Master the GH-FND

An interactive study guide built on 7 memory techniques to help you pass the GitHub Foundations certification exam.

Git & GitHub Intro 10-15%Repositories 10-15%Collaboration 15-20%Modern Development 15-20%Project Management 10-15%Security & Admin 10-15%Community 5-10%

What it covers

Git basics, repositories, branches, commits, pull requests, GitHub Actions, GitHub Pages, GitHub Copilot intro, Issues, Projects, Discussions, security features, and open source community.

Ideal for

Developers, students, and professionals new to GitHub who want foundational certification and a solid understanding of collaborative development workflows.

Aspire to this if

You're starting your developer career, joining a team that uses GitHub, or want to validate your version control and collaboration skills with an industry-recognised credential.

Section 1 / Spatial Memory

The Map

Tap any component to see what you need to know for the exam.

💻 Git Basics

Version Control · CLI · Commits

🐙 GitHub Platform

Cloud Git · Social Coding

📂 Repositories

Public · Private · Templates

🌿 Branches & Commits

Feature Branches · HEAD · Merge

🔀 Pull Requests

Code Review · Merge · Discussion

⚙️ GitHub Actions

CI/CD · Workflows · Automation

🌐 Pages & Copilot

Static Sites · AI Pair Programming

📋 Issues & Projects

Tracking · Boards · Milestones

🔒 Security & Admin

Dependabot · GHAS · Permissions

🌟 Open Source & Community

Forks · Stars · Sponsors

Section 2 / Narrative Memory

The Story

Follow the narrative to build a mental model of how everything connects.

🌱

The Version Control Garden

Before GitHub, there was Git — created by Linus Torvalds in 2005 to manage Linux kernel development. Git is distributed: every developer has a complete copy of the repository history. Changes flow through three states: you edit in the working directory, stage with git add, and commit to create a permanent snapshot.

Exam IntelGit is distributed (not centralised). Three states: working directory → staging area → repository. Commits are identified by SHA-1 hashes. Know git init, add, commit, status, log, diff, clone, push, pull.

🐙

The GitHub Layer

GitHub wraps Git in a web platform that adds collaboration, visibility, and automation. Repositories become the home for code, documentation, and project management. Public repos are free and open; private repos protect proprietary work. Every repository gets a README, Issues, Pull Requests, and Actions — right out of the box.

Exam IntelGitHub adds a web UI and collaboration layer on top of Git. Plans: Free, Pro, Team, Enterprise. GitHub CLI (gh) provides terminal-based access. GitHub Mobile enables review and management on the go.

🌿

The Branching Strategy

Branches are parallel timelines for your code. You create a feature branch from main, make your changes in isolation, and merge back when ready. This keeps the default branch stable while enabling experimentation. HEAD always points to where you are.

Exam IntelDefault branch is 'main'. Feature branches isolate work. Fast-forward merge = no divergence. Merge commit = divergent history. Rebase replays commits onto a new base. git branch, git checkout, git merge are key commands.

🔀

The Pull Request Ritual

Pull requests are the heart of GitHub collaboration. You push a branch, open a PR, describe your changes, and request review. Reviewers examine the diff, leave comments, and approve or request changes. Branch protection rules enforce quality gates — requiring reviews and passing checks before merge.

Exam IntelThree merge types: merge commit (preserves history), squash and merge (single commit), rebase and merge (linear history). Draft PRs prevent premature merging. Branch protection can require: reviews, status checks, signed commits, linear history.

⚙️

The Automation Engine

GitHub Actions turns your repository into a CI/CD pipeline. Workflows defined in YAML respond to events — a push triggers tests, a PR triggers linting, a release triggers deployment. Jobs run on cloud runners, and the Marketplace offers thousands of pre-built actions.

Exam IntelWorkflows live in .github/workflows/. Events trigger workflows (push, pull_request, schedule, workflow_dispatch). Jobs contain steps. Steps use actions or run commands. Secrets are encrypted and injected as env vars. Runners: GitHub-hosted (ubuntu, windows, macos) or self-hosted.

🌐

The Modern Developer Toolkit

GitHub Pages publishes static websites directly from your repository — perfect for documentation, portfolios, and project sites. GitHub Copilot brings AI into your editor, suggesting completions and generating code from natural language prompts. Together they represent the modern development experience.

