---
title: "Using GitHub Actions with Heroku Flow for additional Security Control"
description: "The pattern combines GitHub Actions with Heroku Flow for private repositories and stricter security requirements when GitHub organization IP restrictions cannot use Heroku IP ranges. A custom self-hosted GitHub Runner runs as a Docker image on Heroku, while the Platform API and Source Endpoint API upload source code to ephemeral storage, build and deploy apps, and manage Review Apps. Event-specific workflows handle pushes, manual runs, schedules, and pull requests; a weekly workflow rebuilds and autodeploys the runner image within GitHub’s 30-day update window. Setup uses a Heroku Private Space, its outbound IPs, a GitHub access token, and organization name, but omits the repository URL in the Review App UI, does not run conventional Heroku CI tests, and is incompatible with Fir."
---

# Using GitHub Actions with Heroku Flow for additional Security Control

[Heroku](https://yomu.fyi/company/heroku) · Andrew Fawcett · Mar 27, 2025

**Type:** Tutorial

## Summary

The pattern combines GitHub Actions with Heroku Flow for private repositories and stricter security requirements when GitHub organization IP restrictions cannot use Heroku IP ranges. A custom self-hosted GitHub Runner runs as a Docker image on Heroku, while the Platform API and Source Endpoint API upload source code to ephemeral storage, build and deploy apps, and manage Review Apps. Event-specific workflows handle pushes, manual runs, schedules, and pull requests; a weekly workflow rebuilds and autodeploys the runner image within GitHub’s 30-day update window. Setup uses a Heroku Private Space, its outbound IPs, a GitHub access token, and organization name, but omits the repository URL in the Review App UI, does not run conventional Heroku CI tests, and is incompatible with Fir.

## Context

GitHub organizations cannot be configured with Heroku IP ranges, creating a problem for organizations with security rules requiring IP restrictions. The pattern also addresses private repositories, regulated environments, and the need to manage GitHub Runner updates while retaining Heroku Pipeline visibility.

## Approach / What changed

The setup runs a custom GitHub self-hosted Runner as a Docker image on Heroku and uses Heroku’s Platform API and Source Endpoint API to upload source code, deploy applications, and create, update, or remove Review Apps. A weekly workflow rebuilds and autodeploys the runner image, while GitHub Actions workflows respond to deployment and pull request events. The documented configuration uses a Heroku Private Space, outbound IPs, a GitHub access token, and organization name.

## Takeaways

- A Heroku-hosted custom runner can automate GitHub Actions workflows for Heroku deployments and Review Apps while keeping source code briefly on ephemeral storage.
- The Heroku Flow Action maps specific events to operations: deployments for pushes, manual runs, and schedules; Review App creation or updates for pull requests; and removal when a pull request closes.
- This sample does not use Heroku’s standard Git repository, so conventional Heroku CI tests are not run; it also uses a custom GitHub image and is incompatible with Fir.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [GitHub Actions](https://yomu.fyi/topic/github-actions), [Heroku](https://yomu.fyi/topic/heroku)

- Source: [Heroku](https://www.heroku.com/blog/using-github-actions-heroku-flow-additional-security-control)
- Source URL: https://www.heroku.com/blog/using-github-actions-heroku-flow-additional-security-control
- Ingested by Yomu: 2026-09-10T04:01:52.071Z

[Read original post](https://www.heroku.com/blog/using-github-actions-heroku-flow-additional-security-control)