You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{% data reusables.actions.enterprise-github-hosted-runners %}
17
17
18
-
## About self-hosted runner groups
18
+
## About runner groups
19
19
20
-
{% ifversion fpt %}
21
-
{% note %}
22
-
23
-
**Note:** All organizations have a single default self-hosted runner group. Only enterprise accounts and organizations owned by enterprise accounts can create and manage additional self-hosted runner groups.
24
-
25
-
{% endnote %}
26
-
27
-
Self-hosted runner groups are used to control access to self-hosted runners. Organization admins can configure access policies that control which repositories in an organization have access to the runner group.
28
-
29
-
If you use {% data variables.product.prodname_ghe_cloud %}, you can create additional runner groups; enterprise admins can configure access policies that control which organizations in an enterprise have access to the runner group; and organization admins can assign additional granular repository access policies to the enterprise runner group. For more information, see the [{% data variables.product.prodname_ghe_cloud %} documentation](/enterprise-cloud@latest/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups).
30
-
{% endif %}
20
+
{% data reusables.actions.about-runner-groups %} {% ifversion fpt %}For more information, see the [{% data variables.product.prodname_ghe_cloud %} documentation](/enterprise-cloud@latest/actions/hosting-your-own-runners/managing-access-to-self-hosted-runners-using-groups).{% endif %}
31
21
32
22
{% ifversion ghec or ghes or ghae %}
33
-
Self-hosted runner groups are used to control access to self-hosted runners at the organization and enterprise level. Enterprise owners can configure access policies that control which organizations {% ifversion restrict-groups-to-workflows %}and workflows {% endif %}in an enterprise have access to the runner group. Organization owners can configure access policies that control which repositories{% ifversion restrict-groups-to-workflows %} and workflows{% endif %} in an organization have access to the runner group.
34
-
35
-
When an enterprise owner grants an organization access to a runner group, organization owners can see the runner group listed in the organization's self-hosted runner settings. The organization owners can then assign additional granular repository{% ifversion restrict-groups-to-workflows %} and workflow{% endif %} access policies to the enterprise runner group.
36
-
37
-
When new runners are created, they are automatically assigned to the default group. Runners can only be in one group at a time. You can move runners from the default group to another group. For more information, see "[Moving a self-hosted runner to a group](#moving-a-self-hosted-runner-to-a-group)."
38
23
39
24
## Creating a self-hosted runner group for an organization
40
25
41
-
All organizations have a single default self-hosted runner group. Organizations within an enterprise account can create additional self-hosted groups. Organization admins can allow individual repositories access to a runner group. For information about how to create a self-hosted runner group with the REST API, see "[Self-hosted runner groups](/rest/reference/actions#self-hosted-runner-groups)."
42
-
43
-
Self-hosted runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can move a runner from the default group to any group you create.
44
-
45
-
When creating a group, you must choose a policy that defines which repositories{% ifversion restrict-groups-to-workflows %} and workflows{% endif %} have access to the runner group.
46
-
47
-
{% ifversion ghec or ghes > 3.3 or ghae-issue-5091 %}
48
-
{% data reusables.organizations.navigate-to-org %}
49
-
{% data reusables.organizations.org_settings %}
50
-
{% data reusables.organizations.settings-sidebar-actions-runner-groups %}
51
-
1. In the "Runner groups" section, click **New runner group**.
52
-
1. Enter a name for your runner group.
53
-
{% data reusables.actions.runner-group-assign-policy-repo %}
{% data reusables.actions.self-hosted-runner-security-admonition %}
58
29
59
-
For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories)."
