Repository settings audit (operator)

Periodic manual checks. GitHub does not expose all of these via API.

ADR-097 — self-hosted runner safety

• [ ] Require approval for all outside collaborators is enabled (Settings, Collaborators and teams).
• [ ] .github/SELF_HOSTED_RUNNER_ALLOWLIST.md matches every workflow using self-hosted or dgx-spark.
• [ ] DGX runner registered as ephemeral only.
• [ ] No deploy/release/security workflow targets self-hosted.

Related

• ADR-097
• DGX_RUNBOOK