An ephemeral self-hosted runner, and why persistence leaks

A hosted runner cannot reach the private network, so a deploy job needs a runner inside it — and a long-lived runner inside the network accumulates everything every job has touched.

# --ephemeral: the runner processes ONE job and exits
$ ./config.sh --url https://github.com/org/repo 
    --token "$TOKEN" --ephemeral --labels deploy
$ ./run.sh

# supervised, so a new one registers after each job.
# without --ephemeral, job N+1 inherits job N's:
#   working directory, docker layer cache, ssh agent,
#   anything written outside the workspace

The inheritance is the whole problem: a workflow that writes a credential to ~/.netrc leaves it for the next job, which may be from a different branch. Ephemeral runners cost a registration per job, which is a few seconds, and remove the entire category. The harder question is whether a fork’s pull request can reach that runner at all — and the answer has to be no, which is a repository setting rather than a runner one.