GitHub Actions is now a standard topic in QA automation, SDET and DevOps interviews. This guide covers fundamentals, security, intermediate features, pipeline design and troubleshooting scenarios, with concise model answers.
๐ What You’ll Learn: GitHub Actions fundamentals, triggers, secrets, GITHUB_TOKEN and security, environments, matrices, cache vs artifacts, concurrency, reusable workflows vs composite actions, pipeline design for Playwright, safe deployment, self-hosted runners, and troubleshooting scenarios.
๐ฏ How to Use These Questions
GitHub Actions now appears in most QA automation, SDET and DevOps interviews. The questions below go from fundamentals to advanced design and troubleshooting. Practise answering out loud, and back each answer with something you built, ideally the CI/CD pipeline project.
๐ข Fundamentals
๐ค What is GitHub Actions?
GitHub’s built-in CI/CD and automation platform. Workflows defined in YAML in .github/workflows/ run on events such as pushes, pull requests or schedules, on GitHub-hosted or self-hosted runners (fundamentals).
๐ค Explain workflow, job, step, action and runner.
A workflow is the YAML file; it contains jobs; each job runs on a runner (a VM or container) and executes steps in order; a step runs a shell command (run) or a reusable action (uses).
๐ค How do jobs run: in parallel or in sequence?
In parallel by default. Use needs to create dependencies and pass outputs between jobs (workflow syntax).
๐ค What is the difference between uses and run?
uses calls an action (from the Marketplace, another repository or a local path); run executes shell commands on the runner.
๐ค What triggers have you used?
push and pull_request with branch and path filters, schedule for nightly regression, workflow_dispatch with inputs for manual runs, workflow_call for reusable workflows and release or tag pushes for deployments.
๐ Secrets, Variables and Security
๐ค How do you handle secrets in GitHub Actions?
Store them as repository, environment or organisation secrets, reference them with secrets.NAME as environment variables, never echo them, and keep GITHUB_TOKEN permissions minimal (secrets and environments).
๐ค What is GITHUB_TOKEN and how do you limit it?
A short-lived token created for each run. Set permissions: at workflow or job level (for example contents: read) so it only has the access the job needs.
๐ค Why are secrets not available in pull requests from forks?
To prevent untrusted code in a fork from reading them. Workflows triggered by pull_request from forks run without secrets and with a read-only token.
๐ค How do you use third-party actions safely?
Prefer verified publishers, pin third-party actions to a full commit SHA, review their code, and let Dependabot update action versions (security).
๐ค What are environments used for?
Deployment targets with their own secrets and variables and protection rules: required reviewers, wait timers and allowed branches, which gives approval gates before production.
๐ก Intermediate
๐ค How do you run tests in multiple browsers or OS versions?
With a matrix strategy, fail-fast: false for test suites, and unique artifact names per combination (matrix, cache and artifacts).
๐ค Difference between cache and artifacts?
Caches reuse dependencies across runs to save time; artifacts store outputs of a run (reports, traces, builds) for later jobs or download.
๐ค How do you upload test reports even when tests fail?
Add if: !cancelled() or always() to the upload-artifact step, and record traces or screenshots on failure in the test framework.
๐ค How do you avoid duplicate runs when pushing several times quickly?
A concurrency group per branch or PR with cancel-in-progress: true (but not for deployments).
๐ค How do you skip CI for documentation-only changes?
paths-ignore on the trigger, for example **.md and docs/**.
๐ Advanced Design
๐ค Reusable workflow vs composite action?
A reusable workflow reuses whole jobs (own runner, inputs, secrets, outputs) via workflow_call; a composite action reuses steps inside a job. I use reusable workflows for standard test and deploy pipelines and composite actions for shared setup (reusable workflows).
๐ค How do you design a pipeline for a large Playwright suite?
Fast PR gate (lint, type check, smoke tests in one browser), full regression on main and nightly across browsers with sharding and a merged report, traces on retry, artifacts and a published report, and required checks in a ruleset (Playwright in GitHub Actions).
๐ค How do you deploy safely with GitHub Actions?
Build once, deploy to staging, run smoke tests, then deploy to production behind an environment with required reviewers; use OIDC for cloud credentials and concurrency without cancellation (deployment).
๐ค When would you use self-hosted runners?
For special hardware, access to internal networks or test environments, or cost control on very heavy workloads; with ephemeral runners and care, because they persist state and run untrusted PR code if misconfigured.
๐ค How do you pass data between jobs?
Job outputs for small values (written to $GITHUB_OUTPUT) and artifacts for files.
๐ด Troubleshooting Scenarios
๐ค A workflow is not triggering. How do you investigate?
Check the YAML location and syntax, the event and branch or path filters, whether Actions is enabled, and for schedules that they run on the default branch in UTC. Also note that events created with GITHUB_TOKEN do not trigger new workflow runs.
๐ค Tests pass locally but fail in CI. What do you check?
Differences in environment (headless, viewport, time zone, OS), missing secrets or variables, dependency versions (use npm ci and the lock file), timing and test data. Download the traces and screenshots from artifacts.
๐ค A required status check never appears on the PR. Why?
The job name changed, the workflow did not run for that PR (path filters), or it was never run so it cannot be selected. Required checks must match the job name exactly.
๐ค Your workflow is slow. How do you speed it up?
Cache dependencies, run lint and smoke first, shard or use a matrix, skip irrelevant runs with path filters, cancel superseded runs, and avoid installing unnecessary browsers.
๐ก Tips for the Interview
- Have a public repository with a working pipeline and green badges to show.
- Explain the why behind each design choice (speed, safety, cost).
- Know the common YAML keys well enough to write a basic workflow on a whiteboard.
โ FAQ
๐ค What GitHub Actions questions are asked in QA interviews?
Triggers, running tests in CI, matrices for browsers, artifacts for reports, secrets, required checks on pull requests and debugging failing CI runs.
๐ค How do I prepare for a GitHub Actions interview?
Build a real pipeline for a test project, practise the questions on this page, and be ready to explain your YAML line by line.
๐ค Is GitHub Actions better than Jenkins?
For projects already on GitHub it is usually simpler: no server to maintain, tight PR integration and a large Marketplace. Jenkins remains common for complex self-hosted enterprise pipelines (Playwright with Jenkins).
๐ฏ Next Steps
- ๐๏ธ Project 2: CI/CD Pipeline for a Test Automation Repo
- ๐ผ Git Interview Questions for Experienced
- ๐ Git and GitHub Tutorial: full course
๐ฌ Learn Git and GitHub step by step: watch the series on YouTube!
Subscribe to SqaToolsByDY • Practice on sqatools.in