Do GitHub Actions satisfy NHS DTAC security requirements for CI/CD?

Yes — GitHub Actions on GitHub-hosted runners satisfies DTAC Domain 3 (Technical Security) CI/CD requirements. GitHub is ISO 27001 certified, SOC 2 Type II certified, and provides a complete audit trail of all CI/CD runs (who triggered, when, what ran, what changed). For NHS DTAC evidence: GitHub Actions run logs are archived and exportable as CI/CD change management evidence. ClickMasters configures GitHub Actions with branch protection rules (required reviews before merge) for all NHS DTAC projects.

Should UK companies use GitHub-hosted or self-hosted runners?

GitHub-hosted runners: simplest — no maintenance, Cyber Essentials patching handled by GitHub. Appropriate for most UK projects. Self-hosted runners (on AWS eu-west-2): required when: CI/CD needs access to private network resources (internal databases, private APIs), requires specific hardware (GPU for ML model training), or when data processed during build must remain within UK data boundary. ClickMasters uses self-hosted runners on AWS eu-west-2 for CI/CD pipelines that process personal data during testing.

Github Actions Vs Gitlab Ci Vs Circleci Uk

GitHub Actions vs GitLab CI vs CircleCI — UK CI/CD Comparison (2025)

Updated: August 20259 min read

🇬🇧 UK💷 GBP📊 Comparison🔒 UK GDPR⚖️ UK Law

Direct Answer

GitHub Actions is the right default for all new UK projects: free for public repos, tightly integrated with GitHub (no context switching), the largest ecosystem of community actions, and GitHub-hosted runners satisfy Cyber Essentials patching requirements. GitLab CI is right when self-hosted GitLab is already the source control platform. CircleCI is declining — GitHub Actions has overtaken it on developer experience and cost for most UK teams. CI/CD platform choice affects UK security compliance (Cyber Essentials patching), audit trail quality (FCA/NHS), and cost. Here is an honest UK comparison.

Factor	GitHub Actions	GitLab CI	CircleCI
Cyber Essentials (managed runners)	✅ GitHub-hosted runners — patched by GitHub	✅ GitLab.com runners — patched by GitLab	✅ CircleCI cloud — managed
UK GDPR audit trail	✅ GitHub Actions logs — immutable, 90-day retention	✅ GitLab CI logs — configurable retention	Good
NHS/FCA change management evidence	✅ Pull request + Actions run = complete audit trail	✅ GitLab MR + pipeline = audit trail	Good — but less integrated
Ecosystem (community actions)	✅ Largest — GitHub Marketplace	Growing	Smaller
Free tier	✅ Free for public repos, 2000 min/month private	Free for public, 400 min/month private CI	Free tier limited
Self-hosted runners	✅ Self-hosted runners on AWS eu-west-2	✅ GitLab runners, self-hosted	✅ Self-hosted
Integration with source control	✅ Native — same platform as code	Native (GitLab)	Requires OAuth integration with GitHub/GitLab
YAML syntax	✅ Intuitive — on-push/on-PR triggers	Similar — more options, more complexity	Separate config syntax
ClickMasters standard	✅ All new projects	GitLab-primary teams only	Not recommended for new projects