I don’t think you can handroll github dedicated runners (e.g. I read recently that there’s still no support for M1 dedicated runners).
If ARM wants to run CI directly on the ISAs they’re developing, or with complicated custom toolchains such that they can run tests on ISA under development from a host machine, they probably need pretty extensive customisations on the runner site, which would require contracting github to do that for them, or having to work directly on github code, for ARM-exclusive needs.
Either way a lot of collaboration work for something which isn’t really collaborative, or of any concern or value to github as a company. And with possible risks of information leak one way or another.
That's my guess but not very clear at all...
But it's nearly impossible to do that for the forge itself (GitHub).
I recommend https://slsa.dev (vendor-neutral effort from the Linux Foundation) for a better picture of a secure supply chain.
Simply put, the open source is a beneficial thing for Arm here.
But is not a great reason they probably have more products where the source is not available to them...
Arm was using GitHub for source code hosting. But most of the new core infrastructure that Arm is deploying is on proprietary hardware, and "GitHub is a black box and so we would have to work with them or let them do the work, and it wouldn't necessarily be correct," Wafaa says. "Then we'd have to do reviews. We wouldn't necessarily be able to do the patch reviews because it's all private and proprietary code… that was a big factor for us choosing GitLab."
Seems garbled, what does the proprietary nature of GitHub have to do with code review process?
Are they just saying they can’t host a lot of the code publicly?