In June 2025 I sat the GitHub Foundations exam (GH-900) and passed it. I run a Microsoft-stack shop in Ibbenbüren, so people sometimes assume my certifications all carry a Microsoft logo. This one is a little different — it's GitHub's own entry-level credential — and I think it's worth explaining why I bothered, because the reasoning says something about how modern software really gets built.
I've been writing software professionally for long enough to remember version control before it was good. I don't say that to sound grizzled — I say it because it frames why GitHub matters to me. The platform isn't a nice-to-have on top of the work; for most teams, including ours, it is where the work lives. Certifying my understanding of it felt less like collecting a badge and more like acknowledging the floor I stand on every day.
What GitHub Foundations is
GitHub Foundations is the entry-level certification in GitHub's certification program. That program is GitHub's own — it sits alongside, but is distinct from, the Microsoft role-based and fundamentals certifications I hold. (GitHub is a Microsoft subsidiary, and the exam is delivered through the Microsoft Learn certification platform as GH-900, which is where some of the overlap comes from — but the credential is squarely a GitHub one.)
It's pitched as a beginner-level, foundational credential. The official audience profile is refreshingly broad: candidates "should have foundational knowledge of GitHub and its core features," and the exam is "designed for non-developers, developers, and all GitHub users seeking to improve their proficiency with GitHub fundamentals." That last part matters more than it looks. GitHub stopped being a developers-only tool years ago. Product managers track work in it, technical writers ship docs from it, designers review pull requests in it. A foundational credential that explicitly includes non-developers is GitHub acknowledging its own gravity.
The exam is proctored and scheduled through Pearson VUE, with both in-person test-centre and online proctored options. It's offered in several languages — English, Spanish, Brazilian Portuguese, Korean, and Japanese — and once you pass, the certification is valid for two years.
What it actually certifies
This is the part I want to be precise about, because "GitHub certification" could mean almost anything, and the reality is specific. The exam measures seven skill domains, with the weightings GitHub published in the GH-900 study guide:
- Understand Git and GitHub basics (25–30%) — the largest domain by far. Version control fundamentals, the difference between Git and GitHub, core concepts like repositories, commits, and branches, plus GitHub accounts, organizations, enterprise options, GitHub Flow, and Markdown.
- Work with GitHub repositories (10–15%) — repository structure and the key files (README, LICENSE, CONTRIBUTING, CODEOWNERS, SECURITY), creating and organizing repositories, managing files, and reading repository insights.
- Collaborate using GitHub (10–15%) — issues, pull requests, discussions, linking PRs to issues, templates, notifications, and using Gists, Wikis, and GitHub Pages.
- Apply modern development practices (10–15%) — and this is where it stops being a "just Git" exam. The domain explicitly covers the purpose of GitHub Actions, how GitHub Copilot assists with AI-powered suggestions (including Copilot agents, Agent Mode, and multi-model support), the difference between Copilot for Individuals, Business, and Enterprise, plus Codespaces and dev containers.
- Manage projects with GitHub (5–10%) — GitHub Projects, labels, milestones, workflows, and project insights.
- Understand privacy, security, and administration (10–15%) — two-factor authentication and passkeys, access permissions and roles, Enterprise Managed Users, repository visibility, and branch protection rules.
- Explore the GitHub community (5–10%) — the benefits of open source, GitHub Sponsors, the Marketplace, and how InnerSource applies open-source principles inside an organization.
As for the format: the exam is multiple choice, you have 100 minutes, and a score of 700 (on the standard scale) or greater is required to pass. There's a public sandbox so you can experience the question types before you sit it — a small thing that I appreciate, because exam-day surprises rarely come from the content.
What I find well-judged about this blueprint is the balance. A quarter of the weight is on genuine fundamentals — the things you cannot fake — and the rest is spread across the parts of GitHub that have quietly become essential: automation, AI assistance, security, and the social mechanics of open source and InnerSource. It's an honest map of what GitHub is in 2025, not a nostalgic snapshot of what it was.
Why I bothered to certify
I'll be honest: I already knew most of this. I use GitHub every working day and have for years. So why sit a beginner-level exam?
Three reasons, and none of them are vanity.
