tailscale-wif
Set up and troubleshoot SECRETLESS GitHub Actions -> Tailscale authentication using Workload Identity Federation (WIF): each run mints a GitHub OIDC token that a Tailscale "Trust Credential" exchanges for a short-lived API token or ephemeral auth key, so no Tailscale API key or OAuth client secret is ever stored. Use this WHENEVER a GitHub Actions workflow needs to talk to Tailscale — pushing an ACL/policy file with tailscale/gitops-acl-action, or joining a CI runner to the tailnet with tailscale/github-action — and you want to drop the stored credential, OR when such a workflow is failing with "token exchange failed with status 403: Unauthorized", "requested tags are invalid or not permitted", or "only one of API Key, OAuth secret, or OAuth client ID and audience". Reach for it on phrases like "Tailscale OIDC", "Tailscale WIF", "federated identity Tailscale", "secretless Tailscale in CI", "remove the Tailscale API key / OAuth secret from Actions", or "Tailscale Trust Credential".
