Repository navigation
fix(macos-host): refresh Tailscale only where it is behind and run the formula from its keg - #199
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
03a9250 to
594ccb2
Compare
…e formula from its keg A Mac with the standalone app has the app's wrapper script at /usr/local/bin/tailscale, so Homebrew installs the formula's keg, removes every link it made and exits non-zero. The module treated that as a failed upgrade and failed the play before any cluster task ran. The role now runs the formula's tailscaled and tailscale from the keg's stable opt path, which exists whether or not Homebrew linked anything, and judges an install or upgrade by the formula Homebrew reports afterwards: an installed, current keg is a success whatever the link step said, and anything else fails with Homebrew's own output. The running daemon is read through the formula's tailscale, because the wrapper talks to the app. A cask that Homebrew lists as outdated is upgraded only when the app bundle's release is behind the cask's. The app updates itself, so Homebrew's record lags, and the cask's installer fails over an app that is already current and is reverted.
…r script The wrapper script the tests model called the real /Applications/Tailscale.app where one is installed, so a role that asked the app instead of the daemon could pass by reading the machine's own Tailscale. The wrapper now calls a stand-in that logs the call and fails, and every wrapper test asserts the app was never asked and the wrapper was left as it was, including a join beside the wrapper.
594ccb2 to
43f11dd
Compare
|
@codex security review |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
🎉 This PR is included in version 2.30.2 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
Closes #198
The Tailscale refresh in
github_runner_macos_hostfailedsite.ymlon a Mac that has the standalone app, on two different paths.On an Intel Mac the app's wrapper script holds
/usr/local/bin/tailscale, sobrew upgrade tailscaleinstalls the keg, removes every link it made and exits 1 with "Thebrew linkstep did not complete successfully". The role now runs the formula'stailscaledandtailscalefrom the keg'soptpath, which exists whether or not Homebrew linked anything, and judges an install or upgrade by the formulabrew inforeports afterwards. An installed, current keg is a success whatever the link step said; a formula that did not install still fails the run with Homebrew's output. The running daemon is also read through the formula'stailscale, since the wrapper talks to the app. The first install goes through the same task, so a fresh Mac that has the app no longer fails there either.On an Apple silicon Mac whose app updated itself,
brew outdated --cask --greedystill liststailscale-app, and the cask's pkg fails over the current app and is reverted. The cask is now upgraded only when the release in the app bundle (CFBundleShortVersionString) is behind the cask's.tests/unit/test_macos_host.pygains abrewstand-in that fails as in the issue (keg installed and unlinked with the wrapper in the way, and the cask's installer failing), adefaultsstand-in for the bundle's release, and tests for each state, including--checkand a second run.