Trying to figure out how to lock down my CI runners as much as possible.

They need to be able to reach out to GitHub to HTTPS check out the source code, but I can't easily add a firewall rule for "can only clone this one repo from github".

Ideas beyond "open port 443 outbound to the entire internet"?

0

If you have a fediverse account, you can quote this note from your own instance. Search https://ioc.exchange/users/azonenberg/statuses/116155435146138934 on your instance and quote it. (Note that quoting is not supported in Mastodon.)