GitHub Actions Starts Scheduling Eligible Linux Jobs on AWS as Well as Azure, and Tells Customers to Update IP Allowlists

Overview

GitHub said in an October 28 changelog entry that GitHub Actions now schedules eligible jobs across a broader, multi-cloud compute pool. According to the GitHub Changelog, eligible Linux jobs may run on Amazon Web Services (AWS) in addition to Microsoft Azure. GitHub says the change adds capacity, reduces capacity-related queue times and improves service resilience, and it asks customers to check their network allowlists before their workflows begin running in the expanded pool.

Which Runners Are Affected

Per the same changelog entry, multi-cloud compute applies to standard 2-core and 4-core Linux runners and to compatible 2-core and 4-core larger runners without specialized configurations. The entry states that the change does not apply to Windows runners or to runners with private networking or other specialized configurations.

The rollout differs by plan, according to GitHub:

• GitHub Free, GitHub Pro and GitHub Team customers: eligible runners will automatically use multi-cloud compute.
• GitHub Enterprise Cloud customers: can opt in under Enterprise settings > Actions > Hosted compute cloud providers by enabling AWS compute.

GitHub also says that existing runner labels and workflow syntax remain unchanged.

The Allowlist Warning

The changelog’s recommended action concerns network policy. GitHub states that runners in the expanded compute pool use additional outbound IP addresses, so policies that allow only Azure or Microsoft-owned ranges, including Microsoft Entra Conditional Access policies, can block connections or authentication from these runners (GitHub Changelog).

The entry describes the rollout as a rolling change and recommends updating allowlists now, before workflows begin running in the expanded pool. It points customers to the actions array returned by GET https://api.github.com/meta, which lists all GitHub Actions runner IP ranges including the new ones, and recommends keeping allowlists in sync with that endpoint rather than relying on cloud-provider-specific ranges.

GitHub’s documentation on its IP addresses says GitHub-hosted runners use dynamically assigned IP addresses from shared infrastructure, published via the Meta API under keys such as actions and actions_macos. The same page says: “We do not recommend allowing by IP address, but if you use these IP ranges we strongly encourage regular monitoring of our API.”

A Separate Allowlist Change Six Days Earlier

An October 22 changelog entry announced new blob storage endpoints for GitHub Actions on github.com, which GitHub describes as part of its ongoing work to improve capacity and reliability. The entry lists two new host ranges, both inclusive: productionresultssa30.blob.core.windows.net through productionresultssa49.blob.core.windows.net, and productionresultssa100.blob.core.windows.net through productionresultssa199.blob.core.windows.net.

According to the same entry, organizations that already allow productionresultssa*.blob.core.windows.net need no change, while those that allow individual hosts should add the new ones to avoid interruptions to job summaries and logs. The two entries are separate announcements; the October 22 entry does not mention multi-cloud compute.

What We Don’t Know

The changelog does not give a date by which the rollout will complete, does not say what share of eligible jobs will run on AWS, and does not name the AWS regions used. It also does not publish a figure for the queue-time reduction it describes.