policy auth_error ai_generated true

Error: The self-hosted runner registration token has expired. Please generate a new token and re-register the runner.

ID: policy/github-actions-self-hosted-runner-token-expired

Also available as: JSON · Markdown · 中文

95%Fix Rate

90%Confidence

1Evidence

2024-01-10First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
GitHub Actions Runner v2.311.0	active	—	—	—
GitHub Actions Runner v2.312.0	active	—	—	—
GitHub Actions Runner v2.313.0	active	—	—	—

Root Cause

GitHub self-hosted runner registration tokens have a configurable expiration (default 1 hour) and if the runner registration process is delayed or the token is stored and reused after expiration, registration fails.

generic

中文

GitHub 自托管运行器注册令牌具有可配置的过期时间（默认 1 小时），如果运行器注册过程延迟或令牌在过期后被存储并重用，注册将失败。

Official Documentation

https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners

Workarounds

95% success Generate a new registration token from GitHub repository settings and re-register the runner. Example: # On GitHub: Settings > Actions > Runners > New self-hosted runner > Copy token # On runner machine: ./config.sh remove --token OLD_TOKEN ./config.sh --url https://github.com/owner/repo --token NEW_TOKEN ./run.sh
```
Generate a new registration token from GitHub repository settings and re-register the runner.
Example:
  # On GitHub: Settings > Actions > Runners > New self-hosted runner > Copy token
  # On runner machine:
  ./config.sh remove --token OLD_TOKEN
  ./config.sh --url https://github.com/owner/repo --token NEW_TOKEN
  ./run.sh
```
90% success Automate token generation using GitHub API in a script to avoid manual steps. Example: # Get token using GitHub API TOKEN=$(curl -s -X POST -H "Authorization: token $GITHUB_PAT" \ https://api.github.com/repos/owner/repo/actions/runners/registration-token | jq -r '.token') ./config.sh --url https://github.com/owner/repo --token $TOKEN
```
Automate token generation using GitHub API in a script to avoid manual steps.
Example:
  # Get token using GitHub API
  TOKEN=$(curl -s -X POST -H "Authorization: token $GITHUB_PAT" \
    https://api.github.com/repos/owner/repo/actions/runners/registration-token | jq -r '.token')
  ./config.sh --url https://github.com/owner/repo --token $TOKEN
```
85% success Use a service like Terraform or Ansible to manage runner registration, ensuring tokens are generated fresh each time. Example (Terraform): resource "github_actions_runner_registration_token" "this" { repository = "owner/repo" } # Then use the token in a provisioner
```
Use a service like Terraform or Ansible to manage runner registration, ensuring tokens are generated fresh each time.
Example (Terraform):
  resource "github_actions_runner_registration_token" "this" {
    repository = "owner/repo"
  }
  # Then use the token in a provisioner
```

中文步骤

从 GitHub 仓库设置生成新的注册令牌并重新注册运行器。
示例：
  # 在 GitHub 上：设置 > 操作 > 运行器 > 新建自托管运行器 > 复制令牌
  # 在运行器机器上：
  ./config.sh remove --token OLD_TOKEN
  ./config.sh --url https://github.com/owner/repo --token NEW_TOKEN
  ./run.sh

使用 GitHub API 在脚本中自动化令牌生成，避免手动步骤。
示例：
  # 使用 GitHub API 获取令牌
  TOKEN=$(curl -s -X POST -H "Authorization: token $GITHUB_PAT" \
    https://api.github.com/repos/owner/repo/actions/runners/registration-token | jq -r '.token')
  ./config.sh --url https://github.com/owner/repo --token $TOKEN

使用 Terraform 或 Ansible 等基础设施即代码工具管理运行器注册，确保每次生成全新的令牌。
示例（Terraform）：
  resource "github_actions_runner_registration_token" "this" {
    repository = "owner/repo"
  }
  # 然后在 provisioner 中使用令牌

Dead Ends

Common approaches that don't work:

Restarting the runner service 90% fail
Restarting the runner service does not refresh the expired token; the token is only valid for initial registration, not for ongoing operations.
Editing .runner file to extend token expiration 95% fail
Modifying the .runner file to extend the expiration date manually will not work because the token is validated server-side by GitHub.
Deleting and re-adding with same token 85% fail
Deleting the runner from GitHub and re-adding it with the same expired token will still fail; a new token must be generated.