Skip to content
This repository was archived by the owner on Jan 16, 2025. It is now read-only.

Commit 4cb5cf1

Browse files
npalmnpalm
authored
feat: remove unused app client since SSH key is used to secure app authorization (#1223)
1 parent 859fa38 commit 4cb5cf1

File tree

16 files changed

+71
-124
lines changed

16 files changed

+71
-124
lines changed

Diff for: ‎README.md

+2-5
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,7 @@ Go to GitHub and [create a new app](https://docs.github.com/en/developers/apps/c
129129
- `Self-hosted runners`: Read & write (to register runner)
130130
8. Save the new app.
131131
9. On the General page, make a note of the "App ID" and "Client ID" parameters.
132-
10. Create a new client secret and also write it down.
133-
11. Generate a new private key and save the `app.private-key.pem` file.
132+
10. Generate a new private key and save the `app.private-key.pem` file.
134133

135134
### Setup terraform module
136135

@@ -174,8 +173,6 @@ module "github-runner" {
174173
github_app = {
175174
key_base64 = "base64string"
176175
id = "1"
177-
client_id = "c-123"
178-
client_secret = "client_secret"
179176
webhook_secret = "webhook_secret"
180177
}
181178
@@ -377,7 +374,7 @@ No requirements.
377374
| environment | A name that identifies the environment, used as prefix and for tagging. | `string` | n/a | yes |
378375
| ghes\_ssl\_verify | GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). | `bool` | `true` | no |
379376
| ghes\_url | GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB | `string` | `null` | no |
380-
| github\_app | GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`). | <pre>object({<br> key_base64 = string<br> id = string<br> client_id = string<br> client_secret = string<br> webhook_secret = string<br> })</pre> | n/a | yes |
377+
| github\_app | GitHub app parameters, see your github app. Ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`). | <pre>object({<br> key_base64 = string<br> id = string<br> webhook_secret = string<br> })</pre> | n/a | yes |
381378
| idle\_config | List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle. | <pre>list(object({<br> cron = string<br> timeZone = string<br> idleCount = number<br> }))</pre> | `[]` | no |
382379
| instance\_profile\_path | The path that will be added to the instance\_profile, if not set the environment name will be used. | `string` | `null` | no |
383380
| instance\_type | [DEPRECATED] See instance\_types. | `string` | `"m5.large"` | no |

Diff for: ‎examples/default/main.tf

+8-5
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@ module "runners" {
2727
github_app = {
2828
key_base64 = var.github_app_key_base64
2929
id = var.github_app_id
30-
client_id = var.github_app_client_id
31-
client_secret = var.github_app_client_secret
3230
webhook_secret = random_password.random.result
3331
}
3432

@@ -48,9 +46,14 @@ module "runners" {
4846
# idleCount = 1
4947
# }]
5048

51-
# disable KMS and encryption
52-
# encrypt_secrets = false
53-
5449
# Let the module manage the service linked role
5550
# create_service_linked_role_spot = true
51+
52+
instance_types = ["m5.large", "c5.large"]
53+
54+
# override delay of events in seconds
55+
delay_webhook_event = 5
56+
57+
# override scaling down
58+
scale_down_schedule_expression = "cron(* * * * ? *)"
5659
}

Diff for: ‎examples/ubuntu/main.tf

-2
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,6 @@ module "runners" {
2222
github_app = {
2323
key_base64 = var.github_app_key_base64
2424
id = var.github_app_id
25-
client_id = var.github_app_client_id
26-
client_secret = var.github_app_client_secret
2725
webhook_secret = random_password.random.result
2826
}
2927

Diff for: ‎main.tf

+2-4
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,8 @@ locals {
99
ami_filter = length(var.ami_filter) > 0 ? var.ami_filter : local.runner_architecture == "arm64" ? { name = ["amzn2-ami-hvm-2*-arm64-gp2"] } : { name = ["amzn2-ami-hvm-2.*-x86_64-ebs"] }
1010

1111
github_app_parameters = {
12-
client_id = module.ssm.parameters.github_app_client_id
13-
client_secret = module.ssm.parameters.github_app_client_secret
14-
id = module.ssm.parameters.github_app_id
15-
key_base64 = module.ssm.parameters.github_app_key_base64
12+
id = module.ssm.parameters.github_app_id
13+
key_base64 = module.ssm.parameters.github_app_key_base64
1614
}
1715
}
1816

