Skip to content

Commit

Permalink
update
Browse files Browse the repository at this point in the history
  • Loading branch information
@ydshieh
ydshieh committed Sep 6, 2024
1 parent 40e935a commit e10e516
Show file tree
Hide file tree
Showing 2 changed files with 322 additions and 2 deletions.
320 changes: 320 additions & 0 deletions .github/workflows/myaction.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,320 @@
# Copyright (c) Tailscale Inc & AUTHORS
# SPDX-License-Identifier: BSD-3-Clause
#
name: 'Connect Tailscale'
description: 'Connect your GitHub Action workflow to Tailscale'
branding:
icon: 'arrow-right-circle'
color: 'gray-dark'
inputs:
authkey:
description: 'Your Tailscale authentication key, from the admin panel.'
required: false
deprecationMessage: 'An OAuth API client https://tailscale.com/s/oauth-clients is recommended instead of an authkey'
oauth-client-id:
description: 'Your Tailscale OAuth Client ID.'
required: false
oauth-secret:
description: 'Your Tailscale OAuth Client Secret.'
required: false
tags:
description: 'Comma separated list of Tags to be applied to nodes. The OAuth client must have permission to apply these tags.'
required: false
version:
description: 'Tailscale version to use.'
required: true
default: '1.68.1'
sha256sum:
description: 'Expected SHA256 checksum of the tarball.'
required: false
default: '18edc3067c41bfbcd6eeffeab45d93e10566219cb0ebb78a0f59eba56acc37e3'
containerMode:
description: 'This mode will use the Userspace networking mode (specially for container where tunnel VPN is not possible). DEPRECATED, not used anymore'
type: boolean
required: false
default: true
debug:
description: 'This mode generate the tailscale bug report'
type: boolean
required: false
default: false
debugEnabled:
description: 'This mode will allow to SSH to the runner. DEPRECATED, not used, replaced by github runner variable'
type: boolean
required: false
default: false
acceptDns:
description: ''
type: boolean
required: false
default: true
acceptRoutes:
description: ''
type: boolean
required: false
default: true
slackChannel:
description: 'Provide Slack Channel to send SSH information'
type: string
required: false
slackToken:
description: 'Slack Token to send message'
type: string
required: false
waitForSSH:
description: 'You can use this action at the end of your job with waitForSSH=true to handle SSH connection in case of workflow failed'
type: boolean
required: false
default: false
sshTimeout:
description: 'Number of minute to wait for SSH connection before ending the job'
type: string
required: false
default: "5m"
sshKeyId:
description: 'Internal usage. when the SSH Key changed on tailscale, please update the default value. Its in use in this action, to take the following decisions'
# - if this key is used on the WF, and debug mode is not enabled during action run, no need to connect to tailscale
# - if tailscale is used for something else than SSH (like internal ressources access), so we are testing internal url access.
type: string
required: false
default: "tskey-auth-kBgJJWKh3311CNTRL"
runs:
using: 'composite'
steps:
- name: Check Runner OS
if: ${{ runner.os != 'Linux' }}
shell: bash
run: |
echo "::error title=⛔ error hint::Support Linux Only"
exit 1
- name: check debug
#if: ${{ runner.debug == '1' }}
shell: bash
run: |
if [ "${{ runner.debug }}" = "1" ]; then
echo "debug"
else
echo "no debug"
fi
- name: Check Tailscale Action Usage mode (waitForSSH or Normal)
id: tailscale-mode
shell: bash
run: |
#if waitForSSH is enabled, we need to check if Tailscale is already connected or not (this parameter must be used for debugging usage when a step of worklfow failed)
#if Tailscale is already connected, it means the action was already called at the start of the WF with all mandatory inputs, we just need to enable SSH and wait for connection.
#if Tailscale is not yet connected, we need to execute the entire action (aka setup tailscale) and wait for SSH at the end
if [ "${{ inputs['waitForSSH'] }}" = true ]; then
if ! command -v tailscale &> /dev/null
then
echo "INSTALL=true" >> $GITHUB_OUTPUT
echo "WITHSSH=true" >> $GITHUB_OUTPUT
echo "WAITFORSSH=true" >> $GITHUB_OUTPUT
else
echo "INSTALL=false" >> $GITHUB_OUTPUT
echo "WITHSSH=true" >> $GITHUB_OUTPUT
echo "WAITFORSSH=true" >> $GITHUB_OUTPUT
fi
else
#if Debug is not enabled, so we need to check why this action is called by checking AUTH_KEY : if the workflow is using SSH'ed key, and debug is not enabled, no need to execute Tailscale
if [ "${{ runner.debug }}" = "1" ]; then #debug enabled, so connect to tailscale with SSH
echo "INSTALL=true" >> $GITHUB_OUTPUT
echo "WITHSSH=true" >> $GITHUB_OUTPUT
echo "WAITFORSSH=false" >> $GITHUB_OUTPUT
else
if [[ "${{ inputs['authkey'] }}" =~ "${{ inputs['sshKeyId'] }}" ]]; then #debug not enabled, so if the Key is the SSH'ed one, no need to execute tailscale
echo "INSTALL=false" >> $GITHUB_OUTPUT
echo "WITHSSH=false" >> $GITHUB_OUTPUT
echo "WAITFORSSH=false" >> $GITHUB_OUTPUT
else #debug not enable, but need to execute tailscale because it's standard Tailscale Key
echo "INSTALL=true" >> $GITHUB_OUTPUT
echo "WITHSSH=false" >> $GITHUB_OUTPUT
echo "WAITFORSSH=false" >> $GITHUB_OUTPUT
fi
fi
fi
- name: Check Auth Info Empty
if: ${{ steps.tailscale-mode.outputs.INSTALL == 'true' && inputs.authkey == '' && (inputs['oauth-secret'] == '' || inputs.tags == '') }}
shell: bash
