Integrating with GitHub Apps with IP allowlisting feature

[MirYeh]

Select Topic Area

Question

Body

Hey folks!
I read up on the docs on GitHub Apps supporting IP allowlisting, and could not find answers to my questions in the docs.

1. If I choose to create an app with IP allowlisting, how does updating the IPs work - would it propagate to the underlying installations immediately? Is there an API to manage my app's IPs programmatically?
2. As I understand, once an app is installed, its IP allowlist can be shared with the org the app is installed on to allow incoming traffic from the app - if my GitHub org blocks IPs, do I need to remove this restriction to be able to install the app?

Re-1, i see that when the IPs are managed directly in the org, changes are propagated immediately, not sure the same is true for apps.

Thanks!

[MirYeh]

Bumping, as I still can't find docs on this

[MirYeh]

I tested it on my test GitHub App, note that it's not used at scale so there might be delays if your app as the usage scales.

If I choose to create an app with IP allowlisting, how does updating the IPs work - would it propagate to the underlying installations immediately? Is there an API to manage my app's IPs programmatically?

Yes - post-installation the GitHub App's IP allowlist is added immediately to the GitHub Org's IP allowlist. Same for adding new IP addresses, disabling an IP address and deleting an IP address from the GitHub App's IP allowlist.

As I understand, once an app is installed, its IP allowlist can be shared with the org the app is installed on to allow incoming traffic from the app - if my GitHub org blocks IPs, do I need to remove this restriction to be able to install the app?

No - the installation process is web-based, which allows admin from an allowed IP address to access the installation flow.