Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about GitHub Actions, the GitHub certification for people who build and run CI/CD workflows, as of October 2026. This guide covers the GH-200 exam, the five domains and their weights, the format and passing score, what the January 2026 outline asks for, the two-year validity, and the roles it fits.
GitHub Actions, earned by passing exam GH-200, is the GitHub certification for workflow automation. It proves you can write, debug and secure the YAML workflows that build, test and deploy code on GitHub, publish actions of your own, and run Actions across an organization or an enterprise.
The credential is GitHub-branded, but Microsoft administers it. You register with a Microsoft Learn account, schedule through Pearson VUE, and the certification record sits in your Microsoft Learn profile. The certificate itself says GitHub Actions, not Microsoft Certified.
Microsoft rates GH-200 intermediate and writes it for DevOps engineers, software developers and IT professionals who already work with Actions. There’s no prerequisite certification. The skills measured outline is current as of January 2026, the release Microsoft says changed the exam significantly, and it’s published on Microsoft Learn.
Triggers, inputs, jobs, matrices, service containers, YAML anchors, contexts, caching and outputs. 20 to 25%.
Logs and run history, matrix failures, reusable and starter workflows. 15 to 20%.
JavaScript, Docker and composite actions, metadata, Marketplace publishing, versioning. 15 to 20%.
Use policies, runner groups, hosted and self-hosted runners, IP allow lists, secrets and variables. 20 to 25%.
Script injection, GITHUB_TOKEN scopes, OIDC, SHA pinning, attestations and cost tuning. 10 to 15%.
Four things that set GitHub Actions apart from the other automation and DevOps credentials you could sit in 2026.
GitHub runs six certification exams, and Actions turns up in several of them. GH-900 introduces it, GH-100 gives it a 20 to 25 percent domain, and Microsoft’s AZ-400 lists it beside Azure Pipelines. GH-200 is the one where every objective is about Actions, from the first trigger to enterprise runner fleets and artifact attestations.
Microsoft’s audience profile asks for expertise in automating software development workflows and managing Actions at scale, plus familiarity with CI/CD, GitHub Packages and third-party integrations. That’s a working engineer’s exam. If you’ve never diagnosed a failed run from its logs, GH-900 is the better first step.
The current outline gets specific, from YAML anchors, service containers and immutable actions to OIDC federation, artifact attestations and the move of windows-latest to Windows Server 2025. Prep material built on an older outline may skip some of that. Our guide to the 2026 GitHub certification track covers where GH-200 candidates lose points.
GitHub Actions is valid for two years. GitHub is moving its certifications onto Microsoft’s recertification process so holders can renew without retaking the full exam, and certifications that expire before that process is live are being extended by six months. It isn’t a DoD 8140 credential and doesn’t appear on the Approved Qualifications Matrix. The current matrix is published at the DoD Cyber Exchange.
Its weight is practical instead. Any team that builds, tests or deploys from GitHub can do it with Actions, and GH-200 is the credential that shows you can build and secure those pipelines rather than copy one from a blog post.
Everything you need to know about the certification, the GH-200 exam, and what happens after you pass, as of October 2026.
GH-200 covers one system in depth. The next exam depends on what else you’re accountable for, and these three build most directly on the Actions material.
The administration credential, and the one with the most Actions overlap. GH-100 gives Manage GitHub Actions a 20 to 25 percent domain, and its July 2026 outline also covers identities and access, the enterprise environment, secure development and compliance, and usage monitoring. Its study guide now carries the title GitHub Enterprise Administrator.
The security credential for the code your workflows build. Its July 2026 outline has six skill areas, among them Secret Protection, supply chain security, Code Security with CodeQL, security operations and suite administration. The SHA pinning, token and attestation objectives in GH-200 are the bridge.
Microsoft’s DevOps credential, for teams whose pipelines deploy to Azure. AZ-400 puts build and release pipelines at 50 to 55 percent and covers GitHub Actions alongside Azure Pipelines, but the Expert title also needs AZ-104 or the Azure Developer Associate. GH-200 goes deeper on Actions, so the two stack well.
GH-200 sits at the role-based tier of the GitHub track. GH-900 is optional groundwork below it, and from here the track branches into enterprise administration, security and AI-assisted development.
