Do third-party GitHub Actions runners work with private repositories?
Can I use a third-party runner on a private GitHub repository?
Yes. Third-party runner services install a GitHub App on your account or organization, and GitHub sends the jobs of the repositories you select to the provider’s runners, the same way it sends jobs to a self-hosted runner, so private repositories work exactly like public ones. The workflow, secrets and logs stay in GitHub; your code is checked out onto the runner only for the job. Sengi runs private repositories on personal accounts and organizations at every size, on AMD Ryzen 9 7950X3D bare metal boosting past 5 GHz with a fresh VM for every job, from $0.003 a minute.
Last checked October 23, 2026, against GitHub’s self-hosted runner documentation and Sengi’s setup guide.
Where does each part of a private-repository job live?
| Part of the job | Where it lives |
|---|---|
| Workflow file, triggers, branch rules | GitHub, unchanged |
| Secrets | Stored in GitHub; passed to the job at run time |
| Logs and run history | GitHub |
| Your code | Checked out onto the runner for the job |
| Which repositories can use the runner | The GitHub App’s repository selection, which you control |
| The machine | The provider’s. On Sengi, a fresh VM per job, destroyed afterwards |
How to judge a provider’s isolation is in are third-party GitHub Actions runners secure?
Why do private repositories gain the most from a third-party runner?
Because that is where GitHub bills. On private repositories, ubuntu-latest drops to 2 vCPU and 8 GB, every minute past the plan’s included minutes costs $0.006, and 4 and 8 vCPU larger runners cost $0.012 and $0.022 a minute from the first minute. Sengi runs the same sizes at $0.003, $0.006 and $0.012, and finishes builds up to 1.9× faster. See how much GitHub Actions minutes cost and the runner comparison.
How do I connect a private repository to Sengi?
- Install the Sengi GitHub App on the account or organization that owns the repository, choosing Only select repositories.
- Change the job’s
runs-ontosengi-standard-2-ubuntu-2404,sengi-standard-4-ubuntu-2404orsengi-standard-8-ubuntu-2404, and merge.
Or give your coding agent one prompt and it opens the pull request. See how switching works.
Frequently asked questions
Does a third-party runner provider see my code?
The runner does, for the length of the job: actions/checkout clones the repository onto the machine that runs it, exactly as on GitHub's runners or your own. Choose a provider that gives every job a fresh VM and destroys it afterwards. On Sengi each job runs in its own fresh virtual machine, which is destroyed when the job ends.
Can I limit which repositories a runner provider can use?
Yes. When you install the provider's GitHub App, choose Only select repositories and pick the ones it may run. You can change the selection or uninstall the App at any time from your GitHub settings.
Do I need a GitHub Team or Enterprise plan for a third-party runner?
Not for Sengi. It runs private repositories on personal accounts and organizations alike, at 2, 4 and 8 vCPU. GitHub's own 4 and 8 vCPU larger runners, by contrast, need an organization on Team or Enterprise Cloud.
Will my secrets and OIDC still work?
Yes. Secrets stay stored in GitHub and are passed to the job at run time, the same as on any runner. On Sengi, repository secrets with step and job scoping and OIDC token issuance under id-token: write have each been tested.
The fastest hardware for your GitHub Actions.
AMD Ryzen 9 7950X3D desktop CPUs boosting past 5 GHz, on bare metal with local NVMe, a fresh VM for every job, and 2 vCPU jobs ready in 2 seconds. Builds finish up to 1.9× faster than on GitHub’s runners, and at up to half GitHub’s price per minute they cost up to 74% less per build. Change one runs-on line, or give your coding agent one prompt and it opens the pull request for you.