How can you find the IP address ranges used by GitHub-hosted runners to configure firewall allowlists?
Select an answer to reveal the explanation.
Short Explanation and Infographic
GitHub publishes its IP ranges via the /meta API — it's a live list that should be programmatically synced to your firewall, not hardcoded.
Full explanation below image
![Educational infographic 1024x768 showing GitHub meta API for runner IP ranges. GET api.github.com/meta response JSON showing 'actions': ['192.30.252.0/22', '185.199.108.0/22', ...]. Firewall diagram showing allowlist rules being updated from API response. Warning: ranges change — don't hardcode. Recommended: cron job or webhook to auto-sync. GitHub API icon.](/media/github/gh-200/GH-200-q106-infographic.webp)
Full Explanation
GitHub publishes the IP address ranges used by GitHub Actions runners via the REST API endpoint 'GET https://api.github.com/meta'. The response includes 'actions' as one of the keys listing the CIDR ranges. These ranges change periodically, so GitHub recommends using the API to dynamically update firewall rules rather than hardcoding ranges. Subscribe to the GitHub changelog to know when to refresh. The ranges are publicly available and don't require authentication. GitHub also provides a webhook subscription for meta changes. DNS lookup won't give you runner IPs — runners are assigned IPs from a pool.