tailscale/gitops-acl-action

Tailscale gitops-acl-action lets you manage your Tailscale network's access rules through a GitHub repository instead of a web dashboard. Tailscale is a tool that connects your devices into a private network, and it uses a policy file to control which devices and users can talk to each other. This action automatically syncs that policy file whenever you push changes to GitHub. The setup involves storing your policy file in a repo and configuring GitHub Actions to run on every push and pull request. When you open a pull request, the action runs in "test" mode, checking your changes for errors without actually applying them. When you merge to your main branch, it runs in "apply" mode, validating and then pushing the updated rules to your live Tailscale network. You authenticate using either an API key, an OAuth client, or a federated identity. This is useful for teams that want to treat their network configuration like code. Instead of one person clicking around a dashboard to change who can access what, changes go through the normal pull request workflow: someone proposes a change, a teammate reviews it, and automated checks catch mistakes before anything goes live. For example, if you want to grant a new contractor access to specific servers, you'd edit the policy file, open a PR, and merge it once approved. The project supports all three of Tailscale's authentication methods, though the README notes that API keys expire after 90 days and recommends using OAuth clients or federated identities for long-term setups. The federated identity approach is shown as the preferred option in the provided example, leveraging GitHub's built-in token system so you don't have to manage rotating credentials manually.