Exam IntelPages serves static sites from a branch or /docs folder. Custom domains and HTTPS supported. Copilot suggests code in-editor using AI. Copilot Chat provides conversational help. GitHub Codespaces provides cloud-hosted dev environments.

📋

The Project Command Centre

Issues are the universal tracking unit — bugs, features, tasks. Labels categorise, milestones group toward goals, and assignees own the work. GitHub Projects (v2) provides kanban boards and spreadsheet views with custom fields, automation, and iteration planning for agile teams.

Exam IntelIssues support labels, assignees, milestones, and templates. Projects v2 = boards + tables + custom fields + iterations. Milestones track progress toward releases. Discussions provide threaded Q&A separate from Issues. Tasklists enable hierarchical work breakdown.

🔒

The Security Fortress

GitHub protects code at every layer. Dependabot watches for vulnerable dependencies and opens fix PRs automatically. Code scanning with CodeQL finds bugs before they ship. Secret scanning catches accidentally committed tokens. Repository permissions follow least privilege — Read, Triage, Write, Maintain, Admin.

Exam IntelDependabot: alerts + security updates + version updates. Code scanning: CodeQL analysis in CI. Secret scanning: detects tokens/keys in commits. Branch protection: required reviews, status checks, signed commits. 2FA adds account-level security. GHAS = GitHub Advanced Security.

🌟

The Open Source Commons

Open source thrives on GitHub. Forking creates your copy; pull requests contribute back. Stars signal popularity, CONTRIBUTING.md guides newcomers, and CODE_OF_CONDUCT.md sets community standards. GitHub Sponsors enables financial support for maintainers — sustaining the ecosystem that powers modern software.

Exam IntelFork = personal copy for contribution. Upstream = original repo. Stars = bookmarks/popularity. CONTRIBUTING.md = contribution guide. CODE_OF_CONDUCT.md = behaviour rules. LICENSE = usage terms (MIT, Apache 2.0, GPL). GitHub Sponsors = financial support for maintainers.

Section 3 / Acronym Memory

Mnemonic Wall

Memorable acronyms and phrases to anchor key exam concepts in your memory.

💻

WSR

Git's three states. Files move: edit → git add (stage) → git commit (repo). "Work, Stage, Record."

🌿

CFMR

GitHub Flow in four steps. Simple, effective branching model used by most GitHub teams.

🔀

MSR

Three PR merge strategies. Merge = full history. Squash = single commit. Rebase = linear history.

⚙️

EWJSA

GitHub Actions hierarchy. Events trigger workflows. Workflows contain jobs. Jobs contain steps. Steps run actions.

🔒

DCS

Three pillars of GitHub security. Dependencies, code analysis, credential detection. "Defend Code Secrets."

📂

RGL

Three essential repository files. README = landing page. .gitignore = exclude files. LICENSE = usage terms.

📋

ILMA

Issue management essentials. Issues track work. Labels categorise. Milestones group. Assignees own.

🌟

FSCL

Open source lifecycle on GitHub. Fork to copy, star to bookmark, contribute via PR, respect the license.

👥

RTWMA

Five repository permission levels from least to most privilege. Follow the principle of least privilege.

🚀

PPCC

GitHub's modern developer tools. Pages = hosting. Packages = registries. Copilot = AI. Codespaces = cloud IDE.

🔑

SSH-PAT

Two authentication methods for Git operations. SSH = key pair. PAT = token-based HTTPS. Both replace password auth.

📄

YAML

Workflow files use YAML. Indentation matters. Key concepts: on (triggers), jobs, steps, uses, run, env, secrets.

Section 4 / Contrast Memory

Versus Arena

Side-by-side comparisons to sharpen your understanding of similar concepts.

