Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 0 additions & 53 deletions .github/actions/setup/action.yaml

This file was deleted.

107 changes: 48 additions & 59 deletions .github/workflows/ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -10,15 +10,6 @@ on:
branches:
- main

env:
# tailout environment variables
TAILOUT_REGION: eu-west-3
TAILOUT_NON_INTERACTIVE: "true"
TAILOUT_CREATE_CONNECT: "true"
TAILOUT_CREATE_SHUTDOWN: 5m
TAILOUT_TAILSCALE_API_KEY: ${{ secrets.TAILSCALE_API_KEY }}
TAILOUT_TAILSCALE_AUTH_KEY: ${{ secrets.TAILSCALE_AUTH_KEY }}

defaults:
run:
shell: bash
Expand Down Expand Up @@ -242,59 +233,57 @@ jobs:
needs: binary
permissions:
id-token: write
strategy:
fail-fast: false
matrix:
include:
- first_command: "tailout init"
- first_command: "tailout create"
second_command: "tailout status"
third_command: "tailout disconnect"
- first_command: "tailout create"
second_command: "tailout disconnect"
third_command: "tailout status"
env:
# tailout environment variables
TAILOUT_REGION: us-west-1
TAILOUT_NON_INTERACTIVE: "true"
TAILOUT_CREATE_CONNECT: "true"
TAILOUT_CREATE_SHUTDOWN: 5m
TAILOUT_TAILSCALE_API_KEY: ${{ secrets.TAILSCALE_API_KEY }}
steps:
- name: Checkout repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
with:
role-to-assume: ${{ secrets.AWS_GITHUB_ACTIONS_TAILOUT_ROLE_ARN }}
role-session-name: tailout-${{ github.job }}
aws-region: ${{ env.TAILOUT_REGION }}

- name: Setup environment
uses: ./.github/actions/setup
- name: Connect runner to tailscale
uses: tailscale/github-action@aa604318b61e5b25107287e0d07db6a08b3e72c0 # v4.0.2
with:
region: ${{ env.TAILOUT_REGION }}
role_arn: ${{ secrets.AWS_GITHUB_ACTIONS_TAILOUT_ROLE_ARN }}
tailscale_oauth_client_id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
tailscale_oauth_client_secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
- name: First command
run: ${{ matrix.first_command }}
- name: Second command
if: ${{ matrix.second_command != '' }}
run: ${{ matrix.second_command }}
- name: Third command
if: ${{ matrix.third_command != '' }}
run: ${{ matrix.third_command }}
# TODO: check if the public IP address matches the one from the new instance

# TODO: find a better concurrency pattern
cleanup:
runs-on: ubuntu-24.04
if: ${{ github.event.repository.fork == false && github.actor != 'renovate[bot]' }}
needs: e2e-tests
concurrency:
group: cleanup
cancel-in-progress: true
permissions:
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
oauth-secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
version: 1.88.3 # renovate: datasource=github-tags depName=tailscale/tailscale
tags: tag:github-actions-runner
args: --operator=runner

- name: Setup environment
uses: ./.github/actions/setup
- name: Fetch Cached Artifacts
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
region: ${{ env.TAILOUT_REGION }}
role_arn: ${{ secrets.AWS_GITHUB_ACTIONS_TAILOUT_ROLE_ARN }}
tailscale_oauth_client_id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
tailscale_oauth_client_secret: ${{ secrets.TAILSCALE_OAUTH_CLIENT_SECRET }}
- name: Cleanup
path: ${{ github.workspace }}/dist
key: ${{ needs.binary.outputs.cache-key }}

- name: Move binary to /usr/local/bin
run: sudo mv dist/tailout_linux_amd64*/tailout /usr/local/bin/
shell: bash
Comment on lines +266 to +268
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Verify binary path glob pattern and remove redundant shell directive.

Line 267 uses the glob dist/tailout_linux_amd64*/tailout which must match the actual goreleaser build output structure. Confirm this aligns with the .goreleaser.yaml configuration.

Additionally, the shell: bash on line 268 is redundant since defaults.run.shell is already set to bash on line 15.

Remove line 268 (shell: bash) as it duplicates the default shell setting.


🏁 Script executed:

#!/bin/bash
# Verify the binary glob pattern matches goreleaser output by checking the binary job
rg -n 'dist/tailout' .github/workflows/ci.yaml | head -20

Length of output: 137


🏁 Script executed:

#!/bin/bash
# Find and examine goreleaser configuration to verify binary output structure
fd -type f -name '.goreleaser.yaml' -o -name '.goreleaser.yml' -o -name 'goreleaser.yaml' -o -name 'goreleaser.yml' | head -5

Length of output: 170


🏁 Script executed:

#!/bin/bash
# Also check the build job that produces the binary to see goreleaser output
rg -n -A 10 'name.*build' .github/workflows/ci.yaml | grep -A 10 'runs-on.*ubuntu' | head -40

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Check goreleaser release step in the workflow
rg -n -B 5 -A 15 'goreleaser' .github/workflows/ci.yaml | head -60

Length of output: 1087


🏁 Script executed:

#!/bin/bash
# Check what's in the dist directory references throughout the workflow
rg -n 'dist/tailout' .github/workflows/ci.yaml

Length of output: 137


🏁 Script executed:

#!/bin/bash
# Find the exact build output directory structure by looking at upload-artifact steps
rg -n -B 2 -A 2 'upload.*artifact' .github/workflows/ci.yaml | head -30

