landing-zone-github-runners

Type: decision

Decision

The platform provisions a delegated subnet for GitHub-hosted runners within the landing zone VNet.

Why

Public network access is denied on every service — a public GitHub runner has no network path to the data plane.

Links

• deny-security-controls — Public runners have no data-plane path once public network access is denied.
• landing-zone-vnet — Runners get a dedicated /28 subnet, delegated for runner integration, within the landing zone VNet.
• platform-identity-github — GitHub App permissions are used for runner registration and configuration.
• landing-zone-allowed-public-ip — Runners provide the network path for automation — human access requires configuring the approved public IP on PaaS firewalls.
• landing-zone-template — PRIVATE_GITHUB_RUNNERS is computed and propagated as an environment variable during landing zone provisioning.
• config-lives-in-the-repo — PUBLIC_GITHUB_RUNNERS is defined in githubVariables.json and seeded to application repos at creation.

← Back to all decisions