Commits on Sep 12, 2023

1. Add runner-level config to enforce PR security …

   This allows self-hosted runners to limit who can run jobs to give "just
   enough protection" to allow using self-hosted runners with public repos.
   
   By default, the current behaviour is unchanged -- all jobs passed to the
   runner are executed.
   
   If the `.runner` config file has this block added to it:
   
   ```
     "pullRequestSecurity": {}
   ```
   
   Then by only PRs from "CONTRIBUTORS" and "OWNERS" can run (as defined by
   the field in
   https://docs.github.com/en/free-pro-team@latest/graphql/reference/objects#pullrequest
   -- nothing for us to have to work out ourselves.)
   
   It is also possible to explicitly list users that are allowed to run
   jobs on this worker:
   
   ```
     "pullRequestSecurity": {
       "allowedAuthors": ["ashb"]
     }
   ```
   
   Or to _only_ allow the given users, but not all contributors:
   
   ```
     "pullRequestSecurity": {
       "allowContributors": false,
       "allowedAuthors": ["ashb"]
     }
   ```
   
   Owners of the repo are always allowed to run jobs.
   
   If an allowed user pushes a commit to a PR from a non-allowed user, than
   _that_ build will be allowed to run on the self-hosted runner.

   

   ashb committed Sep 12, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for eaa6f8f
   • Browse repository at this point

   Copy the full SHA

   eaa6f8f View commit details

   Browse the repository at this point in the history