The GitHub groundwork
Automate the platform
Enterprise, security or AI
Two questions to answer before you commit: can you sit it, and should you pursue GH-200 specifically. Here’s a straight answer to both.
Microsoft expects intermediate Actions experience.
GH-200 has no prerequisite exam and no formal experience requirement, so anyone can register. Create a Microsoft Learn account with a personal Microsoft account rather than a work account, because Microsoft warns that records tied to an organizational account are lost if you leave. Then schedule through Pearson VUE, online or at a test center. GH-900 helps but isn’t required.
A fifth of the exam lives in enterprise settings.
Manage GitHub Actions for the enterprise carries 20 to 25 percent, and runner groups, IP allow lists, organization secrets and use policies don’t exist in a personal account. Get access to an organization where you can register a self-hosted runner, scope secrets and set an allow list, and work there until the settings feel routine. Microsoft Learn isn’t available as a lookup during GitHub exams, so the details have to be in your head.
GH-200 backs up a role rather than qualifying you for one on its own. These are the six roles where writing, running or securing GitHub Actions workflows is a regular part of the week.
Owns the build, test and deploy path from commit to production. GH-200 covers the triggers, matrices, caching, environments and approval gates that path is built from, and Microsoft Learn lists DevOps Engineer among the exam’s target roles.
Builds the shared tooling other teams ship through. Reusable workflows, starter templates, runner groups and organization policies are the GH-200 objectives that turn one good pipeline into a standard every repository can use.
Writes the workflow files that live next to the code and the custom actions that package repeated steps. GH-200 checks the JavaScript, Docker and composite action types, action metadata and Marketplace publishing that most developers pick up piecemeal.
Versions artifacts, sets retention and controls what reaches each environment. GH-200 covers outputs, job summaries, environment protections and artifact attestations, the evidence a release team needs when someone asks exactly what shipped.
Secures the automation itself. Script injection, least-privilege GITHUB_TOKEN permissions, OIDC in place of stored cloud secrets and SHA pinning all sit in GH-200, and GH-500 GitHub Advanced Security is the natural next exam.
Runs the GitHub account other teams depend on, including its runners, secrets and Actions policies. GH-200 covers the enterprise side of Actions in depth, and the GH-100 GitHub Administration exam picks up identity, governance and the rest of the platform.
GH-200 is the automation exam in the GitHub track. Here’s how it lines up against the fundamentals exam below it, the administration exam that shares its Actions domain, and Microsoft’s DevOps Engineer Expert exam.
| GitHub Actions (GH-200) | GitHub Foundations (GH-900) | GitHub Administration (GH-100) | DevOps Engineer Expert (AZ-400) | |
|---|---|---|---|---|
| Issuer | GitHub, administered by Microsoft | GitHub, administered by Microsoft | GitHub, administered by Microsoft | Microsoft |
| Level | Intermediate | Fundamentals | Intermediate | Expert |
| Focus | CI/CD with GitHub Actions | Working in GitHub | Running a GitHub enterprise | DevOps across Azure and GitHub |
| Current Outline | January 2026 | January 2026 | July 2026 | July 27, 2026 |
| Prerequisite | None | None | None | AZ-104 or Azure Developer Associate |
| Exam Time | 100 min | 100 min | 100 min | 100 or 120 min |
| Passing Score | 700 of 1000 | 700 of 1000 | 700 of 1000 | 700 of 1000 |
| Cost (US) | $99 | $99 | $99 | $165 |
| Validity | 2 years | Does not expire | 2 years | 1 year, free online renewal |
| Best For | Developers and DevOps engineers who own pipelines | New GitHub users and non-developer roles | Enterprise and organization administrators | DevOps engineers whose pipelines deploy to Azure |
Microsoft prices exams by the country where you test, so fees vary outside the United States. AZ-400 runs 100 minutes, or 120 if your sitting includes labs, and Microsoft confirms the time when you register. None of the three GitHub certifications appear on the DoD 8140 Matrix. The two-year GitHub credentials are moving onto Microsoft’s recertification process, so check your expiration date in your Microsoft Learn profile.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
As a Microsoft training partner, we teach GH-200 inside our GitHub Enterprise Certification Track, a five-day live boot camp, online or in person, that covers four exams: GH-100, GH-200, GH-300 and GH-500. Actions gets its own day, labs run in a hosted GitHub Enterprise organization with Actions runners enabled, and a timed GH-200 practice exam comes on day five. Official Microsoft Courseware, all four exam vouchers, a free retake and 180 days of instructor help are included.
