Static IP for GitHub Enterprise Cloud

GitHub Enterprise Cloud lets you turn on an IP allow list, which blocks any request that doesn’t come from an address you’ve approved. Optibot normally reaches GitHub from a changing range of cloud addresses, so it can’t be allow-listed.

With the static IP add-on, Optibot reaches GitHub from a fixed Optibot IP address. Add that address to your allow list, and Optibot keeps working as before.

Before You Start

  • GitHub Enterprise Cloud only. IP allow lists are a GitHub Enterprise Cloud feature, so the static IP is only useful there. GitHub Enterprise Server and GitHub Enterprise Cloud with data residency (ghe.com) aren’t supported.
  • Optibot Enterprise plan only. The static IP is a paid add-on to the Enterprise plan. To add it, contact your account manager, or contact support from your Optimal dashboard.
  • You need to be a GitHub organization owner (or an enterprise owner) to change the allow list.

What Uses the Static IP

Once the add-on is on, Optibot reaches GitHub for your organization from the static IP when it:

  • Reviews and summarizes pull requests, including re-reviews.
  • Replies when you mention @optibot.
  • Pushes fixes to your branches, and reads CI logs to fix failing builds.
  • Indexes your codebase for review context.

The address is used only by Optibot, for customers with the add-on.

Your code stays encrypted end to end between Optibot and GitHub. The static IP is a network route, not a new place your code is stored.

Setting It Up

1. Contact us to turn it on

Ask your account manager, or contact support from your Optimal dashboard, to add the static IP to your plan. Tell us which GitHub organization it’s for.

Once the add-on is on your plan, we turn it on for your organization and check that it’s working. This usually takes a few minutes. Then we send you the IP address, and you can add it to your allow list right away.

You don’t need to reinstall the GitHub App or re-index your repositories.

2. Add the IP to your allow list

  1. In GitHub, open your organization’s Settings.
  2. Under Security, click Authentication security.
  3. In IP allow list, click + Add, enter the IP address we sent you, and give it a description such as Optibot.
  4. If your allow list isn’t on yet, select Enable IP allow list and click Save.

If you manage the allow list for your whole enterprise, add the address in your enterprise’s Authentication security settings instead.

3. Check a review

Open or update a pull request and confirm Optibot reviews it. If anything was missed, tell us and we’ll check it straight away.

Your Team’s Own Tools

The static IP covers Optibot’s servers only. The Optibot CLI, the IDE extensions and the MCP server run on your developers’ machines and read code from their local copies. Anything those machines do on GitHub directly, like git push, still needs their addresses on your allow list, the same as it does today.

Troubleshooting

  • Optibot stopped reviewing after the allow list went on. Check the address in your allow list matches the one we sent you, then contact support from your Optimal dashboard. We’re alerted when GitHub turns away an Optibot request, and can see what was blocked.
  • Turning the add-on off. Ask your account manager or support before you remove it, and take the address off your allow list only after we confirm. Once it’s off, Optibot goes back to its usual addresses, which an allow list will block.