Author and Maintain Actions Study Guide — GH-200

Author and Maintain Actions

This domain tests your ability to create, configure, publish, and secure custom GitHub Actions of all three types: Docker container, JavaScript, and composite. It accounts for 25% of the exam, making it the highest-weighted single domain. Expect questions on action.yml metadata syntax, toolkit package usage, Dockerfile conventions, composite step wiring, versioning strategies, security hardening, and OIDC token acquisition.

Action Types: Docker Container, JavaScript, and Composite

GitHub Actions supports three action types, each suited to different use cases. Understanding when to use each type is a core exam competency.

Common traps:

• Docker container actions cannot run on Windows or macOS hosted runners — exam questions may present a cross-platform requirement to disqualify Docker.
• JavaScript actions require node20 (or node16) in using, not just javascript.
• Composite actions are not the same as reusable workflows; they live in action.yml and are used as a single step.
• You cannot call another composite action from within a composite action in all contexts — nested composites are supported but have depth limits.

Worked scenario: A team needs an action that runs a Ruby script with specific gem dependencies, must work on self-hosted Linux runners, and should not require gems pre-installed. → Docker container action (bundles Ruby + gems in the image; Linux-only is acceptable on self-hosted Linux runners).

action.yml Metadata: name, description, inputs, outputs, runs

Every action requires an action.yml (or action.yaml) file at the root of the repository. This file defines the action's interface and runtime.

name: 'My Action'
description: 'Short description shown on Marketplace'
author: 'Your Name'

inputs:
  username:
    description: 'The username to greet'
    required: true
    default: 'World'
  token:
    description: 'GitHub token'
    required: false

outputs:
  greeting:
    description: 'The greeting string produced'
    value: ${{ steps.greet.outputs.greeting }}   # composite only

runs:
  using: 'node20'
  main: 'dist/index.js'
  pre: 'dist/setup.js'       # optional: runs before main
  post: 'dist/cleanup.js'    # optional: runs after main
  pre-if: 'success()'
  post-if: 'always()'

Key metadata rules

Common traps:

• Forgetting value: in composite action outputs causes the output to be empty.
• required: true with no default means the workflow will fail if the input is not passed — not silently ignored.
• pre and post hooks are JavaScript-only, not available for Docker or composite.
• branding is optional but questions may ask if it is required for publishing — it is not required.