run: |
echo "::error title=⛔ error hint::OAuth identity empty, Maybe you need to populate it in the Secrets for your workflow, see more in https://docs.github.com/en/actions/security-guides/encrypted-secrets and https://tailscale.com/s/oauth-clients"
exit 1
- name: Install prerequistes
if: ${{ steps.tailscale-mode.outputs.INSTALL == 'true' }}
shell: bash
run: |
if ! command -v sudo &> /dev/null
then
apt-get update
apt-get install -y sudo
else
sudo apt-get update
fi
sudo apt-get install -y curl iptables
- name: Download Tailscale
if: ${{ steps.tailscale-mode.outputs.INSTALL == 'true' }}
shell: bash
id: download
env:
VERSION: ${{ inputs.version }}
SHA256SUM: ${{ inputs.sha256sum }}
run: |
if [ ${{ runner.arch }} = "ARM64" ]; then
TS_ARCH="arm64"
elif [ ${{ runner.arch }} = "ARM" ]; then
TS_ARCH="arm"
elif [ ${{ runner.arch }} = "X86" ]; then
TS_ARCH="386"
elif [ ${{ runner.arch }} = "X64" ]; then
TS_ARCH="amd64"
else
TS_ARCH="amd64"
fi
MINOR=$(echo "$VERSION" | awk -F '.' {'print $2'})
if [ $((MINOR % 2)) -eq 0 ]; then
URL="https://pkgs.tailscale.com/stable/tailscale_${VERSION}_${TS_ARCH}.tgz"
else
URL="https://pkgs.tailscale.com/unstable/tailscale_${VERSION}_${TS_ARCH}.tgz"
fi
if ! [[ "$SHA256SUM" ]] ; then
SHA256SUM="$(curl -H user-agent:tailscale-github-action -L "${URL}.sha256")"
fi
curl -H user-agent:tailscale-github-action -L "$URL" -o tailscale.tgz --max-time 300
echo "Expected sha256: $SHA256SUM"
echo "Actual sha256: $(sha256sum tailscale.tgz)"
echo "$SHA256SUM tailscale.tgz" | sha256sum -c
tar -C /tmp -xzf tailscale.tgz
rm tailscale.tgz
TSPATH=/tmp/tailscale_${VERSION}_${TS_ARCH}
sudo mv "${TSPATH}/tailscale" "${TSPATH}/tailscaled" /usr/bin
- name: Start Tailscale Daemon
if: ${{ steps.tailscale-mode.outputs.INSTALL == 'true' }}
shell: bash
run: |
sudo mkdir -p /dev/net
if [ ! -e /dev/net/tun ]
then
sudo mknod /dev/net/tun c 10 200
fi
sudo -E tailscaled --state=mem: 2>~/tailscaled.log &
# And check that tailscaled came up. The CLI will block for a bit waiting
# for it. And --json will make it exit with status 0 even if we're logged
# out (as we will be). Without --json it returns an error if we're not up.
sudo -E tailscale status --json >/dev/null
- name: Connect to Tailscale
if: ${{ steps.tailscale-mode.outputs.INSTALL == 'true' }}
shell: bash
env:
TAILSCALE_AUTHKEY: ${{ inputs.authkey }}
HOSTNAME: ${{ inputs.hostname }}
TS_EXPERIMENT_OAUTH_AUTHKEY: true
DNS: ${{ inputs.acceptDns }}
ACCEPT_ROUTES: ${{ inputs.acceptRoutes }}
run: |
if [ -z "${HOSTNAME}" ]; then
HOSTNAME="github-$(cat /etc/hostname)"
fi
if [ -n "${{ inputs['oauth-secret'] }}" ]; then
TAILSCALE_AUTHKEY="${{ inputs['oauth-secret'] }}?preauthorized=true&ephemeral=true"
TAGS_ARG="--advertise-tags=${{ inputs.tags }}"
fi
timeout 5m sudo -E tailscale up ${TAGS_ARG} --authkey=${TAILSCALE_AUTHKEY} --hostname=${HOSTNAME} --accept-dns=${DNS} --accept-routes=${ACCEPT_ROUTES} ${ADDITIONAL_ARGS}
#we don't need network test anymore, because we are not using tailscale on CI for accessing registry
#- name: Network Test
# if: ${{ steps.tailscale-mode.outputs.INSTALL == 'true' }}
# shell: bash
# run: |
# if [[ "${{ inputs['authkey'] }}" =~ "${{ inputs['sshKeyId'] }}" ]]; then
# url=https://status.taildb5d.ts.net/status/default
# else
# url=https://registry.internal.huggingface.tech
# fi
# echo $url
# curl --head -X GET --retry 30 --retry-connrefused --retry-delay 1 $url
# echo "WAN IP:"
# curl ifconfig.me/ip
- name: Store Slack infos
#because the SSH can be enabled dynamically if the workflow failed, so we need to store slack infos to be able to retrieve them during the waitforssh step
if: ${{ inputs.slackChannel != '' }}
shell: bash
run: |
echo "SLACKCHANNEL=${{ inputs['slackChannel'] }}" >> $GITHUB_ENV
echo "SLACKTOKEN=${{ inputs['slackToken'] }}" >> $GITHUB_ENV
- name: Enable SSH
id: ssh
if: ${{ steps.tailscale-mode.outputs.WITHSSH == 'true' }}
shell: bash
run: |
sudo apt-get -y install openssh-server >> /dev/null
sudo tailscale set --ssh
echo "TS_IP=$(tailscale ip --4)" >> $GITHUB_OUTPUT
echo "USER=$(whoami)" >> $GITHUB_OUTPUT
echo "warning message content : ${{ inputs['warningMessage'] }}"
if [ "${{ runner.debug }}" = "1" ]; then
echo "MESSAGEHEADER=New Job started in debug mode" >> $GITHUB_OUTPUT
else
echo "MESSAGEHEADER=:x:JOB FAILED !" >> $GITHUB_OUTPUT
fi
- name: Send SSH informations to Slack channel
if: ${{ steps.tailscale-mode.outputs.WITHSSH == 'true' && env.SLACKCHANNEL != '' }}
uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001
with:
# Slack channel id, channel name, or user id to post message.
# See also: https://api.slack.com/methods/chat.postMessage#channels
channel-id: ${{ env.SLACKCHANNEL }}
# For posting a rich message using Block Kit
payload: |
{
"blocks": [
{
"type": "header",
"text": {
"type": "plain_text",
"text": "${{ steps.ssh.outputs.MESSAGEHEADER }}",
"emoji": true
}
},
{
"type": "section",
"fields": [
{
"type": "mrkdwn",
"text": "*Repository:*\n `${{ github.repository }}`"
},
{
"type": "mrkdwn",
"text": "*Workflow:*\n `${{ github.workflow }}`"
},
{
"type": "mrkdwn",
"text": "*Started by:*\n ${{ github.actor }}"
},
{
"type": "mrkdwn",
"text": "*Job:*\n `${{ github.job}}`"
}
]
},
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": "start your VPN (tailscale) and : `ssh ${{ steps.ssh.outputs.USER }}@${{ steps.ssh.outputs.TS_IP }} `"
}
}
]
}
env:
SLACK_BOT_TOKEN: ${{ env.SLACKTOKEN }}

