How do runner group visibility settings help secure self-hosted runners in an enterprise?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Runner groups control which orgs and repos can schedule jobs onto your self-hosted capacity. Lock visibility tightly so untrusted workflows cannot land on privileged or PCI-connected hosts.
Full explanation below image
Full Explanation
Runner groups partition self-hosted (and some larger hosted) capacity and control which organizations or repositories can assign jobs to those runners. Restricting visibility protects privileged networks, secrets on the runner host, and high-cost hardware from untrusted repositories or forks. Groups do not publish SSH keys, do not force only ubuntu-latest hosted labels, and do not weaken host isolation. Administrators should place production deployment runners in tightly scoped groups, use ephemeral runners where possible, and monitor for workflows requesting unauthorized labels. Misconfigured open groups are a common enterprise incident pattern.