The bigger worry would be if they removed some IP addresses from their list. Those IP addresses would be juicy targets for hackers to scoop up and attempt an attack knowing that people have whitelisted them and that they allow access to what is likely relatively poorly protected infrastructure.

from my previous comment:

> You could of course write a cron script to regularly check Github hooks IPs and update firewall if Github changes it's webhooks IPs.

This is way easier and simpler than any other solution. It will be a mere 6 line script.