CI/CD pipelines on GitHub or GitLab gain a fixed, allowlisted IP address for secure outbound connections to production databases or partner sandboxes.
The agent configures the AnchoredIP tunnel on CI runners (GitHub Actions or GitLab CI) to provide a stable identity. It retrieves the WireGuard configuration from encrypted secrets, installs necessary tools, and brings up the tunnel interface. This allows the disposable runner to egress through the leased IP, satisfying partner allowlist requirements without needing complex VPC or NAT gateway setups.
- Category: Operations and infrastructure
- Effect: Changes data in your accounts
- MCP servers: AnchoredIP MCP (https://koskamo.com/explore/anchoredip-mcp)
- Source: Use cases — allowlists, CI runners, serverless egress, inbound | AnchoredIP (https://anchoredip.com/docs/use-cases)
- Source quote: "GitHub Actions and GitLab CI runners come from enormous shared ranges that no security team will allowlist."
- Playbook page: https://koskamo.com/explore/use-cases/configure-stable-egress-ip-for-ci-runners
Prompt: Configure the AnchoredIP tunnel on this GitHub Actions runner. Use the secret 'AIP_CONF' to set up the WireGuard interface and bring up the tunnel. Verify the egress IP is correct by checking api.ipify.org.