Comparison

Updated October 25, 2026

· ~2 min read

GitHub Actions Runners in 2026: GitHub-Hosted vs CodeBuild-Managed vs Self-Hosted on AWS

GitHub Actions
AWS CodeBuild
CI/CD
Self-Hosted Runners
OIDC

On January 1, 2026 GitHub cut the price of its hosted runners by up to 39%, with the Linux 2-core runner going from $0.008 to $0.006 a minute. It also announced a $0.002-a-minute platform charge for self-hosted runners from March 1, then postponed it within days to "re-evaluate our approach". As of this writing it has not taken effect.

That leaves three ways to run GitHub Actions for an AWS workload, and the cheapest depends on volume and on how much the jobs need to reach inside your AWS network.

Side by side

GitHub-hosted

CodeBuild-managed

Self-hosted on AWS

Price

Linux 2-core $0.006/min; larger sizes more; included minutes by plan

general1.small Linux $0.005/min on-demand; Lambda compute billed per second; reserved capacity cheaper

EC2 or EKS compute only; GitHub's platform charge is postponed

Public repositories

Free

Billed as usual

Billed as usual

Access to your VPC

No (larger runners offer private networking on some plans)

Yes, runs in your VPC

Yes

AWS credentials

OIDC federation to an IAM role

The CodeBuild project's IAM role

Instance or pod role

Maintenance

None

None

Images, patching, autoscaling, cleanup between jobs

Isolation

Fresh VM per job

Fresh environment per build

Up to you; ephemeral runners strongly advised

Rough break-even

At 20,000 billable Linux 2-core minutes a month, GitHub-hosted costs about $120 and CodeBuild about $100. Self-hosting at that volume saves little and costs an engineer's time. At 500,000 minutes a month the numbers diverge: about $3,000 on GitHub-hosted, $2,500 on CodeBuild on-demand, and potentially a few hundred dollars of Spot capacity self-hosted with good bin-packing and caching. At that scale self-hosting usually pays, provided someone owns the fleet.

Security notes

Never use persistent self-hosted runners for public repositories; a pull request from a fork can run code on the machine. Use ephemeral runners, one job per instance or pod, for anything self-hosted. For GitHub-hosted runners, use OIDC with a trust policy pinned to the repository and branch or environment, not long-lived access keys. Scope each role to what that workflow deploys.

Which one

Question 1 of 2

Do jobs need private network access to your AWS resources?

Our verdict

**GitHub-hosted:** low or moderate volume, jobs that only need the internet and AWS APIs (through OIDC), and no appetite for runner maintenance. Simplest by far. **CodeBuild-managed runners:** jobs that need your VPC (private databases, internal registries) or an IAM role directly, at per-minute pricing with nothing to maintain. **Self-hosted on EC2 or EKS:** high volume, large or GPU machines, or caching needs that make per-minute pricing expensive. Cheapest per minute at scale; you own patching, scaling and security of the fleet.

Related solutions

CI/CD Pipeline Build

Automated, secure deployment pipelines that get code to production faster without manual steps or weekend deployments.

1–3 weeks
$5k–$15k
View

AWS Cost Optimization & FinOps Sprint

Reduce your AWS bill by 20–60% while improving performance and reliability.

1–3 weeks
$6k–$18k
View

Get your CI/CD pipeline built and costed

We work with startups and growing companies on AWS architecture decisions. Tell us about your situation and we will recommend the right approach.

As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.