runner-group-management

Organize GitHub Actions self-hosted runners into dedicated groups with access restrictions.

3|3|Updated Jan 4, 2026
One-click install
npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill runner-group-management
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: runner-group-management
Source: https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/secure/skills/runner-group-management
Command: npx skills add https://github.com/adaptive-enforcement-lab/claude-skills --skill runner-group-management

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jq, gh, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Self-hosted runners provide powerful capabilities but lack clear security boundaries. This Skill helps organizations enforce boundaries by organizing runners into dedicated groups and applying repository and workflow access controls.

Core Features & Use Cases

  • Strategy 1: Trust-Based Organization – group runners by trust level to control repository access and network exposure.
  • Strategy 2: Workload-Based Organization – isolate CPU/memory/GPU intensive workloads to avoid cross-tenant impact.
  • Strategy 3: Environment-Based Organization – align runner groups with development, staging, production, and disaster recovery environments.
  • Strategy 4: Compliance-Based Organization – map groups to regulatory needs with enhanced logging and restricted access.
  • API/Automation: Use API or scripts to create, configure, and audit runner groups and enforce workflow restrictions.

Quick Start

Review the source documentation and implement runner groups using the examples and available tooling.

Frequently Asked Questions about runner-group-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce security boundaries for self-hosted GitHub Actions runners?

Organize self-hosted GitHub Actions runners into dedicated runner groups to enforce security boundaries. Apply repository allow-lists and workflow restrictions to control access and minimize network exposure across multiple repositories.

What is the best way to isolate CPU and memory intensive workloads in GitHub Actions CI/CD?

Isolate CPU, memory, and GPU intensive workloads in GitHub Actions CI/CD by grouping dedicated self-hosted runners into workload-based runner groups. This avoids cross-tenant impact and maintains workflow stability.

How do I restrict repository access for GitHub Actions runner groups?

Restrict repository access for GitHub Actions runner groups by configuring repository allow-lists and applying workflow restrictions. Use API or scripts to create, configure, and audit these groups for secure access control.

Does this runner group management approach work with existing GitHub Actions workflows?

Yes, runner group management works with existing GitHub Actions workflows by aligning runner groups with development, staging, production, and disaster recovery environments to maintain clear access boundaries.

Do I need jq and gh to configure runner groups for GitHub Actions?

Yes, you need jq and gh to configure and audit runner groups for GitHub Actions. These dependencies support the scripts used to create, configure, and audit runner group access restrictions and workflow boundaries.

Can I map GitHub Actions runner groups to regulatory compliance needs?

Map GitHub Actions runner groups to regulatory compliance needs by creating compliance-based groups. These groups enforce enhanced logging and restricted access to meet specific regulatory and audit requirements.