Skip to content

Commit a69b18b

Browse files
authored
Merge branch 'main' into npalm/remove-deprecated
2 parents 9497e7f + 2e69cfd commit a69b18b

File tree

28 files changed

+1493
-1611
lines changed

28 files changed

+1493
-1611
lines changed

.github/workflows/codeql.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,12 @@ jobs:
3030

3131
# Initializes the CodeQL tools for scanning.
3232
- name: Initialize CodeQL
33-
uses: github/codeql-action/init@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
33+
uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
3434
with:
3535
languages: ${{ matrix.language }}
3636
build-mode: ${{ matrix.build-mode }}
3737

3838
- name: Perform CodeQL Analysis
39-
uses: github/codeql-action/analyze@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
39+
uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
4040
with:
4141
category: "/language:${{matrix.language}}"

.gitignore

+6
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,14 @@
44
# Module directory
55
.terraform/
66

7+
# lock files
8+
**/.terraform.lock.hcl
9+
!examples/**/.terraform.lock.hcl
10+
11+
712
# keys
813
*id_rsa*
14+
*.pem
915

1016
# other
1117
node_modules/

.terraform.lock.hcl

-65
This file was deleted.

CHANGELOG.md

+25
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,30 @@
11
# Changelog
22

3+
## [5.20.1](https://github.com/philips-labs/terraform-aws-github-runner/compare/v5.20.0...v5.20.1) (2024-12-09)
4+
5+
6+
### Bug Fixes
7+
8+
* **lambda:** bump @octokit/types from 13.6.1 to 13.6.2 in /lambdas in the octokit group ([#4291](https://github.com/philips-labs/terraform-aws-github-runner/issues/4291)) ([d8d7519](https://github.com/philips-labs/terraform-aws-github-runner/commit/d8d75191eb4573d07ce3ee7f78bfb246b46e1198))
9+
* **lambda:** bump the aws group across 1 directory with 7 updates ([#4288](https://github.com/philips-labs/terraform-aws-github-runner/issues/4288)) ([039f5db](https://github.com/philips-labs/terraform-aws-github-runner/commit/039f5dbeb8af6a02a4686572d8e3377e5048fb3b))
10+
* **lambda:** bump the aws group in /lambdas with 4 updates ([#4290](https://github.com/philips-labs/terraform-aws-github-runner/issues/4290)) ([eb9c123](https://github.com/philips-labs/terraform-aws-github-runner/commit/eb9c123e53c02b332f78c92aedb69b9267810410))
11+
* **lambda:** bump the aws-powertools group in /lambdas with 4 updates ([#4281](https://github.com/philips-labs/terraform-aws-github-runner/issues/4281)) ([e1f330b](https://github.com/philips-labs/terraform-aws-github-runner/commit/e1f330bb3c8321af875232e23ff1f4d053c684f5))
12+
* **lambda:** bump typescript from 5.6.3 to 5.7.2 in /lambdas ([#4293](https://github.com/philips-labs/terraform-aws-github-runner/issues/4293)) ([f6e4b92](https://github.com/philips-labs/terraform-aws-github-runner/commit/f6e4b926e6e73bddb7b0b2f78183d3542f26d023))
13+
14+
## [5.20.0](https://github.com/philips-labs/terraform-aws-github-runner/compare/v5.19.0...v5.20.0) (2024-11-19)
15+
16+
17+
### Features
18+
19+
* **runners:** add support to disable default labels (Linux) ([#3491](https://github.com/philips-labs/terraform-aws-github-runner/issues/3491)) ([772e1a5](https://github.com/philips-labs/terraform-aws-github-runner/commit/772e1a59906f171c6dc70183544443509f9c0580))
20+
* **runners:** add support to disable default labels (Windows) ([#4261](https://github.com/philips-labs/terraform-aws-github-runner/issues/4261)) ([ad9bcc4](https://github.com/philips-labs/terraform-aws-github-runner/commit/ad9bcc47f8105098811175379b9eed68d73f7d92))
21+
22+
23+
### Bug Fixes
24+
25+
* **lambda:** bump cross-spawn from 7.0.3 to 7.0.6 in /lambdas ([#4273](https://github.com/philips-labs/terraform-aws-github-runner/issues/4273)) ([dcec236](https://github.com/philips-labs/terraform-aws-github-runner/commit/dcec23624b5b0fddc352b9d61cccb18107cc888d))
26+
* **lambda:** bump the aws group in /lambdas with 7 updates ([#4266](https://github.com/philips-labs/terraform-aws-github-runner/issues/4266)) ([849549e](https://github.com/philips-labs/terraform-aws-github-runner/commit/849549e8b6497fa7fc8288739669c8daf1223df8))
27+
328
## [5.19.0](https://github.com/philips-labs/terraform-aws-github-runner/compare/v5.18.4...v5.19.0) (2024-11-12)
429

