Q: Your team heavily utilizes GitHub Actions, but the monthly bill for GitHub-hosted runners has skyrocketed. You want to switch to self-hosted runners, but are worried about security and state poisoning if runners are reused. How do you implement this safely?

You must undeniably use Ephemeral Runners combined with Auto-Scaling (e.g., Actions Runner Controller in Kubernetes). A standard self-hosted runner executes a job and remains alive to accept the next one. This means a malicious PR could execute docker run crypto-miner in the background, or leave behind hidden malware in the /tmp directory that instantly infects the next team's build. By passing the --ephemeral flag when registering the runner, the runner mathematically guarantees it will cleanly accept only one single job. The moment the job finishes, the runner aggressively unregisters itself and the underlying Pod or EC2 instance is completely destroyed, guaranteeing an immutable, clean slate for every build.