Question

Your team runs CI on a self-hosted runner image that intentionally ships minimal software to keep the base image small. A workflow needs a specific version of the AWS CLI that is NOT baked into the image. The security team requires that the installation be reproducible and pinned to an exact version at workflow runtime, without permanently modifying the shared runner image. Which approach best meets these requirements?

Accepted Answer

Add a workflow step that installs the pinned AWS CLI version at runtime (for example, via a package manager or the vendor installer script referencing the exact version), and optionally cache the download to speed up subsequent runs.

Answer

Manually SSH into the self-hosted runner host and install the AWS CLI globally so every job on that runner can use it.

Answer

Switch the job to a GitHub-hosted runner because the AWS CLI is always preinstalled at the exact version your team needs.

Answer

Bake the AWS CLI into the shared custom runner image and rebuild the image each time a new version is required.