Question

An enterprise administrator has registered a pool of self-hosted runners at the enterprise level and placed them in a runner group named 'shared-linux'. Several organizations need to use these runners, but the security team requires that only two specific organizations ('platform' and 'payments') can access them, while all other organizations must be denied. Which configuration correctly enforces this requirement?

Accepted Answer

In the enterprise-level 'shared-linux' runner group settings, change the organization access policy from 'All organizations' to 'Selected organizations' and add only 'platform' and 'payments'.

Answer

Create a repository-level runner group in each of the two organizations and re-register the runners there so other organizations cannot see them.

Answer

Add an IP allow list at the enterprise level that only permits the egress IPs of the 'platform' and 'payments' organizations' runners.

Answer

Set the enterprise Actions policy to 'Allow select actions' and list the two organizations as the only permitted action sources.