from my previous comment: > You could of course write a cron script to regularly check Github hooks IPs and update firewall if Github changes it's webhooks IPs

from my previous comment: > You could of course write a cron script to regularly check Github hooks IPs and update firewall if Github changes it's webhooks IPs. This is way easier and simpler than any other solution. It will be a mere 6 line script.