action.yaml

---
# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2025 The Linux Foundation

name: "OpenStack Bastion with Tailscale"
description: "Setup and manage an OpenStack bastion host with Tailscale VPN for secure remote access"

inputs:
  # Operation Mode
  operation:
    description: "Operation: 'setup' to create bastion, 'teardown' to destroy bastion"
    required: true

  # OpenStack Credentials
  openstack_auth_url:
    description: "OpenStack auth URL"
    required: true
  openstack_project_id:
    description: "OpenStack project/tenant ID"
    required: true
  openstack_username:
    description: "OpenStack username"
    required: true
  openstack_password:
    description: "OpenStack password (will be base64 decoded if needed)"
    required: true
  openstack_region:
    description: "OpenStack region"
    required: false
    default: "ca-ymq-1"
  openstack_network_id:
    description: "OpenStack network UUID"
    required: false
    default: ""

  # Bastion Configuration
  bastion_flavor:
    description: "OpenStack flavor for bastion instance"
    required: false
    default: "v3-standard-2"
  bastion_image:
    description: "Base image for bastion host"
    required: false
    default: "Ubuntu 22.04.5 LTS (x86_64) [2025-03-27]"
  bastion_network:
    description: "Network name for bastion host"
    required: false
    default: "odlci"
  bastion_ssh_key:
    description: "SSH key name for bastion (optional, Tailscale SSH used by default)"
    required: false
    default: ""
  bastion_wait_timeout:
    description: "Timeout in seconds to wait for bastion to be ready"
    required: false
    default: "600"
  bastion_name:
    description: "Name for the bastion instance (defaults to bastion-gh-{run_id})"
    required: false
    default: ""

  # Tailscale Configuration (required for setup only)
  # OAuth is the recommended method - requires both client_id and secret
  tailscale_oauth_client_id:
    description: "Tailscale OAuth client ID (recommended - requires oauth_secret)"
    required: false
    default: ""
  tailscale_oauth_secret:
    description: "Tailscale OAuth secret (recommended - requires oauth_client_id)"
    required: false
    default: ""
  tailscale_use_ephemeral_keys:
    description: "Generate ephemeral auth keys from OAuth (recommended: true, legacy: false)"
    required: false
    default: "true"
  # Legacy auth key support - deprecated but still supported
  tailscale_auth_key:
    description: "Tailscale auth key (legacy - OAuth is recommended)"
    required: false
    default: ""
  tailscale_tags:
    description: "Comma-separated Tailscale tags applied to the GitHub runner (e.g., 'tag:ci') and to OAuth-generated ephemeral auth keys. Runner tagging is skipped when the runner is already connected; auth key tagging always applies"
    required: false
    default: "tag:ci"
  bastion_tailscale_tags:
    description: "Comma-separated list of Tailscale tags for the bastion VM (e.g., 'tag:bastion')"
    required: false
    default: "tag:bastion"
  tailscale_version:
    description: "Tailscale version. Ignored when the runner is already connected to Tailscale"
    required: false
    default: "latest"

  # Options
  debug_mode:
    description: "Enable debug logging"
    required: false
    default: "false"

outputs:
  bastion_ip:
    description: "Tailscale IP of the bastion host"
    value: ${{ steps.get-bastion-ip.outputs.bastion_ip }}
  bastion_name:
    description: "Name of the bastion instance"
    value: ${{ steps.create-bastion.outputs.bastion_name }}
  status:
    description: "Status of the operation (success/failure)"
    value: ${{ steps.operation-status.outputs.status }}

runs:
  using: "composite"
  steps:
    # ========================================
    # Setup Operation
    # ========================================
    - name: Detect existing Tailscale connection
      if: inputs.operation == 'setup'
      id: tailscale-state
      shell: bash
      run: |
        # The Tailscale setup action copies fresh binaries into
        # /usr/local/bin. If a tailscaled started by an earlier step in
        # this job is already running, that copy fails hard with
        # "Text file busy" and takes the whole job with it.
        #
        # Callers legitimately bring the runner onto the tailnet before
        # invoking this action, so treat an existing connection as the
        # one to use rather than trying to replace it.
        if pgrep -x tailscaled >/dev/null 2>&1; then
          echo "connected=true" >> "${GITHUB_OUTPUT}"
          echo "ℹ️ Tailscale is already running on this runner; reusing the existing connection"
          echo "   (tailscale_version and the runner half of tailscale_tags do not apply;"
          echo "    tailscale_tags still tags the bastion's ephemeral auth key)"
        else
          echo "connected=false" >> "${GITHUB_OUTPUT}"
        fi

