Your CI job needs to reach something private — a staging database in a VPC, an internal registry, a deploy target behind a firewall. The usual answers are bad: whitelist GitHub's entire runner IP range, or run a self-hosted runner just for network access.
Better idea: put the runner on your private network for the length of the job. 👉 ankurk91/wireguard-action
A modern VPN protocol, and a small one — ~4,000 lines of code against OpenVPN's hundreds of thousands. It lives in the Linux kernel (mainline since 5.6), so it's fast. Its crypto isn't configurable, so there's nothing to downgrade. And config is just keys, SSH-style:
[Interface]
PrivateKey = <client private key>
