Using GitHub Actions with Heroku Flow for additional Security Control

Summary

The pattern combines GitHub Actions with Heroku Flow for private repositories and stricter security requirements when GitHub organization IP restrictions cannot use Heroku IP ranges. A custom self-hosted GitHub Runner runs as a Docker image on Heroku, while the Platform API and Source Endpoint API upload source code to ephemeral storage, build and deploy apps, and manage Review Apps. Event-specific workflows handle pushes, manual runs, schedules, and pull requests; a weekly workflow rebuilds and autodeploys the runner image within GitHub’s 30-day update window. Setup uses a Heroku Private Space, its outbound IPs, a GitHub access token, and organization name, but omits the repository URL in the Review App UI, does not run conventional Heroku CI tests, and is incompatible with Fir.

Takeaways

1. 1

   A Heroku-hosted custom runner can automate GitHub Actions workflows for Heroku deployments and Review Apps while keeping source code briefly on ephemeral storage.

2. 2

   The Heroku Flow Action maps specific events to operations: deployments for pushes, manual runs, and schedules; Review App creation or updates for pull requests; and removal when a pull request closes.

3. 3

   This sample does not use Heroku’s standard Git repository, so conventional Heroku CI tests are not run; it also uses a custom GitHub image and is incompatible with Fir.