Didn't see it mentioned yet but I like gitea and it's runner. It's all in Go so very low overhead.
https://docs.gitea.com/usage/actions/act-runner
Also supported by Forgejo actions: https://forgejo.org/docs/latest/user/actions/quick-start/ - both based on https://github.com/nektos/act
sadly they, afaik, do not implement the permission model. So no way to control the token permissions.
(plz correct me if i'm wrong)
Also supported by Forgejo actions: https://forgejo.org/docs/latest/user/actions/quick-start/ - both based on https://github.com/nektos/act