Skip to content
This repository was archived by the owner on Jan 16, 2025. It is now read-only.

Commit 0b398f2

Browse files
npalmkoendelaatgithub-actions[bot]
committed
fix!: Change runner labels to list[string] and apply TFLint (#3410)
Change variables `runner_labels` and `runner_extra_labels` to type: `list[string]` to better represent the content Additionally: - [x] Automatic determine runner labels for multi runner based on label matchers - [x] Enable Terraform linting on all modules, including naming conventions - [x] Enable check annotations for linting errors - [x] Fix existing linting errors - [ ] Apply naming conventions within objects (not supported by [TFLint](terraform-linters/tflint#1310)) This PR is based on #3143 creaed by @koendelaat but now via a dedicate branch in this repository. --------- Co-authored-by: Koen de Laat <[email protected]> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent a948da3 commit 0b398f2

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+213
-91
lines changed

Diff for: ‎.github/matchers.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"problemMatcher": [
3+
{
4+
"owner": "tflint-compact",
5+
"pattern": [
6+
{
7+
"regexp": "^(.+):(\\d+):(\\d+):\\s(Error|Warning|Notice)\\s-\\s(.+)\\s\\((.+)\\)$",
8+
"file": 1,
9+
"line": 2,
10+
"column": 3,
11+
"severity": 4,
12+
"message": 5,
13+
"code": 6
14+
}
15+
]
16+
}
17+
]
18+
}

Diff for: ‎.github/workflows/terraform.yml

+67-12
Original file line numberDiff line numberDiff line change
@@ -41,26 +41,38 @@ jobs:
4141
continue-on-error: true
4242
- name: validate terraform
4343
run: terraform validate
44+
- if: contains(matrix.terraform, '1.3.')
45+
name: Fix for actions/cache on alpine
46+
run: apk add --no-cache tar
47+
continue-on-error: true
48+
- if: contains(matrix.terraform, '1.3.')
49+
uses: actions/[email protected]
50+
name: Cache TFLint plugin dir
51+
with:
52+
path: ~/.tflint.d/plugins
53+
key: tflint-${{ hashFiles('.tflint.hcl') }}
4454
- if: contains(matrix.terraform, '1.3.')
4555
name: Setup TFLint
4656
uses: terraform-linters/setup-tflint@v4
4757
with:
4858
github_token: ${{ secrets.GITHUB_TOKEN }}
4959
- if: contains(matrix.terraform, '1.3.')
5060
name: Run TFLint
51-
run: tflint -f compact
61+
run: |
62+
tflint --init -c ${GITHUB_WORKSPACE}/.tflint.hcl
63+
tflint -c ${GITHUB_WORKSPACE}/.tflint.hcl --var-file ${GITHUB_WORKSPACE}/.github/lint/tflint.tfvars
5264
53-
verify_examples:
54-
name: Verify examples
65+
verify_modules:
66+
name: Verify modules
5567
strategy:
5668
fail-fast: false
5769
matrix:
58-
terraform: [1.3.0, "latest"]
59-
example:
60-
["default", "ubuntu", "prebuilt", "arm64", "ephemeral", "windows"]
70+
terraform: [1.3.2, "latest"]
71+
module:
72+
["download-lambda", "multi-runner", "runner-binaries-syncer", "runners", "setup-iam-permissions", "ssm", "webhook"]
6173
defaults:
6274
run:
63-
working-directory: examples/${{ matrix.example }}
75+
working-directory: modules/${{ matrix.module }}
6476
runs-on: ubuntu-latest
6577
container:
6678
image: hashicorp/terraform:${{ matrix.terraform }}
@@ -75,19 +87,41 @@ jobs:
7587
name: check terraform formatting
7688
run: terraform fmt -recursive -check=true -write=false
7789
continue-on-error: true
78-
- name: validate terraform011
90+
- name: validate terraform
7991
run: terraform validate
92+
- if: contains(matrix.terraform, '1.3.')
93+
name: Fix for actions/cache on alpine
94+
run: apk add --no-cache tar
95+
continue-on-error: true
96+
- if: contains(matrix.terraform, '1.3.')
97+
uses: actions/[email protected]
98+
name: Cache TFLint plugin dir
99+
with:
100+
path: ~/.tflint.d/plugins
101+
key: tflint-${{ hashFiles('.tflint.hcl') }}
102+
- if: contains(matrix.terraform, '1.3.')
103+
name: Setup TFLint
104+
uses: terraform-linters/setup-tflint@v3
105+
with:
106+
github_token: ${{ secrets.GITHUB_TOKEN }}
107+
- if: contains(matrix.terraform, '1.3.')
108+
name: Run TFLint
109+
working-directory: ${{ github.workspace }}
110+
run: |
111+
tflint --init -c ${GITHUB_WORKSPACE}/.tflint.hcl --chdir modules/${{ matrix.module }}
112+
tflint -f compact -c ${GITHUB_WORKSPACE}/.tflint.hcl --var-file ${GITHUB_WORKSPACE}/.github/lint/tflint.tfvars --chdir modules/${{ matrix.module }}
80113
81-
82-
verify_multi_runner_example:
83-
name: Verify Multi-Runner examples
114+
verify_examples:
115+
name: Verify examples
84116
strategy:
85117
fail-fast: false
86118
matrix:
87119
terraform: [1.3.2, "latest"]
120+
example:
121+
["default", "ubuntu", "prebuilt", "arm64", "ephemeral", "windows", "multi-runner"]
88122
defaults:
89123
run:
90-
working-directory: examples/multi-runner
124+
working-directory: examples/${{ matrix.example }}
91125
runs-on: ubuntu-latest
92126
container:
93127
image: hashicorp/terraform:${{ matrix.terraform }}
@@ -104,4 +138,25 @@ jobs:
104138
continue-on-error: true
105139
- name: validate terraform
106140
run: terraform validate
141+
- if: contains(matrix.terraform, '1.3.')
142+
name: Fix for actions/cache on alpine
143+
run: apk add --no-cache tar
144+
continue-on-error: true
145+
- if: contains(matrix.terraform, '1.3.')
146+
uses: actions/[email protected]
147+
name: Cache TFLint plugin dir
148+
with:
149+
path: ~/.tflint.d/plugins
150+
key: tflint-${{ hashFiles('.tflint.hcl') }}
151+
- if: contains(matrix.terraform, '1.3.')
152+
name: Setup TFLint
153+
uses: terraform-linters/setup-tflint@v3
154+
with:
155+
github_token: ${{ secrets.GITHUB_TOKEN }}
156+
- if: contains(matrix.terraform, '1.3.')
157+
name: Run TFLint
158+
working-directory: ${{ github.workspace }}
159+
run: |
160+
tflint --init -c ${GITHUB_WORKSPACE}/.tflint.hcl --chdir modules/${{ matrix.module }}
161+
tflint -f compact -c ${GITHUB_WORKSPACE}/.tflint.hcl --var-file ${GITHUB_WORKSPACE}/.github/lint/tflint.tfvars --chdir examples/${{ matrix.example }}
107162

