docs: add a GitHub sign-in page with the IP allow list addresses

administration/authentication/github_login.md

@@ -0,0 +1,62 @@
+---
+title: GitHub sign-in
+description: "Sign in to Kosli with a GitHub account, and allow Kosli's sign-in traffic through a GitHub IP allow list."
+icon: "github"
+---
+
+Kosli supports signing in with a GitHub account. If your organization uses an identity provider,
+[single sign-on](/administration/authentication/single_sign_on) is the alternative, and
+[Magic Link](/administration/authentication/magic_link) works without one.
+
+## Before you begin
+
+Your GitHub account must have a verified email address, otherwise sign-in fails. Check the status of
+your email addresses at [github.com/settings/emails](https://github.com/settings/emails).
+
+## Sign in with GitHub
+
+<Steps>
+  <Step title="Open Kosli">
+    Open the Kosli web app for your region:
+
+    - EU: [app.kosli.com](https://app.kosli.com)
+    - US: [app.us.kosli.com](https://app.us.kosli.com)
+  </Step>
+  <Step title="Choose GitHub">
+    Select the GitHub option on the sign-in page. GitHub asks you to authorize Kosli the first time
+    you sign in.
+  </Step>
+  <Step title="Return to Kosli">
+    Once GitHub confirms the authorization, you are signed in to Kosli.
+  </Step>
+</Steps>
+
+## GitHub IP allow lists
+
+If your GitHub organization or enterprise restricts access with an
+[IP allow list](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization),
+GitHub sign-in to Kosli fails until Kosli's sign-in traffic is allowed.
+
+Kosli uses [Descope](https://www.descope.com/) as its identity provider. After you authorize Kosli in
+GitHub, Descope calls GitHub from a fixed set of IP addresses to complete the sign-in. GitHub rejects
+those calls unless the addresses are on your allow list.
+
+Add the addresses for the Kosli instance you sign in to. Only one set is needed.
+
+### app.kosli.com (EU)
+
+- `3.72.207.40`
+- `3.74.59.88`
+- `3.121.31.67`
+
+### app.us.kosli.com (US)
+
+- `35.170.24.133`
+- `3.212.215.29`
+- `52.44.167.251`
+
+<Info>
+These are Descope's **Project Static IPs**. Descope publishes the current list at
+[Public static IPs](https://docs.descope.com/how-to-deploy-to-production/public-static-ips). If sign-in
+stops working after you have added the addresses above, check that page for changes.
+</Info>

config/navigation.json

@@ -47,6 +47,7 @@
               "pages": [
                 "administration/authentication/single_sign_on",
                 "administration/authentication/magic_link",
+                "administration/authentication/github_login",
                 "administration/authentication/api_authentication_methods",
                 "administration/authentication/service_accounts",
                 "administration/authentication/api_key_rotation"

faq/faq.md

@@ -86,6 +86,8 @@ kosli report evidence artifact generic server:1.0 \
 If you sign in to Kosli with GitHub, you must have a verified email address on your GitHub account — otherwise login will fail.
 
 You can check the status of your email addresses at [github.com/settings/emails](https://github.com/settings/emails).
+
+If your GitHub organization uses an IP allow list, you also need to allow Kosli's sign-in traffic. See [GitHub sign-in](/administration/authentication/github_login#github-ip-allow-lists) for the addresses to add.
 </Accordion>
 
 <Accordion title="Why can't I delete or archive a policy?">

getting_started/authenticating_to_kosli.md

@@ -26,7 +26,7 @@ For anything automated, use a service account. Personal API keys inherit your us
     - EU: [app.kosli.com](https://app.kosli.com)
     - US: [app.us.kosli.com](https://app.us.kosli.com)
 
-    Depending on how your organization is set up, you'll sign in with single sign-on, [Magic Link](/administration/authentication/magic_link) or GitHub.
+    Depending on how your organization is set up, you'll sign in with single sign-on, [Magic Link](/administration/authentication/magic_link) or [GitHub](/administration/authentication/github_login).
   </Step>
   <Step title="Create a key">
     - **For CI/CD**, follow [Service accounts](/administration/authentication/service_accounts) to create a service account and generate its first API key.
@@ -52,6 +52,7 @@ For CLI usage, basic auth, and full examples, see [API authentication methods](/
 
 - [Single sign-on](/administration/authentication/single_sign_on) — configure sign-in through your identity provider.
 - [Magic Link](/administration/authentication/magic_link) — sign in with an emailed link, without an identity provider.
+- [GitHub sign-in](/administration/authentication/github_login) — sign in with a GitHub account, including GitHub IP allow lists.
 - [Service accounts](/administration/authentication/service_accounts) — admin lifecycle for machine credentials.
 - [API key rotation](/administration/authentication/api_key_rotation) — how rotation works, with a [step-by-step tutorial](/tutorials/rotating_api_keys).
 - [Roles in Kosli](/administration/managing_users/roles_in_kosli) — what users and service accounts can do at each role.