GitvsGitHub

Git vs GitHub

Aspect	Git	GitHub
Type	Version control system	Cloud platform
Runs	Locally on your machine	In the cloud (web)
Features	Commits, branches, merge	PRs, Issues, Actions, Pages
Collaboration	Via remotes (manual)	Built-in (web UI)
Created by	Linus Torvalds (2005)	GitHub Inc. (2008)
Offline	Fully functional	Requires internet

Merge CommitvsSquashvsRebase

Merge Commit vs Squash vs Rebase

Aspect	Merge Commit	Squash
History	All commits preserved	Squash: 1 commit \| Rebase: linear
Merge commit	Yes (extra commit)	No merge commit in either
Traceability	Full branch history	Squash: summary \| Rebase: flat
Clean history	No (branching visible)	Yes (both are cleaner)
Best for	Preserving context	Squash: tidy \| Rebase: linear flow

IssuesvsDiscussions

Issues vs Discussions

Aspect	Issues	Discussions
Purpose	Track actionable work	Open-ended conversation
State	Open / Closed	Open / Answered / Closed
Assignees	Yes	No
Labels	Yes	Categories instead
Linked to PRs	Yes (closes #123)	Can convert to Issue
Best for	Bugs, tasks, features	Q&A, ideas, announcements

PublicvsPrivate Repositories

Public vs Private Repositories

Aspect	Public	Private Repositories
Visibility	Anyone can see	Only collaborators
Forking	Anyone can fork	Restricted to collaborators
GitHub Pages	Free	Requires paid plan
Actions minutes	Free (unlimited)	Free tier limited
Best for	Open source, portfolios	Proprietary code, private work
Security scanning	Free code scanning	Requires GHAS licence

GitHub Actions: HostedvsSelf-Hosted Runners

GitHub-Hosted vs Self-Hosted Runners

Aspect	GitHub Actions: Hosted	Self-Hosted Runners
Management	GitHub maintains	You maintain
Environment	Clean VM each run	Persistent (your hardware)
OS options	Ubuntu, Windows, macOS	Any OS you install
Cost	Free tier + paid minutes	Your infrastructure cost
Best for	Standard CI/CD	Custom hardware, private networks

ForkvsClonevsTemplate

Fork vs Clone vs Template

Aspect	Fork	Clone
Creates	Server-side copy on GitHub	Clone: local copy \| Template: new repo
Linked to original	Yes (upstream remote)	Clone: yes \| Template: no
History	Full commit history	Clone: full \| Template: clean start
Contribute back	Yes (via PR to upstream)	Clone: push to own \| Template: independent
Best for	Open source contribution	Clone: development \| Template: scaffolding

GitHub FreevsProvsTeamvsEnterprise

GitHub Plans Compared

Aspect	GitHub Free	Pro
Public repos	Unlimited (all plans)	Unlimited (all plans)
Private repos	Unlimited (all plans)	Unlimited (all plans)
Collaborators	Free: unlimited \| Pro: unlimited	Team: org features \| Ent: SAML SSO
Actions minutes	Free: 2,000 \| Pro: 3,000	Team: 3,000 \| Ent: 50,000
Advanced Security	Public repos only	Team: add-on \| Ent: included
Support	Community \| Email	Email \| Premium + SLA

Branch ProtectionvsRulesets

Branch Protection vs Rulesets

Aspect	Branch Protection	Rulesets
Scope	Single branch pattern	Multiple branches/tags
Management	Per-repository	Repository or organisation-wide
Bypass	Admin override	Configurable bypass list
Status	Legacy (still supported)	Modern replacement
Best for	Simple single-branch rules	Consistent policies at scale

Section 5 / Grouping Memory

Cheat Sheet

Organised reference grouped by exam domain — everything you need on one page.

Introduction to Git and GitHub

10-15%

Git Fundamentals

Distributed VCS — every clone is a full repository
Three states: working directory, staging area, repository
Commits are snapshots identified by SHA-1 hashes
git init, git clone, git add, git commit, git push, git pull
git status shows state; git log shows history

GitHub Platform

Cloud hosting for Git repositories with collaboration features
Plans: Free, Pro, Team, Enterprise
GitHub CLI (gh) for terminal-based operations
GitHub Mobile for on-the-go review and management
GitHub Desktop for GUI-based Git operations

Authentication

SSH keys: public/private key pair for secure Git access
Personal Access Tokens (PATs): token-based HTTPS auth
2FA: TOTP app or security key for account protection
Password authentication deprecated for Git operations

Working with GitHub Repositories

10-15%

Repository Essentials

README.md: landing page rendered on repo homepage
.gitignore: specifies intentionally untracked files
LICENSE: defines code usage terms (MIT, Apache 2.0, GPL)
CODEOWNERS: auto-assigns reviewers based on file paths
Template repositories: scaffold new projects without history