    - name: Setup Tailscale VPN (OAuth)
      # yamllint disable-line rule:line-length
      if: inputs.operation == 'setup' && steps.tailscale-state.outputs.connected != 'true' && inputs.tailscale_oauth_client_id != '' && inputs.tailscale_oauth_secret != ''
      uses: tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888 # v4.1.3
      with:
        oauth-client-id: ${{ inputs.tailscale_oauth_client_id }}
        oauth-secret: ${{ inputs.tailscale_oauth_secret }}
        version: ${{ inputs.tailscale_version }}
        tags: ${{ inputs.tailscale_tags }}
        hostname: github-runner-${{ github.run_id }}
        args: --ssh --accept-dns=false

    - name: Setup Tailscale VPN (Auth Key - Legacy)
      # yamllint disable-line rule:line-length
      if: inputs.operation == 'setup' && steps.tailscale-state.outputs.connected != 'true' && (inputs.tailscale_oauth_client_id == '' || inputs.tailscale_oauth_secret == '') && inputs.tailscale_auth_key != ''
      uses: tailscale/github-action@780049a30b6ff5c378a9e7b389d15ece7a204888 # v4.1.3
      with:
        authkey: ${{ inputs.tailscale_auth_key }}
        version: ${{ inputs.tailscale_version }}
        hostname: github-runner-${{ github.run_id }}
        args: --ssh --accept-dns=false

    - name: Validate Tailscale credentials
      if: inputs.operation == 'setup'
      shell: bash
      env:
        TS_OAUTH_CLIENT_ID: ${{ inputs.tailscale_oauth_client_id }}
        TS_OAUTH_SECRET: ${{ inputs.tailscale_oauth_secret }}
        TS_AUTH_KEY: ${{ inputs.tailscale_auth_key }}
      # yamllint disable rule:line-length
      run: |
        if [[ -z "$TS_OAUTH_CLIENT_ID" ]] && [[ -z "$TS_OAUTH_SECRET" ]] && [[ -z "$TS_AUTH_KEY" ]]; then
          echo "❌ Error: Either tailscale_oauth_client_id+tailscale_oauth_secret OR tailscale_auth_key must be provided for setup"
          exit 1
        fi

        if [[ -n "$TS_OAUTH_CLIENT_ID" ]] && [[ -z "$TS_OAUTH_SECRET" ]]; then
          echo "❌ Error: tailscale_oauth_secret is required when tailscale_oauth_client_id is provided"
          exit 1
        fi

        if [[ -n "$TS_OAUTH_SECRET" ]] && [[ -z "$TS_OAUTH_CLIENT_ID" ]]; then
          echo "❌ Error: tailscale_oauth_client_id is required when tailscale_oauth_secret is provided"
          exit 1
        fi

      # yamllint enable rule:line-length
    - name: Verify Tailscale connection
      if: inputs.operation == 'setup'
      shell: bash
      run: |
        echo "✅ Tailscale status:"
        sudo tailscale status

    - name: Install OpenStack CLI
      if: inputs.operation == 'setup' || inputs.operation == 'teardown'
      shell: bash
      run: |
        pip install python-openstackclient

