Skip to content

README.md

Latest commit

 

History

History
85 lines (64 loc) · 3.39 KB

README.md

File metadata and controls

85 lines (64 loc) · 3.39 KB

Tailscale GitOps Action

A GitHub Action to manage your Tailscale ACL policy using a GitOps workflow. This is a drop-in replacement for tailscale/gitops-acl-action that caches a pre-compiled gitops-pusher binary instead of compiling it from source on every run, reducing execution time from 60–90 seconds to 2–3 seconds.

Usage

name: Sync Tailscale ACLs

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

jobs:
  acls:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v4

      - name: Deploy ACL
        if: github.event_name == 'push'
        uses: matchory/tailscale-gitops-action@v1
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_ID }}
          audience: ${{ secrets.TS_AUDIENCE }}
          tailnet: ${{ secrets.TS_TAILNET }}
          policy-file: ./policy.hujson
          action: apply

      - name: Test ACL
        if: github.event_name == 'pull_request'
        uses: matchory/tailscale-gitops-action@v1
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_ID }}
          audience: ${{ secrets.TS_AUDIENCE }}
          tailnet: ${{ secrets.TS_TAILNET }}
          policy-file: ./policy.hujson
          action: test

Inputs

Input Required Default Description
tailnet Yes — Your tailnet name (e.g. example.com, your-org.github)
api-key No — Tailscale API key (expires every 90 days)
oauth-client-id No — OAuth or OIDC Federated Identity Client ID
oauth-secret No — OAuth Client Secret
audience No — OIDC Federated Identity Audience
policy-file Yes ./policy.hujson Path to your policy file in the repository
action Yes — test (validate only) or apply (validate and push)
tailscale-release No b4d39e... Tailscale commit hash to build gitops-pusher from

Authentication

Exactly one of the following authentication methods must be provided:

  1. API Key — set api-key (note: keys expire after 90 days)
  2. OAuth Client — set oauth-client-id and oauth-secret
  3. OIDC Federated Identity — set oauth-client-id and audience (requires id-token: write permission)

How It Works

The action compiles Tailscale's gitops-pusher as a static binary on the first run and caches it using actions/cache. The cache key includes the runner OS, architecture, and the pinned Tailscale commit hash, so subsequent runs skip compilation entirely and restore the binary from cache.

Run What happens Time
First (cold cache) Installs Go, compiles binary, caches it ~25s
Subsequent (warm cache) Restores binary from cache, executes it ~2–3s

When using OIDC federated identity, the action fetches an ID token from GitHub's OIDC provider before invoking the binary.

Updating the Tailscale version

The tailscale-release input controls which commit of gitops-pusher is compiled. Changing this value (either in this action's default or as an input in your workflow) automatically invalidates the cache and triggers a one-time recompilation.

License

MIT