feat: add support for running the action inside container by liorr · Pull Request #71 · Twingate/github-action

liorr · 2026-02-25T05:07:58Z

Summary

Add test-linux-docker job to CI workflow to test the action inside a Docker container
Add test-linux-docker job to integration tests workflow for the published action
Uses ubuntu:24.04 container with --privileged mode to support systemd

Test plan

Verify test-linux-docker job passes in CI workflow
After merge, verify integration test Docker job passes

🤖 Generated with Claude Code

Add a test-linux-docker job to both .github/workflows/ci.yaml and .github/workflows/integration-tests.yaml. The job runs in an ubuntu:24.04 container (--privileged) with a 10-minute timeout, verifies Twingate status and attempts to access a secure resource via curl. In CI it invokes the local action (./) with the SERVICE_KEY secret; in integration-tests it exercises the published action twingate/github-action@main (passing service-key and debug) to validate behavior in a Docker environment.

Use runtime environment variable instead of parse-time context expression to resolve action path correctly inside Docker containers. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add SUDO variable to linux-helpers.sh that's empty when root - Replace hardcoded sudo with $SUDO in all Linux steps - Auto-install curl and gnupg if missing in container environments Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

@main

TODO: revert to @main after merging PR #71 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Copilot

Pull request overview

This PR adds support for running the Twingate GitHub Action inside Docker containers, specifically testing with ubuntu:24.04 containers. The changes enable the action to work in minimal container environments that run as root and may be missing standard tools like curl and gpg.

Changes:

Added SUDO variable to linux-helpers.sh that adapts to whether the action is running as root
Updated all script path references from ${{ github.action_path }} to "$GITHUB_ACTION_PATH" for better container compatibility
Added prerequisite installation step to install curl and gpg if missing in minimal containers
Added test-linux-docker job to both CI and integration test workflows using ubuntu:24.04 containers with --privileged mode

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
scripts/linux-helpers.sh	Added SUDO variable that is empty when running as root, otherwise "sudo", enabling the action to work in both container and regular runner environments
action.yml	Updated script sourcing to use GITHUB_ACTION_PATH environment variable, replaced all sudo references with $SUDO variable, and added prerequisite installation step for minimal containers
.github/workflows/ci.yaml	Added test-linux-docker job to test the action in ubuntu:24.04 container with --privileged mode
.github/workflows/integration-tests.yaml	Added test-linux-docker job to test the published action in ubuntu:24.04 container with --privileged mode

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/workflows/integration-tests.yaml

Copilot · 2026-02-25T05:33:29Z

action.yml

+        if [ -n "$MISSING_DEPS" ]; then
+          echo "Installing missing dependencies:$MISSING_DEPS"
+          apt-get update
+          apt-get install -y $MISSING_DEPS


The MISSING_DEPS variable should be quoted in the apt-get install command to prevent word splitting issues. While it will likely work in this context, using "$MISSING_DEPS" is a safer practice that prevents potential issues if package names contain special characters.

Suggested change

apt-get install -y $MISSING_DEPS

apt-get install -y "$MISSING_DEPS"

action.yml

Copilot · 2026-02-25T05:33:30Z

action.yml

+        command -v gpg >/dev/null 2>&1 || MISSING_DEPS="$MISSING_DEPS gnupg"
+
+        if [ -n "$MISSING_DEPS" ]; then
+          echo "Installing missing dependencies:$MISSING_DEPS"


Missing space after colon in the echo message. The output will be "Installing missing dependencies:curl gnupg" instead of "Installing missing dependencies: curl gnupg". Add a space after the colon for proper formatting.

Suggested change

echo "Installing missing dependencies:$MISSING_DEPS"

echo "Installing missing dependencies: $MISSING_DEPS"

.github/workflows/ci.yaml

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

- Add "Print client logs" step to test-linux-docker jobs for debugging - Add SUDO logic to prerequisites step for non-root environments - Fix spacing in echo message Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

When journalctl isn't available, Twingate logs to this file instead. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

scripts/linux-helpers.sh

Copilot · 2026-02-25T05:51:42Z

action.yml

+        if [ -n "$MISSING_DEPS" ]; then
+          # Use sudo if not running as root and sudo is available
+          SUDO=""
+          if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then
+            SUDO="sudo"
+          fi
+
+          echo "Installing missing dependencies: $MISSING_DEPS"
+          $SUDO apt-get update
+          $SUDO apt-get install -y $MISSING_DEPS
+        fi


If dependencies are missing and the environment is non-root without sudo installed, this step will attempt apt-get without privileges and fail, but with a confusing error. Add an explicit check for this case (e.g., detect id -u != 0 and no sudo) and fail fast with a clear message (or document that the action requires root/sudo in containers).

