Due to security reasons, we need to explicitly disable GitHub-hosted runners, ideally for the entire organization. Any clues on how to do it?
2 Answers
Since there does not seem to be one global setting, you might need to script a process which would:
- loop over your repos/organizations
- use the Self-hosted runners API
- remove any self-hosted runner found (same for GHE - GitHub Enterprise).
I had the same worry. I came up with an idea (not in practice) that is a bit of a pain...
for anything in .github/workflows/*.yaml, check the yaml to make sure self-hosted is in there; if not, refuse the merge/commit.
Related