We ended up implementing an API Gateway in AWS that just proxies the request to our CI server after a simple authentication (and also checking the signature of

We ended up implementing an API Gateway in AWS that just proxies the request to our CI server after a simple authentication (and also checking the signature of the request as suggested by GH). Another related option is that you can run GitHub Runners in your own environment and they will connect to GitHub to accept "jobs" from GitHub Actions. This is another thing we've started doing as we look to pare down our self managed CI. This is a very solid choice I think. In case anyone is interested: https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners https://docs.github.com/en/actions/hosting-your-own-runners/...