Question

Your enterprise security team requires that all traffic from GitHub-hosted runners to your internal artifact server (protected by a corporate firewall) originates from a known, restricted set of IP addresses. Developers report that jobs using the larger GitHub-hosted runners intermittently fail to reach the artifact server. As the enterprise admin, which configuration correctly satisfies the requirement to allowlist GitHub-hosted runner egress traffic at your firewall?

Accepted Answer

Enable a fixed static IP address range for GitHub-hosted larger runners in the enterprise/organization settings, then add that assigned range to the corporate firewall allowlist.

Answer

Add GitHub's published meta API IP ranges for the entire GitHub.com service to the firewall, since GitHub-hosted runners always use those same addresses.

Answer

Configure the enterprise IP allow list under organization security settings, which forces all GitHub-hosted runners to use only the listed IPs.

Answer

Register the GitHub-hosted runners into a runner group and assign the group a private networking subnet from your on-premises VLAN.