Diff for: ‎.gitignore

-1
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,3 @@ secrets.auto.tfvars
2222
**/coverage/*
2323

2424
node_modules/
25-

Diff for: ‎.pre-commit-config.yaml

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,12 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.77.1
3+
rev: v1.83.5
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_tflint
7+
args:
8+
- --args=--config=__GIT_WORKING_DIR__/.tflint.hcl --var-file __GIT_WORKING_DIR__/.github/lint/tflint.tfvars
79
- repo: https://github.com/pre-commit/pre-commit-hooks
8-
rev: v4.4.0
10+
rev: v4.5.0
911
hooks:
1012
- id: check-merge-conflict

Diff for: ‎.tflint.hcl

+18-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,23 @@ config {
22
format = "compact"
33
module = true
44

5-
varfile = [".github/lint/tflint.tfvars"]
65

76
}
7+
8+
plugin "aws" {
9+
enabled = true
10+
version = "0.23.0"
11+
source = "github.com/terraform-linters/tflint-ruleset-aws"
12+
}
13+
14+
rule "terraform_comment_syntax" {
15+
enabled = true
16+
}
17+
18+
rule "terraform_naming_convention" {
19+
enabled = true
20+
}
21+
22+
rule "terraform_documented_variables" {
23+
enabled = true
24+
}