Branches & Merging

Default branch (main) is the base for all work
Feature branches isolate changes from the main branch
Fast-forward merge: linear, no merge commit needed
Three-way merge: creates merge commit when branches diverge
Rebase: replays commits onto a new base for linear history

Repository Settings

Visibility: public (open) or private (restricted)
Topics and descriptions improve discoverability
Releases and tags mark versioned snapshots
GitHub Pages can be enabled from repository settings
Environments define deployment targets with protection rules

Collaboration Features

15-20%

Pull Requests

Propose changes, request reviews, discuss before merging
Merge commit: preserves all branch commits + merge commit
Squash and merge: combines into single commit on target
Rebase and merge: replays commits linearly on target
Draft PRs: signal work-in-progress, block merging

Code Review

Line-level comments on diffs for precise feedback
Review states: Approve, Request Changes, Comment
Suggested changes: propose edits reviewers can commit directly
Required reviewers enforce quality via branch protection
CODEOWNERS auto-assigns domain experts for review

Discussions & Communication

Discussions: threaded Q&A, ideas, and announcements
Categories organise discussion topics
Discussions can be converted to Issues when actionable
@mentions notify specific people or teams
Markdown supported everywhere: Issues, PRs, Discussions, comments

Modern Development

15-20%

GitHub Actions

Workflow files: .github/workflows/*.yml
Events: push, pull_request, schedule, workflow_dispatch
Jobs run in parallel by default on runners
Steps execute shell commands or reusable actions
Secrets: encrypted variables injected at runtime
GitHub Marketplace: thousands of community actions

GitHub Pages

Static site hosting from a branch or /docs folder
Custom domains with automatic HTTPS
Built-in Jekyll support for static site generation
GitHub Actions can build and deploy any static framework

GitHub Copilot & Codespaces

Copilot: AI-powered code suggestions in your editor
Copilot Chat: conversational AI for code explanation and generation
Codespaces: cloud-hosted dev environments with VS Code
devcontainer.json configures Codespace environments
Prebuilds speed up Codespace creation with cached images

Project Management

10-15%

Issues

Track bugs, features, and tasks with structured metadata
Labels: categorise and filter (bug, enhancement, help wanted)
Assignees: designate ownership of work items
Milestones: group issues/PRs toward a release goal
Issue templates and forms: standardise reporting
Closing keywords: 'fixes #123' in PR auto-closes issues

GitHub Projects

Projects v2: flexible boards, tables, and roadmaps
Custom fields: priority, size, sprint, dates
Automated workflows: move items on status change
Iterations: plan work in time-boxed sprints
Views: filter and group by any field
Link to issues and PRs across multiple repositories

Notifications & Integrations

Watch settings: all activity, releases only, or ignore
Notification filters: reason, repo, organisation
Webhooks: send events to external services
GitHub Apps: installable integrations with scoped permissions

Privacy, Security, and Administration

10-15%

Repository Security

Dependabot alerts: notifies about vulnerable dependencies
Dependabot security updates: auto-opens fix PRs
Code scanning: CodeQL analyses code for vulnerabilities
Secret scanning: detects committed credentials and tokens
Push protection: blocks pushes containing secrets

Access Control

Repository roles: Read, Triage, Write, Maintain, Admin
Teams: group members with shared repository access
Organisation owners manage billing and policies
SAML SSO: enterprise identity provider integration
Audit log: tracks user and admin actions

Branch & Code Protection

Branch protection rules: require reviews, status checks
Rulesets: organisation-wide branch/tag policies
Signed commits: GPG/SSH signature verification
Required status checks: CI must pass before merge
Dismiss stale reviews: re-request after new pushes

Benefits of the GitHub Community

5-10%

Open Source on GitHub

Fork: create a personal copy of a repository
Upstream: the original repo you forked from
CONTRIBUTING.md: guide for new contributors
CODE_OF_CONDUCT.md: community behaviour standards
Licence types: MIT, Apache 2.0, GPL — choose wisely

Community Features

Stars: bookmark repos, signal popularity
GitHub Sponsors: financially support maintainers
Explore: discover trending repos and topics
GitHub Education: free Pro for students (Student Developer Pack)
InnerSource: open source practices within organisations

GitHub Profiles & Recognition

Profile README: showcase your work (special repo: username/username)
Contribution graph: visualise your activity over time
Achievements: badges for milestones and participation
Organisation profiles: public-facing team pages

Section 6 / Method of Loci

The Memory Palace

Walk through themed rooms — each object anchors a concept in spatial memory.