Diff for: ‎modules/runners/README.md

+27-2
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,31 @@ No requirements.
5858
|------|---------|
5959
| aws | n/a |
6060

61+
## Modules
62+
63+
No Modules.
64+
65+
## Resources
66+
67+
| Name |
68+
|------|
69+
| [aws_ami](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) |
70+
| [aws_caller_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) |
71+
| [aws_cloudwatch_event_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) |
72+
| [aws_cloudwatch_event_target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) |
73+
| [aws_cloudwatch_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) |
74+
| [aws_iam_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) |
75+
| [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) |
76+
| [aws_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) |
77+
| [aws_iam_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) |
78+
| [aws_iam_role_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) |
79+
| [aws_lambda_event_source_mapping](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) |
80+
| [aws_lambda_function](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) |
81+
| [aws_lambda_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) |
82+
| [aws_launch_template](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) |
83+
| [aws_security_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) |
84+
| [aws_ssm_parameter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) |
85+
6186
## Inputs
6287

6388
| Name | Description | Type | Default | Required |
@@ -73,8 +98,9 @@ No requirements.
7398
| enable\_organization\_runners | n/a | `bool` | n/a | yes |
7499
| enable\_ssm\_on\_runners | Enable to allow access to the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances. | `bool` | n/a | yes |
75100
| environment | A name that identifies the environment, used as prefix and for tagging. | `string` | n/a | yes |
101+
| ghes\_ssl\_verify | GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). | `bool` | `true` | no |
76102
| ghes\_url | GitHub Enterprise Server URL. DO NOT SET IF USING PUBLIC GITHUB | `string` | `null` | no |
77-
| github\_app\_parameters | Parameter Store for GitHub App Parameters. | <pre>object({<br> key_base64 = map(string)<br> id = map(string)<br> client_id = map(string)<br> client_secret = map(string)<br> })</pre> | n/a | yes |
103+
| github\_app\_parameters | Parameter Store for GitHub App Parameters. | <pre>object({<br> key_base64 = map(string)<br> id = map(string)<br> })</pre> | n/a | yes |
78104
| idle\_config | List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle. | <pre>list(object({<br> cron = string<br> timeZone = string<br> idleCount = number<br> }))</pre> | `[]` | no |
79105
| instance\_profile\_path | The path that will be added to the instance\_profile, if not set the environment name will be used. | `string` | `null` | no |
80106
| instance\_type | [DEPRECATED] See instance\_types. | `string` | `"m5.large"` | no |
@@ -126,7 +152,6 @@ No requirements.
126152
| role\_runner | n/a |
127153
| role\_scale\_down | n/a |
128154
| role\_scale\_up | n/a |
129-
130155
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
131156

132157
## Philips Forest

Diff for: ‎modules/runners/lambdas/runners/src/scale-runners/gh-auth.test.ts

+3-33
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,8 @@ jest.mock('@octokit/auth-app');
1616
const cleanEnv = process.env;
1717
const ENVIRONMENT = 'dev';
1818
const GITHUB_APP_ID = '1';
19-
const GITHUB_APP_CLIENT_ID = '1';
20-
const GITHUB_APP_CLIENT_SECRET = 'client_secret';
2119
const PARAMETER_GITHUB_APP_ID_NAME = `/actions-runner/${ENVIRONMENT}/github_app_id`;
2220
const PARAMETER_GITHUB_APP_KEY_BASE64_NAME = `/actions-runner/${ENVIRONMENT}/github_app_key_base64`;
23-
const PARAMETER_GITHUB_APP_CLIENT_ID_NAME = `/actions-runner/${ENVIRONMENT}/github_app_client_id`;
24-
const PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME = `/actions-runner/${ENVIRONMENT}/github_app_client_secret`;
2521

2622
const mockedGet = mocked(getParameterValue);
2723

@@ -31,8 +27,6 @@ beforeEach(() => {
3127
process.env = { ...cleanEnv };
3228
process.env.PARAMETER_GITHUB_APP_ID_NAME = PARAMETER_GITHUB_APP_ID_NAME;
3329
process.env.PARAMETER_GITHUB_APP_KEY_BASE64_NAME = PARAMETER_GITHUB_APP_KEY_BASE64_NAME;
34-
process.env.PARAMETER_GITHUB_APP_CLIENT_ID_NAME = PARAMETER_GITHUB_APP_CLIENT_ID_NAME;
35-
process.env.PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME = PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME;
3630
nock.disableNetConnect();
3731
});
3832

