A job-level concurrency group coordinates executions that share the same group value across workflow runs. The expression ci-${{ github.ref }} places executions for the same ref into the same group while allowing other refs to use independent groups.

Under the default concurrency behavior, a group permits at most one running execution and one pending execution. When another execution enters an occupied group, it becomes pending; an existing pending execution can be replaced by the newer one. This is a concurrency limit rather than a guarantee that every queued execution will eventually run.

The strategy.max-parallel setting controls simultaneous jobs generated by a matrix within a workflow run. It does not establish the required coordination between separate workflow runs. A matrix definition also does not create a shared concurrency lock. The cancel-in-progress property controls whether an active execution is cancelled, but a cancellation expression alone does not define the necessary group.

Group names should be chosen carefully when multiple jobs or workflows share a repository, because identical names can coordinate those executions too.

Study-guide topics: job synchronization, concurrency groups, and bounded execution. Reference: GitHub Actions—Workflow syntax: job concurrency.

===============

GitHub Copilot CLI plan mode is specifically designed for situations in which an implementation strategy must be developed and reviewed before code modifications begin. In plan mode, Copilot can inspect and analyze the repository, ask clarifying questions, and construct a structured implementation plan while protecting project files from normal editing operations. The resulting plan can then be reviewed and approved before Copilot proceeds with implementation. GitHub explicitly describes plan mode as a mechanism for identifying misunderstandings before code is written and maintaining human control over complex, multi-step work.

Option A is incorrect because --agent=AGENT selects a custom agent; it does not establish a planning-and-approval phase. Option B is the opposite of the requirement: --allow-all grants Copilot broad permission to use tools, paths, and URLs without individual approval. Option D is also incorrect because /compact relates to managing conversation/context size rather than establishing an implementation plan.

Therefore, switching to plan mode is the appropriate first action when the development process requires human review and agreement before changes are applied.

Study Guide Reference Topics: Prepare agent architecture and SDLC processes; human-in-the-loop development; planning before implementation; controlled agent execution.

===============

Requirement

Control

Agent’s draft pull request workflow control

Approve and run the workflows from the pull request merge box.

Production deployment job control

In the deployment job, configure the required reviewers for the production environment.

Approving and running workflows from the pull request interface controls whether workflows associated with the agent’s draft pull request are allowed to begin. This provides the required human authorization before CI executes in that context.

Required reviewers on the production environment protect the deployment job itself. When the workflow reaches that environment, GitHub pauses the job until an authorized reviewer explicitly approves it. The approval is therefore applied at the production boundary, independently from the earlier pull-request workflow authorization.

A concurrency group controls overlap but does not require human approval. A custom deployment protection rule may be useful for specialized external validation, but it is not required by the stated scenario. Commit signing and run-summary inspection do not control the requested execution gates.

Study-guide topics: approval gates, protected environments, draft pull-request workflows, and production accountability.

===============

Statement

Answer

agent1 and agent2 jobs will run in parallel.

Yes

If the agent2 job fails, the workflow will fail.

Yes

GitHub Actions jobs run in parallel by default when no needs dependency establishes an execution order. Therefore, if agent1 and agent2 are independent jobs in the same workflow, they can begin concurrently when runners are available.

A job failure normally causes the workflow to be marked as failed. The workflow can be configured differently through conditional execution, continue-on-error, or dependent job logic, but no such exception is indicated here. An agent2 failure therefore results in a failed workflow outcome under standard behavior.

The environment: agent-sandbox setting identifies an environment associated with agent1. It does not itself create a dependency between agent1 and agent2, nor does it establish workspace isolation between them. Parallel execution requires separate coordination controls if both jobs can modify shared external resources or deploy to the same target.

Study-guide topics: parallel execution, job dependencies, workflow failure propagation, and execution environments. Reference: GitHub Actions—Workflow syntax .

===============

Branch protection rule (main) – Require pull request before merging

Enabled

Workflow trigger for validation checks

on: pull_request

The branch protection setting must be Enabled . GitHub branch protection can require all changes to main to arrive through a pull request and can additionally require a defined number of approving reviews. For this scenario, the repository should require a pull request before merging and configure the required number of approvals to one . This creates a controlled merge boundary while leaving the coding agent free to create its own working branches and submit pull requests. A bypass for direct pushes would violate the requirement because it would provide a path for changes to reach main without review.

The validation workflow should use on: pull_request . GitHub Actions runs workflows for pull_request activity, with opened, synchronize, and reopened among the default triggering activities. Consequently, validation begins when the agent opens the pull request and reruns as the proposed change is updated.

This design separates autonomous low-risk actions —branch creation and PR creation—from the higher-risk operation of modifying the protected default branch. That is precisely the guardrail model tested by GH-600: maximize useful agent autonomy while requiring controlled authorization for consequential changes.

Study Guide Reference Topics: Implement Guardrails and Accountability; human-in-the-loop workflows; protected execution paths; explicit authorization; autonomous branch and pull-request operations.