The Git Workshop

Git Basics — Where version control begins

💻

Git CLI

Distributed VCS. git init, add, commit, push, pull. Every clone is a full repo

📦

Three States

Working directory → staging area (git add) → repository (git commit)

🔑

SHA Hashes

Every commit has a unique SHA-1 hash. Immutable history. Content-addressed storage

🌿

Branches

Lightweight pointers to commits. HEAD tracks current branch. Feature branch workflow

🔄

Merge & Rebase

Merge creates a join commit. Rebase replays commits for linear history

☁️

Remotes

origin = default remote. git push sends commits. git pull fetches + merges

The Repository Vault

Repositories — Where code lives

📂

Repository Structure

Code, branches, history, settings. Public or private visibility

📖

README.md

Landing page for the repo. Rendered as HTML. Project overview and getting started

🚫

.gitignore

Specifies files to exclude from tracking. Build outputs, secrets, OS files

⚖️

LICENSE

Defines usage terms. MIT = permissive. GPL = copyleft. Apache 2.0 = patent grant

📋

CODEOWNERS

Auto-assigns reviewers by file path. Lives in root, docs/, or .github/

🏷️

Releases & Tags

Tags mark specific commits. Releases add changelogs and binary assets

The Collaboration Hub

Pull Requests & Reviews — Where quality is enforced

🔀

Pull Requests

Propose changes, describe intent, request review, discuss, and merge

💬

Code Review

Line comments, suggested changes, approve/request changes/comment states

🛡️

Branch Protection

Require reviews, status checks, signed commits. Prevent force pushes

📄

Draft PRs

Signal work-in-progress. Cannot be merged until marked ready for review

💬

Discussions

Threaded Q&A and announcements. Categories replace labels. Convert to Issue

✍️

Markdown Everywhere

Issues, PRs, comments, README — all support GitHub Flavoured Markdown

The Automation Lab

GitHub Actions — Where code builds and deploys

⚙️

Workflow YAML

.github/workflows/*.yml. Define triggers, jobs, and steps declaratively

⚡

Events & Triggers

push, pull_request, schedule, workflow_dispatch, release, issue events

🖥️

Runners

GitHub-hosted (Ubuntu, Windows, macOS) or self-hosted. Jobs run on runners

🔐

Secrets & Variables

Encrypted secrets at repo/org/environment level. Injected as env vars

🛍️

Marketplace Actions

Thousands of reusable actions. actions/checkout, actions/setup-node, etc.

🌐

GitHub Pages Deploy

Actions can build and deploy static sites to Pages. Custom domains + HTTPS

The Project Board Room

Project Management — Where work is tracked

📋

Issues

Track bugs, features, tasks. Labels, assignees, milestones, templates

🗂️

Projects v2

Kanban boards, tables, roadmaps. Custom fields, iterations, automation

🎯

Milestones

Group issues/PRs toward a release. Track progress with completion percentage

🏷️

Labels

Categorise issues: bug, enhancement, documentation, help wanted, good first issue

🔔

Notifications

Watch repos, filter by reason. @mentions, review requests, CI status

🔗

Closing Keywords

'fixes #123' in PR description auto-closes the issue on merge

The Security Vault

Security & Administration — Where code is protected

🔒

Dependabot

Alerts for vulnerable deps. Auto-opens PRs for security and version updates

🔍

Code Scanning

CodeQL analyses code for security flaws. Runs in Actions workflows

🚨

Secret Scanning

Detects committed tokens and credentials. Push protection blocks at push time

👥

Access Control

5 roles: Read, Triage, Write, Maintain, Admin. Teams for group access

🏢

Organisation Policies

Org owners set defaults: base permissions, 2FA requirement, SAML SSO

📜

Audit Log

Tracks user actions, admin changes, and security events for compliance

The Open Source Plaza

Community — Where collaboration thrives

🍴

Forking

Create a personal copy. Contribute back via pull requests to upstream

⭐

Stars & Explore

Star repos to bookmark. Explore page shows trending projects and topics

📝

CONTRIBUTING.md

Guide for contributors: how to report issues, submit PRs, follow standards

🤝

CODE_OF_CONDUCT.md

Community behaviour expectations. Contributor Covenant is the most common

💰

GitHub Sponsors

Financial support for maintainers. Tiers, one-time, or recurring contributions

🎓

GitHub Education

Student Developer Pack: free Pro, Copilot, tools. Campus Experts programme

Section 7 / Pattern Recognition

Pattern Spotter

Decision trees and trigger-answer pairs — see the pattern, know the answer.

