[renovate]

This PR contains the following updates:

Package	Type	Update	Change
tailscale/github-action	action	minor	v4.1.3 → v4.2.0

---

Release Notes

tailscale/github-action (tailscale/github-action)

v4.2.0

Compare Source

What's Changed

• feat: implement log grouping for better output by @​jaxxstorm in #​304
• fix: reuse stale tailscale.tgz on self-hosted runners by @​TowyTowy in #​305
• Bump typescript from 5.9.3 to 6.0.3 by @​dependabot[bot] in #​298
• Bump actions/setup-node from 6.4.0 to 7.0.0 by @​dependabot[bot] in #​312
• Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​314

New Contributors

• @​TowyTowy made their first contribution in #​305

Full Changelog: tailscale/github-action@v4.1.3...v4.2.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 through 7 and 15 through 21 of the month, and on Monday (* 0-3 1-7,15-21 * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

tailscale/github-action (github-action) v4.1.3 -> v4.2.0

Risk: 🟢 Safe

The Deep Dive

Update Scope

Bumps the SHA-pinned tailscale/github-action from v4.1.3 (780049a) to v4.2.0 (d1b6cd2), a minor release. The change appears in the Connect to Tailscale step of two workflows: .github/workflows/ansible-production-deploy.yaml and .github/workflows/argocd-production-deploy.yaml. Both steps run on ubuntu-latest with oauth-client-id, oauth-secret, tags: tag:github-actions and use-cache: true. The pinned SHAs match the upstream tag refs. The inputs used here, the authentication flow, the cache key logic and the node24 runtime are unchanged. The downloaded Tailscale client version is not pinned and is still resolved at run time.

Features & UX

• Grouped log output (new log-mode input) (#304): adds log-mode with the values grouped (default), normal and quiet. It applies automatically. Both deploy workflows will now show the action's setup and cleanup phases as collapsible log groups. Command output from the action's internal exec calls (for example tailscale up) is now silent unless runner debug logging is on, and stderr is still printed when a command fails (logging.ts). This changes only how the logs look, not the connection behaviour. Neither workflow sets log-mode, so both get the default.

Security

• There are no GitHub security advisories for tailscale/github-action, and none are fixed or introduced in this range.
• Upstream diff review (compare v4.1.3...v4.2.0): the change has no new network endpoints, no new secret handling and no eval or child_process use. The only URL added to dist/ (github.com/tailscale/tailscale.git) was already present in v4.1.3. The release commit is GitHub-verified.
• The tarball-reuse fix checks the SHA256 of an existing tailscale.tgz before reusing it, and deletes and re-downloads the file if the checksum does not match. Integrity checking is therefore kept.
• The only dependency change is a dev-only bump of TypeScript from 5.9.3 to 6.0.3 (#298). It is a build tool and is not shipped at run time.

Key Fixes

• Stale tailscale.tgz on persistent self-hosted runners (#305, fixes #294): this does not apply here. Both workflows use ephemeral ubuntu-latest runners, where the leaked file cannot exist.
• Ping failure path: when the ping input fails, the action now throws an error instead of calling setFailed and process.exit(1). Neither workflow sets ping, so this has no effect.

Newer Versions

v4.2.0 is the latest release (published 2026-09-22). No newer version exists, and no issues have been filed since the release. The most recent upstream issue is #317 (2026-09-11), a feature request.

Hazards & Risks

None identified. This is a minor release with one additive input whose default only changes how logs are displayed. The only bug fix targets self-hosted runners, which this repository does not use. The inputs used here, the OAuth authentication path, the caching path and the Node runtime are unchanged. Pre-existing open issues such as #313 (sha256sum is ignored on a cache hit) and #315 (macOS DNS) affect both versions. Neither applies, because this repository does not set sha256sum and does not use macOS runners.

Sources

• tailscale/github-action v4.2.0 release
• Compare v4.1.3...v4.2.0
• PR #304 log grouping
• PR #305 stale tarball reuse
• PR #298 TypeScript 6 bump
• Security advisories

---

🟢 Verdict: Safe

This is a routine minor bump of an SHA-pinned action. The upstream diff only adds grouped logging and a fix for self-hosted runners, and it leaves the inputs, authentication and caching used by both deploy workflows unchanged. No advisories or regressions were found.