Commit Graph

334 Commits

Author SHA1 Message Date
Brad Fitzpatrick
d784dcc61b go.toolchain.branch: switch to Go 1.26
Updates #18682

Change-Id: I1eadfab950e55d004484af880a5d8df6893e85e8
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-04 21:57:05 -08:00
Claus Lensbøl
ea1f1616b9 .github/workflows: enable natlab in CI
After fixing the flakey tests in #18811 and #18814 we can enable running
the natlab testsuite running on CI generally.

Fixes #18810

Signed-off-by: Claus Lensbøl <claus@tailscale.com>
2026-03-04 15:02:07 -08:00
dependabot[bot]
eeb1fa047b .github: Bump actions/setup-go from 6.2.0 to 6.3.0
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.2.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](7a3fe6cf4c...4b73464bb3)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02 09:52:11 -07:00
dependabot[bot]
e0ca836c99 .github: Bump github/codeql-action from 4.32.3 to 4.32.5
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.32.3 to 4.32.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](9e907b5e64...c793b717bc)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02 09:49:25 -07:00
Tom Proctor
2743e0b681 .github/actions/go-cache: check for pre-built cigocacher (#18833)
Some CI runner images now have cigocacher baked in. Skip building if
it's already present.

Updates tailscale/corp#35667

Change-Id: I5ea0d606d44b1373bc1c8f7bca4ab780e763e2a9

Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2026-03-02 16:01:48 +00:00
James Tucker
142ce997cb .github/workflows: rename tidy workflow to match what it is
I was confused when everything I was reading in the CI failure was
saying `go mod tidy`, but the thing that was actually failing was
related to nix flakes. Rename the pipeline and step name to the `make
tidy` that it actually runs.

Updates #16637

Signed-off-by: James Tucker <james@tailscale.com>
2026-02-28 16:33:39 -08:00
dependabot[bot]
980e1c9d5c .github: bump actions/upload-artifact from 4.6.2 to 6.0.0
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.6.2...b7c566a772e6b6bfb58ed0dc250532a479d7789f)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23 08:48:09 -07:00
dependabot[bot]
8be5affa6d .github: bump actions/checkout from 6.0.1 to 6.0.2
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](8e8c483db8...de0fac2e45)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23 08:44:40 -07:00
dependabot[bot]
3d2bb5baa8 .github: bump actions/download-artifact from 6.0.0 to 7.0.0
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](018cc2cf5b...37930b1c2a)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23 08:44:02 -07:00
dependabot[bot]
98c77ac2f5 .github: bump actions/cache from 4.2.4 to 5.0.3
Bumps [actions/cache](https://github.com/actions/cache) from 4.2.4 to 5.0.3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](0400d5f644...cdf6c1fa76)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 5.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Mario Minardi <mario@tailscale.com>
2026-02-23 08:42:22 -07:00
dependabot[bot]
0ea55d37e3 .github: bump peter-evans/create-pull-request from 8.0.0 to 8.1.0
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 8.0.0 to 8.1.0.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](98357b18bf...c0f553fe54)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-02-23 08:38:58 -07:00
dependabot[bot]
2a60d0a007 .github: Bump github/codeql-action from 3.29.8 to 4.31.10 (#18454)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.8 to 4.31.10.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](76621b61de...cdefb33c0f)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.10
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19 11:54:06 -08:00
dependabot[bot]
03247a35d5 .github: Bump actions/create-github-app-token from 2.0.6 to 2.2.1 (#18388)
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.0.6 to 2.2.1.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Commits](df432ceedc...29824e69f5)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19 11:22:34 -08:00
dependabot[bot]
c0446aa4e1 .github: Bump DeterminateSystems/nix-installer-action from 20 to 21 (#18453)
Bumps [DeterminateSystems/nix-installer-action](https://github.com/determinatesystems/nix-installer-action) from 20 to 21.
- [Release notes](https://github.com/determinatesystems/nix-installer-action/releases)
- [Commits](786fff0690...c5a866b6ab)

---
updated-dependencies:
- dependency-name: DeterminateSystems/nix-installer-action
  dependency-version: '21'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19 10:56:39 -08:00
dependabot[bot]
c208ba2615 .github: Bump actions/setup-go from 5.5.0 to 6.2.0 (#18455)
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.5.0 to 6.2.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v5.5.0...7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19 09:31:50 -08:00
Brad Fitzpatrick
371d6369cd gokrazy: use monorepo for gokrazy appliance builds (monogok)
This switches our gokrazy builds to use a new variant of cmd/gok called
opinionated about using monorepos: https://github.com/bradfitz/monogok

And with that, we can get rid of all the go.mod files and builddir forests
under gokrazy/**.

