Leveraging the power of terraform-aws-github-runner, this project introduces an innovative way to manage self-hosted GitHub runners.
We provide a variety of self-hosted runner configurations. Choose the one that best suits your project's needs (each runner is labelled with size, OS and architecture):
| Size | OS | Architecture | Instance Type |
|---|---|---|---|
| 5xlarge | Ubuntu Noble 24.04 | x64 | c5.4xlarge |
| 4xlarge | Ubuntu Noble 24.04 | x64 | c5.4xlarge |
| 2xlarge | Ubuntu Noble 24.04 | x64 | c5.2xlarge |
| xlarge | Ubuntu Noble 24.04 | x64 | c5.xlarge or m5.xlarge |
| large | Ubuntu Noble 24.04 | x64 | c5.large or m5.large |
| 4xlarge | Ubuntu Noble 24.04 | arm64 | m7g.4xlarge |
| 2xlarge | Ubuntu Noble 24.04 | arm64 | m7g.2xlarge |
| xlarge | Ubuntu Noble 24.04 | arm64 | m7g.xlarge |
| 2xlarge (with GPU) | Ubuntu Noble 24.04 | x64 | g4dn.2xlarge |
| xlarge (with GPU) | Ubuntu Noble 24.04 | x64 | g4dn.xlarge |
| 2xlarge | Windows Server 2022 | x64 | c5.2xlarge |
| xlarge | Windows Server 2022 | x64 | c5.xlarge or m5.xlarge |
Specify the self-hosted runner in your workflow by setting the job.runs-on parameter. For instance, runs-on: [self-hosted, linux, x64, 4xlarge], runs-on: [self-hosted, windows, x64, xlarge].
If you're wondering about the security implications of using self-hosted runners in public repositories, consider these pointers:
- We suggest familiarizing yourself with GitHub's official guidelines on security implications of using self-hosted runners.
- To combat the risk of retaining unwanted or dangerous data, our project only supports ephemeral runners, which are discarded after running a single workflow.
- For an extra layer of protection against untrusted code execution, you might consider these strategies:
- Require approval for workflow execution from all outside collaborators, providing you with an opportunity to review the code before execution.
- Restrict workflows that can use self-hosted runners. This will prevent the use of self-hosted runners for workflows triggered on pull_request as it requires providing the exact git ref.