Skip to main content

此版本的 GitHub Enterprise 已停止服务 2022-10-12. 即使针对重大安全问题,也不会发布补丁。 为了获得更好的性能、更高的安全性和新功能,请升级到最新版本的 GitHub Enterprise。 如需升级帮助,请联系 GitHub Enterprise 支持

Managing access to self-hosted runners using groups

You can use policies to limit access to self-hosted runners that have been added to an organization or enterprise.

注意:GitHub Enterprise Server 目前不支持 GitHub 托管的运行器。 可以在 GitHub public roadmap 上查看有关未来支持计划的更多信息。

About runner groups

Runner groups are used to control access to runners at the organization and enterprise level. Enterprise owners can configure access policies that control which organizations in an enterprise have access to the runner group. Organization owners can configure access policies that control which repositories in an organization have access to the runner group.

When an enterprise owner grants access to a runner group, organization owners can see the runner group listed in the organization's runner settings. The organization owners can then assign additional granular repository access policies to the enterprise runner group.

When new runners are created, they are automatically assigned to the default group. Runners can only be in one group at a time. You can move runners from the default group to another group. For more information, see "Moving a runner to a group."

Creating a self-hosted runner group for an organization

Warning: 建议仅将自托管运行器用于私有仓库。 这是� 为,通过创建在工作流程中执行代� �的拉取请求,仓库的复刻可能会在您的自托管运行器上运行危险代� �。

For more information, see "About self-hosted runners."

All organizations have a single default runner group. Organizations within an enterprise account can create additional groups. Organization admins can allow individual repositories access to a runner group. For information about how to create a runner group with the REST API, see "Self-hosted runner groups."

Runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can move a runner from the default group to any group you create.

When creating a group, you must choose a policy that defines which repositories have access to the runner group.

  1. On your GitHub Enterprise Server instance, navigate to the main page of the organization.

  2. 在组织名称下,单击“设置”。 组织设置按钮

  3. In the left sidebar, click Actions.

  4. In the left sidebar, under "Actions", click Runners.

  5. Under "Runners", click Add new, and then New group.

    Add runner group

  6. Enter a name for your runner group, and assign a policy for repository access.

    You can configure a runner group to be accessible to a specific list of repositories, or to all repositories in the organization. By default, only private repositories can access runners in a runner group, but you can override this. This setting can't be overridden if configuring an organization's runner group that was shared by an enterprise.

    Add runner group options

  7. Click Save group to create the group and apply the policy.

Creating a self-hosted runner group for an enterprise

Warning: 建议仅将自托管运行器用于私有仓库。 这是� 为,通过创建在工作流程中执行代� �的拉取请求,仓库的复刻可能会在您的自托管运行器上运行危险代� �。

For more information, see "About self-hosted runners."

Enterprises can add their runners to groups for access management. Enterprises can create groups of runners that are accessible to specific organizations in the enterprise account. Organization owners can then assign additional granular repository access policies to the enterprise runner groups. For information about how to create a runner group with the REST API, see the enterprise endpoints in the GitHub Actions REST API.

Runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can assign the runner to a specific group during the registration process, or you can later move the runner from the default group to a custom group.

When creating a group, you must choose a policy that defines which organizations have access to the runner group.

  1. 在 GitHub Enterprise Server 的右上角,单击� 的个人资料照片,然后单击“企业设置”。 GitHub Enterprise Server 上个人资料照片下拉菜单中的“企业设置”

  2. 在企业边� �中,单击 “策略”。 企业帐户边� �中的“策略”选项卡

  3. 在“ 策略”下,单击“操作”。

  4. 单击“运行器”选项卡。

  5. Use the Add new drop-down, and select New group.

  6. Under "Group name", type a name for your runner group.

  7. To choose a policy for organization access, select the Organization access drop-down, and click a policy. You can configure a runner group to be accessible to a specific list of organizations, or all organizations in the enterprise. By default, only private repositories can access runners in a runner group, but you can override this.

