I created this before github had an API to get self-hosted runner token - https://developer.github.com/v3/actions/self_hosted_runners/#create-a-registration-token

scrape-token.js

const puppeteer = require('puppeteer');

async function run() {
    const browser = await puppeteer.launch({
        headless: true
    });
    const repo = process.argv[2]
    const page = await browser.newPage();
    await page.goto('https://github.com/login');

    const USERNAME_SELECTOR = '#login_field';
    const PASSWORD_SELECTOR = '#password';
    const BUTTON_SELECTOR = '#login > form > div.auth-form-body.mt-3 > input.btn.btn-primary.btn-block';
    const CREDS = require('./creds');

    await page.click(USERNAME_SELECTOR);
    await page.keyboard.type(CREDS.username);
    await page.click(PASSWORD_SELECTOR);
    await page.keyboard.type(CREDS.password);
    await page.click(BUTTON_SELECTOR);

    await page.goto('https://github.com/myOrg/'+repo+'/settings/actions');
    await page.waitForSelector('#js-pjax-container', {
        timeout: 60000
    });

    const ADD_RUNNER = '#js-pjax-container > div.container-lg.clearfix.new-discussion-timeline.experiment-repo-nav.px-3 > div > div > div.col-9 > div.Subhead.Subhead--spacious > div.Subhead-actions';
    await page.click(ADD_RUNNER);
    await page.waitFor(2 * 1000);

    const mytoken = await page.evaluate(() => {
        return document.getElementById('clipboard-copy-content-linux-create-the-runner-and-start-the-configuration-experience').innerHTML;
    });

    const runnerVer = await page.evaluate(() => {
        return document.getElementById('clipboard-copy-content-linux-download-the-latest-runner-package').innerHTML;
    });

    const token = mytoken.replace(/(^.*)?\-\-token /, '');
    console.log("TOKEN="+token);
    const version_s = runnerVer.replace(/(^.*)?\/runners\//, '');
    const version = version_s.replace(/\/actions-runner.*/, '')
    console.log("RUNNER_VERSION="+version)

    browser.close();
}

run();

And if you ran this on some remote instance, or in kube, or lambda (I tried them all), this would fail, because github doesn't recognize the machine, so it brings up a page during the login process that prompts you for a code that is sent to your email to verify your identity.
The identity I was using, was a service account, who's email address I did not have access to, and thus, had no idea emails were being sent.

The best workaround I found for that, was this:
https://github.com/browsh-org/browsh
kubectl run tmp --generator=run-pod/v1 --rm -i --tty --image browsh/browsh -- /app/browsh --startup-url https://github.com/login
or exec browsh on the EC2 instance, and log into github manually, via the terminal browser, retrieve the code from email, and enter it so that github would recognize the machine lololol