GitHub · GH-200
Environments, trusted actions, and the GITHUB_TOKEN
GH-200 · Lesson 14 of 16 · 2:13:33
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the GH-200 exam (GitHub Actions). In this lesson: environment protection rules and approval gates, choosing trustworthy actions, mitigating script injection with environment variables and action inputs, and the GITHUB_TOKEN lifecycle and permissions compared with personal access tokens and GitHub App tokens. Includes three original practice questions.
Preview the topics
- Contoso’s release engineer starts the production deployment, is also one of its required reviewers, and approves the run they started. What setting prevents this?
- A Contoso step echoes the issue title by putting its expression directly in the run script, and a reviewer flags it. What’s the safest fix?
- A Contoso workflow pushes a version bump commit with the GITHUB_TOKEN, and the team expects that push to start the CI workflow, which never runs. Why?