Checkpoint Lab — GitHub-Hosted Runners, Images, Labels, Hardware, and Runtime Behavior

1. Checkpoint charter

2. Write predictions before execution

1. Ubuntu and Windows jobs will receive different fresh instances and OS/shell semantics.
2. The same Python line will be installed explicitly on both jobs even if preinstalled Python differs.
3. A hard-coded Unix path will fail on Windows, and that failure will occur before any external side effect.
4. The repaired workflow will use RUNNER_TEMP and PowerShell to produce equivalent local output on both OSes.

3. Run A — preserve a controlled portability failure

name: chapter08-checkpoint-broken
on: workflow_dispatch
permissions: {}

jobs:
  probe:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-2025]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Runner identity
        shell: pwsh
        run: |
          "requested=${{ matrix.os }}"
          "runner_os=${{ runner.os }}"
          "runner_arch=${{ runner.arch }}"
          "image_os=$env:ImageOS"
          "image_version=$env:ImageVersion"
          "run_id=$env:GITHUB_RUN_ID"
          "attempt=$env:GITHUB_RUN_ATTEMPT"
          "sha=$env:GITHUB_SHA"

      - name: Set up Python 3.13
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.13'
          check-latest: false

      - name: Record Python
        shell: pwsh
        run: python --version

      - name: Intentionally non-portable step
        shell: bash
        run: |
          printf 'hello
' > /tmp/ch08.txt
          cat /tmp/ch08.txt

Preserve the Windows failure exactly. Do not edit the failed run or pretend the job tested your application. The failure belongs to workflow portability.

4. Run B — repair with runner-provided paths

      - name: Portable deterministic probe
        shell: pwsh
        run: |
          $p = Join-Path $env:RUNNER_TEMP 'ch08.txt'
          'hello' | Set-Content $p
          $text = (Get-Content $p -Raw).Trim()
          if ($text -ne 'hello') { throw "unexpected content" }
          "probe_result=$text"
          "temp_path=$env:RUNNER_TEMP"

Run B should make both matrix cells green. Record the new run ID/attempt and keep Run A as evidence of the original mistake.

5. Reproducibility manifest

Add this safe manifest step to Run B:

$m = [ordered]@{
  run_id        = $env:GITHUB_RUN_ID
  run_attempt   = $env:GITHUB_RUN_ATTEMPT
  source_sha    = $env:GITHUB_SHA
  requested_os  = '${{ matrix.os }}'
  runner_os     = '${{ runner.os }}'
  runner_arch   = '${{ runner.arch }}'
  image_os      = $env:ImageOS
  image_version = $env:ImageVersion
  python        = (python --version 2>&1 | Out-String).Trim()
  git           = (git --version | Out-String).Trim()
  setup_python  = '5fda3b95a4ea91299a34e894583c3862153e4b97'
  setup_release = 'v7.0.0'
  secrets_logged = $false
}
$m | ConvertTo-Json -Depth 3 | Set-Content "$env:RUNNER_TEMP/repro-manifest.json"
Get-Content "$env:RUNNER_TEMP/repro-manifest.json"

The manifest is evidence, not a VM snapshot. It lets another engineer identify the runner image release and explicit toolchain but does not freeze every kernel package, network condition, CPU scheduling decision, or upstream service.

6. Reconcile the two OS cells

7. Verification checklist

• Two requested versioned runner labels only.
• Exact run IDs/attempts and source SHA preserved for Run A and Run B.
• First Windows failure retained, not overwritten by narrative.
• ImageOS/ImageVersion and runner.os/runner.arch recorded.
• Python set explicitly with the immutable official action SHA.
• No whole-environment dump, secret, token, artifact/cache, cloud service, package publication or deployment.
• Repaired workflow uses runner-provided temp state and succeeds on both OSes.
• Manifest states its limitation: evidence identity is not a bit-for-bit VM snapshot.

8. Cleanup / rollback

The hosted instances are destroyed automatically after each job. Remove the checkpoint workflow/branch if it is lab-only, or keep it as course evidence. There is no cloud resource, secret, package, environment, self-hosted runner, or external target to revoke.

9. Chapter 08 production operating contract

Chapter 08 adds a runner reproducibility contract: every important run records requested label, actual image release, architecture, relevant hardware class, explicit critical toolchain versions, job-local filesystem boundaries and external-network assumptions. -latest is a migration policy, not a frozen machine. Preinstalled software is convenient image state, not an undeclared application dependency.

Chapter 09 moves to self-hosted runners, runner groups, isolation, and operational security, where the fresh-hosted-instance assumption disappears and your organization becomes responsible for runner persistence, patching, cleanup, network reachability and trust.

Knowledge check

Official references and version notes

• GitHub-hosted runners reference — current standard/larger runner behavior, filesystem, networking, IP and privilege details.
• Choosing the runner for a job — current runs-on labels, public/private standard runner specifications and architecture availability.
• Using GitHub-hosted runners — current fresh-instance execution model and runner selection.
• GitHub Actions runner images — authoritative current image-label mappings, image releases, weekly update cadence and included-software manifests.
• Ubuntu 24.04 software manifest — current Ubuntu 24.04 image software inventory; verify the run-specific image release rather than assuming this file is frozen.
• Windows Server 2025 software manifest — current Windows Server 2025 image software inventory.
• macOS 26 software manifest — current macOS 26 Arm64 hosted-image inventory.
• Runner context — current runner.os, runner.arch, runner.temp, runner.tool_cache and related context fields.
• Default environment variables — current workspace, temp, repository, run and runner-related default environment state.
• Larger runners concept — current larger-runner plan boundaries and features such as additional resources, groups, autoscaling, GPU and networking options.
• Larger runners reference — current larger-runner hardware/network restrictions, static-IP and macOS caveats.
• setup-python releases — current official action release history; Chapter 08 uses an immutable SHA corresponding to v7.0.0.