@@ -83,14 +77,8 @@ describe('Test createGithubAppAuth', () => {
8377
appId: parseInt(GITHUB_APP_ID),
8478
privateKey: decryptedValue,
8579
installationId,
86-
clientId: GITHUB_APP_CLIENT_ID,
87-
clientSecret: GITHUB_APP_CLIENT_SECRET,
8880
};
89-
mockedGet
90-
.mockResolvedValueOnce(GITHUB_APP_ID)
91-
.mockResolvedValueOnce(b64)
92-
.mockResolvedValueOnce(GITHUB_APP_CLIENT_ID)
93-
.mockResolvedValueOnce(GITHUB_APP_CLIENT_SECRET);
81+
mockedGet.mockResolvedValueOnce(GITHUB_APP_ID).mockResolvedValueOnce(b64);
9482

9583
const mockedAuth = jest.fn();
9684
mockedAuth.mockResolvedValue({ token });
@@ -104,8 +92,6 @@ describe('Test createGithubAppAuth', () => {
10492
// Assert
10593
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_ID_NAME);
10694
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_KEY_BASE64_NAME);
107-
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_CLIENT_ID_NAME);
108-
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME);
10995

11096
expect(mockedCreatAppAuth).toBeCalledTimes(1);
11197
expect(mockedCreatAppAuth).toBeCalledWith(authOptions);
@@ -126,16 +112,10 @@ describe('Test createGithubAppAuth', () => {
126112
appId: parseInt(GITHUB_APP_ID),
127113
privateKey: decryptedValue,
128114
installationId,
129-
clientId: GITHUB_APP_CLIENT_ID,
130-
clientSecret: GITHUB_APP_CLIENT_SECRET,
131115
request: mockedRequestInterface.defaults({ baseUrl: githubServerUrl }),
132116
};
133117

134-
mockedGet
135-
.mockResolvedValueOnce(GITHUB_APP_ID)
136-
.mockResolvedValueOnce(b64)
137-
.mockResolvedValueOnce(GITHUB_APP_CLIENT_ID)
138-
.mockResolvedValueOnce(GITHUB_APP_CLIENT_SECRET);
118+
mockedGet.mockResolvedValueOnce(GITHUB_APP_ID).mockResolvedValueOnce(b64);
139119
const mockedAuth = jest.fn();
140120
mockedAuth.mockResolvedValue({ token });
141121
// eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -149,8 +129,6 @@ describe('Test createGithubAppAuth', () => {
149129
// Assert
150130
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_ID_NAME);
151131
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_KEY_BASE64_NAME);
152-
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_CLIENT_ID_NAME);
153-
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME);
154132

155133
expect(mockedCreatAppAuth).toBeCalledTimes(1);
156134
expect(mockedCreatAppAuth).toBeCalledWith(authOptions);
@@ -172,16 +150,10 @@ describe('Test createGithubAppAuth', () => {
172150
const authOptions = {
173151
appId: parseInt(GITHUB_APP_ID),
174152
privateKey: decryptedValue,
175-
clientId: GITHUB_APP_CLIENT_ID,
176-
clientSecret: GITHUB_APP_CLIENT_SECRET,
177153
request: mockedRequestInterface.defaults({ baseUrl: githubServerUrl }),
178154
};
179155

180-
mockedGet
181-
.mockResolvedValueOnce(GITHUB_APP_ID)
182-
.mockResolvedValueOnce(b64)
183-
.mockResolvedValueOnce(GITHUB_APP_CLIENT_ID)
184-
.mockResolvedValueOnce(GITHUB_APP_CLIENT_SECRET);
156+
mockedGet.mockResolvedValueOnce(GITHUB_APP_ID).mockResolvedValueOnce(b64);
185157
const mockedAuth = jest.fn();
186158
mockedAuth.mockResolvedValue({ token });
187159
mockedCreatAppAuth.mockImplementation(() => {
@@ -194,8 +166,6 @@ describe('Test createGithubAppAuth', () => {
194166
// Assert
195167
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_ID_NAME);
196168
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_KEY_BASE64_NAME);
197-
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_CLIENT_ID_NAME);
198-
expect(getParameterValue).toBeCalledWith(PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME);
199169

