How to whitelist GitHub Actions runner IP in AWS using public-ip?

Use the output IP addresses from public-ip in subsequent steps with AWS CLI commands, like aws ec2 authorize-security-group-ingress, to dynamically update security groups for the duration of the workflow.

public-ip vs manually checking GitHub's IP ranges – which is better?

public-ip is better for real-time, per-run accuracy since GitHub's IP ranges change frequently and are static lists. However, public-ip adds an external dependency, while manual checking is more reliable but labor-intensive.

Does public-ip work with self-hosted GitHub Actions runners?

Yes, it queries the public IP of any runner it runs on, but if self-hosted runners are behind NAT or proxies, the returned IP might not be the true external address, limiting usefulness.

How reliable is the ipify API for public-ip in CI/CD?

Ipify is a free service without guaranteed uptime, so reliability can vary. The retry logic helps, but for critical workflows, monitor ipify's status or implement backup actions to avoid disruptions.

Can public-ip handle IPv6-only networks?

It attempts to fetch IPv6 addresses but falls back to IPv4 if unavailable. In IPv6-only environments, ensure runner connectivity, as the fallback might not apply, potentially causing issues.

What happens if ipify is down during my GitHub Action run?

The action will retry up to the configured maxRetries (default 5), and if all fail, the step errors, halting the workflow unless you add error handling like continue-on-error in your YAML.

Open-Awesome

Public IP

MITTypeScriptv1.3

A GitHub Action that retrieves the public IP address of GitHub Actions runners for firewall whitelisting.

GitHub

126 stars33 forks0 contributors

What is Public IP?

Public IP is a GitHub Action that queries and returns the public IP address of GitHub Actions runners. It solves the problem of dynamically whitelisting runner IP addresses in firewalls and security groups, as GitHub's shared runner infrastructure uses constantly changing IP ranges across Azure and Mac Stadium.

Target Audience

DevOps engineers and developers using GitHub Actions who need to securely connect runners to external services, databases, or APIs that require IP-based firewall rules.

Value Proposition

Developers choose Public IP because it provides a simple, automated solution to a common CI/CD security challenge, eliminating manual IP tracking and reducing security risks from overly permissive firewall rules.

Overview

Queries GitHub actions runner's public IP address

Use Cases

Best For

Whitelisting GitHub Actions runners in cloud firewall rules
Securely connecting CI/CD pipelines to databases with IP restrictions
Dynamically configuring security groups for deployment environments
Troubleshooting network connectivity issues in CI/CD workflows
Auditing which IP addresses GitHub Actions are using
Implementing temporary IP-based access for automated deployments

Not Ideal For

Projects using CI/CD platforms other than GitHub Actions (e.g., GitLab CI, Jenkins)
Environments with strict security policies that prohibit external API calls to services like ipify
Use cases requiring permanent IP whitelisting or historical IP address logging beyond individual runs

Pros & Cons

Pros

Dynamic IP Retrieval

Automatically fetches the runner's current public IPv4 and IPv6 addresses during workflow execution, as shown in the example that prints both IPs, eliminating manual tracking.

Dual Stack Support

Returns both IPv4 and IPv6 addresses with a fallback to IPv4 when IPv6 is unavailable, as specified in the outputs section, ensuring compatibility across networks.

Simple Integration

Easy to use with minimal YAML configuration, requiring only the action reference and output handling, demonstrated in the straightforward workflow example.

Retry Mechanism

Includes configurable retry logic with up to 5 attempts via the maxRetries input, helping gracefully handle temporary API failures from ipify.

Cons

External API Dependency

Relies entirely on the ipify service, which if down or rate-limited can cause workflow failures without built-in fallback options, adding a single point of failure.

Limited Error Handling

Only provides basic retries; lacks advanced recovery like alternative IP sources or validation, which could be risky for production-critical deployments.

No Security Features

Does not validate or sanitize IP addresses, and the README omits security guidance for logging sensitive IP data, potentially exposing information in outputs.

Frequently Asked Questions

Related Projects

action-tmate

Debug your GitHub Actions via SSH by using tmate to get access to the runner system itself.

Stars3,566

Forks330

Last commit2 days ago

Paths Filter

Conditionally run actions based on files modified by PR, feature branch or pushed commits

Stars3,263

Forks380

Last commit14 days ago

Setup ssh-agent

GitHub Action to setup `ssh-agent` with a private key

Stars1,477

Forks300

Last commit1 month ago

GitHub Actions to compile LaTeX documents

:octocat: GitHub Action to compile LaTeX documents

Stars1,401

Forks149

Last commit29 days ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub