Question

Your enterprise has a self-hosted runner group named 'gpu-runners' containing machines with expensive GPU hardware. Currently the group is available to all repositories in the 'data-science' organization, but management wants only the 'ml-training' and 'model-eval' repositories to be able to send jobs to these runners. As an organization owner, what is the correct way to enforce this restriction?

Accepted Answer

In the runner group settings, change 'Repository access' from 'All repositories' to 'Selected repositories' and add only 'ml-training' and 'model-eval'.

Answer

Add an IP allow list to the enterprise account that only permits the IP addresses of the two repositories' runners.

Answer

Edit each runner's config.sh with a '--repos' flag listing 'ml-training' and 'model-eval'.

Answer

Create a repository-level secret in the two repos that the runner group checks before accepting a job.