A self-hosted CI runner is a credential store that also executes whatever the repository says

Hosted build minutes are convenient and predictable. At some point most organisations move part of their pipeline to self-hosted runners, usually for hardware, network reach, or cost. The runner that gets installed is a small agent with a large job: it receives work from a control plane, unpacks it on a machine the organisation owns, and executes it with whatever identity that machine has.

What the runner actually is

GitHub's documentation describes self-hosted runners as machines that run the runner application and connect to GitHub to pick up jobs. The distinction that matters is who can send work. A runner registered at the repository level accepts jobs from that repository. A runner registered at the organisation or enterprise level accepts jobs from every repository in scope, subject to group and label routing.

That scope is the whole security argument. A runner is not a sandbox.…