From 2908ee18f7bf2f0fbd0e5595663a2b109a35867d Mon Sep 17 00:00:00 2001
From: Nandor Kracser <nandor@riptides.io>
Date: Thu, 30 Jul 2026 15:22:57 +0200
Subject: [PATCH] feat: wait for the daemon to be ready before the step
 finishes

The install step returned as soon as riptides.service was active, but the
daemon is not intercepting yet at that point - it still has to connect to
the driver and get a workload identity issued. Connections opened by the
next workflow step could land in that window and go unrecorded.

Pass --wait-ready to install.sh (new wait-for-ready / ready-timeout inputs,
on by default) and assert the driver reports OK in the test workflow.
---
 .github/workflows/test.yml |  5 +++++
 README.md                  |  5 +++++
 action.yml                 | 16 +++++++++++++++-
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8c81d4c..fd04d89 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,3 +24,8 @@ jobs:
         run: lsmod | grep riptides
       - name: Verify daemon is running
         run: systemctl is-active riptides
+      - name: Verify daemon is ready
+        run: |
+          health=$(cat /sys/module/riptides/health)
+          echo "driver health: $health"
+          [[ "$health" == OK* ]]
diff --git a/README.md b/README.md
index e7e91dc..80d4d7b 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,8 @@ Riptides injects the bearer token for outbound calls to services in your policy,
 | `controlplane-url` | yes | | URL of your Riptides control plane |
 | `audience` | no | `riptides` | OIDC token audience, must match `GitHubActionsVerifier` config |
 | `version` | no | `latest` | Daemon version to install |
+| `wait-for-ready` | no | `true` | Wait for the daemon to be fully ready before the step finishes |
+| `ready-timeout` | no | `120` | Seconds to wait for readiness |
 
 ## How it works
 
@@ -80,5 +82,8 @@ The action calls the Riptides [install.sh](https://docs.riptides.io/install.sh)
 1. Installs the kernel driver and daemon package
 2. Calls `riptides daemon auth --plugin GitHubActions`, fetches an OIDC token from the Actions token endpoint and exchanges it for a SPIFFE x509 identity certificate
 3. Starts the daemon as a systemd service
+4. Waits until the driver reports the daemon fully ready — connected, trust anchors loaded, workload identity issued (`--wait-ready`)
+
+Step 4 matters because the daemon needs a moment after the service starts before traffic is actually intercepted. Without it, a step running immediately after this action can open connections that are missed. Set `wait-for-ready: false` to skip the wait.
 
 The runner VM is ephemeral so no cleanup step is needed.
diff --git a/action.yml b/action.yml
index d5321da..4bec73a 100644
--- a/action.yml
+++ b/action.yml
@@ -13,6 +13,14 @@ inputs:
     description: "Daemon version to install (default: latest)"
     required: false
     default: latest
+  wait-for-ready:
+    description: Wait for the daemon to be fully ready (driver connected, workload identity issued) before finishing, so connections made by the next step are not missed
+    required: false
+    default: "true"
+  ready-timeout:
+    description: How long to wait, in seconds, for the daemon to become ready
+    required: false
+    default: "120"
 
 branding:
   icon: shield
@@ -26,7 +34,13 @@ runs:
       env:
         DAEMON_VERSION: ${{ inputs.version }}
       run: |
+        wait_args=()
+        if [[ "${{ inputs.wait-for-ready }}" == "true" ]]; then
+          wait_args=(--wait-ready --wait-timeout "${{ inputs.ready-timeout }}")
+        fi
+
         curl -fsSL https://docs.riptides.io/install.sh | sudo -E bash -s -- \
           --controlplane-url "${{ inputs.controlplane-url }}" \
           --plugin GitHubActions \
-          --github-actions-audience "${{ inputs.audience }}"
+          --github-actions-audience "${{ inputs.audience }}" \
+          "${wait_args[@]}"