Also, it's not what you're asking, but self-hosted runners are a security nightmare if you don't have the hardware to completely isolate them from your local network.

[1] https://github.com/actions/partner-runner-images/blob/main/i...