How to Set Up Runner Groups in GitHub Actions

A runner group is an access boundary: it decides which repositories (and which workflows) are allowed to run on the runners inside it.

Create a runner group at the org or enterprise level, restrict it to selected repositories, and assign runners to it. Jobs from other repos cannot schedule onto those runners.

Steps

• Go to Org Settings to Actions to Runner groups to New runner group.
• Set repository access to Selected repositories (not All).
• Move or register runners into the group.
• Optionally restrict which workflows may target the group.

Target a group from a workflow

jobs:
  deploy:
    runs-on:
      group: production-runners
      labels: [self-hosted, linux, x64]
    steps:
      - run: ./deploy.sh

Gotchas

• A runner belongs to exactly one group; moving it changes who can use it.
• Use runs-on.group plus labels together to pick a group and a runner type within it.
• Default group access is All repositories; tighten it before adding production runners.

Related guides