Question

Your enterprise security team requires that all outbound traffic from GitHub-hosted larger runners originate from a fixed set of IP addresses so that a partner's firewall can allowlist them. As the enterprise administrator, which configuration step enables this while keeping the runners GitHub-hosted?

Accepted Answer

Enable static IP addresses on the larger runner configuration in the organization or enterprise settings, then retrieve the assigned IP ranges to share with the partner

Answer

Add the partner's firewall IP ranges to the repository's IP allow list under the organization security settings

Answer

Register self-hosted runners inside your own VPC because GitHub-hosted runners cannot have predictable outbound IPs

Answer

Configure an Azure private networking peering for the standard GitHub-hosted 2-core runners in the runner group