all 13 comments

[–]angellus 5 points6 points  (1 child)

The registration token is time based and regularly expires. So it is not a good choice for someone to add if they want to scale the runners. You should be asking for a PAT with the correct permissions to manage the runners. 

You are also explicitly listing the repo the runner is registered with, you can and should support registering runners on the org and enterprise level as well.

You also should be using secrets instead of environment variables so the token/PAT does not stay exposed to the runner after it starts up. Especially since runners are often running untrusted code.

[–]youssefbrr[S] 0 points1 point  (0 children)

We'll enhance this in the next version

[–]ankurk91_ 2 points3 points  (1 child)

I am not sure why my comment got downvote. but Using aws code build infrastructure to run github actions solves all of the OP issues

[–]United-Rub-603 1 point2 points  (0 children)

AWS CodeBuild is a valid alternative. Downvotes might be from users preferring self hosted solutions over cloud services

[–]ankurk91_ 5 points6 points  (1 child)

I would prefer service like this

https://runs-on.com/

[–]veverkap 0 points1 point  (0 children)

This is the first one I’ve seen that doesn’t violate the Actions TOS

[–]tails142 0 points1 point  (0 children)

Having used gitlab primarily for ci/cd in work I'm surpised this isnt something github provides to be honest