Github Runner Update - #18
Open
Mastansourcefuse wants to merge 10 commits into
Open
Conversation
New S3 buckets default to BucketOwnerEnforced (ACLs disabled), so aws_s3_bucket_acl fails with AccessControlListNotSupported. The bucket is already private and has a public-access-block, so the ACL is redundant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
null_resource.prepare had only static triggers, so the GitHub registration token (fetched via get-runner-token.sh into SSM) was written only on the first apply. Registration tokens expire in ~1h, so any later re-registration (session drop / container recreate) failed (POST /actions/runner-registration -> 404) and the runner went Offline. Add always_run = timestamp() so each apply fetches a fresh token; data.aws_ssm_parameter.runner_token already depends_on this resource. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…Offline sourcefuse/github-runner:0.3.0 ships runner 2.312.0, now below GitHub's required minimum. GitHub forces a self-update the in-container process cannot apply (can't replace its own running binary), so it relaunches the old binary and GitHub keeps the runner permanently Offline. Switch the default image to myoung34/github-runner (maintained, current runner) and set DISABLE_AUTO_UPDATE. Remap the compose template env vars to the myoung34 contract (RUNNER_SCOPE + REPO_URL/ORG_NAME, LABELS). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tale image) Replaces the docker-compose + baked container image with a direct host install of the official github.com/actions/runner binary, registered and supervised by systemd. The prior sourcefuse/github-runner image shipped runner 2.312.0, which is below GitHub's enforced minimum; the in-container self-update cannot replace its own running binary, so the runner relaunched the old binary and stayed permanently Offline. A host-installed runner self-updates cleanly from GitHub's release and stays current, matching GitHub's official self-hosted runner docs. - main.tf: drop S3 bucket + docker-compose object + bucket IAM; add SSM docs to install CI tooling (aws, kubectl, helm, terraform, docker) and to download + register + service-install the runner; instance reads the reg token from SSM Parameter Store at runtime (new scoped IAM policy) instead of baking it into a doc. - variables.tf: drop runner_image; add runner_version (default 2.336.0); runner_user now the systemd service user (default ubuntu). - remove unused docker-compose template. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ring The self-hosted pipeline jobs rely on host git (actions/checkout) and later on aws/kubectl (deploy-sample, expose-dashboards). Those heavier tools are installed by the separate dependencies association, which can still be running when the runner registers. Install the essentials (git, curl, tar, unzip, jq) inside the runner_install step before config/start, so the moment the runner is Online the first job's checkout is guaranteed to work. Heavier CI tooling stays in the dependencies association and finishes well before the aws/kubectl jobs run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SSM aws:runShellScript executes the script with /bin/sh, which on Ubuntu is dash. dash does not support 'set -o pipefail', so both the dependencies and runner_install documents died on line 1 with 'Illegal option -o pipefail' — nothing was installed and the runner never registered (repo showed 0 runners). Use dash-compatible 'set -eux'. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ode) hashicorp/setup-terraform installs a terraform wrapper (#!/usr/bin/env node) that requires node on the host PATH. Self-hosted hosts don't ship node (the runner's bundled node isn't on PATH), so every setup-terraform job failed with '/usr/bin/env: node: No such file or directory' (exit 127). Install Node.js 20. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vijay-stephen
requested changes
Jul 27, 2026
Leftover from the docker-compose approach, which read the registration token at plan time and baked it into the S3 docker-compose.yml. The host-install rewrite fetches the token at runtime on the instance (aws ssm get-parameter, via the runner_token_read IAM policy), so this data source is never referenced. Removing it per PR review; token flow (null_resource.prepare -> runtime read) is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the cloudposse terraform-aws-ec2-instance (and terraform-aws-key-pair) modules with sourcefuse/arc-ec2/aws 0.0.5, per review (standardize on ARC modules). - IAM folded into arc-ec2 instance_profile_data (create=true): SSM-core managed policies + the token-read inline policy. Drops the separate aws_iam_role_policy_attachment / aws_iam_role_policy resources. - Security group via arc-ec2 security_group_data (egress-only; access is via SSM, not SSH). Drops var.security_group_rules. - Root volume via root_block_device_data. - Dropped the cloudposse SSH key-pair module entirely (SSM Session Manager access). - local.ec2_name replaces module.runner.name (arc-ec2 exposes only id/arn); role name/arn outputs derived as <name>-role. - Removed now-unused vars: ssm_patch_manager_enabled, volume_tags_enabled, security_group_rules. aws provider pinned >= 5.0, < 6.0 (arc-ec2 requires ~> 5.0). Token flow, SSM install docs, systemd runner, and destroy cleanup are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…key) arc-ec2's aws_iam_role_policy.inline uses for_each with keys derived from var.name. Our name included random_string.runner.result, which is unknown at plan time, so terraform errored: 'for_each map includes keys ... cannot be determined until apply'. Drop the random suffix — <ns>-<env>-github-runner is already unique per environment — and remove the now-unused random_string resource + random provider. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rewrote the runner provisioning to install the official
actions/runnerbinary directlyon the EC2 host and run it as a systemd service — GitHub's officially documented method.
A host-installed runner self-updates cleanly and stays at/above the enforced minimum, so it
never goes Offline for version reasons. No Docker image dependency.