🛠 Private Infra Ready: Copilot Coding Agent + Your Self-Hosted Runners (Public Preview)

[ebndev]

Copilot coding agent can now run its development environment on your own infrastructure using self-hosted GitHub Actions runners managed by Actions Runner Controller (ARC). That means agent tasks can reach internal packages, private build tooling, or on-prem services that aren’t exposed to the public internet—while still remaining ephemeral, isolated, and automated.

🤖 What This Unlocks

• Use internal dependency registries or artifact stores (npm, Maven, PyPI mirrors, etc.).
• Run tests against services only reachable inside your network.
• Apply existing compliance / observability layers already baked into your runner fleet.
• Keep Copilot’s environment disposable—every task starts clean, ends clean.

🧩 How It Works (Recap)

Copilot coding agent executes tasks in a GitHub Actions-powered environment. By default we provision hosted runners. Now you can override the environment via copilot-setup-steps.yml and target an ARC scale set.

🔧 Setup Steps

1. Deploy ARC and create a scale set:
   Quickstart: https://docs.github.com/actions/tutorials/use-actions-runner-controller/quickstart
2. Edit copilot-setup-steps.yml in the repository (or org standard) to point to your scale set via runs-on:.
3. Commit & delegate a task to Copilot coding agent—your agent now boots on your infra.

jobs: copilot-setup-steps: runs-on: arc-scale-set-namesteps: - uses: actions/checkout@v4# Add any setup your internal environment needs - name: Install private depsrun: npm ci

🛡️ Security & Isolation Notes

• Each task still uses an ephemeral workspace—no state leakage between tasks.
• Your existing runner-level security policies (network ACLs, scanning, logging) apply automatically.
• Keep secrets management consistent with other ARC-based workflows.

✅ Recommended First Uses

• Internal SDK refactors
• Dependency upgrades needing private registry access
• Integration tests hitting staging APIs behind a firewall
• Legacy monorepo tasks with custom internal toolchains

📎 Tips

• Standardize a base copilot-setup-steps.yml template at the org level for consistency.
• Include lightweight caching if internal dependency retrieval is slow.
• Pair with CodeQL & secret scanning already built into coding agent for layered protection.

📘 Learn More

• Customizing agent environment
• ARC quickstart

💬 Feedback

Let us know what’s missing—metrics visibility? multi-arch scale sets? runner health telemetry surfaced in the agent summary? Drop ideas in comments below:

Bring Copilot to where your code actually lives. 🔐

[GregoireW]

Hello, this day I face an issue when using self hosted runner :

 CodeQL asset ID: 304101132 Error ensuring CodeQL: Error: GitHub host is required Error GitHub host is required ERROR:{"name": "Error", "text": "GitHub host is required", "stack": "Error: GitHub host is required\n at demandGitHubHost (/home/runner/actions-runner/_work/_temp/******-action-main/src/settings/demand.ts:45:15)\n at async (/home/runner/actions-runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:45:18)\n at async (/home/runner/actions-runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:93:41)\n at async async (/home/runner/actions-runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:135:15)\n at async CodeQLCheckerTool.undefined (/home/runner/actions-runner/_work/_temp/******-action-main/src/tools/codeql/codeql-checker.ts:61:9)\n at async async (/home/runner/actions-runner/_work/_temp/******-action-main/src/agents/config.ts:172:100)\n at async CreatePRAgent._0x529bf6 (/home/runner/actions-runner/_work/_temp/******-action-main/src/agents/agentPrimitives.ts:373:41)\n at async CreatePRAgent._0x34f311 (/home/runner/actions-runner/_work/_temp/******-action-main/src/agents/hostedAgents.ts:35:47)\n at async async (/home/runner/actions-runner/_work/_temp/******-action-main/src/index.ts:171:15)\n at async async (/home/runner/actions-runner/_work/_temp/******-action-main/src/index.ts:484:13)", "message": "GitHub host is required", "skipReport": false, "isVisionFlow": false } 

Is codeql a prerequisite now ?

Edit: I found 2 ways to fix it:

• Add an GITHUB_HOST env variable that will make the download possible (but 700Mb each time, cost of network / time not great) (warning env on the job is not working, you have to create a step with echo "GITHUB_HOST=github.com" >> $GITHUB_ENV )
• Add codeQL on the host tool (the process is here https://github.com/actions/runner-images/blob/main/images/ubuntu/scripts/build/install-codeql-bundle.sh )

[Isychan1]