- name: Wait for SSH
if: ${{ steps.tailscale-mode.outputs.WAITFORSSH == 'true' }}
shell: bash
run: |
sleep "${{ inputs['sshTimeout'] }}"
while [ "$(last | grep '^\(ubuntu\|runner\|root\).*still logged in$')" ]; do sleep 1m; done
4 changes: 2 additions & 2 deletions .github/workflows/ssh-runner.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,10 +64,10 @@ jobs:
run: |
if [ "${{ secrets[format('{0}_{1}', github.actor, 'SLACK_ID')] }}" != "" ]; then
echo "Hello 1"
"SLACKCHANNEL=${{ secrets[format('{0}_{1}', github.actor, 'SLACK_ID')] }}" >> $GITHUB_ENV
echo "SLACKCHANNEL=${{ secrets[format('{0}_{1}', github.actor, 'SLACK_ID')] }}" >> $GITHUB_ENV
else
echo "Hello 2"
"SLACKCHANNEL=${{ secrets.SLACK_CIFEEDBACK_CHANNEL }}" >> $GITHUB_ENV
echo "SLACKCHANNEL=${{ secrets.SLACK_CIFEEDBACK_CHANNEL }}" >> $GITHUB_ENV
fi
- name: Tailscale # In order to be able to SSH when a test fails
Expand Down

0 comments on commit e10e516

Please sign in to comment.