Check your environment.

System requirements

Downloads are currently available for macOS. There are no Windows or Linux desktop downloads in this release.

macOS 13 is the app’s minimum. Your container engine has its own OS, memory and storage requirements: check Docker Desktop’s system requirements or OrbStack’s installation guide for the version you choose.

Optional on-device explanations need compatible Apple Intelligence hardware, macOS 26 or later and an available model. Manual setup, supported diagnostics, logs and recorded comparisons work without it. Spotlight indexes project and workflow titles; Spotlight actions require macOS 26 or later. Shortcuts preparation opens the app for normal review.

Images & architecture

The app defaults to Docker and linux/amd64 execution. Apple Silicon Macs can select linux/arm64, but your actions, tools and image must support that architecture. An amd64 run on Apple Silicon may use emulation; its timings do not represent a GitHub-hosted runner.

Balanced images are smaller than GitHub’s hosted environments and do not include every tool. Full images require substantial download and disk space; the native settings describe approximately 20 GB to download and 60 GB on disk. Check your host and Docker storage before pulling them.

For a workflow using runs-on: ubuntu-24.04, the default Balanced mapping is catthehacker/ubuntu:act-24.04. If a step fails with a missing command, inspect that image’s tools or choose a suitable custom mapping in Project settings. A different image changes the execution environment.

See act’s runner documentation for why a container is not an exact copy of a hosted VM.

GitHub differences

Review act’s documented unsupported functionality alongside the compatibility notes shown in Runnr. Important differences include:

• OIDC: act does not provide GitHub’s OIDC request URL. Cloud login steps that depend on it need a suitable alternative for local checks.
• Permissions and environments: GitHub token permission enforcement, environment-scoped secrets and hosted environment policies are not reproduced. Runnr’s local approval gates serve a different purpose.
• Concurrency and timeouts: act ignores workflow concurrency and job timeout-minutes. Runnr’s project timeout bounds the entire local process, including time spent waiting for deployment approval.
• Hosted context and tooling: event fields and preinstalled VM tools can differ. Provide the event payload your selected jobs need.
• Reports: act has limits around hosted summaries and problem matchers. Runnr independently reads supported output, including GitHub ::error annotations and uploaded JUnit reports. Keep the original logs as evidence.

A local pass does not guarantee a hosted pass. Keep required hosted checks and protected-branch policies. Runnr does not automatically disable or cancel the workflows triggered by a push.

Experimental host mode

Host mode uses act’s -self-hosted backend with the machine’s actual OS and tools. It does not turn macOS into Linux. PHP, Composer, Node and other required tools must already be installed; service and container workflows still require Docker.

Host commands run with your Mac’s permissions and installed tools. Review the workflow and explicitly trust a host request in the app. Host trust is not retained when preparing another run. Use Docker for the normal Linux workflow path.

Interactive debugging, breakpoint/watch and preset controls, the Electron dependency graph, reusable workflows and automatic retries are outside native 0.4.3. Expanded Git tools and Raycast Store availability are upcoming. Exportable Raycast source and Quicklinks are available in settings.

Credentials, files and logs

Runnr encrypts saved credentials using AES-256-GCM, with its key protected by the signed helper’s Keychain access group. Protected secrets require authentication. Ordinary variables are visible configuration; use Secrets for sensitive values.

For execution, secrets are supplied through files in a private temporary directory, rather than process arguments. Temporary files are removed after the run, with stale-file cleanup on startup. This is cleanup, not a guarantee of forensic secure erasure.

act masking and Runnr’s additional redaction cover configured secrets, supported encodings and dynamic masks before logs are displayed or saved. Workflow code can transform or transmit credentials; only run code you trust with the values you provide.

Import from GitHub previews repository or environment variables for selective merging. Existing names are unselected by default. Imports are snapshots; GitHub exposes secret names without their values. Settings-only team exports contain no secrets or repository path. Encrypted .runnr-team bundles use a passphrase, scrypt key derivation and AES-256-GCM. Imported automation remains disabled, and importing never starts a run.

Run history and full retained logs are local. History retains up to 100 completed runs and 20,000 lines per run; export includes retained lines. Explicit workflow commands can still read files or use the network. Runnr does not silently load the repository’s .env as the job environment.

Network & GitHub

Licence activation and validation contact the licensing service; update checks contact the release service. Successful licence validation allows up to 7 days of offline use. Images, actions, package downloads and workflow steps may need network access, so Runnr is not unconditionally offline.

The optional GitHub integration uses your signed-in GitHub CLI account. Eligible clean-checkout results can publish a commit status and a PR comment with a bounded, redacted failure excerpt. The account, clean checkout and exact PR commit are checked again before writes. Dirty, ambiguous or divergent checkouts and cancelled runs stay local. Full logs are not uploaded by that integration.

CLI and MCP connect through an authenticated local service while Runnr is open. Requests need desktop review by default unless project access is explicitly enabled. Deployment approvals and protected-secret authentication remain separate. Local deployment gates do not enforce GitHub’s environment reviewer policies.

For that integration only, install gh and sign in for your repository’s host:

gh auth login

Do not enable publication as a substitute for hosted verification. For the setup path, read running GitHub Actions locally; for the execution model, see how Runnr and act work together.