200170
expect(mockedCreatAppAuth).toBeCalledTimes(1);
201171
expect(mockedCreatAppAuth).toBeCalledWith(authOptions);

Diff for: ‎modules/runners/lambdas/runners/src/scale-runners/gh-auth.ts

-2
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,6 @@ async function createAuth(installationId: number | undefined, ghesApiUrl: string
4949
await getParameterValue(process.env.PARAMETER_GITHUB_APP_KEY_BASE64_NAME),
5050
'base64',
5151
).toString(),
52-
clientId: await getParameterValue(process.env.PARAMETER_GITHUB_APP_CLIENT_ID_NAME),
53-
clientSecret: await getParameterValue(process.env.PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME),
5452
};
5553
if (installationId) authOptions = { ...authOptions, installationId };
5654

Diff for: ‎modules/runners/policies/lambda-scale-down.json

-2
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@
3232
],
3333
"Resource": [
3434
"${github_app_key_base64_arn}",
35-
"${github_app_client_secret_arn}",
36-
"${github_app_client_id_arn}",
3735
"${github_app_id_arn}"
3836
]
3937
%{ if kms_key_arn != "" ~}

Diff for: ‎modules/runners/policies/lambda-scale-up.json

-2
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,6 @@
4545
],
4646
"Resource": [
4747
"${github_app_key_base64_arn}",
48-
"${github_app_client_secret_arn}",
49-
"${github_app_client_id_arn}",
5048
"${github_app_id_arn}"
5149
]
5250
},

Diff for: ‎modules/runners/scale-down.tf

+11-15
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,14 @@ resource "aws_lambda_function" "scale_down" {
1313

1414
environment {
1515
variables = {
16-
ENVIRONMENT = var.environment
17-
MINIMUM_RUNNING_TIME_IN_MINUTES = var.minimum_running_time_in_minutes
18-
RUNNER_BOOT_TIME_IN_MINUTES = var.runner_boot_time_in_minutes
19-
SCALE_DOWN_CONFIG = jsonencode(var.idle_config)
20-
GHES_URL = var.ghes_url
21-
NODE_TLS_REJECT_UNAUTHORIZED = var.ghes_url != null && ! var.ghes_ssl_verify ? 0 : 1
22-
PARAMETER_GITHUB_APP_CLIENT_ID_NAME = var.github_app_parameters.client_id.name
23-
PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME = var.github_app_parameters.client_secret.name
24-
PARAMETER_GITHUB_APP_ID_NAME = var.github_app_parameters.id.name
25-
PARAMETER_GITHUB_APP_KEY_BASE64_NAME = var.github_app_parameters.key_base64.name
16+
ENVIRONMENT = var.environment
17+
MINIMUM_RUNNING_TIME_IN_MINUTES = var.minimum_running_time_in_minutes
18+
RUNNER_BOOT_TIME_IN_MINUTES = var.runner_boot_time_in_minutes
19+
SCALE_DOWN_CONFIG = jsonencode(var.idle_config)
20+
GHES_URL = var.ghes_url
21+
NODE_TLS_REJECT_UNAUTHORIZED = var.ghes_url != null && ! var.ghes_ssl_verify ? 0 : 1
22+
PARAMETER_GITHUB_APP_ID_NAME = var.github_app_parameters.id.name
23+
PARAMETER_GITHUB_APP_KEY_BASE64_NAME = var.github_app_parameters.key_base64.name
2624
}
2725
}
2826

@@ -72,11 +70,9 @@ resource "aws_iam_role_policy" "scale_down" {
7270
name = "${var.environment}-lambda-scale-down-policy"
7371
role = aws_iam_role.scale_down.name
7472
policy = templatefile("${path.module}/policies/lambda-scale-down.json", {
75-
github_app_client_id_arn = var.github_app_parameters.client_id.arn
76-
github_app_client_secret_arn = var.github_app_parameters.client_secret.arn
77-
github_app_id_arn = var.github_app_parameters.id.arn
78-
github_app_key_base64_arn = var.github_app_parameters.key_base64.arn
79-
kms_key_arn = local.kms_key_arn
73+
github_app_id_arn = var.github_app_parameters.id.arn
74+
github_app_key_base64_arn = var.github_app_parameters.key_base64.arn
75+
kms_key_arn = local.kms_key_arn
8076
})
8177
}
8278

