How to Use a Just-in-Time (JIT) Runner in GitHub Actions

A JIT runner is configured from a single-use jitconfig token, forcing it to be ephemeral and removing the need to store a registration token.

Call the generate-jitconfig REST endpoint to mint a one-time config, then start the runner with --jitconfig. The runner runs exactly one job and cannot re-register.

Steps

• Call the API to create a JIT config for a named runner with labels.
• Pass the returned encoded config to ./run.sh --jitconfig.
• The runner runs one job and removes itself.
• Generate a new JIT config for the next runner.

Generate and start

# 1) Mint a JIT config (returns .encoded_jit_config)
curl -X POST \
  -H "Authorization: Bearer $GH_TOKEN" \
  https://api.github.com/repos/my-org/my-repo/actions/runners/generate-jitconfig \
  -d '{"name":"jit-runner-1","runner_group_id":1,"labels":["self-hosted","ephemeral"]}'

# 2) Start the runner with the encoded config
./run.sh --jitconfig "${ENCODED_JIT_CONFIG}"

Gotchas

• JIT runners are ephemeral by definition; there is no persistent registration to clean up.
• You need a runner group id; use the default group id 1 if you have not created groups.
• No long-lived registration token is stored on disk, which is the main security win over classic config.sh.

Related guides