a month ago
GitHub Actions runner POSTs to my service get 403 Forbidden from railway-hikari with x-railway-fallback: true before reaching my app; request id jUdANlSOSMOUmezc2prcFg, edge iad1, 2026-07-07 18:36 UTC. Residential-IP requests to the same endpoint succeed.
4 Replies
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • about 1 month ago
a month ago
Hi,I can help you deploy your hosted APK from GitHub on Railway.Quick questions to solve it fast:Is this an Android APK that needs to be hosted for direct download?
Do you want a simple static hosting (for download link) or do you want to run it somehow (e.g. via emulator/web wrapper)?
My suggested solution (most common case):Use Railway's Static service or Nginx template.
Connect your GitHub repo.
Set the root directory to the folder containing the APK.
Enable "Serve as Static Files".
I can deploy it in under 10 minutes once you give me access (or share the repo link).Let me know the details and I'll get it running for you right away.
a month ago
Try using a self hosted runner configured with a residential proxy or a dedicated static IP.
a month ago
That x-railway-fallback: true header is worth focusing on — it means Railway's edge is returning a generic fallback response, not something coming from your application code. Your app likely never sees these requests at all; this is happening upstream at the edge layer.
Combined with "residential IP succeeds, GitHub Actions runner fails," this looks like IP-range-based filtering rather than anything wrong with your deployment. GitHub Actions runners use documented datacenter IP ranges (published at api.github.com/meta under the "actions" key) that are commonly targeted by bot/abuse-mitigation systems precisely because they're well-known automation sources — different from a typical residential IP.
Worth checking: does your Railway project (or anything in front of it — Cloudflare, a WAF, rate limiter) have any IP-based blocking or bot-protection rules enabled? If so, GitHub's Actions IP ranges may need to be explicitly allowlisted. Railway support/staff would be able to confirm whether there's platform-level edge filtering happening for datacenter IP ranges specifically.