Just-in-time (JIT) runner setup registers a self-hosted runner with a configuration value that can be used only once. The runner accepts one job, then is automatically removed and stops, reducing the exposure of reusable registration credentials. section 6.1.1 section 6.3.2
Apply the setup with these operational constraints:
- Generate the encoded configuration through the organization-level generate-jitconfig API endpoint. section 6.3.2
- Start the runner with ./run.sh --jitconfig and pass the encoded value instead of using --ephemeral. section 6.3.2
- Treat the runner host as disposable: automatic removal does not clean the environment or prevent reuse. section 6.3.2
- Use ACTIONS_RUNNER_HOOK_JOB_COMPLETED to handle cleanup after the job finishes. section 6.3.2
Generate and start a JIT runner
Call /orgs/{org}/actions/runners/generate-jitconfig with the runner name, runner group, and labels, then pass the response to ./run.sh --jitconfig ${encoded_jit_config}. The encoded value cannot register another runner. section 6.3.2
Listing 6.9 Creating a JIT runner
curl --location 'https://api.github.com/orgs/GitHubActionsInAction/actions/runners/generate-jitconfig' \
--header 'X-GitHub-Api-Version: 2022-11-28' \
--header 'Content-Type: application/json' \
--header 'Authorization: Basic <encrypted token>' \
--data '{
"name": "New JIT runner",
"runner_group_id": 1,
"labels": ["jitconfig"]
}'
Inspect the complete curl request for creating a labeled JIT runner, including the API version, authorization header, runner group, and runner name. section 6.3.2
