From c66619accfddcb61845cab86ac1342aac357c389 Mon Sep 17 00:00:00 2001
From: Mario Minardi <mario@tailscale.com>
Date: Fri, 4 Jul 2025 10:17:47 -0600
Subject: [PATCH] .github/workflows: add tests for new / granular minimal OAuth
 scopes

Change the default matrix test to use an OAuth client which has the new
set of more granular minimal OAuth scopes necessary to successfully use
the action.

Add a new job that uses the previous OAuth client to ensure that we
don't break legacy clients.

Fixes https://github.com/tailscale/github-action/issues/184

Signed-off-by: Mario Minardi <mario@tailscale.com>
---
 .github/workflows/tailscale.yml | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tailscale.yml b/.github/workflows/tailscale.yml
index aaa128e..0b14674 100644
--- a/.github/workflows/tailscale.yml
+++ b/.github/workflows/tailscale.yml
@@ -16,6 +16,36 @@ jobs:
         os: [ubuntu-latest, windows-latest, macos-latest, windows-11-arm]
         cache: ['false', 'true']
     runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Tailscale Action
+        uses: ./
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_GRANULAR_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_GRANULAR_SECRET }}
+          tags: tag:ci
+          use-cache: ${{ matrix.cache }}
+
+      - name: check for tailscale connection
+        shell: bash
+        run:
+          tailscale status -json | jq -r .BackendState | grep -q Running
+
+      - name: ensure no dirty files from Tailscale Action remain
+        shell: bash
+        run: |
+          extra_files=$(git ls-files . --exclude-standard --others)
+          if [ ! -z "$extra_files" ]; then
+            echo "::error::Unexpected extra files: $extra_files"
+            exit 1
+          fi
+
+  # This job runs as a sanity check to ensure we have not broken the ability for OAuth clients using
+  # our legacy scopes to successfully connect to tailnets using this action.
+  legacyScopesCheck:
+    runs-on: ubuntu-latest
     steps:
       - name: Check out code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -41,4 +71,3 @@ jobs:
             echo "::error::Unexpected extra files: $extra_files"
             exit 1
           fi
-