Standard: Use GitHub Apps instead of Personal Access Tokens (PATs) for machine-to-machine communication.
Benefits: Apps offer fine-grained permissions and don't expire when an employee leaves.






GitHub-Hosted: Default for standard builds (Node.js, Python, Java). Fast and maintenance-free.
Private Self-Hosted (VMSS): Mandatory for any job requiring access to internal VPCs, private databases, or deployments into production landing zones. Use the label runs-on: [self-hosted].







Store your Docker images, npm packages, and Terraform providers in GitHub Packages.
This ensures that our deployment artifacts are stored in the same ecosystem as our source code, reducing latency and increasing security.