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Find goreleaser config file
find . -maxdepth 2 -name '.goreleaser*' -o -name 'goreleaser*' 2>/dev/null | head -10

Length of output: 18


🏁 Script executed:

#!/bin/bash
# Check if goreleaser config exists and examine its structure
cat .goreleaser.yaml 2>/dev/null | head -100

Length of output: 1457


🏁 Script executed:

#!/bin/bash
# Look for the specific build output path in workflow or config
rg -n 'tailout_linux_amd64' .github/workflows/ci.yaml

Length of output: 137


🏁 Script executed:

#!/bin/bash
# Check the cache key to understand what binary is being cached
rg -n -B 2 -A 5 'cache.*key' .github/workflows/ci.yaml | grep -A 5 -B 2 'tailout\|dist' | head -40

Length of output: 828


🏁 Script executed:

#!/bin/bash
# Look at the build job output path and artifact uploads
rg -n -B 5 -A 5 'build.*dist' .github/workflows/ci.yaml

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Check goreleaser outputs configuration
rg -n 'outputs:' .goreleaser.yaml 2>/dev/null | head -5

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Examine the entire goreleaser.yaml file
cat .goreleaser.yaml 2>/dev/null || echo "File not found"

Length of output: 1457


🏁 Script executed:

#!/bin/bash
# Simple check - look at build job in workflow to see what artifacts are created
rg -n -A 30 'jobs:' .github/workflows/ci.yaml | grep -A 30 'build:' | head -50

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Find the line where cache is saved/restored in the build and e2e-tests jobs
rg -n 'cache-hit\|actions/cache' .github/workflows/ci.yaml -A 3 -B 3

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Look for where dist directory is created/populated in build job
rg -n 'goreleaser\|make\|build' .github/workflows/ci.yaml -B 2 -A 2 | head -80

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Check if there's a Make target that runs goreleaser
fd -type f -name 'Makefile' -o -name 'makefile' | xargs cat 2>/dev/null | head -100

Length of output: 170


🏁 Script executed:

#!/bin/bash
# Let's look at the build step more carefully - find what produces the dist directory
rg -n -B 10 'cache.*save' .github/workflows/ci.yaml | grep -B 10 'dist'

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Check if there's version info in the dist directory naming
rg -n 'version\|v1' .github/workflows/ci.yaml | grep -i dist

Length of output: 0


🏁 Script executed:

#!/bin/bash
# List all lines mentioning the dist directory structure
rg -n 'dist/.*linux' .github/workflows/ci.yaml

Length of output: 137


🏁 Script executed:

#!/bin/bash
# Get complete context around line 122 and 267 to understand the binary paths
sed -n '110,130p' .github/workflows/ci.yaml

Length of output: 860


🏁 Script executed:

#!/bin/bash
# Get complete context around the binary move in e2e-tests
sed -n '260,275p' .github/workflows/ci.yaml

Length of output: 480


🏁 Script executed:

#!/bin/bash
# Check if there are multiple goreleaser builds or if the version suffix is dynamic
rg -n 'dist/tailout_linux_amd64' .github/workflows/ci.yaml -A 1 -B 1

Length of output: 257


🏁 Script executed:

#!/bin/bash
# Look at the goreleaser install/run step in build job
rg -n 'goreleaser.*release' .github/workflows/ci.yaml -A 5 -B 5

Length of output: 625


🏁 Script executed:

#!/bin/bash
# Check for the TODO comment around line 285
sed -n '280,290p' .github/workflows/ci.yaml

Length of output: 285


🏁 Script executed:

#!/bin/bash
# Get context for the complete lifecycle steps and cleanup
sed -n '270,290p' .github/workflows/ci.yaml

Length of output: 493


🏁 Script executed:

#!/bin/bash
# Check if there are any TODO or FIXME comments in the e2e-tests job
rg -n 'TODO|FIXME' .github/workflows/ci.yaml | grep -A 2 -B 2 e2e

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Get full e2e-tests job section to see all steps and any comments
sed -n '236,295p' .github/workflows/ci.yaml

Length of output: 1922


🏁 Script executed:

#!/bin/bash
# Verify the defaults.run.shell setting on line 15
sed -n '10,20p' .github/workflows/ci.yaml

Length of output: 137


Glob pattern is correct; remove redundant shell directive and address TODO comment.

The glob pattern dist/tailout_linux_amd64*/ correctly matches both tagged releases (e.g., tailout_linux_amd64_v1) and snapshot builds (e.g., tailout_linux_amd64), making it more robust than the hardcoded path on line 122. No changes needed.

However, the shell: bash on line 268 is redundant—defaults.run.shell already specifies bash globally on line 15. Remove it.

Additionally, the TODO comment on line 285 remains incomplete from the previous review: either implement the public IP validation check or remove the placeholder.

🤖 Prompt for AI Agents
.github/workflows/ci.yaml lines 266-268: the glob pattern for moving the binary
is fine and should be left as-is, but remove the redundant "shell: bash"
directive on line 268 since defaults.run.shell is already set globally; also
address the lingering TODO comment at line 285 by either implementing the
public-IP validation logic referenced there or removing the placeholder comment
and any related no-op steps so the workflow has no incomplete TODOs.


- name: Run init
run: tailout init

- name: Create instance
run: tailout create

- name: Check instance status
run: tailout status

- name: Disconnect instance
run: tailout disconnect

- name: Check instance status after disconnect
run: tailout status

# TODO: check if the public IP address matches the one from the new instance

- name: Cleanup instances
run: tailout stop --all
# TODO: Add cleanup for github nodes as well
if: always()
Loading