Self-hosted GitHub Actions runners
GitHub Actions runners, in your cloud.
RunnerYard starts one clean worker for each job and deletes it afterward. Keep GitHub's queue and workflow UI without Kubernetes or a hosted runner vendor.
npx runneryard init --github https://github.com/acme/widgetsScale from zero · One job per worker · No GitHub token to paste
GitHub keeps the queue and workflow UI.
One clean machine receives a one-job JIT credential.
Completion, timeout, and reconciliation all end in cleanup.
Control
One small control plane.
A single Go controller watches a GitHub runner scale set. Its compute adapter has three operations: launch, inventory, and destroy.
Concurrency, maximum lifetime, and a durable rolling usage budget fail closed. A private status receipt shows capacity, assignment latency, provider latency, and remaining budget without opening a monitoring port.
Compute
Choose the compute account.
The controller and credentials stay there.
Security
Jobs get no permanent credential.
The recommended setup creates a private GitHub App owned by you and installed only where the fleet runs. The browser shows the exact owner and permission; its one-time key moves directly from GitHub to your secret store.
RunnerYard never receives the key. Workers receive only GitHub's short-lived JIT configuration and cannot inherit controller or provider secrets.
Read the security modelFirst run
Start with one private canary.
Normal CI stays on its current runner until doctor passes, the canary is green, cleanup is verified, and you explicitly enable the fleet.
Open the setup guide