GH-200 - Author and maintain actions (18% of the exam) - Section 3.1

Select and implement the appropriate action type among JavaScript, Docker container and composite actions, accounting for immutable action behaviour.

Select between JavaScript actions, Docker container actions, and composite actions based on runtime requirements and portability needs. Recognise that published action versions are immutable and understand the implications for consumers pinning to a tag.

JavaScript actionsDocker container actionscomposite actionsimmutable actions

Practice question for this objective

Free sampleAuthor and maintain actionsmedium

A security lead is explaining why consuming an action published as an immutable release improves supply-chain safety, and how maintainers ship changes under that scheme. Which two statements about immutable actions are accurate? Select TWO.

AA published immutable version is permanently bound to its commit, so its referenced contents cannot be altered, overwritten, or repointed afterwards. Correct
BA maintainer delivers a bug fix by publishing a new version from the corrected commit and having consumers update their uses reference to it. Correct
CA maintainer can force-push the same version tag onto a corrected commit, because immutability protects only the release notes and the attached assets.
DImmutability lets a consumer safely reference a moving major tag, because the runner resolves that tag to a fixed commit that can never change.

Understand that an immutable action version is locked to its commit, so fixes ship as new versions consumers reference instead. An immutable action release permanently binds a published version to a specific commit so its contents cannot be edited, overwritten, or repointed, which is what protects consumers from silent supply-chain changes. The supported way to deliver a fix is to publish a new version from the corrected commit and have consumers update their uses reference, since force-pushing the same version is rejected and a floating major tag still moves between releases.

Why A is correct: Immutability binds each released version to a fixed commit, so consumers are protected because the referenced code cannot be silently changed after publication.

Why B is correct: Because the existing version is locked, the supported path to ship a fix is to release a new version and have consumers point their uses reference at the newer tag.

Why C is wrong: Tempting since tags are normally movable, but immutability locks the version to its commit, so a force-push to the same published version is rejected rather than accepted.

Why D is wrong: Tempting because major tags aid readability, but a moving major tag still advances across releases, so it is the per-release immutable version, not the floating tag, that is fixed.

See more GH-200 practice questions, answers explained.

Exam traps in Author and maintain actions

Answers that look right on this material and are not. Each one is a distractor from a different question in the GH-200 bank for this domain.

A composite action, because listing run steps under using: composite lets the maintainer ship the specialised tool and its system dependencies inside the action package for use on Linux runners.
Why it is wrong: Tempting because composite actions group setup steps, but they install tools at runtime on the host rather than packaging a self-contained environment, so the dependency problem remains.
Append a step that writes failed to GITHUB_STEP_SUMMARY after the deploy command, because the runner reads that summary file and converts a failed entry into a failing step result.
Why it is wrong: Tempting because the step summary is a real reporting file, but it only adds markdown to the run summary page and never influences whether the runner marks the step as passed or failed.
It must be packaged into a container image first, so the runner pulls that image before each invocation regardless of the host operating system.
Why it is wrong: Tempting because images feel portable, but image packaging describes a Docker container action, not a JavaScript action, which runs from committed JavaScript on the host.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.