From 7ecd5e0ea6bd454ccaab477cf9e5717c476aa045 Mon Sep 17 00:00:00 2001 From: manikanta-sadurla Date: Wed, 3 Jun 2026 17:53:13 +0530 Subject: [PATCH 1/2] updated readme and workflows --- .gitignore | 1 + README.md | 60 ++++++++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 50 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index 01e07d1..0119369 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ terraform.tfvars /runner-id /registered-runners.json /errors.log +.DS_Store diff --git a/README.md b/README.md index 5338c4d..21b78b1 100644 --- a/README.md +++ b/README.md @@ -1,26 +1,38 @@ # [terraform-aws-arc-github-runner](https://github.com/sourcefuse/terraform-aws-arc-github-runner) -[![Quality gate](https://sonarcloud.io/api/project_badges/quality_gate?project=sourcefuse_terraform-aws-arc-github-runner)](https://sonarcloud.io/summary/new_code?id=sourcefuse_terraform-aws-arc-github-runner) +> **Module:** `sourcefuse/arc-github-runner/aws` + +> **Registry:** [https://registry.terraform.io/modules/sourcefuse/arc-github-runner/aws](https://registry.terraform.io/modules/sourcefuse/arc-github-runner/aws) + +> **Category:** DevOps / CI/CD + +> **Source:** [https://github.com/sourcefuse/terraform-aws-arc-github-runner](https://github.com/sourcefuse/terraform-aws-arc-github-runner) -[![Known Vulnerabilities](https://github.com/sourcefuse/terraform-refarch-github-runner/actions/workflows/snyk.yaml/badge.svg)](https://github.com/sourcefuse/terraform-refarch-github-runner/actions/workflows/snyk.yaml) +[![Latest Release](https://img.shields.io/github/release/sourcefuse/terraform-aws-arc-github-runner.svg?style=for-the-badge)](https://github.com/sourcefuse/terraform-aws-arc-github-runner/releases/latest) +[![Last Updated](https://img.shields.io/github/last-commit/sourcefuse/terraform-aws-arc-github-runner.svg?style=for-the-badge)](https://github.com/sourcefuse/terraform-aws-arc-github-runner/commits) +![Terraform](https://img.shields.io/badge/terraform-%235835CC.svg?style=for-the-badge&logo=terraform&logoColor=white) +![GitHub Actions](https://img.shields.io/badge/github%20actions-%232671E5.svg?style=for-the-badge&logo=githubactions&logoColor=white) + +[![Quality gate](https://sonarcloud.io/api/project_badges/quality_gate?project=sourcefuse_terraform-aws-arc-github-runner)](https://sonarcloud.io/summary/new_code?id=sourcefuse_terraform-aws-arc-github-runner) ## Overview -SourceFuse AWS Reference Architecture (ARC) Terraform module for managing GitHub Runner. +Deploys a self-hosted GitHub Actions runner on an EC2 instance with auto-registration, SSM access, and configurable labels. -This module will create the following resources in a specified AWS Account: -* S3 bucket: used for storing the generated `docker-compose.yml` -* EC2 instance: Used for running the runner container on -* SSH Key Pair: Used for decrypting EC2 password -* SSM Documents: Used for installing dependencies and updating the SSM Agent -* IAM Policies: For accessing created resources -* SSM Parameter: For storing the runner token +## What It Does + +- EC2-based self-hosted GitHub Actions runner +- Automatic runner registration with GitHub token +- Configurable runner labels for job targeting +- SSM Session Manager access (no SSH required) +- IAM instance profile with configurable policies +- VPC and security group configuration This module utilizes different `local-exec` provisioners to execute scripts for obtaining the needed GitHub Runner token and remove the runner from the organization when the resources are destroyed. See [Pre-Requisites](#pre-requisites) for information on the needed permissions these scripts will require. -### Pre-Requisites +## Pre-Requisites You will need to have a GitHub Personal Access Token (PAT) with `admin:org` permissions in order to manage GitHub runners for the Organization. If you do not have sufficient permissions to