tweak arhs

Author: tarekziade

.github/workflows/ai-review.yml

@@ -55,14 +55,19 @@ jobs:
       - name: Connect to Tailscale
         uses: tailscale/github-action@v4
         with:
-          # Workload-identity federation: the action exchanges a GitHub
-          # OIDC token (audience-scoped) for tailnet access, so no
-          # long-lived auth key is stored. The runner joins as an
-          # ephemeral, tag:ci-tagged node.
+          # OAuth client auth: the secret mints an ephemeral, pre-authorized
+          # tag:ci node. The action always passes --accept-routes itself, so
+          # the tailnet's advertised subnet route to the 10.90.0.0 network
+          # (where serge.huggingface.tech / 10.90.52.50 lives) is installed.
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID_AI_REVIEW }}
           oauth-secret: ${{ secrets.TS_AUDIENCE_AI_REVIEW }}
           tags: tag:ci
-          args: --accept-routes --accept-dns=false
+          # --accept-dns=false: keep the runner's own resolver, which already
+          # resolves serge.huggingface.tech -> 10.90.52.50. Letting MagicDNS
+          # accept tailnet DNS hijacks lookups to an internal nameserver that
+          # hangs (curl: (28) Resolving timed out). Do NOT add --accept-routes
+          # here; the action injects it and a duplicate flag errors.
+          args: --accept-dns=false
 
       - name: Relay event to the Serge GitHub App
         env: