Hacker News Reader

SOC2 ?

are you pushing PHI/PII through github actions?

Does not matter - pipeline needs to be trusted because it has access to sensitive resources for deployment tasks, can fake test results etc.

Even though it is a bit of a PITA to maintain self hosted runners, it is the reason we do it.

GARM can easily manage ephemeral runners for you: https://github.com/cloudbase/garm (Ephemeral runners are also more secure)

Actions have access to environment secrets . Those secrets can open door to PII.