ドキュメントには頻繁に更新が加えられ、その都度公開されています。本ページの翻訳はまだ未完成な部分があることをご了承ください。最新の情報については、英語のドキュメンテーションをご参照ください。本ページの翻訳に問題がある場合はこちらまでご連絡ください。
GitHub AEは、現在限定リリース中です。詳細については営業チームにお問い合わせください。

Managing access to self-hosted runners using groups

You can use policies to limit access to self-hosted runners that have been added to an organization or enterprise.

Warning: Self-hosted runners are currently disabled for GitHub AE. これは、GitHub AEがセルフホストランナーの動作と互換性のないセキュリティ境界を保証しているためです。 ただし、GitHub AEでセルフホストランナーを使う必要があり、セキュリティへの影響を理解しているなら、セルフホストランナーを有効化するセキュリティ例外についてGitHubサポートに連絡できます。

セルフホストランナーが必要ないなら、ワークフローの実行にはAEホストランナーが利用できます。 詳しい情報については「AEホストランナーについて」を参照してください。

ノート: GitHub Actionsは現在GitHub AEでベータです。

About self-hosted runner groups

Self-hosted runner groups are used to control access to self-hosted runners at the organization and enterprise level. Enterprise admins can configure access policies that control which organizations in an enterprise have access to the runner group. Organization admins can configure access policies that control which repositories in an organization have access to the runner group.

When an enterprise admin grants an organization access to a runner group, organization admins can see the runner group listed in the organization's self-hosted runner settings. The organizations admins can then assign additional granular repository access policies to the enterprise runner group.

When new runners are created, they are automatically assigned to the default group. Runners can only be in one group at a time. You can move runners from the default group to another group. For more information, see "Moving a self-hosted runner to a group."

Creating a self-hosted runner group for an organization

All organizations have a single default self-hosted runner group. Organizations within an enterprise account can create additional self-hosted groups. Organization admins can allow individual repositories access to a runner group. For information about how to create a self-hosted runner group with the REST API, see "Self-hosted runner groups."

Self-hosted runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can move a runner from the default group to any group you create.

When creating a group, you must choose a policy that defines which repositories have access to the runner group.

  1. your enterpriseで、Organizationのメインページにアクセスしてください。

  2. Organization 名の下で、クリックします Settings.

    Organizationの設定ボタン

  3. 左のサイドバーで、Actionsをクリックしてください。

  4. In the "Self-hosted runners" section, click Add new, and then New group.

    Add runner group

  5. Enter a name for your runner group, and assign a policy for repository access.

    You can configure a runner group to be accessible to a specific list of repositories, or to all repositories in the organization. By default, only private repositories can access runners in a runner group, but you can override this. This setting can't be overridden if configuring an organization's runner group that was shared by an enterprise.

    Warning

    セルフホストランナーは、プライベートリポジトリでのみ利用することをおすすめします。 これは、ワークフロー中でコードを実行するPull Requestを作成することによって、リポジトリのフォークが危険なコードをセルフホストランナーマシン上で実行できる可能性があるためです。

    For more information, see "About self-hosted runners."

    Add runner group options

  6. Click Save group to create the group and apply the policy.

Creating a self-hosted runner group for an enterprise

Enterprises can add their self-hosted runners to groups for access management. Enterprises can create groups of self-hosted runners that are accessible to specific organizations in the enterprise account. Organization admins can then assign additional granular repository access policies to the enterprise runner groups. For information about how to create a self-hosted runner group with the REST API, see the Enterprise Administration GitHub Actions APIs.

Self-hosted runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can assign the runner to a specific group during the registration process, or you can later move the runner from the default group to a custom group.

When creating a group, you must choose a policy that defines which organizations have access to the runner group.

  1. GitHub AEの右上で、プロフィール写真をクリックし、続いてEnterprise settings(Enterpriseの設定)をクリックしてください。 GitHub AEのプロフィール写真のドロップダウンメニュー内の"Enterprise settings"

  2. Enterpriseアカウントのサイドバーで、 Policies(ポリシー)をクリックしてください。 Enterpriseアカウントサイドバー内のポリシータブ

  3. " Policies(ポリシー)"の下で、Actionsをクリックしてください。

  4. Self-hosted runners(セルフホストランナー)タブをクリックしてください。

  5. Click Add new, and then New group.

    Add runner group

  6. Enter a name for your runner group, and assign a policy for organization access.

    You can configure a runner group to be accessible to a specific list of organizations, or all organizations in the enterprise. By default, only private repositories can access runners in a runner group, but you can override this. This setting can't be overridden if configuring an organization's runner group that was shared by an enterprise.

    Warning

    セルフホストランナーは、プライベートリポジトリでのみ利用することをおすすめします。 これは、ワークフロー中でコードを実行するPull Requestを作成することによって、リポジトリのフォークが危険なコードをセルフホストランナーマシン上で実行できる可能性があるためです。

    For more information, see "About self-hosted runners."

    Add runner group options

  7. Click Save group to create the group and apply the policy.

Changing the access policy of a self-hosted runner group

You can update the access policy of a runner group, or rename a runner group.

  1. 設定ページの"Self-hosted runners(セルフホストランナー)"のセクションで、設定したいランナーグループの隣のをクリックし、続いてEdit name and [organization|repository] access(名前と[Organization|リポジトリ]アクセスの編集)<クリックしてください。 リポジトリの権限の管理
  2. ポリシーオプションを修正するか、ランナーグループ名を変更してください。

Automatically adding a self-hosted runner to a group

You can use the configuration script to automatically add a new self-hosted runner to a group. For example, this command registers a new self-hosted runner and uses the --runnergroup parameter to add it to a group named rg-runnergroup.

./config.sh --url $org_or_enterprise_url --token $token --runnergroup rg-runnergroup

The command will fail if the runner group doesn't exist:

Could not find any self-hosted runner group named "rg-runnergroup".

Moving a self-hosted runner to a group

If you don't specify a runner group during the registration process, your new self-hosted runners are automatically assigned to the default group, and can then be moved to another group.

  1. In the "Self-hosted runners" section of the settings page, locate the current group of the runner you want to move and expand the list of group members. View runner group members
  2. Select the checkbox next to the self-hosted runner, and then click Move to group to see the available destinations. Runner group member move
  3. To move the runner, click on the destination group. Runner group member move

Removing a self-hosted runner group

Self-hosted runners are automatically returned to the default group when their group is removed.

  1. In the "Self-hosted runners" section of the settings page, locate the group you want to delete, and click the button. View runner group settings

  2. To remove the group, click Remove group. View runner group settings

  3. Review the confirmation prompts, and click Remove this runner group.

このドキュメントは役立ちましたか?

プライバシーポリシー

これらのドキュメントを素晴らしいものにするのを手伝ってください!

GitHubのすべてのドキュメントはオープンソースです。間違っていたり、はっきりしないところがありましたか?Pull Requestをお送りください。

コントリビューションを行う

OR, コントリビューションの方法を学んでください。

問題がまだ解決していませんか?