Often asked

Use docker/setup-buildx-action, log in with docker/login-action (GITHUB_TOKEN for GHCR), and docker/build-push-action with layer caching (cache-from: type=gha). Tag with the commit SHA and version, and sign or attest images for provenance.

23What are larger runners and ARM runners?Often asked

GitHub-hosted runners with more CPU and memory, GPUs or ARM64 architecture, configured at the organisation level. They speed up heavy builds or test native ARM, at a higher cost per minute.

24How do you debug a failing workflow?Often asked

Read step logs, enable debug logging with the ACTIONS_STEP_DEBUG secret or by re-running with debug logging, print contexts with toJSON(github), reproduce locally with act, or add a temporary SSH debugging step on a private repository.

25How do status checks and branch protection work together?Often asked

Workflows report status checks on commits; branch protection rules or rulesets can require specific checks to pass, plus reviews, before merging. Use stable job names so required checks match.

26What is workflow_run?Often asked

A trigger that starts a workflow when another workflow completes, for example deploying after CI succeeds or posting results from a fork-safe second workflow that has write permissions.

27How do you limit workflow minutes and cost?Often asked

Cancel superseded runs with concurrency, use path filters, cache dependencies, split slow jobs, set timeout-minutes, use smaller matrices on pull requests and fuller ones nightly.

28How do you trigger a workflow manually or on a schedule?Sometimes asked

on: workflow_dispatch (with optional inputs) adds a 'Run workflow' button and API trigger. on: schedule with a cron expression runs it periodically in UTC; scheduled runs use the default branch.

29What are expressions and contexts?Sometimes asked

${{ }} expressions evaluate values from contexts such as github (event data), env, secrets, matrix, needs and steps, and functions like contains(), success() or failure() in if: conditions.

30How do you generate build provenance?Sometimes asked

Use actions/attest-build-provenance to create signed attestations linking an artifact to the workflow run that built it, which consumers can verify with the GitHub CLI.

Objective questions 30

1Where are workflow files stored?Asked almost every time
  1. A.github/workflows/Correct answer
  2. B.git/hooks/
  3. Cworkflows/ at root
  4. D.ci/

Why: GitHub reads YAML files from .github/workflows.

2How do jobs run by default?Asked almost every time
  1. AOnly on Windows
  2. BOnly on schedule
  3. CSequentially
  4. DIn parallelCorrect answer

Why: Use needs to make one wait for another.

3How do you reference a secret?Asked almost every time
  1. A{{ env.secret }}
  2. B%SECRET%
  3. C$SECRET
  4. D${{ secrets.NAME }}Correct answer

Why: The secrets context exposes stored secrets.

4What should the default token permission be?Asked almost every time
  1. Aadmin
  2. BNone ever
  3. CRead-only, granting more per jobCorrect answer
  4. Dwrite-all

Why: Least privilege.

5What is a good cache key for npm dependencies?Asked almost every time
  1. AThe branch name only
  2. BA random number
  3. CA hash of package-lock.jsonCorrect answer
  4. DThe date

Why: Changes when dependencies change.

6Which pair is needed to deploy to GitHub Pages with actions?Asked almost every time
  1. Adocker/login and push
  2. Bupload-pages-artifact and deploy-pagesCorrect answer
  3. Ccheckout and cache
  4. Dsetup-node and npm

Why: Plus pages: write permission.

7Which key makes a job wait for another?Very often asked
  1. Aafter
  2. BneedsCorrect answer
  3. Cdepends
  4. Dwait

Why: needs: build runs after the build job.

8Which permission is required for OIDC cloud login?Very often asked
  1. Aid-token: writeCorrect answer
  2. Bpackages: read
  3. Cactions: write
  4. Dcontents: write

Why: It lets the job request an OIDC token.

9Which feature cancels outdated runs on the same branch?Very often asked
  1. Amatrix
  2. Bconcurrency with cancel-in-progressCorrect answer
  3. Ctimeout-minutes
  4. Dcontinue-on-error

Why: Concurrency groups runs and can cancel old ones.

10Which action stores files for a later job?Very often asked
  1. Aactions/upload-artifactCorrect answer
  2. Bactions/setup-node
  3. Cactions/cache only
  4. Dactions/checkout

Why: Artifacts move files between jobs and keep them after the run.

