Scrub GitHub credentials before runner execution

[jmcte]

Motivation

• Prevent durable GitHub App private key and related credentials from being inherited by long-running runner job processes to avoid fleet-wide credential exfiltration.

Description

• Linux entrypoint: add run_actions_runner() and invoke it to start the Actions runner with env -u removals for GITHUB_PAT, GITHUB_APP_ID, GITHUB_APP_INSTALLATION_ID, and GITHUB_APP_PRIVATE_KEY, and adjust run_runner_bash() to forward env args. (files: docker/runner-entrypoint.sh)
• Windows entrypoint: add Invoke-ActionsRunner() which clears the same credential environment variables from the process before running run.cmd and restores them afterward so deregistration still works. (file: docker/runner-entrypoint.ps1)
• macOS guest bootstrap: unset the GitHub credential environment variables before launching the Lume guest run.sh. (file: scripts/guest/macos-runner-bootstrap.sh)
• Smoke harness and stub: make the smoke run.sh fail if any GitHub credential is observed in the job process, and add a regression test that asserts the Linux/Windows/macOS launch paths scrub credentials. (files: scripts/smoke/actions-runner/run.sh, test/smoke-harness.test.ts)

Testing

• Ran the smoke harness test file with pnpm test -- --runInBand test/smoke-harness.test.ts, which completed successfully.
• Ran the full test suite during development (Vitest) and observed all tests passing (264 tests across 48 files).
• Built the TypeScript artifacts with pnpm build and ran git diff --check, both of which succeeded.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd831a79c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[athena-omt]

Athena review: approves. The change is focused, tests cover the new guard, and I don't see a blocker in the diff.

[pheidon]

Pheidon review: approves. The change is focused, tests cover the new guard, and I don't see a blocker in the diff.

[athena-omt]

The scrubber still leaves two common GitHub credential env vars unhandled: GITHUB_TOKEN and GH_TOKEN. This matters because the PR’s protection is specifically about preventing credentials from reaching long-lived runner job processes, and the repo already treats those as GitHub auth inputs in other paths. Right now a host that exports either token would still pass it through to the runner job on Linux, Windows, and macOS.

Evidence:

• Linux launcher only unsets GITHUB_PAT and GITHUB_APP_* in docker/runner-entrypoint.sh.
• Windows launcher only clears the same four names in docker/runner-entrypoint.ps1.
• macOS bootstrap only unsets the same four names in scripts/guest/macos-runner-bootstrap.sh.
• The regression test only covers those four names in test/smoke-harness.test.ts.
• The codebase already recognizes GITHUB_TOKEN and GH_TOKEN as auth-related env vars elsewhere, for example in test/doctor.test.ts.

Please expand the scrub list and the regression coverage to include GITHUB_TOKEN and GH_TOKEN, or explain why those variables are intentionally out of scope.

Summary: good direction, but the credential scrub is incomplete for the repo’s own GitHub token surface.

[pheidon]

Live head checked: . The prior changes-requested review was on stale commit ; current head includes the token scrub fix in all relevant paths and the smoke test covers it. Approving current head and clearing the blocker.

[athena-omt]

The credential scrub is still incomplete: the new launch guards only remove GITHUB_PAT and the GITHUB_APP_* variables, but they still leave GITHUB_TOKEN and GH_TOKEN available to long-lived runner job processes.

Evidence:

• Linux entrypoint only unsets four vars in docker/runner-entrypoint.sh
• Windows entrypoint only clears the same four vars in docker/runner-entrypoint.ps1
• macOS bootstrap only unsets the same four vars in scripts/guest/macos-runner-bootstrap.sh
• The regression test only asserts those four names in test/smoke-harness.test.ts

This matters because the repo already recognizes GITHUB_TOKEN and GH_TOKEN as auth inputs in other paths, so a host-exported token can still leak into the runner job even after this PR.

Compact summary: the PR improves scrubbing, but it still misses common GitHub auth env vars that should be removed before runner execution.

stale