GitHub, the runner will not register. @@ -39,6 +51,8 @@ When choosing an AMI, please be sure to select either **Ubuntu** or **Debian**. To see a full example, check out the [main.tf](https://github.com/sourcefuse/terraform-aws-arc-github-runner/blob/main/example/main.tf) file in the example folder. +## Quickstart + ```hcl module "runner" { source = "sourcefuse/arc-github-runner/aws" @@ -56,6 +70,26 @@ module "runner" { } ``` +## Required Inputs + +| Name | Type | Description | +|------|------|-------------| +| `namespace` | `string` | Namespace prefix | +| `environment` | `string` | Deployment environment | +| `subnet_id` | `string` | Subnet ID for the runner EC2 instance | +| `vpc_id` | `string` | VPC ID | +| `github_token` | `string` | GitHub PAT or registration token | +| `runner_labels` | `string` | Comma-separated runner labels | +## Key Outputs + +| Name | Description | +|------|-------------| +| `instance_id` | EC2 instance ID of the runner | +| `instance_private_ip` | Private IP of the runner | +## Full Variable & Output Reference + +The complete inputs/outputs reference is auto-generated below. + ## Requirements @@ -187,6 +221,10 @@ By specifying this , it will bump the version and if you dont specify this in yo go test -timeout 30m ``` +## Contributing + +See [CONTRIBUTING.md](./CONTRIBUTING.md) for commit conventions and development setup. + ## Authors This project is authored by: From 70888193d69b2620121b9e6dac84bb1abfd980e7 Mon Sep 17 00:00:00 2001 From: manikanta-sadurla Date: Wed, 3 Jun 2026 17:53:29 +0530 Subject: [PATCH 2/2] updated readme and workflows --- .github/workflows/snyk.yaml | 34 ---------------------------------- .snyk | 24 ------------------------ 2 files changed, 58 deletions(-) delete mode 100644 .github/workflows/snyk.yaml delete mode 100644 .snyk diff --git a/.github/workflows/snyk.yaml b/.github/workflows/snyk.yaml deleted file mode 100644 index da6ccc5..0000000 --- a/.github/workflows/snyk.yaml +++ /dev/null @@ -1,34 +0,0 @@ ---- -name: snyk - -on: # yamllint disable-line rule:truthy - push: - branches: - - "**" # matches every branch - - "!main" # excludes main - pull_request: - branches: - - main - -jobs: - security: - runs-on: ubuntu-latest - name: snyk - steps: - - name: checkout - uses: actions/checkout@v3 - - name: Vulnerability scan - uses: snyk/actions/iac@master - with: - command: monitor - args: --severity-threshold=medium - - name: Set up Node 18 - uses: actions/setup-node@v3 - with: - node-version: 18 - - name: install Snyk CLI - run: npm install -g snyk - - name: snyk monitor - run: snyk iac test --severity-threshold=medium --report - env: - SNYK_TOKEN: ${{ secrets.ARC_SNYK_TOKEN }} diff --git a/.snyk b/.snyk deleted file mode 100644 index cdb7189..0000000 --- a/.snyk +++ /dev/null @@ -1,24 +0,0 @@ -# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. -version: v1.25.0 -# ignores vulnerabilities until expiry date; change duration by modifying expiry date -ignore: - SNYK-CC-TF-56: - - resource > aws_security_group[external] > description: - reason: Module is referenced upstream and not managed by our Organization. - expires: "2024-01-01T00:00:00.000Z" - created: "2023-01-18T04:58:00.000Z" - - resource > aws_security_group[external] > description: - reason: Module is referenced upstream and not managed by our Organization. - expires: "2024-01-01T00:00:00.000Z" - created: "2023-01-18T04:58:00.000Z" - SNYK-CC-AWS-426: - - resource > aws_instance[default] > disable_api_termination: - reason: These are not highly available instances and can be terminated as needed. - expires: "2024-01-01T00:00:00.000Z" - created: "2023-01-18T04:58:00.000Z" - SNYK-CC-TF-127: - - resource > aws_s3_bucket_versioning[runner] > versioning_configuration > mfa_delete: - reason: Not currently needed with our SSO setup. - expires: "2024-01-01T00:00:00.000Z" - created: "2023-01-18T04:58:00.000Z" -patch: {}