Answers the review of pull request 194 and records the first results of MIL-012.
What this changes
Review fixes (10 findings) in connect-wireguard and connect-tailscale, each with an offline test:
Tailscale waits for tailscaled before tailscale up; a tailscaled that already runs on the runner is not taken over, and down leaves a daemon it did not start; an exact version is required to install, with an optional sha256.
WireGuard passes the wireguard-go choice through sudo; the key file is removed when wg-quick fails; a field with a line break is refused; only key values are masked.
Both use sudo only when the job is not root.
The guides call @main until release 2.2.0 (@v2 does not contain the actions yet) and state when a Tailscale node is ephemeral.
Task 6:tools/lint-action-scripts.sh runs shellcheck and shfmt on actions/**/*.sh; validate-workflows.yml runs it with pinned tools. The tests show a seeded shellcheck problem and a badly formatted script fail. .editorconfig sets the shell format.
Task 1: both forms of uses: (short and full address) resolve a subfolder action at @main (runs 417 and 418). Recorded in the milestone.
Task 9 (part): ADR-0011, Proposed; it has no review record yet and is not part of what RC-082 accepts.
RC-082 reviews the milestone results; the milestone is Accepted.
What this does not do
No action has run on a real runner. Tasks 2 to 5, 7, 8 and 10 to 12 are open: they need the operator's vpn runner, test peers and secrets, or follow the verified guides and the release.
Commits carry Task: MIL-012#N trailers (3, 4 and 6). This pull request is not merged by the author.
Answers the review of pull request 194 and records the first results of [MIL-012](docs/milestones/mil-012-vpn-actions-for-deployment.md).
## What this changes
- **Review fixes (10 findings)** in `connect-wireguard` and `connect-tailscale`, each with an offline test:
- Tailscale waits for `tailscaled` before `tailscale up`; a `tailscaled` that already runs on the runner is not taken over, and `down` leaves a daemon it did not start; an exact `version` is required to install, with an optional `sha256`.
- WireGuard passes the `wireguard-go` choice through `sudo`; the key file is removed when `wg-quick` fails; a field with a line break is refused; only key values are masked.
- Both use `sudo` only when the job is not root.
- The guides call `@main` until release 2.2.0 (`@v2` does not contain the actions yet) and state when a Tailscale node is ephemeral.
- **Task 6:** `tools/lint-action-scripts.sh` runs shellcheck and shfmt on `actions/**/*.sh`; `validate-workflows.yml` runs it with pinned tools. The tests show a seeded shellcheck problem and a badly formatted script fail. `.editorconfig` sets the shell format.
- **Task 1:** both forms of `uses:` (short and full address) resolve a subfolder action at `@main` (runs 417 and 418). Recorded in the milestone.
- **Task 9 (part):** ADR-0011, `Proposed`; it has no review record yet and is not part of what RC-082 accepts.
- RC-082 reviews the milestone results; the milestone is `Accepted`.
## What this does not do
No action has run on a real runner. Tasks 2 to 5, 7, 8 and 10 to 12 are open: they need the operator's `vpn` runner, test peers and secrets, or follow the verified guides and the release.
## Issues
Closes #182
Closes #187
Refs #184
Refs #185
Refs #190
Commits carry `Task: MIL-012#N` trailers (3, 4 and 6). This pull request is not merged by the author.
The wireguard-go choice now survives sudo (it is passed through env), sudo is
used only when the job is not root, a configuration field with a line break is
refused, only the key values of a full configuration are masked, the key file
is removed when wg-quick fails, and the guide calls @main until the release.
Refs #184
Task: MIL-012#3
tailscaled is waited for before tailscale up, a tailscaled that already runs on
the runner is not taken over and down leaves a daemon it did not start, sudo is
used only when the job is not root, an exact version is required to install
(with an optional sha256 of the archive), and the guide states when the node is
ephemeral and calls @main until the release.
Refs #185
Task: MIL-012#4
tools/lint-action-scripts.sh runs shellcheck and shfmt on actions/**/*.sh with
pinned tools; validate-workflows.yml runs it, and .editorconfig sets the shell
format. The tests show a shellcheck problem and a badly formatted script fail.
Refs #187
Task: MIL-012#6
Task 1: both forms of uses: resolve a subfolder action at main. Adds ADR-0011
(Proposed, not yet reviewed), the review record RC-082 for the milestone
results, and the traceability rows.
Refs #182
Refs #190
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Answers the review of pull request 194 and records the first results of MIL-012.
What this changes
connect-wireguardandconnect-tailscale, each with an offline test:tailscaledbeforetailscale up; atailscaledthat already runs on the runner is not taken over, anddownleaves a daemon it did not start; an exactversionis required to install, with an optionalsha256.wireguard-gochoice throughsudo; the key file is removed whenwg-quickfails; a field with a line break is refused; only key values are masked.sudoonly when the job is not root.@mainuntil release 2.2.0 (@v2does not contain the actions yet) and state when a Tailscale node is ephemeral.tools/lint-action-scripts.shruns shellcheck and shfmt onactions/**/*.sh;validate-workflows.ymlruns it with pinned tools. The tests show a seeded shellcheck problem and a badly formatted script fail..editorconfigsets the shell format.uses:(short and full address) resolve a subfolder action at@main(runs 417 and 418). Recorded in the milestone.Proposed; it has no review record yet and is not part of what RC-082 accepts.Accepted.What this does not do
No action has run on a real runner. Tasks 2 to 5, 7, 8 and 10 to 12 are open: they need the operator's
vpnrunner, test peers and secrets, or follow the verified guides and the release.Issues
Closes #182
Closes #187
Refs #184
Refs #185
Refs #190
Commits carry
Task: MIL-012#Ntrailers (3, 4 and 6). This pull request is not merged by the author.