Clarify allowlisting guidance and add sync_token for automation

[innoavator]

Summary

Makes the README easier to act on for customers building allowlists, and adds a sync_token to the published lists so automation can detect changes cheaply.

Companion to the docs change in truefoundry/docs-mintlify#1643, which adds IP allowlisting to Connect Private Models and MCP Servers.

README

• Choosing the list: pick it by tenant URL (<tenant>.truefoundry.cloud → global, <tenant>.us.truefoundry.cloud → us). This replaces "The directory is the control plane" and "The EU control plane is the global control plane".
• What to allowlist: an explicit rule, the control_plane entry plus the gateway entry for the tenant's gateway endpoint: gateway.truefoundry.ai by default, or the multi-regional hostname. This replaces "Find the hostname you connect to", since TrueFoundry connects to the customer, not the other way round. It links to the multi-regional endpoint docs.
• US rollout note: us.json lists only the control plane today; gateway IPs arrive through releases with the 15-day notice.
• Security note: the IPs are shared across tenants, so the endpoint should keep its own authentication.
• Cape Town note: cpt is only covered by gateway.truefoundry.ai and cpt.gateway.truefoundry.ai.
• No individual notification: customers own subscribing and automating.
• Clarifies that the lists include a new address from the release that announces it, so a daily sync is enough.
• jq one-liner (tested against the live global.json) and an "Automate it" section.

build.py

• Adds a top-level sync_token to dist/*.json and a # sync_token: line to the .txt headers. It's the first 16 hex characters of a SHA-256 over the canonical endpoint list, so it changes only when an address or hostname changes. I avoided a timestamp or version because Pages redeploys on every push to main even when no release is cut, which would make those fields churn.
• release_notes.py only reads endpoints, so release diffs are unaffected. Locally: validate OK, build OK, release notes against an identical baseline → publish=false.
• Source files and the schema are unchanged. sync_token exists only in the published artifacts.

Note on merge

This PR touches .github/scripts/**, so merging it triggers the Release workflow. Because no addresses change, no release is published, but GitHub Pages is redeployed and the always-latest JSON gains sync_token.

---

Note

Low Risk
Additive field on public JSON and documentation only; no change to source IP data or authentication behavior, though consumers that assume a fixed JSON shape should tolerate the new key.

Overview
Published IP lists now include a top-level sync_token (and a matching # sync_token: line in .txt headers), computed in build.py as the first 16 hex chars of SHA-256 over the canonical endpoints payload so automation can detect hostname/IP changes without diffing the full file. Source ip-ranges.json files and the schema are unchanged; the token appears only in dist artifacts.

The README is reworked for customers building allowlists: pick global vs US by tenant URL, allowlist control_plane plus the tenant’s gateway entry, security and US-rollout callouts, a jq/curl example, and guidance to poll on a schedule using sync_token to skip no-op updates. Merge triggers a Pages redeploy so always-latest JSON gains sync_token even when no new release is cut.

^{Reviewed by Cursor Bugbot for commit ab934fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Proposed IP changes

No IP changes since the previous release. No firewall action needed.

---

Full list

• GLOBAL (30 addresses): https://github.com/truefoundry/ip-ranges/releases/download/vpr-6/global.json
• US (1 addresses): https://github.com/truefoundry/ip-ranges/releases/download/vpr-6/us.json
• Plain text, one CIDR per line: swap .json for .txt.
• Always-latest: https://truefoundry.github.io/ip-ranges/global.json