Add an install type homebrew for OS X runners

.github/workflows/smoke-test.yml

@@ -30,8 +30,8 @@ jobs:
       - name: Install Dependencies
         run: npm ci
 
-      - name: Build Action
-        run: npm run build
+      - name: Build Action and Run Local Smoke Tests
+        run: npm test
 
       - name: Test Action Loading (No Auth)
         uses: ./

.github/workflows/test.yml

@@ -23,7 +23,7 @@ jobs:
     # TODO(mpminardi): revisit / remove this if / when we give dependabot a tailnet for
     # testing with a smaller blast radius.
     if: ${{ github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}
-    name: ${{ matrix.os }} (${{ matrix.arch }}) (${{ matrix.credential-type }}) tailscale-${{ matrix.version }}
+    name: ${{ matrix.os }} (${{ matrix.arch }}) (${{ matrix.credential-type }}) tailscale-${{ matrix.version || 'default' }} ${{ matrix.install-type && format('({0})', matrix.install-type) || '' }}
     strategy:
       fail-fast: false
       matrix:
@@ -79,22 +79,23 @@ jobs:
             version: latest
             ping: 100.99.0.2,lax-pve.pineapplefish.ts.net,lax-pve
             credential-type: oauth
+            install-type: source
 
-          # macOS latest (ARM)
+          # macOS latest (ARM), explicitly exercising the Homebrew install path.
           - os: macos-latest
             runner-os: macOS
             arch: arm64
-            version: latest
             ping: 100.99.0.2,lax-pve.pineapplefish.ts.net,lax-pve
             credential-type: oauth
+            install-type: brew
 
           # Try workload identity for each platform
           - os: macos-latest
             runner-os: macOS
             arch: amd64
-            version: latest
             ping: 100.99.0.2,lax-pve.pineapplefish.ts.net,lax-pve
             credential-type: workload-identity
+            install-type: brew
 
           - os: windows-latest
             runner-os: Windows
@@ -110,7 +111,6 @@ jobs:
             version: unstable
             credential-type: workload-identity
 
-
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -129,6 +129,23 @@ jobs:
       - name: Build Action
         run: npm run build
 
+      - name: Resolve Homebrew Tailscale Version
+        id: brew-version
+        if: matrix.install-type == 'brew'
+        shell: bash
+        run: |
+          version="$(brew info --json=v2 --formula tailscale | node -e 'let input = ""; process.stdin.on("data", d => input += d); process.stdin.on("end", () => console.log(JSON.parse(input).formulae[0].versions.stable));')"
+          echo "version=${version}" >> "${GITHUB_OUTPUT}"
+
+      - name: Force Source Install Path
+        if: matrix.install-type == 'source'
+        shell: bash
+        run: |
+          mkdir -p "${RUNNER_TEMP}/no-brew"
+          printf '#!/usr/bin/env bash\nexit 127\n' > "${RUNNER_TEMP}/no-brew/brew"
+          chmod +x "${RUNNER_TEMP}/no-brew/brew"
+          echo "${RUNNER_TEMP}/no-brew" >> "${GITHUB_PATH}"
+
       # Test with OAuth authentication
       - name: Test Action
         id: tailscale-oauth
@@ -138,12 +155,28 @@ jobs:
           oauth-secret: ${{ matrix.credential-type == 'oauth' &&  secrets.TS_AUTH_KEYS_OAUTH_CLIENT_SECRET || '' }}
           audience: ${{ matrix.credential-type == 'workload-identity' && secrets.TS_AUDIENCE || ''}}
           tags: "tag:ci"
-          version: "${{ matrix.version }}"
+          version: "${{ matrix.install-type == 'brew' && steps.brew-version.outputs.version || matrix.version }}"
           use-cache: false
           timeout: "5m"
           retry: 3
           ping: "${{ matrix.ping }}"
 
+      - name: Verify Explicit Install Type
+        if: matrix.install-type
+        shell: bash
+        run: |
+          if [ "${{ matrix.install-type }}" = "brew" ]; then
+            brew list --formula tailscale
+            sudo -E tailscale status
+          elif [ "${{ matrix.install-type }}" = "source" ]; then
+            if brew --version >/dev/null 2>&1; then
+              echo "brew should have been unavailable for source install test"
+              exit 1
+            fi
+            test -x /usr/local/bin/tailscale
+            test -x /usr/local/bin/tailscaled
+          fi
+
       # Look up names to make sure MagicDNS is working
       - name: Look up qualified name
         run: nslookup lax-pve.pineapplefish.ts.net

package.json

@@ -7,7 +7,9 @@
     "node": ">=24.0.0"
   },
   "scripts": {
-    "build": "ncc build src/main.ts -o dist && ncc build src/logout/logout.ts -o dist/logout"
+    "build": "ncc build src/main.ts -o dist && ncc build src/logout/logout.ts -o dist/logout",
+    "test": "npm run build && npm run test:smoke",
+    "test:smoke": "node --test test/*.test.js"
   },
   "repository": {
     "type": "git",