syntaqxA self-hosted runner leaves the computer it runs on as little of a job's secrets as it can. A workflow job's token, which sits where the computer can see it (a Windows job's script in the folder Windows Sandbox reads, a container's environment), is spent on fetching the job: the harness asks for it (rotate, set by the self-hosted runner through G1T_ROTATE_JOB_TOKEN), and job_spec answers with a new token beside the spec, swapped in last and only while the old one is still the job's, so a copy left behind, or a second fetch racing the first, is refused and can't fetch the spec, its secrets or a G1T_TOKEN again. The harness reports, logs, uploads and caches with the new one, masked in the log, and the toolkit's runtime token is signed for it. Harnesses that don't ask, g1t's own sandboxes among them (which keep their token to report a sandbox that stopped), keep theirs, and a harness that asks a g1t that doesn't rotate gets no new token and carries on as before. A Windows job's folder is deleted when the job ends, as before, and now also when the runner next starts after being stopped mid-job (a crash, or taskkill from sandbox down).47627cfHistory
