IP range for http://token.actions.githubusercontent.com/

[ccmtaylor]

Select Topic Area

Question

Body

I'm using Github Actions OIDC to authenticate to a relying party that restricts outgoing internet access. The RP needs to access the OIDC metadata at https://token.actions.githubusercontent.com/.well-known/openid-configuration. Some testing shows that token.actions.githubusercontent.com resolves to various IPs.

I found the published IP ranges at https://api.github.com/meta, but I'm not sure which section (web? api? actions?) corresponds to the token.actions.githubusercontent.com hostname. The IP I get appears under multiple sections.

Any pointers would be appreciated :)

[ccmtaylor]

According to Github support, the correct range is web. Maybe this could be added to public documentation somewhere.