    - name: Configure OpenStack credentials
      if: inputs.operation == 'setup' || inputs.operation == 'teardown'
      shell: bash
      env:
        OS_AUTH_URL: ${{ inputs.openstack_auth_url }}
        OS_PROJECT_ID: ${{ inputs.openstack_project_id }}
        OS_USERNAME: ${{ inputs.openstack_username }}
        OS_PASSWORD: ${{ inputs.openstack_password }}
        OS_REGION_NAME: ${{ inputs.openstack_region }}
        OS_IDENTITY_API_VERSION: "3"
        OS_USER_DOMAIN_NAME: "Default"
        OS_PROJECT_DOMAIN_NAME: "Default"
      run: |
        echo "Configuring OpenStack credentials..."
        # Decode base64 encoded password
        PASSWORD=$(printf '%s' "${OS_PASSWORD}" | base64 -d)
        export OS_PASSWORD="${PASSWORD}"

        # Validate credentials
        echo "Validating OpenStack credentials..."
        if ! ERROR_OUTPUT=$(openstack token issue 2>&1); then
          echo "❌ Error: Failed to authenticate with OpenStack"
          echo "OpenStack error output:"
          echo "$ERROR_OUTPUT"
          exit 1
        fi
        echo "✅ OpenStack credentials validated"

    - name: Create bastion host
      if: inputs.operation == 'setup'
      id: create-bastion
      shell: bash
      env:
        # OpenStack credentials
        OS_AUTH_URL: ${{ inputs.openstack_auth_url }}
        OS_PROJECT_ID: ${{ inputs.openstack_project_id }}
        OS_USERNAME: ${{ inputs.openstack_username }}
        OS_PASSWORD: ${{ inputs.openstack_password }}
        OS_REGION_NAME: ${{ inputs.openstack_region }}
        OS_IDENTITY_API_VERSION: "3"
        OS_USER_DOMAIN_NAME: "Default"
        OS_PROJECT_DOMAIN_NAME: "Default"
        # Tailscale configuration
        TAILSCALE_OAUTH_CLIENT_ID: ${{ inputs.tailscale_oauth_client_id }}
        TAILSCALE_OAUTH_SECRET: ${{ inputs.tailscale_oauth_secret }}
        TAILSCALE_AUTH_KEY: ${{ inputs.tailscale_auth_key }}
        TAILSCALE_TAGS: ${{ inputs.tailscale_tags }}
        BASTION_TAILSCALE_TAGS: ${{ inputs.bastion_tailscale_tags }}
        TAILSCALE_USE_EPHEMERAL_KEYS: ${{ inputs.tailscale_use_ephemeral_keys }}
        # Bastion configuration
        BASTION_NAME: ${{ inputs.bastion_name }}
        BASTION_FLAVOR: ${{ inputs.bastion_flavor }}
        BASTION_IMAGE: ${{ inputs.bastion_image }}
        BASTION_NETWORK: ${{ inputs.bastion_network }}
        BASTION_SSH_KEY: ${{ inputs.bastion_ssh_key }}
        BASTION_WAIT_TIMEOUT: ${{ inputs.bastion_wait_timeout }}
        DEBUG_MODE: ${{ inputs.debug_mode }}
        # Workflow context routed via env to avoid template injection
        RUN_ID: ${{ github.run_id }}
        ACTION_PATH: ${{ github.action_path }}
      run: |
        set -euo pipefail

        # Decode base64 encoded password
        PASSWORD=$(printf '%s' "${OS_PASSWORD}" | base64 -d)
        export OS_PASSWORD="${PASSWORD}"

        # Set bastion name
        BASTION_NAME="${BASTION_NAME:-bastion-gh-${RUN_ID}}"
        echo "bastion_name=${BASTION_NAME}" >> "${GITHUB_OUTPUT}"

        # Run setup script
        "${ACTION_PATH}/scripts/setup-bastion.sh"

    - name: Get bastion IP
      if: inputs.operation == 'setup'
      id: get-bastion-ip
      shell: bash
      env:
        # OpenStack credentials (needed for cleanup on timeout)
        OS_AUTH_URL: ${{ inputs.openstack_auth_url }}
        OS_PROJECT_ID: ${{ inputs.openstack_project_id }}
        OS_USERNAME: ${{ inputs.openstack_username }}
        OS_PASSWORD: ${{ inputs.openstack_password }}
        OS_REGION_NAME: ${{ inputs.openstack_region }}
        OS_IDENTITY_API_VERSION: "3"
        OS_USER_DOMAIN_NAME: "Default"
        OS_PROJECT_DOMAIN_NAME: "Default"
        # Bastion configuration
        BASTION_NAME: ${{ steps.create-bastion.outputs.bastion_name }}
        BASTION_WAIT_TIMEOUT: ${{ inputs.bastion_wait_timeout }}
        # Workflow context routed via env to avoid template injection
        ACTION_PATH: ${{ github.action_path }}
      # yamllint disable rule:line-length
      run: |
        set -euo pipefail

