The GitHub Actions self-hosted runner runs on cytohost (or its ARM successor).
It provides the [self-hosted, linux, arm64] label for jobs that need:
``bashSSH into cytohost (t2a-standard-2, us-central1-b)
gcloud compute ssh cytohost --zone=us-central1-b --project=cytognosis-infrastructure
Using the Runner in Workflows
`yaml
jobs:
build:
runs-on: [self-hosted, linux, arm64]
steps:
- uses: actions/checkout@v4
# ... rest of job
`
For jobs that must run on GitHub-hosted runners (e.g., macOS builds):
`yaml
jobs:
build:
runs-on: ubuntu-latest # GitHub-hosted fallback
`
Runner Maintenance
`bash
Check runner status
sudo systemctl status actions.runner.cytognosis.cytohost
View logs
sudo journalctl -u actions.runner.cytognosis.cytohost -f
Update runner binary
sudo ./svc.sh stop
./config.sh remove --token
re-download new binary, re-run config.sh + svc.sh install/start
If node is replaced: deregister old runner first
GitHub org settings → Actions → Runners → delete stale entry
`
ADC (Application Default Credentials) on the Runner
The runner node uses its Compute Engine service account for ADC. Since we disabled
the default compute SA, any workflow using
gcloud or GCP SDKs on the self-hosted
runner must either:
1. Use OIDC in the workflow (recommended — same as GitHub-hosted)
2. Attach a dedicated SA to the node at instance creation time:
`bash
When creating the instance, attach website-deployer SA
gcloud compute instances create cytohost \
--service-account=website-deployer@cytognosis-infrastructure.iam.gserviceaccount.com \
--scopes=cloud-platform \
--zone=us-central1-b
``
Option 1 (OIDC in workflow) is preferred — it works identically on both self-hosted
and GitHub-hosted runners and doesn't require the node to have a SA attached.