A runner label is a route, not a security proof.

GitHub added repository-level runner controls for Dependabot version and security updates. An administrator can choose the runner type and add a custom label or runner group. The change applies to private and internal repositories on GitHub.com. GitHub says the controls are hidden for public repositories and GitHub Enterprise Server.

The useful case is clear. A labeled runner can reach a private package registry or run in a specialized environment. The risk is clear too. The dependency updater now runs where that runner can reach. A routing label says where the job should land. It does not prove the runner exists, the group is accessible, the network path is narrow, or the next update succeeds.

There is a policy seam worth pinning to the dashboard. GitHub's changelog says security configurations do not currently enforce these Dependabot runner settings. The product documentation also says Dependabot jobs run on GitHub Actions when Dependabot is enabled, regardless of Actions policy checks or disablement at repository or organization level.

GitHub creates a dynamic workflow for each Dependabot job. It is not stored in .github/workflows. That makes the run page and its logs part of the evidence. A repository diff cannot show the generated workflow that actually ran.

For a labeled route, record the exact label and group. GitHub warns administrators to confirm that both exist and that the repository can access the group before selecting the route. Labels are case-insensitive. Replacing a self-hosted runner requires custom labels to be assigned again.

Then test the path that justified the move. Resolve the private registry through the same proxy and certificate chain. Give the updater only the registry permission it needs. Keep unrelated internal services outside the route. Finally, wait for or trigger the next Dependabot job and retain its URL, revision, result, and cleanup state. GitHub notes that saving a different runner setting does not itself start a run.

Do not call the card ready when it only names sections. The all-selected state below means the template structure is ready. It still needs real labels, hosts, credential scopes, and job evidence.