GitHub Actions to Enforce Minimum Version Requirements for Self-Hosted Runners
GitHub has announced the resumption of its minimum version enforcement timeline for self-hosted runners operating on github.com and GitHub Enterprise Cloud with Data Residency. This policy update is part of an ongoing security initiative aimed at strengthening the infrastructure of running workflows. Outdated runner versions lack crucial security patches and feature updates, making them a potential vector for vulnerability exploitation within CI/CD pipelines.
Related tools
Recommended tools for this topic
These picks prioritize high-intent tools relevant to this topic. Some links may include partner or affiliate tracking.
A strong security and edge platform match across CDN, Zero Trust, and app protection.
View CloudflareA high-relevance security pick for identity, secret management, and team access control.
View 1PasswordStrong for identity, OIDC, and B2B auth readers evaluating implementation tradeoffs.
View Auth0Action Checklist
- Identify all self-hosted runners currently connected to your GitHub organization or enterprise. Use the GitHub REST API or the admin dashboard to export the list of active runners.
- Check the current runner application version running on each self-hosted machine. Compare your active runner versions against the latest official releases on the actions/runner repository.
- Enable automatic updates for self-hosted runners where possible. Automatic updates ensure runners receive security patches and meet version requirements without manual intervention.
- Manually upgrade any runners restricted from automatic updates behind strict firewalls. Ensure outbound network rules permit the runner to fetch the latest binaries from GitHub distribution servers.
- Monitor workflow run logs for deprecation warnings or runner connection errors. Runners below the minimum enforced version will fail to register and accept new jobs once enforcement goes live.
Source: GitHub Changelog
This page summarizes the original source. Check the source for full details.
