GitHub made repository-level custom runner settings available for Dependabot version and security updates on September 29, 2026. Administrators of eligible repositories can select a runner type and optionally specify a custom label and runner group, allowing individual projects to control where their Dependabot jobs execute instead of relying only on organization-level configuration.
Per-Repository Job Routing
The new controls extend runner configuration that GitHub already offered at the organization level. A repository can use a labeled runner to direct Dependabot work to either self-hosted infrastructure or a larger GitHub-hosted runner. GitHub says this can support projects that need access to private package registries or specialized environments while processing dependency updates.
Configuration Options
Administrators can find the setting under Advanced Security in repository settings. Within the Dependency scanning area, editing Runner type for Dependabot version updates provides a choice between Labeled runner and Standard GitHub runner. The labeled option accepts an optional custom label and runner group; when no label is entered, Dependabot uses the dependabot label. The standard option keeps jobs on GitHub's default hosted environment.
Availability and Limits
Repository-level runner settings are limited to private and internal repositories hosted on github.com. GitHub hides the controls for public repositories, and they are not available on GitHub Enterprise Server. The company also notes that security configurations do not currently enforce Dependabot runner settings, so teams using those configurations cannot treat them as a central policy mechanism for this choice.
AI-generated editorial illustration; not a documentary photograph.
Source: Repository custom runner settings for Dependabot
SIGNAL TITANS
Leave a Reply