syntaqxA self-hosted runner leaves the computer it runs on as little of a job's secrets as it can. A workflow job's token, which sits where the computer can see it (a Windows job's script in the folder Windows Sandbox reads, a container's environment), is spent on fetching the job: the harness asks for it (rotate, set by the self-hosted runner through G1T_ROTATE_JOB_TOKEN), and job_spec answers with a new token beside the spec, swapped in last and only while the old one is still the job's, so a copy left behind, or a second fetch racing the first, is refused and can't fetch the spec, its secrets or a G1T_TOKEN again. The harness reports, logs, uploads and caches with the new one, masked in the log, and the toolkit's runtime token is signed for it. Harnesses that don't ask, g1t's own sandboxes among them (which keep their token to report a sandbox that stopped), keep theirs, and a harness that asks a g1t that doesn't rotate gets no new token and carries on as before. A Windows job's folder is deleted when the job ends, as before, and now also when the runner next starts after being stopped mid-job (a crash, or taskkill from sandbox down).47627cfHistory
README.md
GitHub's workflow schema
workflow-v1.0.json is GitHub's schema for workflow files, copied unchanged from
actions/languageservices, file
workflow-parser/src/workflow-v1.0.json, at commit
4043eda158e16579cc5fb1b0b07a4bce2a76f0b5 (5 August 2026). It is MIT licensed;
LICENSE is that repository's licence, copied from the same commit.
g1t does not read it at run time. src/syntax.rs lists the keys each part of a
workflow may have, and its tests check those lists against this file, so they
cannot drift from GitHub's. To update it, copy the file again, write the commit
here, and run cargo test -p g1t-actions.