Skip to content
GitHub Forensics

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.

Glossary

Self-hosted runner

A machine you operate that runs GitHub Actions jobs. It is not reset between jobs unless ephemeral, and it often sits inside your network.

A self-hosted runner is a machine (VM, container, Kubernetes pod or physical host) running GitHub's runner application to execute Actions jobs for a repository, an organization or an enterprise. Unlike GitHub-hosted runners, it is not guaranteed to be clean between jobs unless it is registered as ephemeral or just-in-time.

A rogue runner registered by an attacker receives jobs and their secrets, and a compromised persistent runner gives a foothold inside your network. Registrations appear in the audit log as org.register_self_hosted_runner or repo.register_self_hosted_runner. See self-hosted runner security.

This tool is not affiliated with, endorsed by or sponsored by GitHub, Inc. or Microsoft Corporation. GitHub and GitHub Actions are trademarks of GitHub, Inc. Other names are trademarks of their respective owners.