Can standard GitHub-hosted runners verify Node before first use?

[jsoine1972-cmd]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Actions Runner

Discussion Details

For standard GitHub-hosted ubuntu-24.04 runners, does GitHub provide a supported way to verify the exact Node executables used by checkout and later workflow steps before either starts? We need the SHA-256 measurements tied to the assigned runner and workflow revision, with execution blocked if either executable differs from the reviewed version. If supported, where is that documented?

[zero7goat]

I don't think GitHub-hosted runners provide a supported way to guarantee this level of verification.

You can inspect the Node versions and executable paths during a workflow run, but that doesn't necessarily verify the exact executable used internally by actions/checkout before it starts.

For a strict SHA-256 verification requirement, I think a self-hosted runner with a controlled environment would be a better approach. Otherwise, you're relying on the runner image and the action's runtime setup, which can change.

Would be interested to know if GitHub documents any supported mechanism for verifying the runner's actual Node executable before action execution.