An in-cluster GitHub Actions runner, the third checkbox in namespace
settings. Point it at an org or a repo (the runnerRepo setting); it
registers itself with a one-hour registration token when you toggle it
on, and unregisters on the way out.
Jobs target it with the labels:
runs-on: [self-hosted, tiny]
The issue → PR loop needs to reach the sessions:
tiny deliver writes to a Session object and tiny export lifts bundles
over the exec API. Running those on GitHub's hosted runners would mean
exposing your cluster to the internet. On the in-cluster runner the
cluster credentials stay in the cluster, a labeled issue reaches its
session's inbox in about five seconds, and the courier that empties the
outbox runs next to the fleet.
The runner image carries the tiny CLI, installed by an init container
the same way agent images get theirs. The workflow jobs
use the same binary you run on your laptop.