[ivangrynenko]

Why

Deployments need SSH access to servers that restrict ingress to trusted source addresses. GitHub-hosted runner egress addresses are dynamic and published in broad ranges, so they are not a practical narrow SSH allowlist.

Investigation

Existing deployment workflows connect through WireGuard and use a split tunnel to reach the deployment host. The reusable action needs to run on the Ubuntu runner host to configure its routes, keep the private peer configuration out of logs, and remove the tunnel after the job.

Decision

Add a JavaScript action under a repository subdirectory so consumers can reference it directly with truecms/sentinel-actions/wireguard-ssh@<reviewed-ref>. Keep VPN configuration separate from SSH credentials, verify the target IPv4 route and reachability before deployment, bound setup and name resolution, and register a separate post entrypoint for cleanup.

What changed

• Added the wireguard-ssh action with validated inputs, private temporary configuration storage, route and handshake checks, TCP reachability verification, and post-job cleanup.
• Added direct-use documentation and a complete deployment workflow example with a separate SSH key and pinned host keys.
• Added Node regression tests and wired them into the repository test workflow.

Where

• wireguard-ssh/action.yml — action metadata and inputs for direct repository use.
• wireguard-ssh/index.js and post.js — tunnel setup, route verification, and cleanup.
• wireguard-ssh/examples/deploy.yml — end-to-end workflow example to copy into a deployment repository.
• tests/wireguard-ssh.test.js — input, route, timeout, secret-file, and cleanup coverage.

Validation

• node --check wireguard-ssh/index.js && node --check wireguard-ssh/post.js — passed.
• node --test tests/wireguard-ssh.test.js — 8 tests passed.
• shellcheck scripts/*.sh */scan.sh tests/*/stubs/* examples/drupal-db-image/*.sh — passed.
• bats tests/*/*.bats — 63 tests passed.
• YAML parsing and git diff --check — passed.
• Live GitHub Actions and WireGuard deployment were not run; the example uses a placeholder ref that must be replaced after merge with a reviewed immutable SHA or release tag.