Updates #13038
Updates gokrazy/gokrazy#361

Change-Id: I9f18fbe59b8792286abc1e563d686ea9472c622d
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-13 16:19:14 -08:00
Brad Fitzpatrick
d468870310 .github/workflows: bump oss-fuzz builder hash
Fixes #18710

Change-Id: I2ebad48b1227321233172beb9801087963ece4fa
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-12 14:25:17 -08:00
Brad Fitzpatrick
d26d3fcb95 .github/workflows: add macos runner
Fixes #18118

Change-Id: I118fcc6537af9ccbdc7ce6b78134e8059b0b5ccf
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-09 15:09:19 -08:00
Brad Fitzpatrick
2d2d5e6cc7 .github/workflows: set CMD_GO_USE_GIT_HASH=true for our cmd/go
Updates tailscale/go#150
Updates tailscale/corp#28679

Change-Id: Ieb4780f157451f5c6660c96c6efaec9ddcfcb415
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-01-28 18:45:12 -08:00
Simon Law
5aeee1d8a5 .github/workflows: double the timeout for golangci-lint (#18404)
Recently, the golangci-lint workflow has been taking longer and longer
to complete, causing it to timeout after the default of 5 minutes.

    Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: context deadline exceeded
    Timeout exceeded: try increasing it by passing --timeout option

Although PR #18398 enabled the Go module cache, bootstrapping with a
cold cache still takes too long.

This PR doubles the default 5 minute timeout for golangci-lint to 10
minutes so that golangci-lint can finish downloading all of its
dependencies.

Note that this doesn’t affect the 5 minute timeout configured in
.golangci.yml, since running golangci-lint on your local instance
should still be plenty fast.

Fixes #18366

Signed-off-by: Simon Law <sfllaw@tailscale.com>
2026-01-14 11:53:14 -08:00
Irbe Krumina
28f163542c .github/actions/go-cache: build cigocacher using remote path, fall back to ./tool/go (#18409)
If local tailscale/tailscale checkout is not available,
pulll cigocacher remotely.
Fall back to ./tool/go if no other Go installation
is present.

Updates tailscale/corp#32493

Signed-off-by: Irbe Krumina <irbekrm@gmail.com>
2026-01-14 15:15:02 +00:00
Simon Law
76fb09c6bd .github/workflows: fix timeouts by caching packages for golangci-lint (#18398)
Recently, the golangci-lint workflow has been taking longer and longer
to complete, causing it to timeout after the default of 5 minutes.

    Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: context deadline exceeded
    Timeout exceeded: try increasing it by passing --timeout option

This PR upgrades actions/setup-go to version 6, the latest, and
enables caching for Go modules and build outputs. This should speed up
linting because most packages won’t have to be downloaded over and
over again.

Fixes #18366

Signed-off-by: Simon Law <sfllaw@tailscale.com>
2026-01-13 09:56:53 -08:00
Mario Minardi
a662c541ab .github/workflows: bump create-pull-request to 8.0.0
Bump peter-evans/create-pull-request to 8.0.0 to ensure compatibility
with actions/checkout 6.x.

Updates #cleanup

Signed-off-by: Mario Minardi <mario@tailscale.com>
2026-01-06 11:57:39 -07:00
dependabot[bot]
9a6282b515 .github: Bump actions/checkout from 4.2.2 to 5.0.0
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](11bd71901b...08c6903cd8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-06 11:48:32 -07:00
Tom Proctor
d0d993f5d6 .github,cmd/cigocacher: add flags --version --stats --cigocached-host
Add flags:

* --cigocached-host to support alternative host resolution in other
  environments, like the corp repo.
* --stats to reduce the amount of bash script we need.
* --version to support a caching tool/cigocacher script that will
  download from GitHub releases.

Updates tailscale/corp#10808

Change-Id: Ib2447bc5f79058669a70f2c49cef6aedd7afc049
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-12-15 13:17:03 +00:00
Irbe Krumina
cb5fa35f57 .github/workfkows,Dockerfile,Dockerfile.base: add a test for base image (#18180)
Test that the base image builds and has the right iptables binary
linked.

Updates #17854

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-12-12 18:10:00 +00:00
Tom Proctor
dd1bb8ee42 .github: add cigocacher release workflow
To save rebuilding cigocacher on each CI job, build it on-demand, and
publish a release similar to how we publish releases for tool/go to
consume. Once the first release is done, we can add a new
tool/cigocacher script that pins to a specific release for each branch
to download.

