Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
Certification exams reward two kinds of knowledge, and only one of them is understanding. The other is a small set of arbitrary values — defaults, limits, precedence orders — that no amount of reasoning will recover if you never learned them. Everything below falls into that second category: the numbers GitHub chose, the order in which scopes win, and the pairs of features whose names suggest they are interchangeable when they are not. Each entry is developed properly somewhere in Phases 1 through 6; this is the compressed form for the last hour before the exam, when re-reading a phase is no longer practical and you simply need the values to be present in working memory.
🎯 Defaults and Numbers
| Fact | Value |
|---|
fail-fast default | true (one failure cancels the matrix) |
| Matrix job cap | 256 jobs per workflow run |
| Job timeout default | 6 hours; workflow run max 35 days |
| Artifact/log retention default | 90 days (public repos; configurable) |
| Cache limit / eviction | 10 GB per repository; removed after 7 idle days |
| Secret size limit | 48 KB |
| Secret count limits | 1,000 org · 100 repo · 100 environment |
workflow_dispatch inputs | Maximum 25 |
| Reusable workflow nesting | 10 levels; max 50 referenced |
| Composite action nesting | 10 levels |
| Required reviewers | Up to 6; run waits up to 30 days |
| Scheduled workflow auto-disable | After 60 days of repository inactivity |
| Minimum cron interval | 5 minutes (UTC, default branch only) |
| Passing score | 700 / 1000 |
🎯 Precedence and Scope
| Question | Answer |
|---|
| Secret / variable precedence | Environment → Repository → Organization |
env: precedence | Step → Job → Workflow |
| Policy layering | Enterprise → Organization → Repository (inner may only restrict) |
| Missing secret behavior | Empty string, no error raised |
| Fork PR secrets | Not delivered; token is read-only |
Declaring permissions: | Replaces defaults entirely — unlisted scopes are revoked |
🎯 Confusable Pairs
| A | B | Discriminator |
|---|
pull_request | pull_request_target | Target runs in the base context with secrets and a write token |
$GITHUB_ENV | $GITHUB_OUTPUT | Env var for later steps vs. step output for steps.<id>.outputs |
| Cache | Artifact | Evictable speed-up vs. retained, downloadable, billed |
| Starter workflow | Reusable workflow | Copied at creation (drifts) vs. resolved on every run |
| Composite action | Reusable workflow | Steps inside the caller's job (no runs-on) vs. its own jobs |
| Disable | Delete | Reversible state change vs. removing the file (history survives both) |
GITHUB_TOKEN | PAT | Ephemeral, repo-scoped, bot identity vs. long-lived, user-scoped |
| Runner labels | Runner groups | What matches the job vs. who may schedule on the fleet |
| GitHub-hosted | Self-hosted | Ephemeral VM vs. persistent machine (⚠️ not for public repos) |
Tag pin @v1.2.3 | SHA pin @a1b2c3… | Movable pointer vs. immutable bytes |
🎯 Syntax You Must Recognize
on:
workflow_dispatch:
inputs:
env: { type: choice, options: [dev, prod] }
workflow_call:
inputs: { env: { type: string } }
secrets: { token: { required: true } }
permissions: { contents: read, id-token: write }
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
call:
uses: org/repo/.github/workflows/ci.yml@v2
secrets: inherit
build:
strategy:
fail-fast: false
matrix: { os: [ubuntu-latest], node: [20, 22] }
steps:
- run: echo "v=1.0" >> "$GITHUB_OUTPUT"
- env:
TITLE: ${{ github.event.pull_request.title }}
run: echo "$TITLE"
Remember: Event → workflow → job → fresh runner → steps. Nothing crosses a job boundary unless you send it deliberately.
