Dedicated IP for releasing?

[onlywei]

Hello, I want to incorporate this action in @fastify/vite: fastify/fastify-vite#266

One of the concerns from the Fastify team is that we want to whitelist the IP address of the machine that is used to perform the release action just in case the NPM token gets leaked. However, Github actions use many many many IP addresses. Is there a way to specify we only want to use one dedicated machine?

Does anyone have any ideas on how to achieve this?

[Andarist]

You can fetch the list of their IPs using curl https://api.github.com/meta - but yes, this isn't a small list. You could use a self-hosted github actions runner - but that's a heavyweight option for such a small problem.