Remove Tailscale + K3s deploy from GitHub Actions #92

New issue

Closed

opened 2026-05-28 00:00:32 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-28 00:00:32 +00:00

Owner

Problem

.github/workflows/docker.yml still runs a ship job that joins the tailnet via Tailscale OIDC and runs k3s ctr / k3s kubectl on kai-server. GitHub Actions should no longer touch K3s or the tailnet in any circumstance — pull-side update already covers redeploys.

Proposal

Delete the ship job entirely.
Drop id-token: write from the top-level permissions: block (only the ship job needed it for Tailscale OIDC).
Trim the top-of-file doc comment so it only describes the GHCR publish path.
After merge, Kai unsets the repo's TS_CLIENT_ID / TS_AUDIENCE secrets and removes the federated identity entry from coilysiren/infrastructure/terraform/tailscale-oidc/.

Acceptance

docker.yml has no Tailscale or K3s steps.
CI on a main push runs only the build job (GHCR publish).
repo-recall-update.service on kai-server continues to roll the deploy.

**Problem** `.github/workflows/docker.yml` still runs a `ship` job that joins the tailnet via Tailscale OIDC and runs `k3s ctr` / `k3s kubectl` on kai-server. GitHub Actions should no longer touch K3s or the tailnet in any circumstance — pull-side update already covers redeploys. **Proposal** - Delete the `ship` job entirely. - Drop `id-token: write` from the top-level `permissions:` block (only the ship job needed it for Tailscale OIDC). - Trim the top-of-file doc comment so it only describes the GHCR publish path. - After merge, Kai unsets the repo's `TS_CLIENT_ID` / `TS_AUDIENCE` secrets and removes the federated identity entry from `coilysiren/infrastructure/terraform/tailscale-oidc/`. **Acceptance** - `docker.yml` has no Tailscale or K3s steps. - CI on a `main` push runs only the `build` job (GHCR publish). - `repo-recall-update.service` on kai-server continues to roll the deploy.

coilysiren referenced this issue from coilyco-flight-deck/infrastructure

2026-05-28 00:17:55 +00:00

Revoke GH Actions tailnet credentials after rip-out sweep #160

coilysiren referenced this issue from a commit

2026-05-28 04:41:23 +00:00

chore(ci): rip Tailscale + K3s deploy out of docker.yml

coilysiren closed this issue

2026-05-28 04:41:23 +00:00