Remove Tailscale + K3s deploy from GitHub Actions #20

New issue

Open

opened 2026-05-28 00:01:46 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-28 00:01:46 +00:00

Owner

Problem

.github/workflows/build-and-publish.yml runs a deploy job that joins the tailnet via Tailscale OIDC and shells k3s ctr / kubectl into kai-server. GitHub Actions should no longer touch K3s or the tailnet in any circumstance — pull-side update already covers redeploys.

Proposal

Delete the deploy job entirely (Tailscale join, image sideload, rollout).
The same job's report status to datastore step also POSTs to the tailnet-internal api host; it goes with the rest of the job. A public-endpoint replacement (or removal) is out of scope for this issue — file separately if still wanted.
Keep the test job.
After merge, Kai unsets the repo's TS_CLIENT_ID / TS_AUDIENCE (and DATASTORE_TOKEN if no longer needed) and removes the federated identity entry from coilysiren/infrastructure/terraform/tailscale-oidc/.
The AGENTS.md "Post-push follow-up" section and infrastructure/docs/k3s-deploy-notes.md references to this workflow may need a follow-up edit.

Acceptance

Workflow has no Tailscale, K3s, or tailnet-internal HTTP steps.
test job still runs on every push to main.

**Problem** `.github/workflows/build-and-publish.yml` runs a `deploy` job that joins the tailnet via Tailscale OIDC and shells `k3s ctr` / `kubectl` into kai-server. GitHub Actions should no longer touch K3s or the tailnet in any circumstance — pull-side update already covers redeploys. **Proposal** - Delete the `deploy` job entirely (Tailscale join, image sideload, rollout). - The same job's `report status to datastore` step also POSTs to the tailnet-internal `api` host; it goes with the rest of the job. A public-endpoint replacement (or removal) is out of scope for this issue — file separately if still wanted. - Keep the `test` job. - After merge, Kai unsets the repo's `TS_CLIENT_ID` / `TS_AUDIENCE` (and `DATASTORE_TOKEN` if no longer needed) and removes the federated identity entry from `coilysiren/infrastructure/terraform/tailscale-oidc/`. - The AGENTS.md "Post-push follow-up" section and `infrastructure/docs/k3s-deploy-notes.md` references to this workflow may need a follow-up edit. **Acceptance** - Workflow has no Tailscale, K3s, or tailnet-internal HTTP steps. - `test` job still runs on every push to `main`.

coilysiren referenced this issue

2026-05-28 00:03:10 +00:00

Pre-commit doc-layout violations block new commits #21

coilysiren referenced this issue from coilyco-flight-deck/infrastructure

2026-05-28 00:17:55 +00:00

Revoke GH Actions tailnet credentials after rip-out sweep #160

coilysiren added the

label

2026-05-31 01:54:11 +00:00