GitHub Actions Interview Questions and Answers
Real scenario-based questions, a free 15-page GitHub Actions guide, and practice exercises — free to get started.
Free GitHub Actions interview questions
A free sample — one beginner, one intermediate, one advanced — with the full answer shown below each question.
BeginnerWhat is the difference between a workflow, a job and a step in GitHub Actions?
A workflow is one automation defined in a YAML file and started by an event. It contains jobs, each of which runs on its own runner (a fresh machine), and jobs run in parallel unless you order them with `needs`. A job contains steps, which run in order on that one machine and are either a shell command (`run`) or a reusable action (`uses`).
IntermediateWhat is the difference between a reusable workflow and a composite action?
A reusable workflow (`on: workflow_call`) shares a whole pipeline or job, is called at job level with `uses:`, runs on its own runner and can define jobs, matrices and environments. A composite action shares a list of steps, is used as a step, and runs on the caller's runner inside the caller's job. Every `run` step in a composite action needs an explicit `shell:`.
AdvancedWhy is checking out a pull request's code under `pull_request_target` dangerous?
That event runs the base branch's workflow with secrets and a write-scoped token, but the PR can come from a stranger. Checking out and running the PR's code there executes their code with your secrets. Use plain `pull_request` for building fork code, and pass only results to a separate trusted `workflow_run` workflow.
Learn GitHub Actions in depth, free to start
A 15-page guide covering triggers, runners, reusable workflows, OIDC deploys, and security hardening. The first page is free for everyone.
- Getting Started: Your First Workflow
- Triggers: Events, Filters & Schedules
- Jobs, Steps, Contexts & Expressions
- Runners: Hosted, Self-Hosted & Labels
- Secrets, Variables & Environments
- Caching, Artifacts & Speed
Practice GitHub Actions for real
Find and re-run only the failed jobs of the right run with gh run rerun --failed, or rotate a leaked secret at both the repository and environment scope — all graded on real gh CLI and workflow behavior.
GitHub Actions interview FAQ
What are the most commonly asked GitHub Actions interview questions?
Interviewers usually describe a workflow that doesn't run when expected, a required check that blocks merges forever, or a security gap (an unpinned third-party action, a token with too much access) — and ask how you'd fix it, rather than asking you to define a workflow from memory.
Is GitHub Actions enough, or do I also need to know Jenkins?
Many teams use GitHub Actions exclusively now, but Jenkins is still extremely common in larger or older organizations. The underlying CI/CD concepts transfer between them — knowing one well and understanding the concepts generally is usually enough to pick up the other quickly.
What's the biggest GitHub Actions security mistake interviewers test for?
Script injection from untrusted input (like a pull request title used directly in a shell command) and using an unpinned third-party action by tag instead of a commit SHA. Both let an attacker run arbitrary code inside your workflow.
How do I practice GitHub Actions without a real repository?
Work through fix-the-workflow exercises and simulated-terminal incidents first — fixing a broken cache key, re-running only the failed jobs of the right run, rotating a leaked secret at both scopes — all graded on real GitHub Actions and gh CLI behavior.
Starting from zero? Read the step-by-step DevOps career roadmap →
The rest of the guide is waiting.
Create a free account to track your progress through the guide, pass the end-of-page quizzes, and take a full-length readiness check.