Is it possible to use a static IP when using GitHub Actions

Question

I am using GitHub Actions as my project CI. For the unit tests, the project must use a database. My database has an IP allow-list and only IPs in the list can connect to my database, but when I run unit tests in GitHub Actions, I don't know the runner's IP address. Is it possible to use a static IP or any other way to solve the problem? I do not want any IP to be able to connect my database, it may have a security problem.

Answer 1

You can dynamically retrieve the GitHub Actions runner's IP address during your workflow using the public-ip action and update your RDS instance's security group ingress rules before and after your unit test steps.

This will allow you to use GitHub's hosted runners with your workflow instead of hosting your own.

Note: You will need to also set AWS credentials on your runner with permissions to update the associated security group. Also, you need to make sure the RDS instance is in a public subnet with an Internet Gateway attached and security group attached to it.

Your workflow should look something like this:

deploy:
    name: deploy
    runs-on: ubuntu-latest
    env:
      AWS_INSTANCE_SG_ID: <your-rds-subnet-sg-id>
    steps:
      - name: configure aws credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: <your-ci-aws-access-key>
          aws-secret-access-key: <your-ci-aws-secret-key>
          aws-region: <your-rds-aws-region>
      - name: get runner ip addresses
        id: ip
        uses: haythem/[email protected]
      - name: whitelist runner ip address
        run: |
          aws ec2 authorize-security-group-ingress \
            --group-id $AWS_INSTANCE_SG_ID \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32
      - name: connect to your rds instance and run tests
        run: |
          ...run tests...
      - name: revoke runner ip address
        run: |
          aws ec2 revoke-security-group-ingress \
            --group-id $AWS_INSTANCE_SG_ID \
            --protocol tcp \
            --port 22 \
            --cidr ${{ steps.ip.outputs.ipv4 }}/32

Ideally though you would run your integration tests in an EC2 within the same VPC as your RDS instance to avoid publicly exposing your RDS instance.