30
+
{%- endif %}
60
31
61
-
{% endwarning %}
62
-
{% data reusables.actions.runner-group-assign-policy-workflow %}{%- ifversion restrict-groups-to-workflows %} Organization-owned runner groups cannot access workflows from a different organization in the enterprise; instead, you must create an enterprise-owned runner group.{% endif %}
63
-
{% data reusables.actions.self-hosted-runner-create-group %}
64
-
{% elsif ghae or ghes < 3.4 %}
65
-
{% data reusables.organizations.navigate-to-org %}
66
-
{% data reusables.organizations.org_settings %}
67
-
{% data reusables.organizations.settings-sidebar-actions-runner-groups %}
68
-
1. Under {% ifversion ghes or ghae %}"Runners"{% endif %}, click **Add new**, and then **New group**.
1. Enter a name for your runner group, and assign a policy for repository access.
72
-
73
-
You can configure a runner group to be accessible to a specific list of repositories, or to all repositories in the organization.{% ifversion ghec or ghes %} By default, only private repositories can access runners in a runner group, but you can override this. This setting can't be overridden if configuring an organization's runner group that was shared by an enterprise.{% endif %}
For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories)."
83
-
84
-
{% endwarning %}
85
-
{%- endif %}
86
-
87
-
88
-
1. Click **Save group** to create the group and apply the policy.
89
-
{% endif %}
32
+
{% data reusables.actions.creating-a-runner-group-for-an-organization %}
90
33
91
34
## Creating a self-hosted runner group for an enterprise
92
35
93
-
Enterprises can add their self-hosted runners to groups for access management. Enterprises can create groups of self-hosted runners that are accessible to specific organizations in the enterprise account{% ifversion restrict-groups-to-workflows %} or to specific workflows{% endif %}. Organization owners can then assign additional granular repository{% ifversion restrict-groups-to-workflows %} or workflow{% endif %} access policies to the enterprise runner groups. For information about how to create a self-hosted runner group with the REST API, see the enterprise endpoints in the [{% data variables.product.prodname_actions %} REST API](/rest/reference/actions#self-hosted-runner-groups).
94
-
95
-
Self-hosted runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can assign the runner to a specific group during the registration process, or you can later move the runner from the default group to a custom group.
96
-
97
-
When creating a group, you must choose a policy that defines which organizations have access to the runner group.
98
-
99
-
{% data reusables.actions.self-hosted-runner-groups-add-to-enterprise-first-steps %}
100
-
1. To choose a policy for organization access, select the **Organization access** drop-down, and click a policy. You can configure a runner group to be accessible to a specific list of organizations, or all organizations in the enterprise.{% ifversion ghes %} By default, only private repositories can access runners in a runner group, but you can override this.{% endif %}
36
+
{%- ifversion ghec or ghes %}
101
37
102
-
{%- ifversion ghec or ghes %}
103
-
{% warning %}
38
+
{% data reusables.actions.self-hosted-runner-security-admonition %}
For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories)."
110
-
111
-
{% endwarning %}
112
-
{%- endif %}
113
-
{%- ifversion ghec or ghes %}
114
-
115
-
116
-
{%- elsif ghae %}
117
-
118
-
119
-
{%- endif %}
120
-
{% data reusables.actions.runner-group-assign-policy-workflow %}
121
-
1. Click **Save group** to create the group and apply the policy.
42
+
{% data reusables.actions.creating-a-runner-group-for-an-enterprise %}
122
43
123
44
{% endif %}
124
45
125
46
## Changing the access policy of a self-hosted runner group
126
47
127
-
For runner groups in an enterprise, you can change what organizations in the enterprise can access a runner group{% ifversion restrict-groups-to-workflows %} or restrict what workflows a runner group can run{% endif %}. For runner groups in an organization, you can change what repositories in the organization can access a runner group{% ifversion restrict-groups-to-workflows %} or restrict what workflows a runner group can run{% endif %}.
128
-
129
-
### Changing what organizations or repositories can access a runner group
130
-
131
-
{% ifversion fpt or ghec or ghes > 3.3 or ghae-issue-5091 %}
132
-
{% data reusables.actions.self-hosted-runner-groups-navigate-to-repo-org-enterprise %}
133
-
{% data reusables.actions.settings-sidebar-actions-runner-groups-selection %}
134
-
1. For runner groups in an enterprise, under **Organization access**, modify what organizations can access the runner group. For runner groups in an organization, under **Repository access**, modify what repositories can access the runner group.
