how to provide IP address for GITHUB runner windows-latest to open port 22 on my own target machine

[Shailendri-15]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

Misc

Discussion Details

Am doing a POC to deploy dot net application to our own target server using GITHUB windows-latest runner .
I am able to publish the artifact through CICD workflow however stuck to copy this artifact to our own target server .
Need to use scp or sftp method to copy artifact to target server as suggested by Copilot . Hence have asked our firewall team to opne port 22 on target server .Now to open port they need source ip address which is github runners ip address .which IP address I have to provide .

[adityajethwa7]

Hi @Shailendri-15 ,

When using the windows-latest GitHub hosted runner, the IP address you need to provide your firewall team to allow port 22 access isn’t fixed—it can change because GitHub Actions runners use dynamic, shared IP addresses managed by Microsoft.

Here’s how to proceed:
1.) Use GitHub’s Published IP Range JSON:
GitHub publishes the IP ranges used by their Actions runners in a public JSON file here:
https://api.github.com/meta
Within the response, look for the "actions" IP blocks section. These represent the IP ranges from which GitHub-hosted runners (including Windows-latest) can originate outbound connections.

2.) Provide Firewall Team with the Current Actions IP Ranges:
Share these IP ranges with your firewall team to whitelist them on port 22 for your target server. Keep in mind these are ranges, so your firewall rules will need to support CIDR blocks, not just single IPs.

3.) Automate IP Range Updates:
The IP ranges GitHub uses can change over time. To avoid manual updates:

4.) Implement a scheduled job or script that fetches https://api.github.com/meta regularly.
Extract the "actions" IP ranges and update your firewall rules dynamically via automation or your firewall’s API (if supported).
Consider Self-Hosted Runners for Fixed IP:
If your infrastructure requires a static source IP for security reasons:

Deploy a self-hosted runner within your network or a cloud VM with a fixed IP.
Use this runner for deployments, eliminating the need to open port 22 for the broad GitHub IP ranges.

5.) Test Connectivity Before Finalizing:
Use the runner in your workflow to ping or execute ssh commands to your target server once the firewall rules are updated, verifying access is working as expected.

Hope this helps!

[pratama404]

GitHub-hosted runners like windows-latest do not use fixed IP addresses. They run in a shared pool managed by GitHub (via Azure) and their outbound IP addresses are dynamic. However, GitHub provides the public list of possible IP address ranges used by these runners.
🔧 Solution Steps

1. Fetch GitHub Actions IP Ranges
   GitHub publishes a live JSON metadata file containing the IP address ranges used by GitHub-hosted runners:
   📌 URL: https://api.github.com/meta
   "actions": [
   "185.199.108.0/22",
   "140.82.112.0/20",
   ...
   ]
   These are the IP address CIDR blocks used for outbound traffic from GitHub-hosted runners, including windows-latest.
2. Provide the Firewall Team with These IP Ranges
   You should share the full list under "actions" with your network/security team. Ask them to allow these ranges on port 22 for the target server. Most enterprise firewalls support CIDR-based rules.
3. Be Aware of IP Changes
   GitHub’s IP ranges can change over time. To stay current:
   Use a scheduled script (e.g., Python or PowerShell) to fetch the latest IPs from https://api.github.com/meta
   Automate firewall rule updates if your system allows API-based rule management
4. Alternative: Use a Self-Hosted Runner with Static IP
   If your infrastructure requires a fixed IP for security:
   Deploy a self-hosted GitHub Actions runner inside your network or on a cloud VM (Azure, AWS) with a known static IP
   This removes the need to whitelist dynamic GitHub IPs
   📘 Reference: About self-hosted runners
5. Testing the Connection
   Once the firewall rule is applied, test SSH connectivity from a GitHub workflow step:

• name: Test SSH Connection
  run: |
  ssh -o StrictHostKeyChecking=no youruser@your-server-ip "echo SSH successful"
  📚 References
  GitHub Meta IP API: https://api.github.com/meta
  GitHub Docs: About IP addresses for GitHub-hosted runners
  GitHub Docs: About self-hosted runners
  ✅ Recommendation
  If your organization prefers tight network control, a self-hosted runner is the best approach. But if you're okay managing firewall rules dynamically, using the GitHub-hosted runner with the published IP ranges is entirely viable.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Shailendri-15]

Hello everyone .
Thanks for your reply . As our security team was not ready to open all IP address used by GITHUB hence we have decided to use self-hosted runner and provided the solution .

[Shailendri-15]

Got solution by using self-hosted runner .

[Shailendri-15]

Closing this discussion as issue is fixed .