        # Decode base64 encoded password
        PASSWORD=$(printf '%s' "${OS_PASSWORD}" | base64 -d)
        export OS_PASSWORD="${PASSWORD}"

        TIMEOUT="${BASTION_WAIT_TIMEOUT}"
        ELAPSED=0
        RETRY_INTERVAL=10

        echo "Waiting for bastion Tailscale IP..."
        while [[ $ELAPSED -lt $TIMEOUT ]]; do
          # Get bastion IP from Tailscale
          BASTION_IP=$(sudo tailscale status --json | jq -r ".Peer[] | select(.HostName | contains(\"${BASTION_NAME}\")) | .TailscaleIPs[0]" || echo "")

          if [[ -n "$BASTION_IP" && "$BASTION_IP" != "null" ]]; then
            echo "✅ Bastion Tailscale IP: ${BASTION_IP}"
            echo "bastion_ip=${BASTION_IP}" >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          echo "Waiting for bastion to connect to Tailscale... (${ELAPSED}s/${TIMEOUT}s)"
          sleep "${RETRY_INTERVAL}"
          ELAPSED=$((ELAPSED + RETRY_INTERVAL))
        done

        echo "❌ Error: Timeout waiting for bastion Tailscale IP"
        # Trigger automatic cleanup on timeout
        if [[ -n "${BASTION_NAME}" ]]; then
          echo "Triggering automatic cleanup due to timeout..."
          "${ACTION_PATH}/scripts/cleanup-bastion.sh" "${BASTION_NAME}" || true
        fi
        exit 1

      # yamllint enable rule:line-length
    - name: Cleanup bastion host
      if: inputs.operation == 'teardown'
      shell: bash
      env:
        # OpenStack credentials
        OS_AUTH_URL: ${{ inputs.openstack_auth_url }}
        OS_PROJECT_ID: ${{ inputs.openstack_project_id }}
        OS_USERNAME: ${{ inputs.openstack_username }}
        OS_PASSWORD: ${{ inputs.openstack_password }}
        OS_REGION_NAME: ${{ inputs.openstack_region }}
        OS_IDENTITY_API_VERSION: "3"
        OS_USER_DOMAIN_NAME: "Default"
        OS_PROJECT_DOMAIN_NAME: "Default"
        # Bastion configuration
        BASTION_NAME: ${{ inputs.bastion_name }}
        DEBUG_MODE: ${{ inputs.debug_mode }}
        # Workflow context routed via env to avoid template injection
        RUN_ID: ${{ github.run_id }}
        ACTION_PATH: ${{ github.action_path }}
      run: |
        set -euo pipefail

        # Decode base64 encoded password
        PASSWORD=$(printf '%s' "${OS_PASSWORD}" | base64 -d)
        export OS_PASSWORD="${PASSWORD}"

        BASTION_NAME="${BASTION_NAME:-bastion-gh-${RUN_ID}}"

        # Run cleanup script
        "${ACTION_PATH}/scripts/cleanup-bastion.sh" "${BASTION_NAME}"

    - name: Set operation status
      if: always()
      id: operation-status
      shell: bash
      run: |
        if [[ "${JOB_STATUS}" == "success" ]]; then
          echo "status=success" >> "${GITHUB_OUTPUT}"
        else
          echo "status=failure" >> "${GITHUB_OUTPUT}"
        fi
      env:
        JOB_STATUS: ${{ job.status }}

branding:
  icon: "cloud"
  color: "blue"