# GitHub Actions immutable actions firewall allowlist pkg.actions.githubusercontent.com

Status: search-observed
Product: Immutable GitHub Actions
Last verified: 2026-06-25
Canonical HTML: https://gitdocs.org/fix/github-actions-immutable-actions-firewall-allowlist-pkg-actions-githubusercontent-com
Machine JSON: https://gitdocs.org/api/fixes/github-actions-immutable-actions-firewall-allowlist-pkg-actions-githubusercontent-com.json

## Exact Symptom

See the observed Codex queries below.

## Diagnosis

Firewall and proxy rules are external to the repository; local action references do not reveal the platform's new artifact-distribution hostname.

## Fix

```
Verifier checks the minimal domain/CA/proxy update and successful immutable action retrieval. Check the narrow egress rule and integrity-verified download.
```

## Avoid

- Changing local code without checking the current external contract.
- Retrying the same install, build, or API call with no version/source change.
- Applying a broad unsafe bypass when a narrow compatibility fix is available.

## Observed Codex Queries

- GitHub Actions immutable actions firewall allowlist pkg.actions.githubusercontent.com
- site:docs.github.com actions firewall pkg.actions.githubusercontent.com immutable actions
- "pkg.actions.githubusercontent.com" "GitHub Actions"
- GitHub Actions Immutable Actions public preview firewall domain
- "pkg.actions.githubusercontent.com"
- "pkg.actions" GitHub
- "pkg.actions.github.com"
- "immutable actions" "package" "GitHub"
- "immutable" "actions" "pkg.actions"
- "Immutable GitHub Actions"
- GitHub Docs communication requirements self-hosted runners actions domains actions.githubusercontent.com
- https://docs.github.com/en/actions/reference/github-hosted-runners-reference

## Sources

- Immutable Actions network allow-list changes: https://github.blog/changelog/2025-02-12-notice-of-upcoming-deprecations-and-breaking-changes-for-github-actions/
- GitHub source file or repository reference: https://docs.github.com/en/actions/reference/github-hosted-runners-reference