Keep a self-hosted CI runner safe

Which repositories to connect, why jobs can leave things behind, and ephemeral runners.

Your RunMac is yours alone, but a CI runner executes whatever code a workflow tells it to. GitHub’s own security guidance:

• Self-hosted runners should almost never be used with public repositories: anyone can open a pull request that runs code on your Mac.
• Be careful with private repositories too: anyone who can fork and open a pull request can reach the runner, and with it your secrets.
• A runner can be persistently compromised: something left behind by one job can affect the next.

What we suggest

• Connect only private repositories you control.
• Delete signing material at the end of every job: see Code signing in CI builds.
• Consider an ephemeral runner, which GitHub removes after a single job:

  ./config.sh --url https://github.com/your-org --token YOUR-TOKEN --ephemeral

  You then re-register it for the next job with your own script.
• If you think the Mac is compromised, Reset to clean macOS rebuilds it from scratch in about 20 minutes.