runner group

A named set of self-hosted or larger runners whose use an organization or enterprise limits to chosen repositories and workflows.

Jobs reach a group's runners with runs-on and the group key. New runners land in the Default group unless placed elsewhere. Groups are how a platform team keeps sensitive runners away from public or untrusted repositories.