On persistent self-hosted runners the XDG cache directory survives between
jobs. When GitHub's Actions cache backend doesn't return a hit (no working
backend, evicted entry, etc.), the tailscale.tgz left behind by a previous
job is still on disk, and tc.downloadTool() refuses to overwrite an existing
destination, failing with "Destination file path ... already exists".
Mirror the Windows MSI fix (#259): if the tarball already exists, reuse it
when its checksum matches, otherwise delete and re-download. Only the
cloud-cache-restore path previously avoided this collision, so the Linux
download was unconditional.
Fixes#294
Signed-off-by: TowyTowy <towy@airreps.link>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bump default version used by the action to 1.94.2. This will resolve
warnings in the admin console about known security vulnerabilities in
the previous default of 1.90.4 which aren't applicable for the GitHub
action.
The security vulnerabilities are specifically related to MDM policies
for MacOS (see https://tailscale.com/security-bulletins#ts-2026-001) and
related to using Tailnet lock without passing `--statedir` or `--state`
to tailscaled (see https://tailscale.com/security-bulletins#ts-2025-008).
Neither of these impact the GitHub action as MacOS runners aren't
managed by MDM policies and we pass either `--statedir` or `--state` to
the tailscale daemon.
Fixes https://github.com/tailscale/github-action/issues/272
Signed-off-by: Mario Minardi <mario@tailscale.com>
On self-hosted runners, the tool cache directory persists between runs.
When GitHub's cloud cache doesn't have an entry (first run, evicted, etc.), but the local MSI file exists from a previous run, tc.downloadTool() fails with "Destination file path already exists".
This fix checks if the existing MSI has a valid checksum before downloading:
- If valid: reuse it (skip download)
- If invalid: delete and re-download
Signed-off-by: Dorin Geman <dorin.geman@docker.com>
Running make build was missed on #235 and subsequently missed by me
when reviewing that PR (whoops).
Updates #cleanup
Signed-off-by: Mario Minardi <mario@tailscale.com>
Check against platform and package specific version numbers returned
from pkgs.tailscale.com instead of defaulting to "Version" as this can
be incorrect for certain platforms when a release has only been built
for a subset of platforms.
For example. 1.90.2 is available for linux at the time of writing so
"Version" is 1.90.2, but only 1.90.1 is available for windows which
causes an error when using latest as the version specifier on windows
machines.
Fixes https://github.com/tailscale/github-action/issues/219
Signed-off-by: Mario Minardi <mario@tailscale.com>
Also include a troubleshooting section in the README with information about the
requested tags are invalid or not permitted error.
Updates #78
Signed-off-by: Percy Wegmann <percy@tailscale.com>
On macOS, `tailscaled` does not manage DNS. Configure it manually in the GitHub action to make
sure MagicDNS name resolution works.
Updates tailscale/corp#32821
Signed-off-by: Percy Wegmann <percy@tailscale.com>
The ping logic had some bugs in the wait logic which are now fixed.
Pinging hosts in parallel will speed up CI.
LICENSE and README got small updates in preparation for moving this code
to tailscale/github-action.
Updates tailscale/corp#32862
Signed-off-by: Percy Wegmann <percy@tailscale.com>
Documented new features:
- Logout functionality
- Ping functionality
Also removed speed-comparison CI flow in preparation for replacing the official GitHub
action with this one.
Updates tailscale/corp#32820
Signed-off-by: Percy Wegmann <percy@tailscale.com>
Even if we just have DERP connectivity, stop pinging so that action can continue sooner.
Updates tailscale/corp#32862
Signed-off-by: Percy Wegmann <percy@tailscale.com>
`oauth-client-secret` is renamed to `oauth-secret` to match the original action.
Not all of the descriptions matched exactly, but this attempts to take the best from both versions.
Default Tailscale version is updated to 1.88.3.
Updates tailscale/corp#32814
Signed-off-by: Percy Wegmann <percy@tailscale.com>
The new argument `ping` allows users to specify a comma-seperated list
of hosts (IP or hostname) to ping in order to verify connectivity.
Ping is considered successful as soon as the peer is reachable either
directly or via DERP.
Updates tailscale/corp#32817
Signed-off-by: Percy Wegmann <percy@tailscale.com>
The tailscale repo does not get tagged for unstable builds, so the best we can do when
building macOS from source is to build from the HEAD of `main`.
Updates tailscale/corp#32813
Signed-off-by: Percy Wegmann <percy@tailscale.com>