Diff for: ‎README.md

+6-6
Original file line numberDiff line numberDiff line change
@@ -502,7 +502,7 @@ We welcome any improvement to the standard module to make the default as secure
502502
| <a name="input_delay_webhook_event"></a> [delay\_webhook\_event](#input\_delay\_webhook\_event) | The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event. | `number` | `30` | no |
503503
| <a name="input_disable_runner_autoupdate"></a> [disable\_runner\_autoupdate](#input\_disable\_runner\_autoupdate) | Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/) | `bool` | `false` | no |
504504
| <a name="input_enable_cloudwatch_agent"></a> [enable\_cloudwatch\_agent](#input\_enable\_cloudwatch\_agent) | Enables the cloudwatch agent on the ec2 runner instances. The runner uses a default config that can be overridden via `cloudwatch_config`. | `bool` | `true` | no |
505-
| <a name="input_enable_enable_fifo_build_queue"></a> [enable\_enable\_fifo\_build\_queue](#input\_enable\_enable\_fifo\_build\_queue) | DEPCRECATED: Replaced by `enable_fifo_build_queue` / `fifo_build_queue`. | `string` | `null` | no |
505+
| <a name="input_enable_enable_fifo_build_queue"></a> [enable\_enable\_fifo\_build\_queue](#input\_enable\_enable\_fifo\_build\_queue) | DEPRECATED: Replaced by `enable_fifo_build_queue` / `fifo_build_queue`. | `string` | `null` | no |
506506
| <a name="input_enable_ephemeral_runners"></a> [enable\_ephemeral\_runners](#input\_enable\_ephemeral\_runners) | Enable ephemeral runners, runners will only be used once. | `bool` | `false` | no |
507507
| <a name="input_enable_event_rule_binaries_syncer"></a> [enable\_event\_rule\_binaries\_syncer](#input\_enable\_event\_rule\_binaries\_syncer) | Option to disable EventBridge Lambda trigger for the binary syncer, useful to stop automatic updates of binary distribution. | `bool` | `true` | no |
508508
| <a name="input_enable_fifo_build_queue"></a> [enable\_fifo\_build\_queue](#input\_enable\_fifo\_build\_queue) | Enable a FIFO queue to keep the order of events received by the webhook. Recommended for repo level runners. | `bool` | `false` | no |
@@ -517,9 +517,9 @@ We welcome any improvement to the standard module to make the default as secure
517517
| <a name="input_enable_user_data_debug_logging_runner"></a> [enable\_user\_data\_debug\_logging\_runner](#input\_enable\_user\_data\_debug\_logging\_runner) | Option to enable debug logging for user-data, this logs all secrets as well. | `bool` | `false` | no |
518518
| <a name="input_enable_userdata"></a> [enable\_userdata](#input\_enable\_userdata) | Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI. | `bool` | `true` | no |
519519
| <a name="input_enable_workflow_job_events_queue"></a> [enable\_workflow\_job\_events\_queue](#input\_enable\_workflow\_job\_events\_queue) | Enabling this experimental feature will create a secondory sqs queue to which a copy of the workflow\_job event will be delivered. | `bool` | `false` | no |
520-
| <a name="input_enabled_userdata"></a> [enabled\_userdata](#input\_enabled\_userdata) | DEPCRECATED: Replaced by `enable_userdata`. | `string` | `null` | no |
520+
| <a name="input_enabled_userdata"></a> [enabled\_userdata](#input\_enabled\_userdata) | DEPRECATED: Replaced by `enable_userdata`. | `string` | `null` | no |
521521
| <a name="input_environment"></a> [environment](#input\_environment) | DEPRECATED, no longer used. See `prefix` | `string` | `null` | no |
522-
| <a name="input_fifo_build_queue"></a> [fifo\_build\_queue](#input\_fifo\_build\_queue) | DEPCRECATED: Replaced by `enable_fifo_build_queue`. | `string` | `null` | no |
522+
| <a name="input_fifo_build_queue"></a> [fifo\_build\_queue](#input\_fifo\_build\_queue) | DEPRECATED: Replaced by `enable_fifo_build_queue`. | `string` | `null` | no |
523523
| <a name="input_ghes_ssl_verify"></a> [ghes\_ssl\_verify](#input\_ghes\_ssl\_verify) | GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). | `bool` | `true` | no |
524524
| <a name="input_ghes_url"></a> [ghes\_url](#input\_ghes\_url) | GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB | `string` | `null` | no |
525525
| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`). | <pre>object({<br> key_base64 = string<br> id = string<br> webhook_secret = string<br> })</pre> | n/a | yes |
@@ -568,8 +568,8 @@ We welcome any improvement to the standard module to make the default as secure
568568
| <a name="input_runner_credit_specification"></a> [runner\_credit\_specification](#input\_runner\_credit\_specification) | The credit option for CPU usage of a T instance. Can be unset, "standard" or "unlimited". | `string` | `null` | no |
569569
