gitops-acl-action/action.yml at main · tailscale/gitops-acl-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
name: "Sync Tailscale ACLs"
description: "Push changes to Tailscale and run ACL tests in CI"
inputs:
  tailnet:
    description: "Tailnet name (eg. example.com, xe.github, tailscale.org.github)"
    required: true
  api-key:
    description: "Tailscale API key"
    required: false
  oauth-client-id:
    description: "Tailscale OAuth or OIDC Federated Identity Client ID"
    required: false
  oauth-secret:
    description: "Tailscale OAuth Secret"
    required: false
  audience:
    description: "Tailscale OIDC Federated Identity Audience"
    required: false
  policy-file:
    description: "Path to policy file"
    required: true
    default: ./policy.hujson
  action:
    description: "Action to take (test/apply)"
    required: true
runs:
  using: "composite"
  steps:
    - name: Check Auth Info Empty
      if: ${{ inputs['api-key'] == '' && inputs['oauth-secret'] == '' && inputs['oauth-client-id'] == ''}}
      shell: bash
      run: |
        echo "::error title=⛔ error hint::API Key, OAuth secret, or OAuth client ID and audience must be specified. Maybe you need to populate it in the Secrets for your workflow, see more in https://docs.github.com/en/actions/security-guides/encrypted-secrets and https://tailscale.com/s/trust-credentials"
        exit 1
    - name: Check Conflicting Auth Info
      if: ${{ (inputs['api-key'] != '' && (inputs['oauth-secret'] != '' || inputs['audience'] != '')) || (inputs['oauth-secret'] != '' && (inputs['api-key'] != '' || inputs['audience'] != '')) || (inputs['audience'] != '' && (inputs['api-key'] != '' || inputs['oauth-secret'] != '')) }}
      shell: bash
      run: |
        echo "::error title=⛔ error hint::only one of API Key, OAuth secret, or OAuth client ID and audience should be specified."
        exit 1
    - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version: 1.25.6
        cache: false
    - name: Fetch ID token
      if: ${{ inputs['oauth-client-id'] != '' && inputs['audience'] != '' }}
      shell: bash
      id: fetch-id-token
      run: |
        ID_TOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${{ inputs.audience }}" | jq -r '.value')
        echo "::add-mask::ID_TOKEN"
        echo "id_token=$ID_TOKEN" >> $GITHUB_OUTPUT
    - name: Gitops pusher
      shell: bash
      env:
        # gitops-pusher will use OAUTH_ID and OAUTH_SECRET or
        # OAUTH_ID and ID_TOKEN if non-empty,
        # otherwise it will use API_KEY.
        TS_OAUTH_ID: "${{ inputs.oauth-client-id }}"
        TS_OAUTH_SECRET: "${{ inputs.oauth-secret }}"
        TS_ID_TOKEN: "${{ steps.fetch-id-token.outputs.id_token }}"
        TS_API_KEY: "${{ inputs.api-key }}"
        TS_TAILNET: "${{ inputs.tailnet }}"
      run: go run tailscale.com/cmd/gitops-pusher@b4d39e2fd92538384aa7388fdbeda0ec51973bfc "--policy-file=${{ inputs.policy-file }}" "${{ inputs.action }}"