    Add runner group options

  8. Click Save group to create the group and apply the policy.

Changing the access policy of a self-hosted runner group

Warning: 建议仅将自托管运行器用于私有仓库。 这是� 为,通过创建在工作流程中执行代� �的拉取请求,仓库的复刻可能会在您的自托管运行器上运行危险代� �。

For more information, see "About self-hosted runners."

For runner groups in an enterprise, you can change what organizations in the enterprise can access a runner group. For runner groups in an organization, you can change what repositories in the organization can access a runner group.

Changing what organizations or repositories can access a runner group

  1. 在“设置”页的“运行器”部分,单击要配置的运行器组旁边的 ,然后单击“编辑名称和 [组织|存储库] 访问权限”。 管理存储库权限

  2. Modify your policy options.

    Warning

    建议仅将自托管运行器用于私有仓库。 这是� 为,通过创建在工作流程中执行代� �的拉取请求,仓库的复刻可能会在您的自托管运行器上运行危险代� �。

    For more information, see "About self-hosted runners."

Changing the name of a runner group

  1. 在“设置”页的“运行器”部分,单击要配置的运行器组旁边的 ,然后单击“编辑名称和 [组织|存储库] 访问权限”。 管理存储库权限
  2. Change the runner group name.

Automatically adding a self-hosted runner to a group

You can use the configuration script to automatically add a new runner to a group. For example, this command registers a new runner and uses the --runnergroup parameter to add it to a group named rg-runnergroup.

./config.sh --url $org_or_enterprise_url --token $token --runnergroup rg-runnergroup

The command will fail if the runner group doesn't exist:

Could not find any self-hosted runner group named "rg-runnergroup".

Moving a self-hosted runner to a group

If you don't specify a runner group during the registration process, your new runners are automatically assigned to the default group, and can then be moved to another group.

  1. 导航到自托管运行器注册的位置:

    • 在组织中:导航到主页并单击“ 设置” 。

    • 如果使用的是企业级运行器:

      1. 在 GitHub Enterprise Server 的右上角,单击� 的个人资料照片,然后单击“企业设置”。 GitHub Enterprise Server 上个人资料照片下拉菜单中的“企业设置”
  2. 导航到 GitHub Actions 设置:

    • 在组织中:

      1. In the left sidebar, click Actions.
      2. In the left sidebar, under "Actions", click Runners.
    • 如果使用的是企业级运行器:

      1. 在企业边� �中,单击 “策略”。 企业帐户边� �中的“策略”选项卡 1. 在“ 策略”下,单击“操作”。 1. 单击“运行器”选项卡。
  3. In the "Runner groups" section of the settings page, locate the current group of the runner you want to move and expand the list of group members. View runner group members

  4. Select the checkbox next to the self-hosted runner, and then click Move to group to see the available destinations. Runner group member move

  5. To move the runner, click on the destination group. Runner group member move

Removing a self-hosted runner group

Runners are automatically returned to the default group when their group is removed.

  1. Navigate to where your runner groups are located:

    • In an organization: navigate to the main page and click Settings.

    • If using an enterprise-level group:

      1. 在 GitHub Enterprise Server 的右上角,单击� 的个人资料照片,然后单击“企业设置”。 GitHub Enterprise Server 上个人资料照片下拉菜单中的“企业设置”
  2. Navigate to the "Runner groups" settings:

    • In an organization:

      1. In the left sidebar, click Actions.
      2. In the left sidebar, under "Actions", click Runners.
    • If using an enterprise-level group:

      1. 在企业边� �中,单击 “策略”。 企业帐户边� �中的“策略”选项卡
      2. 在“ 策略”下,单击“操作”。
      3. 单击“运行器组”选项卡。
  3. In the list of groups, to the right of the group you want to delete, click .

  4. To remove the group, click Remove group.

  5. Review the confirmation prompts, and click Remove this runner group. Any runners still in this group will be automatically moved to the default group, where they will inherit the access permissions assigned to that group.