Add recommendations for runner groups and labels by konstruktoid · Pull Request #91 · github/github-well-architected

konstruktoid · 2026-05-22T16:03:53Z

This pull request makes several improvements to the documentation on securing GitHub Actions workflows. The most significant updates include adding new recommendations for segregating runners, enhancing repository ruleset guidance, and updating author attribution.

Enhancements to security recommendations:

Added a new recommendation to segregate runners by using organizational runner groups and labels to separate high-privilege from low-privilege runners, reducing the risk of unauthorized access to sensitive resources. [1] [2]
Expanded repository ruleset guidance by recommending the use of "Require workflows to pass before merging" to enforce organizational or enterprise-level workflow requirements prior to merging.

Documentation and metadata updates:

Updated the authors list in the document metadata to include Thomas Sjögren (konstruktoid).

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the “Securing GitHub Actions Workflows” guidance by adding runner-segregation recommendations and expanding ruleset guidance, while marking the page as draft.

Changes:

Set the page to draft: true and added an additional author.
Added “Segregate runners” as a top-level recommendation and a dedicated section with implementation details.
Added a repository ruleset recommendation to require workflows to pass before merging.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

tspascoal · 2026-05-27T11:11:22Z

+
+Use [runner groups](https://docs.github.com/en/actions/concepts/runners/runner-groups) and [labels](https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/apply-labels) to separate high-privilege runners from low-privilege runners. High-privilege runners may have access to sensitive resources or direct host access, while low-privilege runners should not.
+
+This separation provides more granular control over [which repositories can access different runners](https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/manage-access#changing-which-repositories-can-access-a-runner-group) and which [jobs can access specific runners](https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job). It also reduces the risk that a compromised or misconfigured workflow could gain access to sensitive resources.


Can you clarify the "which jobs can access specific runners" ? this cannot be enforced once a repo has access to a given runner (you can restrict which workflows can use the runner but not the jobs) any job can use it.

Unless you restrict the workflows that can access a runner if a user can author workflows in a repo which has access to the runner it can use it.

yeah, it's actually workflows but https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job#choosing-self-hosted-runners says "To specify a self-hosted runner for your job, configure runs-on in your workflow file with self-hosted runner labels." and "When you combine groups and labels, the runner must meet both requirements to be eligible to run the job." (https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/use-in-a-workflow#using-labels-and-groups-to-route-jobs).

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

…ecurity/index.md Co-authored-by: Ken Muse <kenmuse@users.noreply.github.com>

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

* Sync from github/github-well-architected-internal (main) Source Repository: github/github-well-architected-internal Source Branch: main Source SHA: 19df7eb80cb63be9f9f42048ccf315e876108117 * Fix PR HTML proofer by preprocessing content --------- Co-authored-by: well-architected-sync-bot[bot] <235114805+well-architected-sync-bot[bot]@users.noreply.github.com> Co-authored-by: David Kalmin <dkalmin@github.com>

Sync from github/github-well-architected-internal (main) Source Repository: github/github-well-architected-internal Source Branch: main Source SHA: ff52156188feebe7b601a566b5112519172b4714 Co-authored-by: well-architected-sync-bot[bot] <235114805+well-architected-sync-bot[bot]@users.noreply.github.com>

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

Add recommendation regarding runner groups and labels

c8a8f40

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 22, 2026 16:03

konstruktoid requested review from a team as code owners May 22, 2026 16:03

Copilot AI reviewed May 22, 2026

View reviewed changes

konstruktoid added 2 commits May 22, 2026 16:06

adjust to documentation terminology

b974622

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

split into shorter sentences

72c1fa7

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

konstruktoid had a problem deploying to development May 27, 2026 07:23 — with GitHub Actions Failure

Copilot AI mentioned this pull request May 27, 2026

fix: set draft: false on actions-security page to restore publication #92

Draft

set draft: false

d0109d7

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

tspascoal reviewed May 27, 2026

View reviewed changes

konstruktoid temporarily deployed to development May 27, 2026 12:20 — with GitHub Actions Inactive

replace and with or

2a3e165

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

kenmuse reviewed May 27, 2026

View reviewed changes

konstruktoid and others added 5 commits May 27, 2026 16:29

Update content/library/application-security/recommendations/actions-s…

114a9e6

…ecurity/index.md Co-authored-by: Ken Muse <kenmuse@users.noreply.github.com>

rewording regarding secrets

1c1845d

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

reword secret access

ed08520

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

just mention sensitive resources

7df4b2b

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

Merge branch 'main' into rungroup

41456dd

konstruktoid requested a review from Copilot June 16, 2026 14:42

Copilot AI reviewed Jun 16, 2026

View reviewed changes

Comment thread content/library/application-security/recommendations/actions-security.md

well-architected-sync-bot Bot and others added 2 commits June 18, 2026 07:21

konstruktoid requested review from a team and bot-digital-customer-success as code owners June 18, 2026 07:21

konstruktoid added 3 commits June 18, 2026 09:23

Merge branch 'main' into rungroup

dfc235f

clean up after failed web commit

7d7d25f

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

add bypass requests link and more web commit cleanup

5a3bfef

Signed-off-by: Thomas Sjögren <konstruktoid@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add recommendations for runner groups and labels#91

Add recommendations for runner groups and labels#91
konstruktoid wants to merge 15 commits into
github:mainfrom
konstruktoid:rungroup

konstruktoid commented May 22, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tspascoal May 27, 2026

Uh oh!

konstruktoid May 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants


		Use [runner groups](https://docs.github.com/en/actions/concepts/runners/runner-groups) and [labels](https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/apply-labels) to separate high-privilege runners from low-privilege runners. High-privilege runners may have access to sensitive resources or direct host access, while low-privilege runners should not.

		This separation provides more granular control over [which repositories can access different runners](https://docs.github.com/en/actions/how-tos/manage-runners/self-hosted-runners/manage-access#changing-which-repositories-can-access-a-runner-group) and which [jobs can access specific runners](https://docs.github.com/en/actions/how-tos/write-workflows/choose-where-workflows-run/choose-the-runner-for-a-job). It also reduces the risk that a compromised or misconfigured workflow could gain access to sensitive resources.

Conversation

konstruktoid commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tspascoal May 27, 2026

Choose a reason for hiding this comment

Uh oh!

konstruktoid May 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

konstruktoid commented May 22, 2026 •

edited

Loading