Question

Your enterprise runs self-hosted runners on ephemeral VMs that are recreated after each job. Security wants to ensure that if a workflow from an untrusted repository were ever assigned to these runners, the runner process would not persist state or reuse a compromised environment for a subsequent job. Which runner configuration flag best satisfies this requirement?

Accepted Answer

Register the runner with the --ephemeral flag so it accepts only one job and then automatically deregisters

Answer

Register the runner with the --replace flag to overwrite any existing runner registration with the same name

Answer

Register the runner with the --once flag and rely on a cron job to restart the service between runs

Answer

Register the runner using a long-lived Personal Access Token so the runner stays authenticated across jobs