Didn't see it mentioned yet but I like gitea and it's runner. It's all in Go so very low overhead.

https://docs.gitea.com/usage/actions/act-runner

Also supported by Forgejo actions: https://forgejo.org/docs/latest/user/actions/quick-start/ - both based on https://github.com/nektos/act

sadly they, afaik, do not implement the permission model. So no way to control the token permissions.

(plz correct me if i'm wrong)