Configure stable egress IP for CI runners
CI/CD pipelines on GitHub or GitLab gain a fixed, allowlisted IP address for secure outbound connections to production databases or partner sandboxes.
How it works
Changes data in your accountsOperations and infrastructure
The agent configures the AnchoredIP tunnel on CI runners (GitHub Actions or GitLab CI) to provide a stable identity. It retrieves the WireGuard configuration from encrypted secrets, installs necessary tools, and brings up the tunnel interface. This allows the disposable runner to egress through the leased IP, satisfying partner allowlist requirements without needing complex VPC or NAT gateway setups.
Prompt
Paste this into an agent that has the servers below connected. Adjust the names and dates to your own.
Prompt for Configure stable egress IP for CI runners
Configure the AnchoredIP tunnel on this GitHub Actions runner. Use the secret 'AIP_CONF' to set up the WireGuard interface and bring up the tunnel. Verify the egress IP is correct by checking api.ipify.org.MCP servers it needs
Source
The vendor page this playbook is drawn from, and the passage that supports it.
GitHub Actions and GitLab CI runners come from enormous shared ranges that no security team will allowlist.Use cases — allowlists, CI runners, serverless egress, inbound | AnchoredIP