About self-hosted runners for GitHub Actions
GitHub Actions 允许 使用 您的 GitHub Enterprise Server 实例 的人员 通过自动化软件开发工作流程的每个阶段来提高生产力。 For more information, see "About GitHub Actions for enterprises."
With GitHub Actions, developers can write and combine individual tasks called actions to create custom workflows. To enable GitHub Actions for 您的 GitHub Enterprise Server 实例, you must host at least one machine to execute jobs. This machine is called a self-hosted runner. 自托管运行器可以是物理设备、虚拟设备、容器,也可以部署在本地或云端。 Your runner machine connects to GitHub Enterprise Server using the GitHub Actions self-hosted runner application. Self-hosted runners can run Linux, Windows, or macOS. For more information, see "About self-hosted runners."
This guide shows you how to apply a centralized management approach to self-hosted runners for GitHub Actions in your enterprise. In the guide, you'll complete the following tasks.
- Configure a limited policy to restrict the actions that can run within your enterprise
- Deploy a self-hosted runner for your enterprise
- Create a group to manage access to the runners available to your enterprise
- Optionally, further restrict the repositories that can use the runner
- Optionally, build custom tooling to automatically scale your self-hosted runners
You'll also find additional information about how to monitor and secure your self-hosted runners, how to access actions from GitHub.com, and how to customize the software on your runner machines.
After you finish the guide, users of 您的 GitHub Enterprise Server 实例 will be able to run workflow jobs from GitHub Actions on a self-hosted runner machine.
Prerequisites
-
GitHub Actions must be enabled for GitHub Enterprise Server. A site administrator can enable and configure GitHub Actions for your instance. For more information, see "Getting started with GitHub Actions for GitHub Enterprise Server."
-
You must have access to the machine you will use as a self-hosted runner in your environment.
-
自托管运行器与 GitHub Enterprise Server 之间的连接通过HTTP(端口 80)或 HTTPS(端口 443)。 要确保通过 HTTPS 的连接,请为 您的 GitHub Enterprise Server 实例 配置 TLS。 更多信息请参阅“配置 TLS”。 For more information, see "About self-hosted runners."
-
Your enterprise must own at least one organization. For more information, see "About organizations" and "Creating a new organization from scratch."
1. Configure policies for GitHub Actions
First, enable GitHub Actions for all organizations, and configure a policy to restrict the actions that can run on 您的 GitHub Enterprise Server 实例. Optionally, organization owners can further restrict these policies for each organization.
-
在 GitHub Enterprise Server 的右上角,单击您的个人资料照片,然后单击 Enterprise settings(Enterprise 设置)。
-
在企业账户侧边栏中,单击 Policies(政策)。
-
在“ Policies(政策)”下,单击 Actions(操作)。
-
Under "Policies", select Enable for all organizations.
-
Select 允许选择操作 and Allow actions created by GitHub to allow local actions, and actions created by GitHub.
-
Click Save.
You can configure additional policies to restrict the actions available to users of 您的 GitHub Enterprise Server 实例. For more information, see "Enforcing policies for GitHub Actions in your enterprise."
2. Deploy the self-hosted runner for your enterprise
Next, add a self-hosted runner to your enterprise. GitHub Enterprise Server will guide you through installation of the necessary software on the runner machine. After you deploy the runner, you can verify connectivity between the runner machine and 您的 GitHub Enterprise Server 实例.
