Runners

Warm starts Private beta

Skip your job’s setup time. Jobs start with your toolchains, packages and Docker images already in place, so their setup steps find their work already done.

Add one line after your setup

Put vitko-inc/checkpoint@v1 right after your job’s setup steps. Everything before it is saved from runs of your default branch, and later jobs of the repository start from it.

steps:
  - uses: actions/checkout@v5
  - uses: actions/setup-node@v4
    with:
      node-version: 22
  - run: npm ci
  - uses: vitko-inc/checkpoint@v1   # everything above is saved
  - run: npm test

Your setup steps still run, but find their work done. On any other runner the step does nothing, so the same workflow runs everywhere, and it never fails your job.

What is saved

Installed tools and toolchains.
Package manager caches and installed packages in the runner’s home: npm, pnpm, Yarn, pip, uv, cargo, Go, Maven, Gradle and others.
Docker images.

Your workspace isn’t saved: actions/checkout fetches it fresh in every job. Keep anything your build needs again outside the workspace; most package managers already do.

When it is saved

Only from runs of your default branch: pushes, manual runs and scheduled runs.
Pull requests, including ones from forks, never save anything. They start from your default branch’s setup and install whatever their changes need.
After a new commit lands on your default branch, its next run saves a fresh setup. Until then, jobs start from the previous one.
Each job gets its own copy. What one job writes is never seen by another job.

Secrets

We remove common credentials and refuse to save a setup that still contains one; see Security for what we can’t detect.

Steps before the checkpoint must not use secrets other than GITHUB_TOKEN, including in the workflow’s and job’s env. If they do, nothing is saved, the job summary says why, and the job continues normally. Move steps that need secrets, such as registry logins, after the checkpoint.
Common credential files (Docker, npm, pip, git, cloud CLIs, SSH keys and others) are removed before anything is saved, and if anything that looks like a credential remains, nothing is saved.

Inputs

Input	Default	What it does
`token`	`${{ github.token }}`	Reads this run’s workflow file for the secrets check when the repository isn’t checked out.
`timeout-seconds`	`120`	How long to wait for the setup to be saved before going on without it.

Optional: a setup script instead

If you’d rather keep setup out of your workflows, add a script at .vitko/setup.sh on your default branch. It runs as the job user in a checkout of your repository, with network, and installs what your jobs need. When the script is present, it is used instead of the checkpoint step.

#!/usr/bin/env bash
set -euo pipefail
npm ci
npm run build

A setup script can’t use Docker yet: pre-pulling or building images in it fails. Use the checkpoint step if you want Docker images saved. Docker works normally in your jobs.