ExamworthyExamworthy
Open the appStart free

GH-200 - Author and manage workflows - Section 1.6

Read workflow and runtime metadata through contexts and evaluate expressions, distinguishing parse-time from runtime evaluation while preventing secret leakage.

Read workflow and runtime metadata through contexts such as github, env, and secrets, and evaluate expressions using the ${{ }} syntax. Distinguish which values are resolved at parse time versus runtime, and recognise the risk of exposing secrets through expression outputs.

contextsexpression syntaxgithub contextruntime evaluation

Practice question for this objective

Free sampleAuthor and manage workflowshard

A repository defines a non-sensitive configuration value named REGION through the Actions settings, alongside a masked credential named DEPLOY_KEY and a job-level environment variable named STAGE. A step must read the configured REGION value in an expression so it resolves to the value entered in settings rather than to an empty string. Which context exposes a repository configuration variable created through Actions settings?

- name: Show region
  run: echo "Deploying to ${{ <context>.REGION }}"
  • AThe vars context, because a configuration variable defined in repository Actions settings is resolved through vars.REGION and returns the entered value in expressions at run time. Correct
  • BThe env context, because REGION is read through env.REGION once any value defined in repository Actions settings is automatically merged into the env context for every job.
  • CThe secrets context, because REGION is stored under the same repository Actions settings page as credentials and is therefore resolved through secrets.REGION at run time.
  • DThe github context, because configuration variables are part of run metadata and so REGION is read through github.REGION wherever the github context is available.
Read repository configuration variables through the vars context, distinct from secrets, workflow env, and the github metadata context. Configuration variables defined through the repository or organisation Actions settings are surfaced through the dedicated vars context, so an expression such as vars.REGION resolves to the value entered in settings. The secrets context is reserved for masked credentials, the env context only carries variables declared with an env key in the workflow, and the github context exposes fixed run metadata rather than arbitrary named values. Mixing these up is why an expression returns an empty string when the wrong context is used.

Why A is correct: Configuration variables created under Actions settings are exposed through the vars context, so vars.REGION resolves to the value entered in settings, kept distinct from secrets and from workflow-declared env.

Why B is wrong: Tempting because env holds named values, but the env context only carries variables declared with an env key in the workflow file, not configuration variables set in repository settings, so env.REGION would be empty here.

Why C is wrong: Tempting because both live under Actions settings, but the secrets context only resolves masked secrets such as DEPLOY_KEY, and a plain configuration variable is never exposed through secrets.REGION.

Why D is wrong: Tempting because github carries broad run metadata, but it exposes fixed fields such as the repository and event, not arbitrary configuration variables, so github.REGION does not exist and resolves to nothing.

See more GH-200 practice questions, answers explained.

More in this domain

Back to all Author and manage workflows objectives, or the GH-200 cert hub.

Examworthy is not affiliated with or endorsed by GitHub. Original, blueprint-aligned practice material only.