Updates tailscale/corp#10808

Change-Id: I7694b2c2240020ba2335eb467522cdd029469b6c
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-12-09 13:21:11 +00:00
Tom Proctor
f8cd07fb8a .github: make cigocacher script more robust
We got a flake in https://github.com/tailscale/tailscale/actions/runs/19867229792/job/56933249360
but it's not obvious to me where it failed. Make it more robust and
print out more useful error messages for next time.

Updates tailscale/corp#10808

Change-Id: I9ca08ea1103b9ad968c9cc0c42a493981ea62435
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-12-02 20:01:23 +00:00
Raj Singh
bd5c50909f scripts/installer: add TAILSCALE_VERSION environment variable (#18014)
Add support for pinning specific Tailscale versions during installation
via the TAILSCALE_VERSION environment variable.

Example usage:
  curl -fsSL https://tailscale.com/install.sh | TAILSCALE_VERSION=1.88.4 sh

Fixes #17776

Signed-off-by: Raj Singh <raj@tailscale.com>
2025-12-02 07:57:21 -08:00
Tom Proctor
ece6e27f39 .github,cmd/cigocacher: use cigocacher for windows
Implements a new disk put function for cigocacher that does not cause
locking issues on Windows when there are multiple processes reading and
writing the same files concurrently. Integrates cigocacher into test.yml
for Windows where we are running on larger runners that support
connecting to private Azure vnet resources where cigocached is hosted.

Updates tailscale/corp#10808

Change-Id: I0d0e9b670e49e0f9abf01ff3d605cd660dd85ebb
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-12-02 09:18:45 +00:00
Tom Proctor
97f1fd6d48 .github: only save cache on main
The cache artifacts from a full run of test.yml are 14GB. Only save
artifacts from the main branch to ensure we don't thrash too much. Most
branches should get decent performance with a hit from recent main.

Fixes tailscale/corp#34739

Change-Id: Ia83269d878e4781e3ddf33f1db2f21d06ea2130f
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-12-02 09:07:20 +00:00
Mario Minardi
411cee0dc9 .github/workflows: only run golang ci lint when go files have changed
Restrict running the golangci-lint workflow to when the workflow file
itself or a .go file, go.mod, or go.sum have actually been modified.

Updates #cleanup

Signed-off-by: Mario Minardi <mario@tailscale.com>
2025-11-27 16:07:12 -07:00
Mario Minardi
9cc07bf9c0 .github/workflows: skip draft PRs for request review workflows
Skip the "request review" workflows for PRs that are in draft to reduce
noise / skip adding reviewers to PRs that are intentionally marked as
not ready to review.

Updates #cleanup

Signed-off-by: Mario Minardi <mario@tailscale.com>
2025-11-26 17:18:26 -07:00
Brad Fitzpatrick
2a6cbb70d9 .github/workflows: make go_generate check detect new files
Updates #17957

Change-Id: I904fd5b544ac3090b58c678c4726e7ace41a52dd
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-11-18 06:42:08 -08:00
Joe Tsai
5b40f0bc54 cmd/vet: add static vet checker that runs jsontags (#17778)
This starts running the jsontags vet checker on the module.
All existing findings are adding to an allowlist.

Updates tailscale/corp#791

Signed-off-by: Joe Tsai <joetsai@digital-static.net>
2025-11-05 16:17:49 -08:00
Mario Minardi
02681732d1 .github: drop branches filter with single asterisk from workflows (#17682)
Drop usage of the branches filter with a single asterisk as this matches
against zero or more characters but not a forward slash, resulting in
PRs to branch names with forwards slashes in them not having these
workflow run against them as expected.

Updates https://github.com/tailscale/corp/issues/33523

Signed-off-by: Mario Minardi <mario@tailscale.com>
2025-10-28 09:33:03 -06:00
Alex Chan
3944809a11 .github/workflows: pin the google/oss-fuzz GitHub Actions
Updates https://github.com/tailscale/corp/issues/31017

Signed-off-by: Alex Chan <alexc@tailscale.com>
2025-10-21 10:26:37 +01:00
Andrew Lytvynov
6493206ac7 .github/workflows: pin nix-related github actions (#17574)
Updates #cleanup

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-10-17 10:00:42 -07:00
Irbe Krumina
7df7e01d0f tstest/integration/vms,.github/workflows: bump Ubuntu and NixOS for VM tests + cleanup (#16098)
This PR cleans up a bunch of things in ./tstest/integration/vms:

- Bumps version of Ubuntu that's actually run from CI 20.04 -> 24.04
- Removes Ubuntu 18.04 test
- Bumps NixOS 21.05 -> 25.05

Updates#cleanup

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
2025-09-27 08:23:58 +01:00
Simon Law
6d45fcfc93 .github/workflows: reviewing depaware.txt is unnecessary (#16990)
Apparently, #16989 introduced a bug in request-dataplane-review.yml:

> you may only define one of `paths` and `paths-ignore` for a single event

Related #16372
Updates #cleanup

Signed-off-by: Simon Law <sfllaw@tailscale.com>
2025-08-31 13:29:25 -04:00
Simon Law
442f4758a9 .github/workflows: reviewing depaware.txt is unnecessary (#16989)
@tailscale/dataplane almost never needs to review depaware.txt, when
it is the only change to the DERP implementation.