For more information, see "[About self-hosted runners](/actions/hosting-your-own-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories)."
144
-
145
-
{% endwarning %}
146
-
{%- endif %}
147
-
{% elsif ghae or ghes < 3.4 %}
148
-
{% data reusables.actions.self-hosted-runner-configure-runner-group-access %}
149
-
{% endif %}
150
-
151
-
{% ifversion restrict-groups-to-workflows %}
152
-
### Changing what workflows can access a runner group
153
-
You can configure a self-hosted runner group to run either selected workflows or all workflows. For example, you might use this setting to protect secrets that are stored on self-hosted runners or to standardize deployment workflows by restricting a runner group to run only a specific reusable workflow. This setting cannot be overridden if you are configuring an organization's runner group that was shared by an enterprise.
154
-
{% data reusables.actions.self-hosted-runner-groups-navigate-to-repo-org-enterprise %}
155
-
{% data reusables.actions.settings-sidebar-actions-runner-groups-selection %}
156
-
1. Under **Workflow access**, select the dropdown menu and click **Selected workflows**.
1. Enter a comma separated list of the workflows that can access the runner group. Use the full path, including the repository name and owner. Pin the workflow to a branch, tag, or full SHA. For example: `octo-org/octo-repo/.github/workflows/build.yml@v2, octo-org/octo-repo/.github/workflows/deploy.yml@d6dc6c96df4f32fa27b039f2084f576ed2c5c2a5, monalisa/octo-test/.github/workflows/test.yml@main`.
48
+
{%- ifversion fpt or ghec or ghes %}
159
49
160
-
Only jobs directly defined within the selected workflows will have access to the runner group.
161
-
162
-
Organization-owned runner groups cannot access workflows from a different organization in the enterprise; instead, you must create an enterprise-owned runner group.
50
+
{% data reusables.actions.self-hosted-runner-security-admonition %}
163
51
164
-
1. Click **Save**.
52
+
{%- endif %}
165
53
166
-
{% endif %}
54
+
{% data reusables.actions.changing-the-access-policy-of-a-runner-group %}
167
55
168
56
## Changing the name of a runner group
169
57
170
-
{% ifversion fpt or ghec or ghes > 3.3 or ghae-issue-5091 %}
171
-
{% data reusables.actions.self-hosted-runner-groups-navigate-to-repo-org-enterprise %}
172
-
{% data reusables.actions.settings-sidebar-actions-runner-groups-selection %}
173
-
1. Change the runner group name.
174
-
175
-
{% elsif ghae or ghes < 3.4 %}
176
-
{% data reusables.actions.self-hosted-runner-configure-runner-group %}
177
-
1. Change the runner group name.
178
-
{% endif %}
58
+
{% data reusables.actions.changing-the-name-of-a-runner-group %}
179
59
180
60
{% ifversion ghec or ghes or ghae %}
181
61
## Automatically adding a self-hosted runner to a group
182
62
183
-
You can use the configuration script to automatically add a new self-hosted runner to a group. For example, this command registers a new self-hosted runner and uses the `--runnergroup` parameter to add it to a group named `rg-runnergroup`.
The command will fail if the runner group doesn't exist:
190
-
191
-
```
192
-
Could not find any self-hosted runner group named "rg-runnergroup".
193
-
```
63
+
{% data reusables.actions.automatically-adding-a-runner-to-a-group %}
194
64
195
65
## Moving a self-hosted runner to a group
196
66
197
-
If you don't specify a runner group during the registration process, your new self-hosted runners are automatically assigned to the default group, and can then be moved to another group.
