GH-200 GitHub Actions

Alex at NorthPeak Robotics owns the trigger strategy for FleetBoard CI, nightly scans, and manual deploys. This lesson walks the six trigger families, typed workflow_dispatch inputs, workflow_call reusable workflow contracts, filter plus permissions discipline, then the shape of a workflow run itself: parallel jobs, needs: dependencies, matrix strategies, service containers, and runner image lifecycle. By the end you will be able to pick the right trigger for a workload, scope it safely, design the job graph that runs on it, and reason about service containers plus runner image choices.

Alex at NorthPeak Robotics covers six Jan 2026 blueprint primitives for FleetBoard workflows: the thirteen contexts and when each is populated, static vs runtime ${{ }} evaluation with secret-leak defences, the four-hop output contract (step → job → workflow → caller), actions/cache with hit vs miss vs partial restore, artifacts plus Markdown step summaries plus environment protection gates, and YAML anchors plus SHA-pinning third-party actions under Immutable Actions. By the end of this lesson you will be able to pick the right primitive for every build output, gate deploys with environment reviewers, and ship a supply-chain-hardened workflow.

Alex Kim at NorthPeak Robotics inherits a FleetBoard pipeline from Michael and must consume what someone else wrote AND author custom actions. This Exam Domain 2+3 lesson covers reading workflow logs with YAML anchor expansion, identifying failing matrix axes and selective reruns, pulling artifacts and logs via UI/CLI/REST, differentiating starter workflows vs reusable workflows vs composite actions, consuming reusable workflows plus non-public organization starter templates, the three action types (JavaScript, Docker, composite), writing a Marketplace-grade action.yml with current workflow commands, distribution across public, private, and Marketplace channels with semantic versioning plus sliding major tags, and the Jan 2026 Immutable Actions rollout plus SHA pinning plus Dependabot governance. By the end of this lesson you will be able to troubleshoot, consume, author, publish, and version a production-grade action.

Govern GitHub Actions at organization scale through six coordinated levers: enterprise→org→repo allowlists with the January 2026 immutable-action layer; GitHub-hosted runner image + size + minute-multiplier choices; self-hosted runner groups with ephemeral mode and allows_public_repositories gating; the org .github catalog of starter workflows, reusable workflows, composite actions, and required workflows; secrets and variables at three scopes with silent most-specific-wins precedence and environments-as-gate; and programmatic management via the Actions REST API with the libsodium sealed-box write contract and retention PATCHes. Teaching lesson with six scored multiple-choice assessments — five of six correct to complete.

Alex at NorthPeak Robotics hardens FleetBoard CI for a SOC 2 audit while Michael tunes a tripled Actions bill. This Exam Domain 5 lesson covers the workflow boundary (script injection mitigation, scoped GITHUB_TOKEN permissions, environment protections), OIDC federation to Azure / AWS / GCP replacing stored secrets, supply-chain hardening with SHA pinning plus SLSA v1.0 attestations, and performance tuning via caching, retention, matrix sizing, and runner sizing. By the end of this lesson you will be able to harden and optimize a production pipeline.

Alex at NorthPeak Robotics has nine pairs of GitHub Actions parts on the bench and needs to synthesize them for Michael's production sign-off. This capstone briefing names the five anchors of a production pipeline (triggers, CI gates, build and attest, OIDC-federated deploy, observability), cross-walks every capability back to the GH-200 exam domains, and lays out the eight acceptance criteria the FleetBoard pipeline must satisfy. By the end of this lesson you will be able to draw the FleetBoard pipeline topology from memory before writing any YAML.