When Mac mini M4 hosts are schedulable build nodes, leaked registration tokens or over-scoped PATs—not SSH passwords—are what let an attacker silently join your pool while dashboards stay green. This 2026 checklist covers rotation cadence, secret storage boundaries, a leak triage matrix, eight response steps, quarterly tabletop guidance, OIDC migration notes, and CMDB minimum fields. Two differently shaped tables plus explicit numeric thresholds let you paste sections straight into your on-call binder.
If runners are not online yet, start with self-hosted GitHub Actions on Mac mini M4. Align maintenance with runner drain and handoffs. When CI shares hardware with agents, read CI and agent capacity lending. For remote consoles use help and VNC.
Why tokens beat passwords as an attack path
- One-time registration misuse: A token pasted into Slack or a ticket can let anyone register a malicious runner within roughly 60 minutes while queues look healthy.
- Over-scoped PATs: A build PAT with repo write plus workflow edit equals indirect access to many secret contexts after a single leak.
- Secrets on disk: Tokens inside backup-synced
.envfiles or plists create false confidence when you rotate upstream but forget golden images.
Rotation cadence and storage patterns
| Credential | Max recommended life | Storage |
|---|---|---|
| Org/repo registration token | Single use, consume within 1 hour | Ephemeral secret manager injection, never bake into images |
| Fine-grained PAT (runner registration only) | Review every 90 days, warn at 30 | macOS Keychain, minimal scopes |
| Wide PAT for debugging | 7 days or forbid on builders | Laptops only, never the runner user profile |
Leak triage matrix
Use the matrix to end the common debate about whether to delete runners first or revoke tokens first—execute column two, then column three, then verify column four before opening the eight-step checklist.
| Exposure | First action | Second action | Proof |
|---|---|---|---|
| Registration token in public channel | Invalidate and regenerate org flow | Audit runners registered in last 24 h | Unknown hosts removed |
| PAT can edit repos and workflows | Revoke immediately | Scan anomalous workflow commits | Default-branch protections intact |
| Suspected runner session theft | Offline host, rotate machine secrets | Inspect unexpected outbound calls | New sessions only from fresh tokens |
CMDB minimums: Every build Mac should record runner_id, a hash fingerprint of the active PAT, last rotation UTC, and owning engineering group. Missing those four fields stretches median incident time from 25 minutes to hours.
OIDC job identities versus PATs
In 2026 many macOS fleets exchange OIDC tokens for short-lived cloud credentials so long-lived PATs never touch disk. Split "clone and test" jobs that only need GITHUB_TOKEN from "deploy" jobs that use OIDC or deploy keys. That way a stolen disk image yields only ephemeral context. Expect to touch 3–5 workflow snippets during migration, but PAT rotation drops from quarterly to emergency-only for most paths.
Stream audit logs to SIEM and alert on repo.* and runner registration events. Without SIEM, a cron job that pulls the last hour of API changes still catches roughly 80% of rogue registrations.
Quarterly fake-leak tabletop
Post a synthetic token fragment in a drill channel and measure whether someone applies the matrix within 15 minutes. First attempts usually fail because nobody knows who can revoke org-level credentials—fix that before production pain. Track decision latency and mis-clicks; require two consecutive 10% improvements before lowering drill frequency. Pair drills with staging versus production runner pools so production only observes whether alerts bleed through.
Eight-step leak response checklist
Keep a printed one-pager next to the rack or in the cloud-region runbook: who owns revocation, the exact URL for runner inventory, and the escalation phone tree. During incidents, cognitive load spikes—searching Notion for "how we revoked last time" burns the 15-minute window that separates clean removal from persistent attacker access.
- Open a security ticket: Capture carrier (Slack/ticket/log) and approximate exposure duration.
- Execute matrix first and second actions: Avoid parallel priority debates.
- Freeze new runner registration: Tighten org policy until fresh token chains exist.
- Drain suspicious hosts: Follow your drain SLO—often 60–90 minutes natural wait.
- Re-register clean runners: Fresh tokens, hostname suffix
-rot-YYYYMMDDfor audit trails. - Validate least privilege: Run read-only clone plus no-op build to prove no stray write scopes.
- Postmortem: Document why chat tools held credentials and which automation gap remains.
- Secondary scan inside 72 h: Hunt lingering PAT usage per OAuth application.
- Close the loop: Update CMDB fingerprints and notify stakeholders that green builds resumed under new credentials only after explicit verification and log review.
Runner service accounts and FileVault unlock order
Dedicated Mac builders should run under a non-admin service account whose password rotation policy matches PAT rotation. Interactive admin logins belong on separate laptops, not on the runner profile—admins tend to leave browser sessions and wide PAT exports behind. After macOS updates, verify the LaunchAgent still loads before FileVault fully unlocks user homedirs; otherwise you get flaky "token valid but runner offline" symptoms that waste hours chasing GitHub instead of launchd ordering.
Document which team may paste registration tokens into chat (ideally nobody). If marketing insists on screenshots, use redacted placeholders and rotate tokens immediately after filming. Measure how often tokens appear in searchable archives; declining that metric is a better KPI than counting password complexity rules nobody reads.
Cloud Mac provider boundaries
Vendors isolate bare metal and network edges; they cannot revoke your GitHub PATs. Write token rotation as an application responsibility in procurement docs. When bursting capacity via regional pricing, keep the same least-privilege PAT instead of temporarily widening scopes "to move faster."
Mac mini M4 Apple Silicon hosts make per-machine runner identities and disk isolation practical, while unified memory reduces suspicious swap during concurrent secret parsing and compilation. NodeMac offers SSH and VNC across Hong Kong, Japan, South Korea, Singapore, and the United States so you can stand up clean nodes quickly after revocation. Pay-as-you-go rental aligns hardware lead time with credential rotation velocity—both determine MTTR when you treat nodes as cattle.