Related #16372
Updates #cleanup

Signed-off-by: Simon Law <sfllaw@tailscale.com>
2025-08-31 12:30:17 -04:00
Patrick O'Doherty
c5429cd49c go.toolchain.branch: bump to go1.25 (#16954)
go.toolchain.rev: bump go1.25 version
flake.nix: bump Go to 1.25

Updates #16330

Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2025-08-26 07:44:26 -07:00
dependabot[bot]
3e198f6d5f .github: Bump github/codeql-action from 3.29.7 to 3.29.8 (#16828)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.7 to 3.29.8.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](51f77329af...76621b61de)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-21 09:48:31 -06:00
Mike O'Driscoll
e4031daa08 .github/Makefile/flake: update nix flake support (#16636)
Cleanup nix support, make flake easier to read with nix-systems.
This also harmonizes with golinks flake setup and reduces an input
dependency by 1.

Update deps test to ensure the vendor hash stays harmonized
with go.mod.

Update make tidy to ensure vendor hash stays current.

Overlay the current version of golang, tailscale runs
recent releases faster than nixpkgs can update them into
the unstable branch.

Updates #16637

Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-08-19 10:46:07 -04:00
Aaron Klotz
02f6030dbd tool, tool/gocross: update gocross to support building natively on Windows and add a PowerShell Core wrapper script
gocross-wrapper.ps1 is a PowerShell core script that is essentially a
straight port of gocross-wrapper.sh. It requires PowerShell 7.4, which
is the latest LTS release of PSCore.

Why use PowerShell Core instead of Windows PowerShell? Essentially
because the former is much better to script with and is the edition
that is currently maintained.

Because we're using PowerShell Core, but many people will be running
scripts from a machine that only has Windows PowerShell, go.cmd has
been updated to prompt the user for PowerShell core installation if
necessary.

gocross-wrapper.sh has also been updated to utilize the PSCore script
when running under cygwin or msys.

gocross itself required a couple of updates:

We update gocross to output the PowerShell Core wrapper alongside the
bash wrapper, which will propagate the revised scripts to other repos
as necessary.

We also fix a couple of things in gocross that didn't work on Windows:
we change the toolchain resolution code to use os.UserHomeDir instead
of directly referencing the HOME environment variable, and we fix a
bug in the way arguments were being passed into exec.Command on
non-Unix systems.

Updates https://github.com/tailscale/corp/issues/29940

Signed-off-by: Aaron Klotz <aaron@tailscale.com>
2025-08-18 09:49:24 -06:00
dependabot[bot]
d07166b87d .github: Bump actions/cache from 4.2.3 to 4.2.4 (#16829)
Bumps [actions/cache](https://github.com/actions/cache) from 4.2.3 to 4.2.4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](5a3ec84eff...0400d5f644)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-12 20:36:47 -06:00
dependabot[bot]
71d51eb8db .github: bump github/codeql-action from 3.29.3 to 3.29.5 (#16765)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.3 to 3.29.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](d6bbdef45e...51f77329af)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-10 21:56:17 -06:00
Andrew Lytvynov
f80ea92030 .github/workflows: enforce github action version pinning (#16768)
Use https://github.com/stacklok/frizbee via the new `go tool` support
from Go 1.24.

Updates https://github.com/tailscale/corp/issues/31017

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-08-05 11:49:33 -07:00
dependabot[bot]
4a435aedcb .github: Bump github/codeql-action from 3.29.2 to 3.29.3 (#16615)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.2 to 3.29.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](181d5eefc2...d6bbdef45e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 3.29.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-28 08:41:59 -06:00
Mike O'Driscoll
f1f334b23d flake.lock/go.mod.sri: update flake version info (#16631)
Update nixpkgs-unstable to include newer golang
to satisfy go.mod requirement of 1.24.4

Update vendor hash to current.

Updates #15015

Signed-off-by: Mike O'Driscoll <mikeo@tailscale.com>
2025-07-23 11:25:05 -04:00