530

README.md

+6-7
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,12 @@
22

33
[![docs](https://img.shields.io/badge/docs-runners-blue.svg)](https://philips-labs.github.io/terraform-aws-github-runner) [![awesome-runners](https://img.shields.io/badge/listed%20on-awesome--runners-blue.svg)](https://github.com/jonico/awesome-runners) [![Terraform registry](https://img.shields.io/github/v/release/philips-labs/terraform-aws-github-runner?label=Terraform%20Registry)](https://registry.terraform.io/modules/philips-labs/github-runner/aws/) [![Terraform checks](https://github.com/philips-labs/terraform-aws-github-runner/actions/workflows/terraform.yml/badge.svg)](https://github.com/philips-labs/terraform-aws-github-runner/actions/workflows/terraform.yml) [![Lambdas](https://github.com/philips-labs/terraform-aws-github-runner/actions/workflows/lambda.yml/badge.svg)](https://github.com/philips-labs/terraform-aws-github-runner/actions/workflows/lambda.yml)
44

5+
> 📢 We're moving `terraform-aws-github-runner` to a new organization https://github.com/github-aws-runners in January to foster growth and community ownership! 🎉 Join us on our new [Discord server](https://discord.gg/EwUScJy8) for discussions and updates. Please see #4298 for more details.
6+
57
> 📄 Extensive documentation is available via our [GitHub Pages Docs site](https://philips-labs.github.io/terraform-aws-github-runner/).
68
79
> 📢 We maintain the project as a truly open-source project. We maintain the project on a best effort basis. We welcome contributions from the community. Feel free to help us answering issues, reviewing PRs, or maintaining and improving the project.
810
9-
> 📢 [`v5`](https://github.com/philips-labs/terraform-aws-github-runner/pull/3552) replaces Amazon Linux 2 with Amazon Linux 2023 as default OS. Check the PR for more details and other changes.
10-
11-
> 📢 For contributions to older versions you can make a PR to the related branch, e.g. `v4`. We have no release process in place for older versions.
12-
1311
This [Terraform](https://www.terraform.io/) module creates the required infrastructure needed to host [GitHub Actions](https://github.com/features/actions) self-hosted, auto-scaling runners on [AWS spot instances](https://aws.amazon.com/ec2/spot/). It provides the required logic to handle the life cycle for scaling up and down using a set of AWS Lambda functions. Runners are scaled down to zero to avoid costs when no workflows are active.
1412

1513
<picture>
@@ -90,8 +88,8 @@ Talk to the forestkeepers in the `runners-channel` on Slack.
9088

9189
| Name | Version |
9290
|------|---------|
93-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.31.0 |
94-
| <a name="provider_random"></a> [random](#provider\_random) | 3.6.0 |
91+
| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 5.27 |
92+
| <a name="provider_random"></a> [random](#provider\_random) | ~> 3.0 |
9593

