Remove Tailscale deploy trigger from GitHub Actions #10

New issue

Open

opened 2026-05-28 00:05:10 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-28 00:05:10 +00:00

Owner

Problem

.github/workflows/release.yml has a deploy-kai-server job that joins the tailnet via Tailscale OAuth and triggers personal-dashboard-update.service over SSH. GitHub Actions should no longer touch the tailnet in any circumstance — pull-side update on kai-server (e.g. a systemd timer that polls the Formula and runs brew upgrade) covers redeploys.

Proposal

Delete the entire deploy-kai-server job (formula wait, Tailscale join, SSH trigger).
Keep release (tag + GH Release cut) and bump-formula.
After merge, Kai unsets TS_OAUTH_CLIENT_ID / TS_OAUTH_SECRET and revokes the OAuth client at the Tailscale admin console.
AGENTS.md "Release" + "Post-push" sections need a follow-up edit to drop the deploy-kai-server reference and document the pull-side timer instead.

Acceptance

Workflow has no Tailscale or ssh kai-server steps.
release + bump-formula still run on every push to main.

**Problem** `.github/workflows/release.yml` has a `deploy-kai-server` job that joins the tailnet via Tailscale OAuth and triggers `personal-dashboard-update.service` over SSH. GitHub Actions should no longer touch the tailnet in any circumstance — pull-side update on kai-server (e.g. a systemd timer that polls the Formula and runs `brew upgrade`) covers redeploys. **Proposal** - Delete the entire `deploy-kai-server` job (formula wait, Tailscale join, SSH trigger). - Keep `release` (tag + GH Release cut) and `bump-formula`. - After merge, Kai unsets `TS_OAUTH_CLIENT_ID` / `TS_OAUTH_SECRET` and revokes the OAuth client at the Tailscale admin console. - AGENTS.md "Release" + "Post-push" sections need a follow-up edit to drop the `deploy-kai-server` reference and document the pull-side timer instead. **Acceptance** - Workflow has no Tailscale or `ssh kai-server` steps. - `release` + `bump-formula` still run on every push to `main`.

coilysiren referenced this issue from coilyco-flight-deck/infrastructure

2026-05-28 00:17:55 +00:00

Revoke GH Actions tailnet credentials after rip-out sweep #160

coilysiren added the

label

2026-05-30 17:09:23 +00:00

coilysiren added

and removed

labels

2026-05-30 17:20:46 +00:00

coilysiren added

and removed