Hello, this day I face an issue when using self hosted runner 👍

 CodeQL asset ID: 304101132 Error ensuring CodeQL: Error: GitHub host is required Error GitHub host is required ERROR:{"name": "Error", "text": "GitHub host is required", "stack": "Error: GitHub host is required\n at demandGitHubHost (/home/runner/actions-runner/_work/_temp/******-action-main/src/settings/demand.ts:45:15)\n at async (/home/runner/actions-runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:45:18)\n at async (/home/runner/actions-runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:93:41)\n at async async (/home/runner/actions-runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:135:15)\n at async CodeQLCheckerTool.undefined (/home/runner/actions-runner/_work/_temp/******-action-main/src/tools/codeql/codeql-checker.ts:61:9)\n at async async (/home/runner/actions-runner/_work/_temp/******-action-main/src/agents/config.ts:172:100)\n at async CreatePRAgent._0x529bf6 (/home/runner/actions-runner/_work/_temp/******-action-main/src/agents/agentPrimitives.ts:373:41)\n at async CreatePRAgent._0x34f311 (/home/runner/actions-runner/_work/_temp/******-action-main/src/agents/hostedAgents.ts:35:47)\n at async async (/home/runner/actions-runner/_work/_temp/******-action-main/src/index.ts:171:15)\n at async async (/home/runner/actions-runner/_work/_temp/******-action-main/src/index.ts:484:13)", "message": "GitHub host is required", "skipReport": false, "isVisionFlow": false } 

Is codeql a prerequisite now ?

Edit: I found 2 ways to fix it:

• Add an GITHUB_HOST env variable that will make the download possible (but 700Mb each time, cost of network / time not great) (warning env on the job is not working, you have to create a step with echo "GITHUB_HOST=github.com" >> $GITHUB_ENV )
• Add codeQL on the host tool (the process is here https://github.com/actions/runner-images/blob/main/images/ubuntu/scripts/build/install-codeql-bundle.sh )

[shoootyou]

I tried both options and that specific error was fixed, but now I’m getting a new one. Do you know what might be missing? My EKS nodes are even in public subnets, and I’ve already confirmed they have internet access.

Error ensuring CodeQL: TypeError: fetch failed TypeError fetch failed ERROR:{"name": "TypeError", "text": "fetch failed", "stack": "TypeError: fetch failed\n at node:internal/deps/undici/undici:13510:13\n at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n at async async (/home/runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:46:11)\n at async async (/home/runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:93:11)\n at async async (/home/runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:135:15)\n at async undefined (/home/runner/_work/_temp/******-action-main/src/tools/codeql/codeql-checker.ts:61:9)\n at async async (/home/runner/_work/_temp/******-action-main/src/agents/config.ts:391:100)\n at async async (/home/runner/_work/_temp/******-action-main/src/agents/config.ts:157:11)\n at async async (/home/runner/_work/_temp/******-action-main/src/agents/config.ts:200:12)\n at async RespondToPRCommentAgent.createToolsAndPrompt (/home/runner/_work/_temp/******-action-main/src/agents/agentPrimitives.ts:36 "message": "fetch failed", "skipReport": false, "isVisionFlow": false } 

[shoootyou]

I tried both options and that specific error was fixed, but now I’m getting a new one. Do you know what might be missing? My EKS nodes are even in public subnets, and I’ve already confirmed they have internet access.

Error ensuring CodeQL: TypeError: fetch failed TypeError fetch failed ERROR:{"name": "TypeError", "text": "fetch failed", "stack": "TypeError: fetch failed\n at node:internal/deps/undici/undici:13510:13\n at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n at async async (/home/runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:46:11)\n at async async (/home/runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:93:11)\n at async async (/home/runner/_work/_temp/******-action-main/src/tools/codeql/download-codeql.ts:135:15)\n at async undefined (/home/runner/_work/_temp/******-action-main/src/tools/codeql/codeql-checker.ts:61:9)\n at async async (/home/runner/_work/_temp/******-action-main/src/agents/config.ts:391:100)\n at async async (/home/runner/_work/_temp/******-action-main/src/agents/config.ts:157:11)\n at async async (/home/runner/_work/_temp/******-action-main/src/agents/config.ts:200:12)\n at async RespondToPRCommentAgent.createToolsAndPrompt (/home/runner/_work/_temp/******-action-main/src/agents/agentPrimitives.ts:36 "message": "fetch failed", "skipReport": false, "isVisionFlow": false } 

Update: Turns out I forgot to set ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache when building the custom image. That made CodeQL install in / instead of /opt/hostedtoolcache, and it was failing because of that.

[Ryangr0]

Just in case someone comes across this and wants an easy fix: I added the following to my dockerfile:

# https://github.com/orgs/community/discussions/177903 # This "fixes" a "bug" that causes errors on self-hosted runners when runner ghcp agent workloads # The problem is that the workload expects codeql to be installed, but it's not present by default # Run https://github.com/actions/runner-images/blob/main/images/ubuntu/scripts/build/install-codeql-bundle.sh RUN bash -c "$(curl -fsSL https://raw.githubusercontent.com/actions/runner-images/main/images/ubuntu/scripts/build/install-codeql-bundle.sh)"