Trying to figure out how to lock down my CI runners as much as possible.
They need to be able to reach out to GitHub to HTTPS check out the source code, but I can't easily add a firewall rule for "can only clone this one repo from github".
Ideas beyond "open port 443 outbound to the entire internet"?