Repository navigation
feat: keep Tailscale current in the host baseline roles - #169
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
The role only ever installed Tailscale when absent, and tailscaled install-system-daemon copies the formula's binary, so a later formula upgrade left the old daemon running. With github_runner_macos_host_tailscale_update (default true) the role brings the tailscale formula alone to its latest release, runs tailscaled install-system-daemon again once when the installed or the running daemon differs from the formula, and upgrades the standalone app when it is installed as the Homebrew cask. Nothing is installed that is absent, a daemon built by hand is left as it is, and no tailnet is joined or logged in to.
The Linux host role had no Tailscale handling, so a client installed from Tailscale's apt repository was never upgraded. github_runner_linux_host_tailscale_update (default true, the one step that is on by default) upgrades the tailscale package alone with apt-get install --only-upgrade when apt has a newer release, and enables and starts tailscaled if it is not. It installs nothing, skips a host without the package, a non-apt host and a native node whose cluster role pins the release, and never joins a tailnet.
81f590b to
1c70dfa
Compare
|
@codex security review |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
🎉 This PR is included in version 2.18.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
Keeps the Tailscale software the host baseline roles find current, on macOS and Linux. The roles only installed it when absent, so a host that already had it never updated.
On macOS,
tailscaled install-system-daemoncopies the formula'stailscaledto/usr/local/binand launchd keeps running whatever it started, so upgrading the formula alone leaves the old daemon running. Withgithub_runner_macos_host_tailscale_update(default true) the role brings thetailscaleformula, and no other formula, to its latest release and runstailscaled install-system-daemonagain once when the installed or the running daemon differs from the formula. When the standalone app is installed as thetailscale-appcask it is upgraded too (greedy, since the app updates itself and Homebrew lists it as outdated only then). Nothing absent is installed and a daemon built by hand is left as it is.On Linux,
github_runner_linux_host_tailscale_update(default true) upgrades thetailscalepackage alone (apt-get install --only-upgrade tailscale) when it is installed and apt has a newer release, and enables and startstailscaledif it is not. The Linux role did not handle Tailscale at all before this, and the cluster role's native node installs a pinned release and downgrades to it on every run, so a native node is skipped.Neither role joins or logs in to a tailnet. Both work under
--checkand skip with a message when Tailscale is absent.