GitHub Actions: secure self-hosted runners by limiting them to specific workflows
You can now enforce consistent usage of self-hosted runner groups across your organization and enterprise.
![](https://github.blog/wp-content/uploads/2022/03/Enterprise-Product@2x-3.png?resize=1600%2C850)
Over the last few months, we’ve made it easier for large organizations to improve the consistency and security of their CI/CD workflows using GitHub Actions. For example, you can create reusable workflows, share actions and reusable workflows within your enterprise, or secure your deployments with OpenID Connect. Today, we’re taking things a step further.
We’re excited to announce an enhancement to the self-hosted runners experience that improves the security of your CI/CD workflows. Many organizations today have secrets stored on their self-hosted runners in order to enable production deployments or other highly-privileged workflows. Previously, any workflow in the repository, such as an issue labeller, could access these runners, but that’s no longer the case. Now, admins can pick which specific workflows can access a runner group. This is a great way to secure your deployments if you aren’t ready to adopt OpenID Connect.
When combined with reusable workflows, this feature enables admins to enforce consistent usage of runner groups and workflows across their organization. For example, you can have a runner group with production secrets on it and require that everyone use it via a reusable deployment workflow. Other workflows in the organization can’t access these runners unless they also use the reusable deployment workflow. This allows you to standardize your deployment workflows, including the runners they use, for your entire organization.
Here’s how to set this up:
- Create a reusable workflow that describes the steps you want everyone to utilize when deploying to production.
- In the runner group settings, set Repository access to All repositories.
- In the runner group settings, set Workflow access to Selected workflows, and specify the reusable workflow you created.
Once these settings are saved, everyone in your organization will be able to use the production runner group, but only when executing the monalisa/automation/workflows/deployment.yaml reusable workflow at ref v1.
Learn more about workflow restrictions for self-hosted runner groups.
Tags:
Written by
Related posts
![](https://github.blog/wp-content/uploads/2023/10/Collaboration-DarkMode-2.png?resize=400%2C212)
2024 is the biggest global election year in history. What’s at stake for developers?
GitHub is considering what is at stake for our users and platform, how we can take responsible action to support free and fair elections, and how developers contribute to resilient democratic processes.
![](https://github.blog/wp-content/uploads/2023/10/AI-DarkMode-2.png?resize=400%2C212)
GitHub named a Leader in the Gartner first-ever Magic Quadrant for AI Code Assistants
This year, as part of its annual Magic Quadrant series, Gartner published a first-of-its-kind report analyzing the state of play in the AI Code Assistants market–and named GitHub a Leader.
![AI in software development 2024 survey results with colorful graphics and percentages.](https://github.blog/wp-content/uploads/2024/08/ai-survey-header.png?resize=400%2C212)
Survey: The AI wave continues to grow on software development teams
We surveyed 2,000 people on software development teams at enterprises in the U.S., Brazil, India, and Germany about the use, experience, and expectations around generative AI tools in software development.