Question

An enterprise owner wants a specific set of self-hosted runners with GPU capabilities to be available only to repositories in the 'ml-platform' and 'data-science' organizations, but not to any other org in the enterprise. The runners are already registered at the enterprise level. What is the correct way to enforce this restriction?

Accepted Answer

Create an enterprise-level runner group containing the GPU runners, then configure the group's access policy to allow only the 'ml-platform' and 'data-science' organizations.

Answer

Add a custom label to the GPU runners and instruct all other organizations not to reference that label in their workflows.

Answer

Register the GPU runners separately in each of the two organizations instead of at the enterprise level, and delete the enterprise registration.

Answer

Set an IP allow list on the enterprise so that only the two organizations can reach the GPU runners.