Comparison
Identity federationvsSelf-hosted runner
Identity federation
the pipeline authenticates to the cloud with a signed token from its own provider, so there is no stored key at all.
Trusting an external identity provider's assertions instead of issuing your own credentials, whether for people through single sign-on or for pipelines through short-lived signed tokens. It removes the last static keys from delivery systems, which is the single highest-value credential improvement most organisations can make. The subject condition on the trust matters enormously: federating a whole provider rather than a specific repository and branch is a well-known hole.
Full entry →Self-hosted runner
the build runs on your own machines so it can reach the private network, and now you own patching and isolating it.
Running pipeline jobs on infrastructure you operate rather than the provider's. It is chosen for network access to private resources, for specialised hardware or for cost at volume, and it moves responsibility for isolation onto you. A persistent runner shared between jobs is a genuine security problem: one job can leave things behind for the next, which is why ephemeral, single-use runners are the safe default.
Full entry →