198
-
199
-
{% data reusables.actions.self-hosted-runner-navigate-to-org-enterprise %}
200
-
{% ifversion ghec or ghes > 3.3 or ghae-issue-5091 %}
201
-
1. In the "Runners" list, click the runner that you want to configure.
202
-
2. Select the **Runner group** drop-down.
203
-
3. In "Move runner to group", choose a destination group for the runner.
204
-
{% elsif ghae or ghes < 3.4 %}
205
-
1. In the {% ifversion ghes or ghae %}"Runner groups"{% endif %} section of the settings page, locate the current group of the runner you want to move and expand the list of group members.
206
-
207
-
2. Select the checkbox next to the self-hosted runner, and then click **Move to group** to see the available destinations.
208
-
209
-
3. To move the runner, click on the destination group.
210
-
211
-
{% endif %}
67
+
{% data reusables.actions.moving-a-runner-to-a-group %}
212
68
213
69
## Removing a self-hosted runner group
214
70
215
-
Self-hosted runners are automatically returned to the default group when their group is removed.
71
+
{% data reusables.actions.removing-a-runner-group %}
216
72
217
-
{% ifversion ghes or ghae or ghec %}
218
-
{% data reusables.actions.self-hosted-runner-groups-navigate-to-repo-org-enterprise %}
219
-
1. In the list of groups, to the right of the group you want to delete, click {% octicon "kebab-horizontal" aria-label="The horizontal kebab icon" %}.
220
-
2. To remove the group, click **Remove group**.
221
-
3. Review the confirmation prompts, and click **Remove this runner group**.
@@ -82,7 +83,7 @@ For more information, see "[Creating actions](/actions/creating-actions)."
82
83
83
84
### Runners
84
85
85
-
{% data reusables.actions.about-runners %} Each runner can run a single job at a time. {% ifversion ghes or ghae %} You must host your own runners for {% data variables.product.product_name %}. {% elsif fpt or ghec %}{% data variables.product.company_short %} provides Ubuntu Linux, Microsoft Windows, and macOS runners to run your workflows; each workflow run executes in a fresh, newly-provisioned virtual machine. If you need a different operating system or require a specific hardware configuration, you can host your own runners.{% endif %} For more information{% ifversion fpt or ghec %} about self-hosted runners{% endif %}, see "[Hosting your own runners](/actions/hosting-your-own-runners)."
86
+
{% data reusables.actions.about-runners %} Each runner can run a single job at a time. {% ifversion ghes or ghae %} You must host your own runners for {% data variables.product.product_name %}. {% elsif fpt or ghec %}{% data variables.product.company_short %} provides Ubuntu Linux, Microsoft Windows, and macOS runners to run your workflows; each workflow run executes in a fresh, newly-provisioned virtual machine. {% ifversion actions-hosted-runners %} {% data variables.product.prodname_dotcom %} also offers {% data variables.actions.hosted_runner %}s, which are available in larger configurations. For more information, see "[Using {% data variables.actions.hosted_runner %}s](/actions/using-github-hosted-runners/using-larger-runners)." {% endif %}If you need a different operating system or require a specific hardware configuration, you can host your own runners.{% endif %} For more information{% ifversion fpt or ghec %} about self-hosted runners{% endif %}, see "[Hosting your own runners](/actions/hosting-your-own-runners)."
86
87
87
88
{% data reusables.actions.workflow-basic-example-and-explanation %}
Copy file name to clipboardExpand all lines: content/actions/using-github-hosted-runners/about-github-hosted-runners.md
+9Lines changed: 9 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -86,6 +86,15 @@ While the job runs, the logs and output can be viewed in the {% data variables.p
86
86
87
87
## Supported runners and hardware resources
88
88
89
+
{% ifversion actions-hosted-runners %}
90
+
91
+
{% note %}
92
+
93
+
**Note**: {% data variables.product.prodname_dotcom %} also offers {% data variables.actions.hosted_runner %}s, which are available in larger configurations. For more information, see "[Using {% data variables.actions.hosted_runner %}s](/actions/using-github-hosted-runners/using-larger-runners)."
94
+
95
+
{% endnote %}
96
+
{% endif %}
97
+
89
98
Hardware specification for Windows and Linux virtual machines:
0 commit comments