11Artifacts are for…Very often asked
  1. ASpeeding up installs
  2. BStoring secrets
  3. CTriggering workflows
  4. DSharing outputs between jobs or downloading laterCorrect answer

Why: Caches are for dependencies.

12Which key stops a job that runs too long?Very often asked
  1. Atimeout-minutesCorrect answer
  2. Bmax-time
  3. Cdeadline
  4. Dstop-after

Why: Default is 360 minutes.

13Which trigger runs after another workflow completes?Very often asked
  1. Apush
  2. Bworkflow_runCorrect answer
  3. Cworkflow_dispatch
  4. Drepository_dispatch

Why: Used for chained pipelines.

14Which filter runs a workflow only when certain files change?Very often asked
  1. ApathsCorrect answer
  2. Bbranches-ignore
  3. Ctypes
  4. Dtags

Why: Saves minutes.

15Events created with GITHUB_TOKEN usually…Very often asked
  1. AFail
  2. BNeed approval
  3. CDo not trigger new workflowsCorrect answer
  4. DTrigger infinite loops

Why: Prevents recursion.

16Which trigger adds a manual 'Run workflow' button?Often asked
  1. Aschedule
  2. Brelease
  3. Cpush
  4. Dworkflow_dispatchCorrect answer

Why: workflow_dispatch allows manual runs.

17What does on: workflow_call make a workflow?Often asked
  1. AScheduled
  2. BReusable by other workflowsCorrect answer
  3. CPrivate
  4. DManual only

Why: Reusable workflows are invoked with uses:.

18Which is the safest way to reference a third-party action?Often asked
  1. AA full commit SHACorrect answer
  2. BNo version
  3. C@main
  4. D@latest

Why: SHAs cannot be moved to new code.

19Where do steps write outputs?Often asked
  1. A$GITHUB_OUTPUTCorrect answer
  2. B$HOME/output
  3. Cstdout only
  4. Dsecrets

Why: Append name=value lines to $GITHUB_OUTPUT.

20Which file defines a custom action?Often asked
  1. Aworkflow.yml
  2. Bpackage.json only
  3. CDockerfile only
  4. Daction.ymlCorrect answer

Why: Inputs, outputs and runs.

21Which cache backend does build-push-action use with GitHub?Often asked
  1. Atype=local only
  2. Btype=none
  3. Ctype=ghaCorrect answer
  4. Dtype=s3 only

Why: GitHub Actions cache.

22Which tool runs workflows locally?Often asked
  1. Agh run only
  2. Bjest
  3. Cdocker compose
  4. DactCorrect answer

Why: Approximates the runner.

23How do you print the full github context?Often asked
  1. Aprint(github)
  2. B${{ toJSON(github) }}Correct answer
  3. Cecho $github
  4. Denv.github

Why: Useful for debugging.

24Which action logs in to a container registry?Often asked
  1. Adocker/push
  2. Bdocker/login-actionCorrect answer
  3. Cactions/login
  4. Dregistry/auth

Why: Works with GHCR and others.

25Branch protection can require…Often asked
  1. AOnly commit messages
  2. BLarger runners
  3. CSelf-hosted runners
  4. DSpecific status checks to passCorrect answer

Why: Blocks merging on failure.

26Scheduled workflows use which time zone?Sometimes asked
  1. AThe runner's time zone
  2. BPST
  3. CYour local time
  4. DUTCCorrect answer

Why: Cron schedules are in UTC.

27Which job-level key limits the token's rights?Sometimes asked
  1. Aroles
  2. BpermissionsCorrect answer
  3. Caccess
  4. Dscope

Why: Set least-privilege permissions for GITHUB_TOKEN.

28Which condition runs a step only when an earlier one failed?Sometimes asked
  1. Aif: failure()Correct answer
  2. Bif: always()
  3. Cif: cancelled()
  4. Dif: success()

Why: failure() is true when a previous step failed.

29Which action creates signed build provenance?Sometimes asked
  1. Aactions/verify
  2. Bactions/attest-build-provenanceCorrect answer
  3. Cactions/sign
  4. Dsigstore/run

Why: Verified with the gh CLI.

30Which secret enables step debug logs?Sometimes asked
  1. ARUNNER_LOG
  2. BACTIONS_STEP_DEBUGCorrect answer
  3. CDEBUG_MODE
  4. DGH_VERBOSE

Why: Set to true.

Track what you have practised and search every bank in your dashboard.

Start learning