chore(ci): reach the database over the tailnet when CI_DB_TAILNET is set

Merged
WA
9d ago
+48-0

Summary

  • migrate.yml and docs.yml join the tailnet (official tailscale/github-action, pinned by SHA) before their first database connection, so database IP restrictions can admit the tailnet's app connector instead of ever-changing runner addresses
  • Off unless the repo variable CI_DB_TAILNET is true: merging is a no-op, it can be verified on a staging deploy before any restriction depends on it, and unsetting it reverts instantly
  • Auth is Tailscale workload identity federation (the job's GitHub OIDC token, tag:ci), so no long-lived Tailscale secret is stored; --accept-routes because Linux nodes ignore app connector routes otherwise
  • The migrate, migrate-dev, and docs callers in ci.yml grant id-token: write and pass TS_OAUTH_CLIENT_ID / TS_AUDIENCE; a called job requesting id-token: write without the caller granting it would fail the whole run at startup

Type of Change

  • Chore (CI)

Testing

  • actionlint -shellcheck= -pyflakes= (the CI invocation) clean on all workflows
  • scripts/migrations-workflow.test.ts, scripts/dev-deployment-workflow.test.ts, scripts/desktop-prune-workflow.test.ts: 20/20 pass
  • With CI_DB_TAILNET unset the new steps are skipped, so behavior is unchanged until the variable is flipped and a staging deploy confirms the route

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)