add CI that verifies GitHub IPv4 ranges that send webhooks

.github/workflows/github_hooks_ip_ranges.yml

@@ -0,0 +1,47 @@
+name: Check GitHub webhook IP ranges
+
+on:
+  schedule:
+    - cron: "42 6 * * *"   # daily, 06:42 UTC
+  workflow_dispatch:
+  pull_request:
+    types: [opened]
+
+permissions:
+  contents: read
+
+env:
+  # Path (in this repo) to the file listing the GitHub IP ranges we accept webhooks from
+  GITHUB_WEBHOOK_IP_RANGES_FILE: .github/workflows/github_hooks_ip_ranges_file.cfg
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Compare GitHub hooks ranges with accepted webhook IPv4 ranges
+        run: |
+          set -euo pipefail
+
+          curl -fsSL https://api.github.com/meta \
+            | jq -r '.hooks[] | select(contains(":") | not)' \
+            | sort -u > current_ip_ranges_hooks_are_sent_from.txt
+
+          echo "Current GitHub hooks IPv4 ranges:"
+          cat current_ip_ranges_hooks_are_sent_from.txt
+
+          missing=0
+          while read -r cidr; do
+            if ! grep -qxF "$cidr" "$GITHUB_WEBHOOK_IP_RANGES_FILE"; then
+              echo "::error::Missing from accepted GitHub webhook IP ranges: $cidr"
+              missing=1
+            fi
+          done < current_ip_ranges_hooks_are_sent_from.txt
+
+          if [ "$missing" -eq 1 ]; then
+            echo "Accepted GitHub webhook IPv4 ranges are out of date. Add the ranges above to $GITHUB_WEBHOOK_IP_RANGES_FILE."
+            exit 1
+          fi
+          echo "All current GitHub hooks IPv4 ranges are accepted."

.github/workflows/github_hooks_ip_ranges_file.cfg

@@ -0,0 +1,7 @@
+140.82.112.0/20
+143.55.64.0/20
+185.199.108.0/22
+192.30.252.0/22
+9.234.106.48/28
+9.234.98.160/28
+9.234.98.176/28