Which Merge Strategy?

Which Merge Strategy?
  ├── Preserve full branch history → Merge commit
  ├── Clean single commit on target → Squash and merge
  ├── Linear history, no merge commits → Rebase and merge
  └── Work-in-progress, not ready yet → Draft PR (don't merge yet)

Which GitHub Security Feature?

Which GitHub Security Feature?
  ├── Vulnerable dependency detected → Dependabot alerts + security updates
  ├── Find bugs in source code → Code scanning (CodeQL)
  ├── Accidentally committed a secret → Secret scanning
  ├── Prevent secrets from being pushed → Push protection
  ├── Enforce reviews before merge → Branch protection rules
  └── Consistent policies across org → Repository rulesets

Which Collaboration Feature?

Which Collaboration Feature?
  ├── Track a bug or feature request → Issue
  ├── Open-ended Q&A or brainstorming → Discussion
  ├── Propose and review code changes → Pull Request
  ├── Plan work across multiple repos → GitHub Projects
  ├── Group work toward a release → Milestone
  └── Contribute to someone else's repo → Fork + Pull Request

Which GitHub Plan?

Which GitHub Plan?
  ├── Individual developer, open source → GitHub Free
  ├── Individual with advanced features → GitHub Pro
  ├── Organisation with team management → GitHub Team
  └── Enterprise: SAML SSO, audit log, GHAS → GitHub Enterprise

Decision Cards

“distributed version control”→Git — every clone is a full repository

“three states” or “staging area”→Working directory → staging → repository

“pull request” or “code review”→PRs propose changes with review before merge

“squash and merge”→Combines all PR commits into a single commit on target

“.github/workflows” or “YAML workflow”→GitHub Actions workflow definition

“workflow_dispatch” or “manual trigger”→GitHub Actions manual workflow trigger

“Dependabot” or “vulnerable dependencies”→Dependabot alerts and automated fix PRs

“CodeQL” or “code scanning”→GitHub code scanning for security vulnerabilities

“secret scanning” or “push protection”→Detects/blocks committed secrets and tokens

“fork” and “upstream”→Fork = personal copy; upstream = original repository

“README.md” or “landing page”→Repository homepage rendered from README.md

“GitHub Pages” or “static site hosting”→Free hosting from a branch or /docs folder

“GitHub Copilot” or “AI code suggestions”→AI-powered code completion and chat in your editor

“Projects v2” or “kanban board”→GitHub Projects with boards, tables, custom fields

“branch protection” or “required reviews”→Branch protection rules enforce quality gates

“CODEOWNERS” or “auto-assign reviewers”→CODEOWNERS file maps file paths to required reviewers

“GitHub Sponsors” or “fund maintainers”→Financial support for open source maintainers

“Read, Triage, Write, Maintain, Admin”→Five repository permission levels (least to most)

Ready to certify?

Train with practitioners, not presenters

Lucid Labs delivers Microsoft certification training led by Microsoft Certified Trainers (MCTs) and grounded in real-world project experience. We adapt every session to your team's environment, data stack, and business objectives — because the best exam prep comes from engineers who build these solutions every day.

🎯

Tailored Content

Training built around your team's workflows, repositories, and collaboration patterns — not generic slides.

🛠️

Hands-On Labs

Work through real scenarios: branching, pull requests, Actions workflows, and security scanning with expert guidance.

📈

Exam + Capability

Pass the certification and build lasting GitHub skills your team can apply from day one.

Talk to us about GitHub Foundations training

Custom training for teams & individuals — remote or on-site across Australia

Keith Oak

Chief Technology Officer — Lucid Labs

Microsoft Solutions Partner architect specialising in Fabric, Azure Data & AI, and GitHub Enterprise. 18+ years delivering data platforms for Australian businesses — building the systems these exams test every day.

LinkedIn ↗lucidlabs.com.au ↗Published 29-03-2026