===============

Statement

Selection

When the developer uses the default profile on main, the workspace release-notes agent will appear in the agents dropdown.

Yes

When the developer is on branch1, the workspace version of the release-notes agent will be available in the agents dropdown.

No

When the developer switches to profile1, the user profile release-notes agent will appear in the agents dropdown.

No

The first statement is Yes because the workspace agent definition exists in the conventional .github/agents directory on main. Assuming a valid agent definition with no visibility restriction, Visual Studio Code discovers it and makes it available for selection. The default value of user-invocable is true.

The second statement is No because workspace discovery depends on the files present in the checked-out workspace. Switching to branch1, where the definition does not exist, removes that workspace-defined agent from the applicable configuration. Its existence on the repository’s default branch does not make it globally available across every branch.

The third statement is No because the profile-level definition explicitly sets user-invocable: false. That setting hides the agent from the dropdown even though its definition exists in the active profile. It controls manual selection rather than deleting the agent or necessarily preventing programmatic or subagent invocation.

The scenario therefore separates three independent factors: workspace file presence, active profile configuration, and agent visibility metadata.

Relevant curriculum topics are evaluating development-environment context, configuring custom agents, and controlling how agents are invoked.

A properly configured branch ruleset establishes enforcement outside the agent’s editable task instructions. It can require pull requests, successful checks, and appropriate reviews before changes enter protected branches. In an enterprise setup, required workflows can also be governed centrally so that changing a repository-local workflow does not remove the organization’s validation requirement.

The ruleset must be configured to preserve the intended checks. Merely creating an empty ruleset does not solve the problem, and requiring a check whose implementation the agent can freely weaken is insufficient. Protecting workflow changes through required ownership review or centrally managed validation addresses that remaining gap. The agent should not receive bypass permission for these controls.

Option A increases authority rather than constraining the unwanted behavior. Option C removes the checks that are supposed to detect defective code. Option D affects treatment of untracked files and does not prevent changes to already tracked workflow definitions.

The control cannot guarantee successful reasoning, but it can prevent acceptance of a shortcut that defeats validation.

Relevant curriculum topics are blocking prohibited actions, enforcing independent controls, and correcting undesirable behavior identified through evaluation.

Repository memory is supported by citations to the code that establishes the remembered fact. When a fact appears relevant to a new task, Copilot checks its supporting citations against the current branch before relying on it. This validation prevents an observation from an earlier repository state from being treated automatically as current truth.

The branch check is particularly important when work spans release branches, experimental changes, or pull requests that were never merged. A memory may have been accurate when created but no longer describe the code now being edited. If its supporting code is absent or no longer supports the claim, the remembered fact should not influence the task.

Option A incorrectly describes memory as permanently retained information requiring only manual intervention. Option B substitutes pull-request disposition for validation of the underlying evidence. Option C incorrectly treats repository knowledge as usable only by its original contributor.

The governing mechanism is evidence validation at the point of use, not an assumption that all previously stored information remains authoritative.

Relevant curriculum topics are task-relevant memory, stale-context prevention, and maintaining state consistency across branches and sessions.

The repository-wide Copilot instruction file is .github/copilot-instructions.md. GitHub explicitly identifies this file as the location for review guidance that should apply throughout the codebase. It can describe coding standards, security expectations, error-handling requirements, and other review criteria that should be considered across pull requests.

A pull request template primarily structures the description supplied when a pull request is created. It is not the designated repository-wide Copilot instruction mechanism. Files beneath .github/instructions support instructions with defined applicability, commonly using path patterns. The filename in option C alone does not establish repository-wide scope. Custom agent profiles define the behavior of particular agents and do not replace the standard configuration for Copilot code review.

The instructions should state concrete, reviewable requirements rather than vague preferences. For example, a rule about checking authorization at a defined service boundary is more actionable than a general instruction to “ensure security.” Repository settings must also allow custom instructions to be used for code review.

This configuration improves consistency while human reviewers remain responsible for evaluating the resulting findings.

Relevant curriculum topics are tuning instructions, defining evaluation criteria, and aligning automated review with development intent.

A repository skill stored under .github/skills/ < skill-name > /SKILL.md provides reusable, task-specific guidance that can be invoked when relevant. Because it is committed to the repository, the guidance is available in ephemeral development containers without relying on a developer’s local configuration.

Repository-wide instructions in .github/copilot-instructions.md are applied broadly and are suitable for enduring conventions, architectural rules, or team standards. They are not the best choice when guidance should apply only to a particular task or workflow.

Personal instructions are user-specific and do not provide a version-controlled, team-shared implementation. A .copilot/skills path does not represent the repository-scoped skill location required by the scenario.

Task-specific skills improve precision by supplying focused procedures, reference material, and constraints only when the related task is active. This prevents unrelated work from being burdened by instructions that do not apply.

Study-guide topics: agent skills, repository-scoped guidance, contextual instructions, and ephemeral development environments.

===============