Adding the self-hosted runner
-
在 GitHub Enterprise Server 的右上角,单击您的个人资料照片,然后单击 Enterprise settings(Enterprise 设置)。
-
在企业账户侧边栏中,单击 Policies(政策)。
-
在“ Policies(政策)”下,单击 Actions(操作)。
-
单击 Runners(运行器)选项卡。
-
单击 New runner(新运行器)。
-
选择自托管运行器机器的操作系统映像和架构。
-
您将看到指示您如何下载运行器应用程序并安装到自托管运行器机器上的说明。
在自托管运行器机器上打开 shell,并按显示的顺序运行每个 shell 命令。
注意: 在 Windows上,如果要将自托管运行器应用程序安装为服务,必须打开具有管理员权限的 shell。 我们还建议您使用
C:\actions-runner
作为自托管运行器应用程序的目录,以便 Windows 系统帐户可以访问运行器目录。这些说明将指导您完成以下任务:
- 下载并提取自托管运行器应用程序。
- 运行
config
脚本配置自托管运行器应用程序,并向 GitHub Actions 注册。config
脚本需要目标 URL 和自动生成的时间限制令牌来验证请求。- 在 Windows上,
config
脚本还会询问您是否想将自托管运行器应用程序安装为服务。 对于 Linux 和 macOS,您可以在完成添加运行器后安装服务。 更多信息请参阅“将自托管运行器应用程序配置为服务”。
- 在 Windows上,
- 运行自托管运行器应用程序以将机器连接到 GitHub Actions。
检查您的自托管运行器是否已成功添加
完成添加自托管运行器的步骤后,运行器及其状态现在列在“ ”自托管运行器“ 下。
必须激活自托管运行器应用程序,运行器才能接受作业。 当运行器应用程序连接到 GitHub Enterprise Server 并准备接收作业时,您将在机器的终端上看到以下消息。
√ 已连接到 GitHub
2019-10-24 05:45:56Z: 正在监听作业
3. Manage access to the self-hosted runner using a group
You can create a runner group to manage access to the runner that you added to your enterprise. You'll use the group to choose which organizations can execute jobs from GitHub Actions on the runner.
GitHub Enterprise Server adds all new runners to a group. Runners can be in one group at a time. By default, GitHub Enterprise Server adds new runners to the "Default" group.
-
在 GitHub Enterprise Server 的右上角,单击您的个人资料照片,然后单击 Enterprise settings(Enterprise 设置)。
-
在企业账户侧边栏中,单击 Policies(政策)。
-
在“ Policies(政策)”下,单击 Actions(操作)。
-
单击 Runner groups(运行器组)选项卡。
-
单击 New runner group(新运行器组)。
-
在“Group Name(组名称)”下,输入运行器组的名称。
-
To choose a policy for organization access, under "Organization access", select the Organization access drop-down, and click Selected organizations.
-
To the right of the drop-down with the organization access policy, click .
-
Select the organizations you'd like to grant access to the runner group.
-
Optionally, to allow public repositories in the selected organizations to use runners in the group, select Allow public repositories.
Warning:
建议仅将自托管运行器用于私有仓库。 这是因为,通过创建在工作流程中执行代码的拉取请求,仓库的复刻可能会在您的自托管运行器上运行危险代码。
For more information, see "About self-hosted runners."
-
单击创建组以创建组并应用策略。
-
Click the "Runners" tab.
-
In the list of runners, click the runner that you deployed in the previous section.
-
Click Edit.
-
Click Runner groups .
-
In the list of runner groups, click the name of the group that you previously created.
-
Click Save to move the runner to the group.
You've now deployed a self-hosted runner that can run jobs from GitHub Actions within the organizations that you specified.
4. Further restrict access to the self-hosted runner
Optionally, organization owners can further restrict the access policy of the runner group that you created. For example, an organization owner could allow only certain repositories in the organization to use the runner group.
For more information, see "Managing access to self-hosted runners using groups."
5. Automatically scale your self-hosted runners
Optionally, you can build custom tooling to automatically scale the self-hosted runners for 您的 GitHub Enterprise Server 实例. For example, your tooling can respond to webhook events from 您的 GitHub Enterprise Server 实例 to automatically scale a cluster of runner machines. For more information, see "Autoscaling with self-hosted runners."
Next steps
-
You can monitor self-hosted runners and troubleshoot common issues. For more information, see "Monitoring and troubleshooting self-hosted runners."
-
GitHub recommends that you review security considerations for self-hosted runner machines. For more information, see "Security hardening for GitHub Actions."
-
You can manually sync repositories on GitHub.com containing actions to your enterprise on GitHub Enterprise Server. Alternatively, you can allow members of your enterprise to automatically access actions from GitHub.com by using GitHub Connect. For more information, see the following.
-
You can customize the software available on your self-hosted runner machines, or configure your runners to run software similar to GitHub-hosted runners available for customers using GitHub.com. The software that powers runner machines for GitHub Actions is open source. For more information, see the
actions/runner
andactions/runner-images
repositories.