Hacker News Reader

Does not matter - pipeline needs to be trusted because it has access to sensitive resources for deployment tasks, can fake test results etc.

Even though it is a bit of a PITA to maintain self hosted runners, it is the reason we do it.

GARM can easily manage ephemeral runners for you: https://github.com/cloudbase/garm (Ephemeral runners are also more secure)