A service team adds a job that calls the central reusable workflow. The run fails immediately with an error stating that the required secret REGISTRY_TOKEN was not provided. What must the calling workflow do so that the reusable workflow receives the credential?
a) Set REGISTRY_TOKEN: ${{ secrets.DEPLOY_REGISTRY_TOKEN }} in the calling job's secrets: block, so the callee resolves the name it declared.
b) Define REGISTRY_TOKEN as a repository secret in the central workflows repository, so the reusable workflow resolves it where the file lives.
c) Pass the value in the with: block as an input named REGISTRY_TOKEN, since a called workflow reads its inputs and its secrets from the same place.
d) Add secrets: inherit to the calling job, which forwards every secret the caller can already see to the workflow it invokes, without naming any of them individually.
The security team intends to keep the current policy selection. Build Engineering needs actions/checkout to run again, and needs the Terraform pipeline to call hashicorp/setup-terraform at the reviewed commit and at no other revision. Which two configuration changes achieve this?
(Choose two.)
a) Add hashicorp/setup-terraform at the reviewed commit SHA to the list of allowed actions, which accepts an entry of the form OWNER/REPOSITORY@TAG-OR-SHA alongside the patterns already listed.
b) Select Allow actions created by GitHub, which permits the actions published by the actions and github organizations.
c) Add woodgrove/* to the allowed list so that the organization's own reusable workflows keep running.
d) Switch the policy to allow all actions and reusable workflows, the only setting under which a third-party action may be pinned to a commit SHA.
In release.yml the step that calls proseware/actions-toolkit/setup-cli@v2 runs, while the very next step, which calls ./.github/actions/tag-release, cannot find its metadata file. Why does the second step fail when the first one succeeds?
a) A local action must carry a version tag before a workflow can reference it, exactly as setup-cli@v2 does.
b) A relative uses path resolves against the repository's default branch, and tag-release has not been merged there yet.
c) Paths under .github/actions are reserved for reusable workflows, so a local action has to live outside .github.
d) The workflow never ran actions/checkout, so the path it resolves is empty on the runner.
04. As a developer, you need to use GitHub Actions to deploy a microservice that requires runtime access to a secure token. This token is used by a variety of other microservices managed by different teams in different repos. To minimize management overhead and ensure the token is secure, which mechanisms should you use to store and access the token?
(Choose two.)
a) Store the token in a configuration file in a private repository. Use GitHub Actions to deploy the configuration file to the runtime environment.
b) Store the token as a GitHub encrypted secret in the same repo as the code. During deployment, use GitHub Actions to store the secret in an environment variable that can be accessed at runtime.
c) Store the token as a GitHub encrypted secret in the same repo as the code. Create a reusable custom GitHub Action to access the token by the microservice at runtime.
d) Use a corporate non-GitHub secret store (e.g., HashiCorp Vault) to store the token. During deployment, use GitHub Actions to store the secret in an environment variable that can be accessed at runtime.
e) Store the token as an organizational-level encrypted secret in GitHub. During deployment, use GitHub Actions to store the secret in an environment variable that can be accessed at runtime.
05. Which of the following commands will set the $FOO environment variable within a script, so that it may be used in subsequent workflow job steps?
a) run: echo ${{ $FOO=bar }}
b) run: echo "FOO=bar" >> $GITHUB_ENV
c) run: export FOO=bar
d) run: echo "::set-env name=FOO::bar"
06. How is a self-hosted runner different from a GitHub-hosted runner?
a) Self-hosted runners give you a clean new machine for every job that is run.
b) Self-hosted runners run only GitHub-provided workflows.
c) Self-hosted runners are managed by you, not GitHub.
d) Self-hosted runners only run locally.
The payments-api integration job declares the postgres service exactly as the migration notes describe, and its steps run on the runner itself rather than inside a job container. Every test aborts with a connection refused at localhost:5432, although the service container itself starts and logs that it is ready to accept connections.
What change makes the database reachable at the address the tests already use?
a) Reference the database as host postgres instead of localhost, because a service container is reachable on the Docker network under the label the workflow gives it, which removes any need to publish a port.
b) Add a container: block to the job, which places the steps on the same Docker network as the service and lets the existing localhost:5432 connection resolve to the database without further change.
c) Give the service an options: health check so that the job waits for PostgreSQL to accept connections before the first test starts.
d) Add ports: 5432:5432 to the postgres service, because a job on the runner reaches a service only through a port published to the host.
The five toolchain-and-license steps that open package, sign and publish must be written once and then used at the start of all three jobs, each of which continues with its own work afterwards. Which two changes accomplish this?
(Choose two.)
a) Reference that action from each job's steps: list with uses:, which runs it as a single step of the job.
b) Define the five steps as a composite action stored in the atlas repository, with its runs: block set to using: composite.
c) Declare needs: on sign and publish so that they inherit the steps already completed by package.
d) Publish the five steps as a starter workflow in the organization's .github repository and adapt a copy of it inside each of the three jobs.
e) Move the five steps into a reusable workflow and call it from each of the three jobs with uses: at job level, so that one central definition serves all of them.
09. You need to create a custom GitHub Action in Ruby. Which action type would you choose?
a) JavaScript action
b) Reusable workflow
c) Docker container action
d) Composite action
10. Reference Scenario: GH-200 Case 3 — Litware multi-organization enterprise governance
The publish job runs with environment: production and reads secrets.ARTIFACT_FEED_TOKEN, which is defined at three levels with three different values. Which value does the job receive?
a) The value held in the production environment, because secrets resolve from the narrowest scope outward and an environment is narrower than the other two.
b) No value; the run stops with an error reporting that the same secret name is defined at more than one level.
c) The value held in the litware-clinical organization, because organization secrets are inherited by every repository beneath them and applied last.
d) The value held in the batch-report repository, because repository settings override the organization above them and the environment below them.