How can an enterprise limit which repositories may use expensive larger runners?
Select an answer to reveal the explanation.
Short Explanation
Runner groups are the ACL for shared runners, especially the pricey larger ones. Put big iron in a locked group, allow only payment-approved repos, and keep open-source forks off that hardware. Branch renames and maintenance mode aren't your cost control.
Full Explanation
Restricting larger runners by placing them in runner groups limited to selected organizations or repositories is the correct enterprise control. This is the standard way to govern self-hosted and larger hosted runners. Renaming the default branch to 'larger-runner' does nothing to control runner access. Deleting the GitHub API is not a practical or valid control. Enabling maintenance mode on GHES for all cloud runners confuses GHES maintenance with cloud runner governance. Combine group restrictions with workflow permissions that require explicit runs-on labels so random workflows cannot select privileged runners.