Using groups to manage access to AE hosted runners

About AE hosted runner groups

AE hosted runner groups are used to control access to AE hosted runners at the organization and enterprise level. Enterprise admins can configure access policies that control which organizations in an enterprise have access to the runner group. Organization admins can configure access policies that control which repositories in an organization have access to the runner group.

When an enterprise admin grants an organization access to a runner group, organization admins can see the runner group listed in the organization's AE hosted runner settings. The organizations admins can then assign additional granular repository access policies to the enterprise runner group.

When new runners are created, they are automatically assigned to the default group. Runners can only be in one group at a time. You can move runners from the default group to another group. For more information, see "Moving an AE hosted runner to a group."

Creating an AE hosted runner group for an organization

All organizations have a single default AE hosted runner group. Organizations within an enterprise account can create additional runner groups. Organization admins can allow individual repositories access to a runner group.

AE hosted runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can move a runner from the default group to any group you create.

When creating a group, you must choose a policy that defines which repositories have access to the runner group.

1. On GitHub AE, navigate to the main page of the organization.

2. Under your organization name, click Settings.

   

3. In the left sidebar, click Actions.

4. In the Self-hosted runners section, click Add new, and then New group.

   

5. Enter a name for your runner group, and assign a policy for repository access.

   You can configure a runner group to be accessible to a specific list of repositories, or to all repositories in the organization. By default, only private repositories can access runners in a runner group, but you can override this. This setting can't be overridden if configuring an organization's runner group that was shared by an enterprise.

6. Click Save group to create the group and apply the policy.

Creating an AE hosted runner group for an enterprise

Enterprises can add their AE hosted runners to groups for access management. Enterprises can create groups of AE hosted runners that are accessible to specific organizations in the enterprise account. Organization admins can then assign additional granular repository access policies to the enterprise runner groups.

AE hosted runners are automatically assigned to the default group when created, and can only be members of one group at a time. You can assign the runner to a specific group during the registration process, or you can later move the runner from the default group to a custom group.

When creating a group, you must choose a policy that defines which organizations have access to the runner group.

1. In the top-right corner of GitHub AE, click your profile photo, then click Enterprise settings.

2. In the enterprise sidebar, click Policies.

3. Under " Policies", click Actions.

4. Click the Self-hosted runners tab.

5. Click Add new, and then New group.

   

6. Enter a name for your runner group, and assign a policy for organization access.

   You can configure a runner group to be accessible to a specific list of organizations, or all organizations in the enterprise. By default, only private repositories can access runners in a runner group, but you can override this. This setting can't be overridden if configuring an organization's runner group that was shared by an enterprise.

7. Click Save group to create the group and apply the policy.

Changing the access policy of an AE hosted runner group

You can update the access policy of a runner group, or rename a runner group.

1. In the runner section of the settings page, click next to the runner group you'd like to configure, then click Edit name and [organization|repository] access.
2. Modify your policy options, or change the runner group name.

Moving an AE hosted runner to a group

New AE hosted runners are automatically assigned to the default group, and can then be moved to another group.

1. In the Self-hosted runners section of the settings page, locate the current group of the runner you want to move and expand the list of group members.
2. Select the checkbox next to the runner, and then click Move to group to see the available destinations.
3. To move the runner, click on the destination group.

Removing an AE hosted runner group

AE hosted runners are automatically returned to the default group when their group is removed.

1. In the Self-hosted runners section of the settings page, locate the group you want to delete, and click the button.

2. To remove the group, click Remove group.

   

3. Review the confirmation prompts, and click Remove this runner group.