Self-Hosted Runner and GitHub-Hosted Runner: Secret Mapping Interoperability

Secret Availability Across Runner Types

The goal is to guarantee that a secret defined in the repository is accessible as an environment variable in every job step, irrespective of whether the workflow runs on a self-hosted or GitHub-hosted runner.

Constraints include the requirement to explicitly map secrets to env vars in the workflow YAML, the potential for self-hosted runners to retain stale environment variables between runs, and regional variations in the timing of GitHub-hosted runner image updates that may affect default tooling.

Does GitHub Actions guarantee that a secret mapped to an environment variable is available at the start of every job step regardless of runner type?

Is there a recommended practice to enforce a clean environment on self-hosted runners that mirrors the ephemeral nature of GitHub-hosted runners for secret consumption?

What verification steps can be added early in a workflow to confirm that all required secrets are present before proceeding with build steps?