| <a name="input_runner_ec2_tags"></a> [runner\_ec2\_tags](#input\_runner\_ec2\_tags) | Map of tags that will be added to the launch template instance tag specifications. | `map(string)` | `{}` | no |
570570
| <a name="input_runner_egress_rules"></a> [runner\_egress\_rules](#input\_runner\_egress\_rules) | List of egress rules for the GitHub runner instances. | <pre>list(object({<br> cidr_blocks = list(string)<br> ipv6_cidr_blocks = list(string)<br> prefix_list_ids = list(string)<br> from_port = number<br> protocol = string<br> security_groups = list(string)<br> self = bool<br> to_port = number<br> description = string<br> }))</pre> | <pre>[<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "description": null,<br> "from_port": 0,<br> "ipv6_cidr_blocks": [<br> "::/0"<br> ],<br> "prefix_list_ids": null,<br> "protocol": "-1",<br> "security_groups": null,<br> "self": null,<br> "to_port": 0<br> }<br>]</pre> | no |
571-
| <a name="input_runner_enable_workflow_job_labels_check_all"></a> [runner\_enable\_workflow\_job\_labels\_check\_all](#input\_runner\_enable\_workflow\_job\_labels\_check\_all) | DEPCRECATED: Replaced by `enable_runner_workflow_job_labels_check_all`. | `string` | `null` | no |
572-
| <a name="input_runner_extra_labels"></a> [runner\_extra\_labels](#input\_runner\_extra\_labels) | Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `enable_workflow_job_labels_check`. GitHub read-only labels should not be provided. | `string` | `""` | no |
571+
| <a name="input_runner_enable_workflow_job_labels_check_all"></a> [runner\_enable\_workflow\_job\_labels\_check\_all](#input\_runner\_enable\_workflow\_job\_labels\_check\_all) | DEPRECATED: Replaced by `enable_runner_workflow_job_labels_check_all`. | `string` | `null` | no |
572+
| <a name="input_runner_extra_labels"></a> [runner\_extra\_labels](#input\_runner\_extra\_labels) | Extra (custom) labels for the runners (GitHub). Labels checks on the webhook can be enforced by setting `enable_workflow_job_labels_check`. GitHub read-only labels should not be provided. | `list(string)` | `[]` | no |
573573
| <a name="input_runner_group_name"></a> [runner\_group\_name](#input\_runner\_group\_name) | Name of the runner group. | `string` | `"Default"` | no |
574574
| <a name="input_runner_iam_role_managed_policy_arns"></a> [runner\_iam\_role\_managed\_policy\_arns](#input\_runner\_iam\_role\_managed\_policy\_arns) | Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role | `list(string)` | `[]` | no |
575575
| <a name="input_runner_log_files"></a> [runner\_log\_files](#input\_runner\_log\_files) | (optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details. | <pre>list(object({<br> log_group_name = string<br> prefix_log_group = bool<br> file_path = string<br> log_stream_name = string<br> }))</pre> | `null` | no |
@@ -594,7 +594,7 @@ We welcome any improvement to the standard module to make the default as secure
594594
| <a name="input_userdata_pre_install"></a> [userdata\_pre\_install](#input\_userdata\_pre\_install) | Script to be ran before the GitHub Actions runner is installed on the EC2 instances | `string` | `""` | no |
595595
| <a name="input_userdata_template"></a> [userdata\_template](#input\_userdata\_template) | Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored. | `string` | `null` | no |
596596
| <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | The VPC for security groups of the action runners. | `string` | n/a | yes |
597-
| <a name="input_webhook_lambda_apigateway_access_log_settings"></a> [webhook\_lambda\_apigateway\_access\_log\_settings](#input\_webhook\_lambda\_apigateway\_access\_log\_settings) | n/a | <pre>object({<br> destination_arn = string<br> format = string<br> })</pre> | `null` | no |
597+
| <a name="input_webhook_lambda_apigateway_access_log_settings"></a> [webhook\_lambda\_apigateway\_access\_log\_settings](#input\_webhook\_lambda\_apigateway\_access\_log\_settings) | Access log settings for webhook API gateway. | <pre>object({<br> destination_arn = string<br> format = string<br> })</pre> | `null` | no |
598598
| <a name="input_webhook_lambda_s3_key"></a> [webhook\_lambda\_s3\_key](#input\_webhook\_lambda\_s3\_key) | S3 key for webhook lambda function. Required if using S3 bucket to specify lambdas. | `string` | `null` | no |
599599
| <a name="input_webhook_lambda_s3_object_version"></a> [webhook\_lambda\_s3\_object\_version](#input\_webhook\_lambda\_s3\_object\_version) | S3 object version for webhook lambda function. Useful if S3 versioning is enabled on source bucket. | `string` | `null` | no |
600600
| <a name="input_webhook_lambda_timeout"></a> [webhook\_lambda\_timeout](#input\_webhook\_lambda\_timeout) | Time out of the webhook lambda in seconds. | `number` | `10` | no |

