GitHub Tightens Self-Hosted Runner Versions: Protect Proxy CI Before Enforcement

GitHub Enterprise Cloud is scheduled to begin full enforcement of minimum self-hosted Actions runner versions on September 25, 2026. GitHub says a runner that falls more than 30 days behind an available update can lose registration or runtime support; a critical security update can also pause job queuing until the runner is updated.

For proxy engineering, browser automation, authorized data collection and regional verification teams, the risk is operational confusion. An outdated runner may stop registering, remain queued or fail to execute, while monitoring reports a “proxy test failure.” No request may have reached the proxy at all.

What the enforcement changes

The policy applies to GitHub-hosted service users operating self-hosted runners on GitHub Enterprise Cloud, including the published cloud enforcement timeline. GitHub Enterprise Server is not included in this specific schedule.

GitHub's model separates two boundaries:

• registration support: whether a runner can register or reregister;
• runtime support: whether an already connected runner can receive and execute jobs.

After enforcement, a stale runner can fail at either boundary. Treat queueing, registration and network-test execution as separate states. A proxy health metric should begin only after the runner has accepted the job and the network test has produced a start marker.

Build a complete runner inventory

Do not rely only on runners visible as online in one repository. Inventory organization, enterprise, autoscaled and ephemeral pools, plus images that can create future runners.

Record:

runner_group
runner_name_or_instance_id
runner_version
operating_system_and_architecture
image_or_template_digest
registration_source
last_registration_time
last_job_time
labels
network_zone
proxy_test_role
owner
upgrade_method

Audit installation scripts, golden images, container images, machine templates and disaster-recovery copies. Updating a running machine is not enough if the autoscaler can recreate an older version five minutes later.

Separate runner health from proxy health

Add explicit lifecycle markers:

1. workflow queued;
2. runner assigned;
3. job started;
4. proxy test process started;
5. proxy gateway reached;
6. authentication completed;
7. destination assertion completed;
8. cleanup completed.

Only stages five through seven describe the proxy path. A job that never leaves the queue must not reduce proxy success rate, rotate an exit or trigger a provider incident.

Use separate error classes for unsupported runner, registration rejected, job not assigned, tool bootstrap failure and actual network failure. This preserves purchasing and reliability signals.

Find stale versions before the deadline

GitHub exposes runner-version information and audit evidence, including registration events. Use repository, organization and enterprise views appropriate to your fleet, but remember that registration logs show runners that registered; they are not necessarily a complete inventory of every connected or dormant machine.

Compare three sources:

• control-plane list of registered runners;
• infrastructure inventory and autoscaling templates;
• recent workflow evidence showing the runner version that actually executed.

A runner absent from recent jobs can still be selected during failover. Test standby and disaster-recovery pools explicitly.

Upgrade the factory, not only the fleet

Update the mechanism that creates runners first:

• installation and bootstrap scripts;
• VM, container and machine images;
• autoscaler launch templates;
• cached offline packages;
• network allowlists required for runner updates;
• health checks that decide when a runner joins a label group.

Then replace or upgrade existing instances. New runners should report a supported version before receiving sensitive proxy credentials or production network jobs.

Do not broaden outbound access permanently just to make upgrades work. Use approved artifact sources, verify signatures or digests where your process requires them, and keep proxy bypass rules narrow. The NO_PROXY policy test can prove that update traffic and test traffic follow their intended routes.

Canary proxy CI after upgrading

Upgrading a runner changes more than one binary in many fleets. The base image, certificates, shell tools, browsers, libraries or service configuration may also change. Run a low-volume canary before replacing all workers.

Test:

• runner registration and job pickup;
• action startup and required runtime availability;
• proxy secret injection without log exposure;
• DNS behavior for the proxy gateway and destination;
• HTTP proxy, HTTPS CONNECT and SOCKS modes in use;
• IPv4 and IPv6 when purchased;
• certificate and hostname verification;
• sticky and rotating session semantics;
• response integrity, cancellation and bounded retries;
• artifact upload and cleanup.