9694
## Modules
9795

@@ -203,9 +201,10 @@ Talk to the forestkeepers in the `runners-channel` on Slack.
203201
| <a name="input_runner_binaries_syncer_lambda_zip"></a> [runner\_binaries\_syncer\_lambda\_zip](#input\_runner\_binaries\_syncer\_lambda\_zip) | File location of the binaries sync lambda zip file. | `string` | `null` | no |
204202
| <a name="input_runner_boot_time_in_minutes"></a> [runner\_boot\_time\_in\_minutes](#input\_runner\_boot\_time\_in\_minutes) | The minimum time for an EC2 runner to boot and register as a runner. | `number` | `5` | no |
205203
| <a name="input_runner_credit_specification"></a> [runner\_credit\_specification](#input\_runner\_credit\_specification) | The credit option for CPU usage of a T instance. Can be unset, "standard" or "unlimited". | `string` | `null` | no |
204+
| <a name="input_runner_disable_default_labels"></a> [runner\_disable\_default\_labels](#input\_runner\_disable\_default\_labels) | Disable default labels for the runners (os, architecture and `self-hosted`). If enabled, the runner will only have the extra labels provided in `runner_extra_labels`. In case you on own start script is used, this configuration parameter needs to be parsed via SSM. | `bool` | `false` | no |
206205
| <a name="input_runner_ec2_tags"></a> [runner\_ec2\_tags](#input\_runner\_ec2\_tags) | Map of tags that will be added to the launch template instance tag specifications. | `map(string)` | `{}` | no |
207206
| <a name="input_runner_egress_rules"></a> [runner\_egress\_rules](#input\_runner\_egress\_rules) | List of egress rules for the GitHub runner instances. | <pre>list(object({<br/> cidr_blocks = list(string)<br/> ipv6_cidr_blocks = list(string)<br/> prefix_list_ids = list(string)<br/> from_port = number<br/> protocol = string<br/> security_groups = list(string)<br/> self = bool<br/> to_port = number<br/> description = string<br/> }))</pre> | <pre>[<br/> {<br/> "cidr_blocks": [<br/> "0.0.0.0/0"<br/> ],<br/> "description": null,<br/> "from_port": 0,<br/> "ipv6_cidr_blocks": [<br/> "::/0"<br/> ],<br/> "prefix_list_ids": null,<br/> "protocol": "-1",<br/> "security_groups": null,<br/> "self": null,<br/> "to_port": 0<br/> }<br/>]</pre> | no |
208-
| <a name="input_runner_extra_labels"></a> [runner\_extra\_labels](#input\_runner\_extra\_labels) | Extra (custom) labels for the runners (GitHub). Labels checks on the webhook can be enforced by setting `enable_runner_workflow_job_labels_check_all`. GitHub read-only labels should not be provided. | `list(string)` | `[]` | no |
207+
| <a name="input_runner_extra_labels"></a> [runner\_extra\_labels](#input\_runner\_extra\_labels) | Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `enable_workflow_job_labels_check`. GitHub read-only labels should not be provided. | `list(string)` | `[]` | no |
209208
| <a name="input_runner_group_name"></a> [runner\_group\_name](#input\_runner\_group\_name) | Name of the runner group. | `string` | `"Default"` | no |
210209
| <a name="input_runner_iam_role_managed_policy_arns"></a> [runner\_iam\_role\_managed\_policy\_arns](#input\_runner\_iam\_role\_managed\_policy\_arns) | Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role | `list(string)` | `[]` | no |
211210
| <a name="input_runner_log_files"></a> [runner\_log\_files](#input\_runner\_log\_files) | (optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details. | <pre>list(object({<br/> log_group_name = string<br/> prefix_log_group = bool<br/> file_path = string<br/> log_stream_name = string<br/> }))</pre> | `null` | no |

docs/configuration.md

+9-6
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ To be able to support a number of use-cases, the module has quite a lot of confi
1313
- GitHub Cloud vs GitHub Enterprise Server (GHES). The runners support GitHub Cloud as well GitHub Enterprise Server. For GHES, we rely on our community for support and testing. We at Philips have no capability to test GHES ourselves.
1414
- Spot vs on-demand. The runners use either the EC2 spot or on-demand life cycle. Runners will be created via the AWS [CreateFleet API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateFleet.html). The module (scale up lambda) will request via the CreateFleet API to create instances in one of the subnets and of the specified instance types.
1515
- ARM64 support via Graviton/Graviton2 instance-types. When using the default example or top-level module, specifying `instance_types` that match a Graviton/Graviton 2 (ARM64) architecture (e.g. a1, t4g or any 6th-gen `g` or `gd` type), you must also specify `runner_architecture = "arm64"` and the sub-modules will be automatically configured to provision with ARM64 AMIs and leverage GitHub's ARM64 action runner. See below for more details.
16+
- Disable default labels for the runners (os, architecture and `self-hosted`) can achieve by setting `runner_disable_default_labels` = true. If enabled, the runner will only have the extra labels provided in `runner_extra_labels`. In case you on own start script is used, this configuration parameter needs to be parsed via SSM.
1617