Diff for: ‎modules/runners/scale-up.tf

+16-20
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,17 @@ resource "aws_lambda_function" "scale_up" {
1414

1515
environment {
1616
variables = {
17-
ENABLE_ORGANIZATION_RUNNERS = var.enable_organization_runners
18-
ENVIRONMENT = var.environment
19-
GHES_URL = var.ghes_url
20-
NODE_TLS_REJECT_UNAUTHORIZED = var.ghes_url != null && ! var.ghes_ssl_verify ? 0 : 1
21-
RUNNER_EXTRA_LABELS = var.runner_extra_labels
22-
RUNNER_GROUP_NAME = var.runner_group_name
23-
RUNNERS_MAXIMUM_COUNT = var.runners_maximum_count
24-
LAUNCH_TEMPLATE_NAME = join(",", [for template in aws_launch_template.runner : template.name])
25-
SUBNET_IDS = join(",", var.subnet_ids)
26-
PARAMETER_GITHUB_APP_CLIENT_ID_NAME = var.github_app_parameters.client_id.name
27-
PARAMETER_GITHUB_APP_CLIENT_SECRET_NAME = var.github_app_parameters.client_secret.name
28-
PARAMETER_GITHUB_APP_ID_NAME = var.github_app_parameters.id.name
29-
PARAMETER_GITHUB_APP_KEY_BASE64_NAME = var.github_app_parameters.key_base64.name
17+
ENABLE_ORGANIZATION_RUNNERS = var.enable_organization_runners
18+
ENVIRONMENT = var.environment
19+
GHES_URL = var.ghes_url
20+
NODE_TLS_REJECT_UNAUTHORIZED = var.ghes_url != null && ! var.ghes_ssl_verify ? 0 : 1
21+
RUNNER_EXTRA_LABELS = var.runner_extra_labels
22+
RUNNER_GROUP_NAME = var.runner_group_name
23+
RUNNERS_MAXIMUM_COUNT = var.runners_maximum_count
24+
LAUNCH_TEMPLATE_NAME = join(",", [for template in aws_launch_template.runner : template.name])
25+
SUBNET_IDS = join(",", var.subnet_ids)
26+
PARAMETER_GITHUB_APP_ID_NAME = var.github_app_parameters.id.name
27+
PARAMETER_GITHUB_APP_KEY_BASE64_NAME = var.github_app_parameters.key_base64.name
3028
}
3129
}
3230

@@ -70,13 +68,11 @@ resource "aws_iam_role_policy" "scale_up" {
7068
name = "${var.environment}-lambda-scale-up-policy"
7169
role = aws_iam_role.scale_up.name
7270
policy = templatefile("${path.module}/policies/lambda-scale-up.json", {
73-
arn_runner_instance_role = aws_iam_role.runner.arn
74-
sqs_arn = var.sqs_build_queue.arn
75-
github_app_client_id_arn = var.github_app_parameters.client_id.arn
76-
github_app_client_secret_arn = var.github_app_parameters.client_secret.arn
77-
github_app_id_arn = var.github_app_parameters.id.arn
78-
github_app_key_base64_arn = var.github_app_parameters.key_base64.arn
79-
kms_key_arn = local.kms_key_arn
71+
arn_runner_instance_role = aws_iam_role.runner.arn
72+
sqs_arn = var.sqs_build_queue.arn
73+
github_app_id_arn = var.github_app_parameters.id.arn
74+
github_app_key_base64_arn = var.github_app_parameters.key_base64.arn
75+
kms_key_arn = local.kms_key_arn
8076
})
8177
}
8278

Diff for: ‎modules/runners/variables.tf

+2-4
Original file line numberDiff line numberDiff line change
@@ -116,10 +116,8 @@ variable "enable_organization_runners" {
116116
variable "github_app_parameters" {
117117
description = "Parameter Store for GitHub App Parameters."
118118
type = object({
119-
key_base64 = map(string)
120-
id = map(string)
121-
client_id = map(string)
122-
client_secret = map(string)
119+
key_base64 = map(string)
120+
id = map(string)
123121
})
124122
}
125123

0 commit comments

Comments
 (0)