Use destinations you own or are authorized to test. Keep the proxy account, target, payload and acceptance criteria fixed while comparing old and upgraded runner groups.

The Node 24 Actions migration plan helps distinguish JavaScript action runtime changes from application runtime and proxy behavior.

Protect credentials during replacement

Ephemeral runners should receive short-lived, least-privilege credentials only after they have passed version and posture checks. Never bake proxy passwords, cookies or tokens into a machine image.

When retiring old instances:

• stop new job assignment;
• wait for or safely cancel in-flight work;
• revoke runner registration material;
• remove temporary proxy allowlist entries;
• delete local work directories and diagnostic artifacts according to policy;
• confirm the instance cannot rejoin from a stale snapshot.

If logs reveal a proxy credential during troubleshooting, rotate it. Removing the runner does not invalidate a leaked secret.

Design a rollback that stays supported

Rollback should not restore an unsupported runner version. Keep a previous validated infrastructure revision whose runner remains within the supported window, or maintain a small known-good pool on a current release.

Useful rollout stages are:

1. one non-production runner;
2. one production canary per network zone;
3. 10 percent of each label group;
4. half the fleet;
5. full replacement after stable evidence.

At every gate, compare job pickup delay, useful-result rate, p95 test duration, retry amplification and cost per verified result. A faster queue is not useful if response validation falls.

Respond correctly when jobs stop

If jobs remain queued near enforcement:

1. inspect runner assignment and version annotations;
2. confirm the runner can register and is eligible for the requested labels;
3. inspect runner service logs for update or compatibility errors;
4. check whether the autoscaler is launching a stale template;
5. only after the network test starts, investigate proxy DNS, authentication, tunnels and exits.

Do not rotate residential IPs, expand concurrency or change proxy providers to fix a job that never executed. Those actions add cost and destroy diagnostic evidence.

Readiness checklist

• All runner groups, standby pools and autoscaling templates are inventoried.
• The latest created runner reports the intended supported version.
• Registration and runtime support are monitored separately.
• Queue failures cannot contaminate proxy success metrics.
• Runner factory images and bootstrap scripts are updated.
• Offline caches cannot recreate stale runners.
• Upgrade traffic follows approved network policy.
• Proxy credentials are injected after posture checks and never baked into images.
• Canary tests cover DNS, authentication, tunnel, TLS, route and response integrity.
• IPv4, IPv6 and required markets are tested independently.
• Cancellation, cleanup and artifact handling pass.
• Rollback uses a supported known-good runner version.
• Retired runners cannot rejoin and their registration material is revoked.

FAQ

Does this enforcement apply to GitHub Enterprise Server?

GitHub's published September 25 timeline applies to GitHub Enterprise Cloud. The announcement states that GitHub Enterprise Server is not affected by this specific change.

Will every runner exactly 30 days old stop at once?

The rule is tied to how long an update has been available and the minimum versions required for registration and runtime support. Inspect the current annotations and APIs rather than inferring eligibility from installation date alone.

Is an online runner necessarily compliant?

No. Online state does not prove future registration or runtime eligibility, and an autoscaler may still recreate an older build. Verify the executed version and the source image.

Should proxy tests use hosted runners instead?

That depends on network access, data handling, regional requirements and security policy. A temporary hosted-runner control can help diagnosis, but it does not replace validation of the production runner architecture.

What is the most important metric during rollout?

Use verified useful-result rate, segmented by runner version and network zone. Keep queue delay, execution failures and proxy-path failures as separate dimensions.

Compliance note

Run proxy and data-collection checks only against systems, accounts, data and markets you are authorized to use. Respect access controls, privacy requirements, destination terms and rate limits. Protect runner and proxy credentials, retain minimal evidence and do not use proxy rotation to conceal prohibited activity.

Source note: GitHub, “GitHub Actions: Minimum version enforcement timeline for self-hosted runners,” June 12, 2026; timeline reviewed September 24, 2026. External research locations are retained only in the internal operations record.