Actions: Outbound network control for GitHub-hosted runners

[github-product-roadmap]

Summary

Customers can now configure a list of IP address or domains that are allowed to be accessible by GitHub-hosted runners.

Intended Outcome

This feature allows platform administrators to control their Enterprise or org-owned GitHub-hosted runners to only access approved destinations while blocking access to everything else giving them control on the network security of their build machines. This also enables teams to run workflows on GitHub-hosted runners that require access to private resources (private artifact repository, on-prem test database, cloud-based storage etc.) as software is deployed.

How will it work?

Platform administrators can enter a range of allowed IPs or domains while configuring a runner group. All runners created as part of that runner group will inherit the outbound allow-list and will only be able to reach the approved destinations.

[ankneis]

Please continue to refer to our updated Public Roadmap for the latest ships, including updates on the continuation of these projects.

[ankneis]

We wanted to provide more details on why we removed this from the roadmap. We are currently prioritizing other features on our roadmap at this time, and are removing this from the roadmap until we determine a more confident delivery date.

If you’re interested in this feature, please share your feedback in the GitHub community so we can track interest and consider it in the future.