The full GitHub track, the Microsoft catalog around AZ-400, and how to study from an outline and get through exam day.
All six GitHub exams as of September 2026, the GH-200 objectives that separate candidates (reuse models, expressions, GITHUB_TOKEN, OIDC, SHA pinning and YAML anchors), and the order that makes sense for each role.
The full Microsoft catalog as updated in September 2026, including where AZ-400 DevOps Engineer Expert sits and why it now pairs with AZ-104 after AZ-204 retired.
The Microsoft exams people are actually sitting as of September 2026, AZ-400 for DevOps among them, with what each one costs and who it fits.
CompTIA’s vendor-neutral automation exam went live on June 2, 2026 and names Jenkins and GitHub Actions in its Continuous Integration domain. Worth a look if your pipelines span more than one CI tool.
How to read an exam outline as a specification rather than a table of contents. Microsoft publishes the GH-200 version as a study guide on Microsoft Learn, and its verbs tell you how deep each objective goes.
ID checks, breaks, remote proctoring and retake windows compared across vendors, including how Microsoft handles a Pearson VUE technical failure and why the same-day case number matters.
For platform engineers whose workflows deploy to Kubernetes. The three hands-on Linux Foundation exams, what each one tests, and the order worth taking them in.
The GH-200 exam is organized into five domains. Authoring workflows and managing Actions for the enterprise tie for the most weight at 20 to 25 percent each. Securing automation is the lightest at 10 to 15 percent, though secret handling also turns up in the workflow and enterprise domains. Click any domain for what it covers.
Triggers for scheduled, manual, webhook and repository events, workflow_dispatch inputs, and passing inputs and secrets to reusable workflows through workflow_call. Also covers jobs, steps, conditions and dependencies, service containers, strategy and matrix, YAML anchors and aliases, contexts and ${{ }} expressions, caching and artifacts, outputs through GITHUB_ENV and GITHUB_OUTPUT, and job summaries. Tied for the heaviest domain.
Reading a workflow you didn’t write. Identifying triggers and effects from configuration and logs, diagnosing failed runs from run history, expanding YAML anchors, and matching matrix job names to their axes so you can rerun one failed variant. Also covers finding logs and artifacts in the UI and through the API, organization and reusable workflows, starter workflows, and the difference between disabling and deleting a workflow.
Building your own actions. The three types (JavaScript, Docker and composite), the required files, directory structure and metadata, and workflow commands inside an action. Also covers immutable actions and what they mean for version pinning, troubleshooting action errors, choosing public, private or Marketplace distribution, publishing to the GitHub Marketplace, and versioning and release strategy.
Running Actions for many teams at once. Reusable components and templates, controlling access to actions and workflows across the enterprise, and organization use policies. Also covers GitHub-hosted and self-hosted runners, runner groups, IP allow lists and networking, the preinstalled software on hosted runner images, and encrypted secrets and variables at the organization, repository and environment levels, including managing them through the REST API. Tied for the heaviest domain.
Environment protections and approval gates, choosing trustworthy Marketplace actions, mitigating script injection, the GITHUB_TOKEN lifecycle and granular permissions compared with a personal access token, and OIDC federation with cloud providers. Also covers pinning third-party actions to full commit SHAs, enforcing allow and deny lists, generating and verifying artifact attestations, and tuning caching, retention and scaling for cost and speed.
Domains and weights reflect the Microsoft Learn GH-200 study guide, skills measured as of January 2026, the release Microsoft says changed the exam significantly. Microsoft notes that most questions cover generally available features, though commonly used preview features can appear. Confirm the current outline on Microsoft Learn before scheduling.
The questions candidates ask most often when researching the GitHub Actions certification.
GitHub Actions, earned by passing exam GH-200, is the intermediate certification in the GitHub track for workflow automation. It covers authoring and managing workflows, consuming and troubleshooting them, building custom actions, managing Actions for an enterprise, and securing and optimizing automation. Microsoft writes it for DevOps engineers, software developers and IT professionals who already use GitHub Actions.
Microsoft administers it, but the credential stays GitHub-branded. You register with a Microsoft Learn account, schedule through Pearson VUE, and the certification appears in your Microsoft Learn profile, but the title is GitHub Actions rather than a Microsoft Certified credential. Training Camp teaches it as a Microsoft training partner using Official Microsoft Courseware.
No. GH-200 has no prerequisite certification and no formal experience requirement, so anyone can register. Microsoft rates it intermediate, though, and expects expertise in automating workflows with GitHub Actions plus familiarity with CI/CD, GitHub Packages and third-party integrations. GH-900 GitHub Foundations is useful groundwork but isn’t required.
The five domains are Author and manage workflows (20 to 25 percent), Consume and troubleshoot workflows (15 to 20 percent), Author and maintain actions (15 to 20 percent), Manage GitHub Actions for the enterprise (20 to 25 percent), and Secure and optimize automation (10 to 15 percent). Workflow authoring and enterprise management tie for the most weight.
Microsoft does not publish a question count for GH-200. You have 100 minutes, the exam is proctored, and Microsoft says it may include interactive components. Microsoft Learn isn’t available as a reference during GitHub exams, unlike Microsoft’s own associate and expert exams, so plan to answer from what you know.
You need 700 on a scale of 1 to 1,000. Microsoft uses scaled scoring, so 700 doesn’t mean 70 percent correct, and the score reflects question difficulty as well as the number you got right. If you fail a first attempt, you can retake after 24 hours, and later attempts carry longer waits under Microsoft’s retake policy.
The GH-200 exam costs $99 USD in the United States as of October 2026, scheduled through Pearson VUE. Microsoft prices by the country where you test, so check the exam page for your region. Training Camp’s GitHub Enterprise Certification Track boot camp includes vouchers for GH-200, GH-100, GH-300 and GH-500 in the program fee, along with a free retake.
Microsoft’s change log says the exam changed significantly in January 2026, with objectives added, removed and moved, and all of them reworded. The current outline names YAML anchors and aliases, service containers, workflow_dispatch inputs, job summaries, immutable actions and SHA pinning, OIDC federation, artifact attestations, and runner image changes such as the Ubuntu 20.04 deprecation. Confirm the skills measured date on any study material before you rely on it.
No. GitHub certifications don’t appear on the DoD 8140 Approved Qualifications Matrix, so GH-200 on its own won’t satisfy a cyber-coded position requirement. Its value is practical. It shows you can build, debug and secure the pipelines a GitHub team ships through. See the full DoD 8140 work role paths.
Yes. GitHub Actions is valid for two years. GitHub is moving its certifications onto Microsoft’s recertification process, which will let holders renew without retaking the full exam, and certifications that expire before that process is available are being extended by six months. If yours has already lapsed, GitHub says to contact learn@github.com for one exam voucher toward your first renewal attempt.
GH-200 fits DevOps engineers, platform engineers, software developers who own their own pipelines, build and release engineers, DevSecOps engineers, and the administrators who run Actions for a GitHub enterprise. It supports a role you already hold or are moving into rather than qualifying you for one on its own.
Take GH-200 if your pipelines run on GitHub Actions and you want the deeper Actions credential. AZ-400 is Microsoft’s DevOps Engineer Expert exam. It covers GitHub Actions alongside Azure Pipelines and Azure infrastructure, costs $165 in the United States, and grants the Expert title only with AZ-104 or the Azure Developer Associate. For pipelines that deploy to Azure, the two stack well.
Pick by the system you’re accountable for next. Enterprise administrators take GH-100, which gives Actions its own 20 to 25 percent domain. Application security engineers take GH-500 Advanced Security. Teams rolling out Copilot go to GH-300, and anyone running AI agents inside a pipeline should look at GH-600. Training Camp’s GitHub Enterprise Certification Track covers GH-100, GH-200, GH-300 and GH-500 in one five-day program.
For anyone who writes or runs GitHub workflows for a team, yes. It costs $99, the January 2026 outline covers current practice such as OIDC, SHA pinning and artifact attestations, and it lines up with the Actions objectives in GH-100 and AZ-400. If you only trigger workflows someone else wrote, start with GH-900 or wait until you’ve built and debugged a few pipelines of your own.
If you’re weighing the certification, planning the GitHub track for yourself, or arranging GitHub Actions training for a team, tell us where you are and we’ll help you map out the right path.