To use a self-hosted runner for Dependabot version updates, configure the repository’s runner type as Labeled runner, then match that choice to an available runner label and, optionally, a runner group. This feature is for eligible private repositories; public repositories use standard GitHub-hosted runners.
What the Dependabot runner setting controls
The setting chooses the execution environment for Dependabot version update jobs. It does not provision a runner: you must first register a self-hosted runner and give it the label you plan to select. Organization owners and repository administrators can configure this option, provided Dependabot and GitHub Actions are enabled and in use. Organization policy can restrict whether a repository administrator may change it. See GitHub’s self-hosted runner configuration guide.
As an Amazon Associate I earn from qualifying purchases.
Choose the runner type that fits the repository
| Runner choice | Repository eligibility | When it fits | Billing and limits |
|---|---|---|---|
| Standard GitHub-hosted runner | Available for public repositories, which cannot use labeled runners for Dependabot. | Use it when the job does not need a self-hosted environment, custom runner targeting, or access to internal resources. | Standard hosted Dependabot runs do not count against included Actions minutes. See GitHub’s hosted runner guide. |
| Labeled self-hosted runner | For eligible private repositories; a runner must have the selected label and be accessible to the repository. | Use it when Dependabot needs access to a private registry or internal network, or when you need control over the runner environment. | Self-hosted Dependabot runs do not count against included Actions minutes. See GitHub’s overview of Dependabot on Actions runners. |
| Larger runner | Can be targeted as a labeled runner where the repository and organization configuration permit it. | Consider it when greater resources may help with timeouts or memory pressure. | Charged at the regular larger-runner rate. More resources do not extend the documented 55-minute job limit. See GitHub’s overview of Dependabot on Actions runners. |
Prepare the self-hosted runner
- Check eligibility and prerequisites. Confirm the repository is private and that Dependabot and GitHub Actions are enabled and in use. Public repositories use standard GitHub-hosted runners instead.
- Provision the runner. Register it at repository or organization scope and ensure the repository can use it. GitHub’s Dependabot on GitHub Actions requirements specify a Linux x64 VM and Docker accessible to runner users. CPU and memory needs depend on concurrency and the repositories being updated; GitHub does not provide a universal sizing formula.
- Set its label and group access. The default label is
dependabot. If you choose a custom label, add that exact label to the runner. You may also select a runner group, which further limits where Dependabot can run. Confirm the repository has access to the group.
Set the repository’s runner type
- Open the repository and go to Settings → Security and quality → Advanced Security.
- Under Dependency scanning → Dependabot version updates → Runner type, select Labeled runner.
- Choose a runner group if needed, then enter the runner label. If you leave the label blank, Dependabot uses
dependabot. - Save the selection. GitHub documents this repository setting in its self-hosted runner guide.
Saving a changed runner type does not start a Dependabot update. Check the Actions tab for the next scheduled or otherwise eligible update job.
Recommended Free Tools
Troubleshoot jobs that do not start
- The repository is public: labeled runners are not available for public repositories; use the standard GitHub-hosted option.
- The job reports a runner-group error: verify that the group exists and that the repository is allowed to access it. A nonexistent group causes an immediate error.
- The job stays queued: check that an online runner is available in the selected group and has the exact label configured for Dependabot. If no matching runner is available, the job can remain queued.
- You cannot change the setting: ask an organization owner to check organization-level security policy and the repository’s permissions.
- No job appeared after saving: this is expected; the setting change itself does not trigger a run. Look for the next Dependabot update job in Actions.
GitHub documents runner eligibility and queue behavior in Dependabot on GitHub Actions runners.
#1 Best Overall
Security considerations for private network access
A self-hosted runner can give Dependabot a route to private registries or internal services, so limit that access to what updates require and manage runner access carefully. GitHub warns against using GitHub-hosted Actions IP addresses as authentication for private registries. For registry setup, consult GitHub’s private registry configuration guide. For organization-wide policy, see GitHub’s global security settings guide.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
