mirror of
https://github.com/tailscale/github-action.git
synced 2026-08-20 13:09:20 +00:00
69 lines
2.1 KiB
YAML
69 lines
2.1 KiB
YAML
name: tailscale
|
|
|
|
permissions:
|
|
id-token: write # This is required for requesting the JWT
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- '*'
|
|
|
|
jobs:
|
|
build:
|
|
strategy:
|
|
matrix:
|
|
os: [ubuntu-latest, windows-latest, macos-latest, windows-11-arm]
|
|
cache: ['false', 'true']
|
|
auth: ['oauth', 'oauth-legacy', 'oidc']
|
|
runs-on: ${{ matrix.os }}
|
|
steps:
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Tailscale Action (OAuth)
|
|
if: matrix.auth == 'oauth'
|
|
uses: ./
|
|
with:
|
|
oauth-client-id: ${{ secrets.TS_OAUTH_GRANULAR_CLIENT_ID }}
|
|
oauth-secret: ${{ secrets.TS_OAUTH_GRANULAR_SECRET }}
|
|
tags: tag:ci
|
|
use-cache: ${{ matrix.cache }}
|
|
|
|
# This job runs as a sanity check to ensure we have not broken the ability for OAuth clients using
|
|
# our legacy scopes to successfully connect to tailnets using this action.
|
|
- name: Tailscale Action (OAuth legacy)
|
|
if: matrix.auth == 'oauth-legacy'
|
|
uses: ./
|
|
with:
|
|
oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
|
|
oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
|
|
tags: tag:ci
|
|
use-cache: ${{ matrix.cache }}
|
|
|
|
- name: Tailscale Action (OIDC)
|
|
if: matrix.auth == 'oidc'
|
|
uses: ./
|
|
with:
|
|
oidc-client-id: ${{ secrets.TS_OIDC_CLIENT_ID }}
|
|
oidc-aud-claim: ${{ secrets.TS_OIDC_AUD_CLAIM }}
|
|
tags: tag:ci
|
|
tailnet: ${{ secrets.TS_TAILNET_NAME }}
|
|
use-cache: ${{ matrix.cache }}
|
|
|
|
- name: check for tailscale connection
|
|
shell: bash
|
|
run:
|
|
tailscale status -json | jq -r .BackendState | grep -q Running
|
|
|
|
- name: ensure no dirty files from Tailscale Action remain
|
|
shell: bash
|
|
run: |
|
|
extra_files=$(git ls-files . --exclude-standard --others)
|
|
if [ ! -z "$extra_files" ]; then
|
|
echo "::error::Unexpected extra files: $extra_files"
|
|
exit 1
|
|
fi
|