| name | github-actions-policy |
| description | Use when editing GitHub Actions in private repos. Requires self-hosted runners; flags ubuntu-latest as policy drift unless explicitly approved. |
Private repo Actions policy
For private repositories, GitHub Actions jobs must run on self-hosted runners by default to minimize runner costs (save money).
- Use the repo/org shared selector, for example:
${{ fromJson(vars.SELF_HOSTED_RUNNER_LABELS || '["self-hosted","self-hosted-mikey"]') }}
- Do not use
ubuntu-latest or other GitHub-hosted runners in a private repo unless the user explicitly approves a specific exception
- Treat any mixed routing pattern like "PRs on GitHub-hosted, pushes on self-hosted" as a routing decision that requires explicit user approval
- When reviewing or editing private-repo workflows, flag GitHub-hosted runner usage as policy drift unless there is documented approval