[waleedlatif1]

Summary

• migrate.yml and docs.yml join the tailnet (official tailscale/github-action, pinned by SHA) before their first database connection, so database IP restrictions can admit the tailnet's app connector instead of ever-changing runner addresses
• Off unless the repo variable CI_DB_TAILNET is true: merging is a no-op, it can be verified on a staging deploy before any restriction depends on it, and unsetting it reverts instantly
• Auth is Tailscale workload identity federation (the job's GitHub OIDC token, tag:ci), so no long-lived Tailscale secret is stored; --accept-routes because Linux nodes ignore app connector routes otherwise
• The migrate, migrate-dev, and docs callers in ci.yml grant id-token: write and pass TS_OAUTH_CLIENT_ID / TS_AUDIENCE; a called job requesting id-token: write without the caller granting it would fail the whole run at startup

Type of Change

• Chore (CI)

Testing

• actionlint -shellcheck= -pyflakes= (the CI invocation) clean on all workflows
• scripts/migrations-workflow.test.ts, scripts/dev-deployment-workflow.test.ts, scripts/desktop-prune-workflow.test.ts: 20/20 pass
• With CI_DB_TAILNET unset the new steps are skipped, so behavior is unchanged until the variable is flipped and a staging deploy confirms the route

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 31, 2026 9:39pm UTC

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable defects were found.

Summary

Adds optional Tailscale access before database work in the migration and docs workflows.

• Migration runs can use the tailnet to reach their database.
• Docs indexing can use the tailnet to reach its database.

_{Reviews (1) · Last reviewed commit: "chore(ci): reach the database over the t..." · Reviewed by Greptile}