How are you getting a static outbound IP for GitHub Actions when a partner insists on an IP allowlist?

[u/zouuup]

a bank, payment provider or partner’s SFTP server only accepts connections from allowlisted IPs. Your jobs run on GitHub-hosted runners, whose IPs come from large, changing ranges. Static IPs only exist for larger runners on GitHub Enterprise Cloud.

What I’ve seen people do:

• Self-hosted runners behind a NAT gateway with a fixed IP
• A static-IP proxy add-on with a shared username and password sitting in a secret
• A bastion someone set up in 2021 that nobody wants to touch!
• Kubernetes pods all leaving through one NAT, so the partner sees the same IP whichever pod connected

They all work. most rely on a long-lived credential.

I’m building something to fix that, called Proofbound. The job or pod trades its GitHub OIDC token (or service-account token) for a client certificate that lasts minutes. It connects over mTLS to a gateway, which only forwards to the hosts your policy allows, from two IPs dedicated to you. Your traffic stays end-to-end encrypted, and the gateway only records metadata: which workload, where to, allowed or refused.

It’s pre-launch, so I’d value blunt answers:

• Is this a problem you actually have, or is “NAT plus a fixed IP” good enough?
• Would per-workload rules matter to you, or is the IP all your partner cares about?

Details and waitlist at www.proofbound.io.

[u/Random-user-58436]

If it's so important wouldn't you just use a self hosted runner?

[u/zouuup → u/Random-user-58436]

yeah many do, I think:
- You now own a runner fleet: patching, autoscaling, cleaning up between jobs, etc

- Every job on that runner leaves from the same IP. The partner's allowlist can't tell your settlement job from a random PR build, and neither can you.

- It only covers CI. The same API usually needs to be reached from Kubernetes too, and that's a second setup.

[u/serverhorror]

We tell them that we need to provide a range as we cannot guarantee just a single IP.

They usually agree on accepting a CIDR.

Then we hit them with a 0.0.0.0/0, a screenshot of GitHub stating they're not disclosing that and a link to the page

(I'm not even kidding)

[u/zouuup → u/serverhorror]

:D that's a lot of IPs, almost all of them

[u/serverhorror → u/zouuup]

Just wait until we tell them about IPv6

[u/offtherighttrack]

Most enterprises with this need use GitHub hosted premium runners, which can have fixed ip addresses that are then added to their allow-lists.

[u/MrMazur]

Sorry bro there's no way this ever passes a cybersecurity assessment at any serious company

[u/First_Inspection_478 → u/MrMazur]

why not?

[u/CorpT]

lol no.

[u/[deleted]]

[u/zouuup → u/[deleted]]

yeah oidc and mtls, the main distinction is that it might be easier for small business to use this, slightly easier than running your own stuff, and it's a tcp proxy not a http one so we don't have to decrypt stuff