Diff for: ‎examples/arm64/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ module "runners" {
4545

4646
enable_organization_runners = false
4747
# Runners will automatically get the "arm64" label
48-
runner_extra_labels = "default,example"
48+
runner_extra_labels = ["default", "example"]
4949

5050
# enable access to the runners via SSM
5151
enable_ssm_on_runners = true
@@ -87,7 +87,7 @@ module "runners" {
8787
scale_down_schedule_expression = "cron(* * * * ? *)"
8888
}
8989

90-
module "webhook-github-app" {
90+
module "webhook_github_app" {
9191
source = "../../modules/webhook-github-app"
9292

9393
github_app = {

Diff for: ‎examples/default/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ terraform output webhook_secret
6262

6363
| Name | Description | Type | Default | Required |
6464
|------|-------------|------|---------|:--------:|
65-
| <a name="input_environment"></a> [environment](#input\_environment) | n/a | `string` | `null` | no |
65+
| <a name="input_environment"></a> [environment](#input\_environment) | Environment name, used as prefix | `string` | `null` | no |
6666
| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub for API usages. | <pre>object({<br> id = string<br> key_base64 = string<br> })</pre> | n/a | yes |
6767

6868
## Outputs

Diff for: ‎examples/default/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ module "runners" {
4848
# runners_lambda_zip = "../lambdas-download/runners.zip"
4949

5050
enable_organization_runners = true
51-
runner_extra_labels = "default,example"
51+
runner_extra_labels = ["default", "example"]
5252

5353
# enable access to the runners via SSM
5454
enable_ssm_on_runners = true
@@ -98,7 +98,7 @@ module "runners" {
9898
# log_level = "debug"
9999
}
100100

101-
module "webhook-github-app" {
101+
module "webhook_github_app" {
102102
source = "../../modules/webhook-github-app"
103103
depends_on = [module.runners]
104104

Diff for: ‎examples/default/variables.tf

+2
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ variable "github_app" {
88
}
99

1010
variable "environment" {
11+
description = "Environment name, used as prefix"
12+
1113
type = string
1214
default = null
1315
}

Diff for: ‎examples/ephemeral/main.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ module "runners" {
3838
runners_lambda_zip = "../../lambda_output/runners.zip"
3939

4040
enable_organization_runners = true
41-
runner_extra_labels = "default,example"
41+
runner_extra_labels = ["default", "example"]
4242

4343
# enable access to the runners via SSM
4444
enable_ssm_on_runners = true
@@ -86,7 +86,7 @@ module "runners" {
8686
# }
8787
}
8888

89-
module "webhook-github-app" {
89+
module "webhook_github_app" {
9090
source = "../../modules/webhook-github-app"
9191
depends_on = [module.runners]
9292

Diff for: ‎examples/multi-runner/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ terraform output webhook_secret
6666
| Name | Source | Version |
6767
|------|--------|---------|
6868
| <a name="module_base"></a> [base](#module\_base) | ../base | n/a |
69-
| <a name="module_multi-runner"></a> [multi-runner](#module\_multi-runner) | ../../modules/multi-runner | n/a |
69+
| <a name="module_multi_runner"></a> [multi\_runner](#module\_multi\_runner) | ../../modules/multi-runner | n/a |
7070
| <a name="module_webhook-github-app"></a> [webhook-github-app](#module\_webhook-github-app) | ../../modules/webhook-github-app | n/a |
7171

7272
## Resources
@@ -79,7 +79,7 @@ terraform output webhook_secret
7979

8080
| Name | Description | Type | Default | Required |
8181
|------|-------------|------|---------|:--------:|
82-
| <a name="input_environment"></a> [environment](#input\_environment) | n/a | `string` | `null` | no |
82+
| <a name="input_environment"></a> [environment](#input\_environment) | Environment name, used as prefix | `string` | `null` | no |
8383
| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub for API usages. | <pre>object({<br> id = string<br> key_base64 = string<br> })</pre> | n/a | yes |
8484

8585
## Outputs

0 commit comments

Comments
 (0)