.github/workflows/ci.yaml

Copilot · 2026-02-25T05:51:43Z

.github/workflows/ci.yaml

+              journalctl -u twingate
+            elif [ -f /var/log/twingated.log ]; then
+              cat /var/log/twingated.log


In container environments journalctl may exist but still exit non-zero (e.g., no systemd/journald). Because run steps use bash -e, a non-zero journalctl here will fail the job even though this is a best-effort log dump. Consider appending || true (and --no-pager) to the journalctl/cat commands to ensure the step never fails.

Suggested change

journalctl -u twingate

elif [ -f /var/log/twingated.log ]; then

cat /var/log/twingated.log

journalctl -u twingate --no-pager || true

elif [ -f /var/log/twingated.log ]; then

cat /var/log/twingated.log || true

Copilot · 2026-02-25T05:51:43Z

.github/workflows/integration-tests.yaml

+        env:
+          TEST_URL: http://business.prod.beamreachinc.int/
+        run: |
+          curl -v $TEST_URL


This Docker integration test uses curl -v without --fail, so HTTP 4xx/5xx responses won't fail the step. Add --fail (as used in the existing test-linux job) to ensure the job actually validates access to the protected resource.

Suggested change

curl -v $TEST_URL

curl -v --fail $TEST_URL

Copilot · 2026-02-25T05:51:43Z

.github/workflows/integration-tests.yaml

+            journalctl -u twingate
+          elif [ -f /var/log/twingated.log ]; then
+            cat /var/log/twingated.log


Similar to CI, journalctl may be present in the container but still fail if systemd/journald isn't running. With bash -e, that would fail the whole job even though this is an if: always() diagnostics step. Make the journalctl/cat calls non-fatal (e.g., ... || true) so log collection never causes a failure.

Suggested change

journalctl -u twingate

elif [ -f /var/log/twingated.log ]; then

cat /var/log/twingated.log

journalctl -u twingate || true

elif [ -f /var/log/twingated.log ]; then

cat /var/log/twingated.log || true

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

liorr and others added 3 commits February 24, 2026 21:07

fix: use GITHUB_ACTION_PATH env var for container compatibility

dfae559

Use runtime environment variable instead of parse-time context expression to resolve action path correctly inside Docker containers. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

liorr changed the title ~~feat: add Docker container tests for GitHub Action~~ feat: add support for running the action inside container Feb 25, 2026

liorr requested review from Copilot and ekampf February 25, 2026 05:29

Copilot started reviewing on behalf of liorr February 25, 2026 05:29 View session

test: temporarily use branch for integration tests

9798931

TODO: revert to @main after merging PR #71 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Copilot AI reviewed Feb 25, 2026

View reviewed changes

liorr and others added 3 commits February 24, 2026 21:35

revert: use @main for integration tests

d8ab135

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

fix: address PR review feedback

ba0bda0

- Add "Print client logs" step to test-linux-docker jobs for debugging - Add SUDO logic to prerequisites step for non-root environments - Fix spacing in echo message Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

fix: use /var/log/twingated.log in container environments

12f79d2

When journalctl isn't available, Twingate logs to this file instead. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

liorr requested a review from Copilot February 25, 2026 05:46

Copilot started reviewing on behalf of liorr February 25, 2026 05:46 View session

Copilot AI reviewed Feb 25, 2026

View reviewed changes

ekampf and others added 3 commits February 25, 2026 09:06

Apply suggestion from @Copilot

0d1d45a

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fix error message

a5ed0c5

refactor sudo logic to be shared

524ae82

ekampf approved these changes Feb 25, 2026

View reviewed changes

ekampf merged commit 06732f4 into main Feb 25, 2026
17 of 19 checks passed

ekampf deleted the feature/lr/support_for_running_inside_docker branch February 25, 2026 21:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add support for running the action inside container#71

feat: add support for running the action inside container#71
ekampf merged 10 commits intomainfrom
feature/lr/support_for_running_inside_docker

liorr commented Feb 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Copilot AI Feb 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	apt-get install -y $MISSING_DEPS
	apt-get install -y "$MISSING_DEPS"

	echo "Installing missing dependencies:$MISSING_DEPS"
	echo "Installing missing dependencies: $MISSING_DEPS"

Conversation

liorr commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

liorr commented Feb 25, 2026 •

edited

Loading