In a GitHub Organization, what is the primary purpose of placing self-hosted runners into a runner group with repository access controls?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Runner groups are an access boundary: only selected repos can schedule jobs onto those machines, which matters because self-hosted runners can expose secrets and network access.
Full explanation below image
Full Explanation
Runner groups organize self-hosted runners and control which repositories are allowed to target them. Because a compromised workflow on a less-trusted repo could execute arbitrary code on a shared self-hosted runner, restricting group access is a core security control. Groups do not rewrite workflow YAML, share tokens across repos, or eliminate billing mechanics. Additional controls include requiring the group for specific workflows, restricting public repository use, and combining with labels. Ephemeral just-in-time runners further reduce persistence risk. On the exam, associate runner groups with organization governance and least-privilege access to compute — not with syntax upgrades or token sharing features.