ExamworthyExamworthy
Open the appStart free

GH-200 - Author and maintain actions - Section 3.1

Select and implement the appropriate action type among JavaScript, Docker container and composite actions, accounting for immutable action behaviour.

Select between JavaScript actions, Docker container actions, and composite actions based on runtime requirements and portability needs. Recognise that published action versions are immutable and understand the implications for consumers pinning to a tag.

JavaScript actionsDocker container actionscomposite actionsimmutable actions

Practice question for this objective

Free sampleAuthor and maintain actionsmedium

A security lead is explaining why consuming an action published as an immutable release improves supply-chain safety, and how maintainers ship changes under that scheme. Which two statements about immutable actions are accurate? Select TWO.

  • AA published immutable version is permanently bound to its commit, so its referenced contents cannot be altered, overwritten, or repointed afterwards. Correct
  • BA maintainer delivers a bug fix by publishing a new version from the corrected commit and having consumers update their uses reference to it. Correct
  • CA maintainer can force-push the same version tag onto a corrected commit, because immutability protects only the release notes and the attached assets.
  • DImmutability lets a consumer safely reference a moving major tag, because the runner resolves that tag to a fixed commit that can never change.
Understand that an immutable action version is locked to its commit, so fixes ship as new versions consumers reference instead. An immutable action release permanently binds a published version to a specific commit so its contents cannot be edited, overwritten, or repointed, which is what protects consumers from silent supply-chain changes. The supported way to deliver a fix is to publish a new version from the corrected commit and have consumers update their uses reference, since force-pushing the same version is rejected and a floating major tag still moves between releases.

Why A is correct: Immutability binds each released version to a fixed commit, so consumers are protected because the referenced code cannot be silently changed after publication.

Why B is correct: Because the existing version is locked, the supported path to ship a fix is to release a new version and have consumers point their uses reference at the newer tag.

Why C is wrong: Tempting since tags are normally movable, but immutability locks the version to its commit, so a force-push to the same published version is rejected rather than accepted.

Why D is wrong: Tempting because major tags aid readability, but a moving major tag still advances across releases, so it is the per-release immutable version, not the floating tag, that is fixed.

See more GH-200 practice questions, answers explained.

More in this domain

Back to all Author and maintain actions objectives, or the GH-200 cert hub.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.