fix(cd): OAuth token exchange requires client_id — read TS_OAUTH_CLIENT_ID

.github/workflows/cd.yml

@@ -32,17 +32,20 @@ jobs:
         run: nix develop --command python3 scripts/validate.py
         env:
           TAILSCALE_API_KEY: ${{ secrets.TAILSCALE_API_KEY }}
+          TS_OAUTH_CLIENT_ID: ${{ vars.TS_OAUTH_CLIENT_ID }}
           XDG_CACHE_HOME: ${{ runner.temp }}/.cache
 
       - name: Show diff
         run: |
           nix develop --command python3 scripts/push.py --dry-run || true
         env:
           TAILSCALE_API_KEY: ${{ secrets.TAILSCALE_API_KEY }}
+          TS_OAUTH_CLIENT_ID: ${{ vars.TS_OAUTH_CLIENT_ID }}
           XDG_CACHE_HOME: ${{ runner.temp }}/.cache
 
       - name: Push ACL to Tailscale
         run: nix develop --command python3 scripts/push.py --confirm
         env:
           TAILSCALE_API_KEY: ${{ secrets.TAILSCALE_API_KEY }}
+          TS_OAUTH_CLIENT_ID: ${{ vars.TS_OAUTH_CLIENT_ID }}
           XDG_CACHE_HOME: ${{ runner.temp }}/.cache

scripts/ts_auth.py

@@ -14,6 +14,7 @@
 """
 
 import json
+import os
 import urllib.parse
 import urllib.request
 
@@ -24,14 +25,24 @@ def resolve_bearer(secret: str) -> str:
     """Return a usable bearer token for the Tailscale API.
 
     Direct API keys are returned unchanged; OAuth client secrets are exchanged
-    for an access token.
+    for an access token. The exchange requires the (non-secret) client id in
+    TS_OAUTH_CLIENT_ID — Tailscale's token endpoint rejects requests without it.
     """
     if not secret or not secret.startswith("tskey-client-"):
         return secret
 
+    client_id = os.environ.get("TS_OAUTH_CLIENT_ID", "")
+    if not client_id:
+        raise RuntimeError(
+            "TAILSCALE_API_KEY holds an OAuth client secret (tskey-client-...) "
+            "but TS_OAUTH_CLIENT_ID is unset; the token exchange requires the "
+            "client id. Set the TS_OAUTH_CLIENT_ID Actions variable (it is not "
+            "a secret) alongside the client-secret swap."
+        )
+
     data = urllib.parse.urlencode(
         {
-            "client_id": "",
+            "client_id": client_id,
             "client_secret": secret,
             "grant_type": "client_credentials",
         }