ref_id: REF-GITHUB-SELF-HOSTED
grade: MODERATE
baseline: LOW
source_type: platform_documentation
upgrades:
  - Primary GitHub documentation for the runner trust boundary used by the proposed workflow.
downgrades:
  - Documentation establishes platform risk, not proof of this repository's future runner configuration.
allowed_language:
  - "GitHub warns that persistent self-hosted runners can be compromised by untrusted workflow code..."
  - "The Jetson lane must be limited to trusted refs and maintainer-controlled dispatch..."
forbidden_language:
  - "A runner label alone safely isolates untrusted pull requests..."
