A runner registration token authorizes a self-hosted GitHub Actions runner to join GitHub at an enterprise, organization, or repository scope. Supply it during configuration, alongside the GitHub URL; the selected service and scope cannot be changed after installation. Tokens generated in the UI or through the organization REST endpoint expire after one hour and can be used only once for installation. section 6.1
Treat registration as a security boundary. Runner configuration creates local files containing runner identity and longer-lived connection credentials. A job able to read those files may be able to start a similarly configured runner elsewhere; Linux credential material is described as copyable, while the Windows RSA-parameter file is protected for the local machine. Limit access to the account running the service and avoid exposing runner files to untrusted jobs. section 6.1.1
Register a Linux runner
After downloading and extracting the runner package, invoke its configuration script with the target URL and a freshly generated token, then start it. The token belongs in the configuration command, not in a workflow file or reusable machine image. ./config.sh --url https://github.com/devops-actions --token <registration-token> ./run.sh section 6.1 section 6.1 section 6.1
For tighter exposure limits, use just-in-time (JIT) configuration. Request encoded JIT configuration from the organization API, start the runner with --jitconfig, and let it accept one job. The JIT configuration is valid for one installation and cannot be reused; after the job, GitHub removes the runner and stops its service. Clean up the underlying environment with a completion hook to prevent reuse. section 6.3.2 section 6.3.2
Listing 6.2 Configuring and starting the runner
# Create the runner and start the configuration experience. $ ./config.sh --url https://github.com/devops-actions --token ABONY4PKE6CXIW5YZREB3EDES4LLG # Last step, run it! $ ./run.sh
Use this command sequence to see where the registration token is passed during interactive runner configuration and how the runner process is started afterward. section 6.1