First, GitHub is the backbone of how we ship. Every project we run at ThreeBIT lives on GitHub. Not "is backed up to" — lives on. The repository is the source of truth, the pull request is where decisions get made and recorded, and the Actions pipeline is what turns a merged commit into something running in Azure. When a tool is that central, "I basically know it" is not the same as "I have verified that I understand it correctly, including the parts I use less often." Certifying forced me to read the manual on the corners I'd been improvising around — branch protection rules I'd configured by feel, the exact distinctions between Copilot's licensing tiers, the security features I'd half-enabled. Sitting an exam is a cheap, structured way to close those gaps.
Second, Copilot and Actions literacy is now part of the job, not an extra. I write a lot, here and elsewhere, about AI-assisted development being real rather than hype. It would be a poor look to argue that and then be vague about how the tools I lean on are actually licensed, governed, and run. The GitHub Foundations blueprint treats Copilot and Actions as core knowledge, and I think that's correct. If you're going to put AI agents and CI/CD at the centre of how a company builds — as we have — you should be able to explain them precisely, including to a customer's security team.
Third, and more quietly: it's a fair credential to ask of my own team. I don't like asking people to do things I haven't done. If I think GitHub fluency is a reasonable baseline for someone joining ThreeBIT, the least I can do is hold the same baseline myself, with the same proof. A founder who's "too senior to certify the basics" is usually a founder who's drifted away from the work.
How it shows up in our work at ThreeBIT
None of this would matter if it were abstract, so here's the concrete version — the GitHub Foundations domains, mapped onto a normal week at ThreeBIT.
Every project lives on GitHub. Xircuit, Outastory, this website, our internal tooling — each is a repository, with branch protection on the default branch and a CODEOWNERS file that routes reviews to the right person. The "repository structure and key files" domain isn't trivia to us; the README, LICENSE, CONTRIBUTING, and SECURITY files are the first thing a new collaborator or a curious customer reads.
Pull requests are how decisions get made. We don't push to main. Work happens on a feature branch, opens a pull request, gets reviewed, and merges only when the checks are green — exactly the GitHub Flow the exam describes. The PR thread is also our decision log: six months later, the why behind a change is right there, linked to the issue that prompted it.
Actions do the unglamorous, reliable work. Build, test, lint, and deploy to Azure all run as GitHub Actions. For the industries we serve — where a bug isn't a cosmetic glitch but a missed export or a failed payment — a pipeline that runs the same way every time is worth more than any individual's heroics. The exam's "purpose and capabilities of GitHub Actions" objective is, for us, just a description of Tuesday.
Copilot agents and isolated worktrees are how we work now. We run AI-assisted development in earnest: Copilot for suggestions, and agents working in isolated worktrees so parallel tasks don't collide — each agent gets its own checkout of the repo, works independently, and we merge when the checks pass. Understanding Copilot's agent modes and the difference between its licensing tiers — straight off the exam blueprint — is what lets me make sober decisions about where AI belongs in a client's workflow and where a human still signs off on the merge.
Security and access are not afterthoughts. Two-factor authentication, sensible repository visibility, and proper roles across our organization are baseline hygiene. When we tell a customer their code and their data are handled responsibly, the GitHub administration and security domain is part of what makes that sentence true rather than aspirational.
That's the honest case for a senior person sitting a beginner's exam. The credential is entry-level; the platform it certifies is anything but. GitHub is where our software actually gets built, and I'd rather be demonstrably fluent in the foundation than quietly assume I am.
Verify: https://www.credly.com/badges/4d591f69-7b8e-43a7-9c15-af4e00cbc2c6/public_url
Sources & further reading
- Microsoft Learn — GitHub Foundations certification (exam GH-900): https://learn.microsoft.com/en-us/credentials/certifications/github-foundations/
- Microsoft Learn — Study guide for Exam GH-900: GitHub Foundations (skills measured and weightings): https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/gh-900
- GitHub Education — GitHub Foundations Certification: https://education.github.com/experiences/foundations_certificate
- GitHub Docs — Get started with Git and GitHub: https://docs.github.com/get-started
- GitHub Docs — GitHub Actions: https://docs.github.com/actions
- GitHub Docs — GitHub Copilot: https://docs.github.com/copilot
Image credits
All images are used under their respective Creative Commons or public-domain terms; we are grateful to the creators.
- cmd.exe — © *n3wjack's world in pixels, CC BY-SA 2.0, via Flickr (source).
- On the big screen — © Disgwylfa, CC BY 2.0, via Flickr (source).
- Processed Mango Fruit Juice been conveyed from one place to another in the factory 01 — © Samsule2, CC BY-SA 4.0, via Wikimedia Commons (source).