From bd89a389f1ee69df61a92682bbe0a665308f0019 Mon Sep 17 00:00:00 2001
From: Seb Pretzer <24555985+sebpretzer@users.noreply.github.com>
Date: Tue, 1 Jul 2025 13:27:23 -0500
Subject: [PATCH] README.md: update required scopes for oauth clients

Document the `all:read` and `devices:core` required scopes discussed in https://github.com/tailscale/github-action/issues/100

Signed-off-by: Seb Pretzer <24555985+sebpretzer@users.noreply.github.com>
---
 README.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 57d306f..4426a7a 100644
--- a/README.md
+++ b/README.md
@@ -17,8 +17,9 @@ Subsequent steps in the Action can then access nodes in your Tailnet.
 oauth-client-id and oauth-secret are an [OAuth client](https://tailscale.com/s/oauth-clients/)
 for the tailnet to be accessed. We recommend storing these as
 [GitHub Encrypted Secrets.](https://docs.github.com/en/actions/security-guides/encrypted-secrets)
-OAuth clients used for this purpose must have the
-[`auth_keys` scope.](https://tailscale.com/kb/1215/oauth-clients#scopes)
+OAuth clients used for this purpose must have the following
+[scopes](https://tailscale.com/kb/1215/oauth-clients#scopes):
+`all:read`, `auth_keys`, and `devices:core`.
 
 tags is a comma-separated list of one or more [ACL Tags](https://tailscale.com/kb/1068/acl-tags/)
 for the node. At least one tag is required: an OAuth client is not associated