1718
## AWS SSM Parameters
1819

@@ -24,14 +25,16 @@ The module uses the AWS System Manager Parameter Store to store configuration fo
2425
| `ssm_paths.root/var.prefix?/runners/config/<name>` | Configuration parameters used by runner start script |
2526
| `ssm_paths.root/var.prefix?/runners/tokens/<ec2-instance-id>` | Either JIT configuration (ephemeral runners) or registration tokens (non ephemeral runners) generated by the control plane (scale-up lambda), and consumed by the start script on the runner to activate / register the runner. |
2627
| `ssm_paths.root/var.prefix?/webhook/runner-matcher-config` | Runner matcher config used by webhook to decide the target for the webhook event. |
28+
2729
Available configuration parameters:
2830

29-
| Parameter name | Description |
30-
| ------------------- | ----------------------------------------------------------- |
31-
| `agent_mode` | Indicates if the agent is running in ephemeral mode or not. |
32-
| `enable_cloudwatch` | Configuration for the cloudwatch agent to stream logging. |
33-
| `run_as` | The user used for running the GitHub action runner agent. |
34-
| `token_path` | The path where tokens are stored. |
31+
| Parameter name | Description |
32+
|-------------------------------------|---------------------------------------------------------------------------------------------------|
33+
| `agent_mode` | Indicates if the agent is running in ephemeral mode or not. |
34+
| `disable_default_labels` | Indicates if the default labels for the runners (os, architecture and `self-hosted`) are disabled |
35+
| `enable_cloudwatch` | Configuration for the cloudwatch agent to stream logging. |
36+
| `run_as` | The user used for running the GitHub action runner agent. |
37+
| `token_path` | The path where tokens are stored. |
3538

3639
## Encryption
3740

lambdas/functions/ami-housekeeper/package.json

+8-8
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,17 @@
2020
"@types/aws-lambda": "^8.10.145",
2121
"@types/jest": "^29.5.14",
2222
"@types/node": "^22.9.0",
23-
"@typescript-eslint/eslint-plugin": "^8.9.0",
24-
"@typescript-eslint/parser": "^8.14.0",
25-
"@vercel/ncc": "^0.38.2",
23+
"@typescript-eslint/eslint-plugin": "^8.18.1",
24+
"@typescript-eslint/parser": "^8.16.0",
25+
"@vercel/ncc": "^0.38.3",
2626
"aws-sdk-client-mock": "^4.1.0",
2727
"aws-sdk-client-mock-jest": "^4.1.0",
2828
"eslint": "^8.57.0",
2929
"eslint-plugin-prettier": "5.2.1",
3030
"jest": "^29.7.0",
3131
"jest-mock": "^29.7.0",
3232
"jest-mock-extended": "^3.0.7",
33-
"nock": "^13.5.4",
33+
"nock": "^13.5.6",
3434
"prettier": "3.3.3",
3535
"ts-jest": "^29.2.5",
3636
"ts-node": "^10.9.2",
@@ -39,11 +39,11 @@
3939
"dependencies": {
4040
"@aws-github-runner/aws-powertools-util": "*",
4141
"@aws-github-runner/aws-ssm-util": "*",
42-
"@aws-sdk/client-ec2": "^3.687.0",
43-
"@aws-sdk/client-ssm": "^3.687.0",
44-
"@aws-sdk/types": "^3.686.0",
42+
"@aws-sdk/client-ec2": "^3.714.0",
43+
"@aws-sdk/client-ssm": "^3.714.0",
44+
"@aws-sdk/types": "^3.714.0",
4545
"cron-parser": "^4.9.0",
46-
"typescript": "^5.6.3"
46+
"typescript": "^5.7.2"
4747
},
4848
"nx": {
4949
"includedScripts": [

0 commit comments

Comments
 (0)