Allow GitHub to access ACR - IP rule limit exceeded

Question

I have an Azure Container Registry which has images being pushed to it using GitHub Actions. To make this work, I had previously enabled access to the ACR from all public networks.

As part of a security hardening, I'm currently in the process of limiting it to selected public networks. However, there is a big problem with this.

I have to manually add each GitHub IP as an IP rule for the Azure Container Registry. However, there is a limit of no more than 100 IP rules in the ACR, and GitHub uses a total of 2098 different IP ranges for GitHub actions (https://api.github.com/meta), well over the limit of 100.

How should I proceed? Do I need to just ignore security recommendations and leave the ACR open to the entire internet just to get around this issue?

Answer 1

Same question.

I guess everyone just leaves it open to the public or uses circleCI who has a much more limited range of IP addresses (about 20).

I am considering dropping GitHub Actions and moving to circle CI for this reason alone.