How to Use Runner Groups to Control Access at Scale

A runner group scopes a set of runners to specific repositories or workflows, which is essential once a fleet grows.

Runner groups let an org bucket its self-hosted runners and grant access to selected repositories or workflows only. As a fleet scales, use groups to keep production or GPU runners away from untrusted repos, and to route scale sets. You assign a runner (or scale set) to a group at registration time.

Steps

• Create a runner group in Organization settings and pick which repos may use it.
• Register runners or scale sets into that group by id or name.
• Keep sensitive fleets (deploy, GPU) in a group scoped to trusted repos only.

Assign a scale set to a group

# ARC scale set values: put the runners in a named group
githubConfigUrl: https://github.com/my-org
runnerGroup: production-fleet
minRunners: 0
maxRunners: 20

Gotchas

• Runner groups are an org or enterprise feature; a single repo cannot create them.
• A runner belongs to exactly one group; move it by re-registering, not by editing in place.

Related guides