@cloudsnorkel/cdk-github-runners 0.11.3 → 0.11.5

package/API.md

@@ -6048,6 +6048,7 @@ const ecsRunnerProviderProps: EcsRunnerProviderProps = { ... }
 | <code><a href="#@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.labels">labels</a></code> | <code>string[]</code> | GitHub Actions labels used for this provider. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.maxInstances">maxInstances</a></code> | <code>number</code> | The maximum number of instances to run in the cluster. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.memoryLimitMiB">memoryLimitMiB</a></code> | <code>number</code> | The amount (in MiB) of memory used by the task. |
+| <code><a href="#@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.memoryReservationMiB">memoryReservationMiB</a></code> | <code>number</code> | The soft limit (in MiB) of memory to reserve for the container. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.minInstances">minInstances</a></code> | <code>number</code> | The minimum number of instances to run in the cluster. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.securityGroups">securityGroups</a></code> | <code>aws-cdk-lib.aws_ec2.ISecurityGroup[]</code> | Security groups to assign to the task. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.spot">spot</a></code> | <code>boolean</code> | Use spot capacity. |
@@ -6230,12 +6231,25 @@ public readonly memoryLimitMiB: number;
 ```
 
 - *Type:* number
-- *Default:* 3500
+- *Default:* 3500, unless `memoryReservationMiB` is used and then it's undefined
 
 The amount (in MiB) of memory used by the task.
 
 ---
 
+##### `memoryReservationMiB`<sup>Optional</sup> <a name="memoryReservationMiB" id="@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.memoryReservationMiB"></a>
+
+```typescript
+public readonly memoryReservationMiB: number;
+```
+
+- *Type:* number
+- *Default:* undefined
+
+The soft limit (in MiB) of memory to reserve for the container.
+
+---
+
 ##### `minInstances`<sup>Optional</sup> <a name="minInstances" id="@cloudsnorkel/cdk-github-runners.EcsRunnerProviderProps.property.minInstances"></a>
 
 ```typescript
@@ -7978,7 +7992,7 @@ public readonly retryOptions: ProviderRetryOptions;
 Workflow job parameters as parsed from the webhook event. Pass these into your runner executor and run something like:.
 
 ```sh
-./config.sh --unattended --url "https://${GITHUB_DOMAIN}/${OWNER}/${REPO}" --token "${RUNNER_TOKEN}" --ephemeral --work _work --labels "${RUNNER_LABEL}" --name "${RUNNER_NAME}" --disableupdate
+./config.sh --unattended --url "{REGISTRATION_URL}" --token "${RUNNER_TOKEN}" --ephemeral --work _work --labels "${RUNNER_LABEL}" --name "${RUNNER_NAME}" --disableupdate
 ```
 
 All parameters are specified as step function paths and therefore must be used only in step function task parameters.
@@ -7997,6 +8011,7 @@ const runnerRuntimeParameters: RunnerRuntimeParameters = { ... }
 | --- | --- | --- |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters.property.githubDomainPath">githubDomainPath</a></code> | <code>string</code> | Path to GitHub domain. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters.property.ownerPath">ownerPath</a></code> | <code>string</code> | Path to repository owner name. |
+| <code><a href="#@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters.property.registrationUrl">registrationUrl</a></code> | <code>string</code> | Repository or organization URL to register runner at. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters.property.repoPath">repoPath</a></code> | <code>string</code> | Path to repository name. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters.property.runnerNamePath">runnerNamePath</a></code> | <code>string</code> | Path to desired runner name. |
 | <code><a href="#@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters.property.runnerTokenPath">runnerTokenPath</a></code> | <code>string</code> | Path to runner token used to register token. |
@@ -8029,6 +8044,18 @@ Path to repository owner name.
 
 ---
 
+##### `registrationUrl`<sup>Required</sup> <a name="registrationUrl" id="@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters.property.registrationUrl"></a>
+
+```typescript
+public readonly registrationUrl: string;
+```
+
+- *Type:* string
+
+Repository or organization URL to register runner at.
+
+---
+
 ##### `repoPath`<sup>Required</sup> <a name="repoPath" id="@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters.property.repoPath"></a>
 
 ```typescript

package/SETUP_GITHUB.md

@@ -13,6 +13,7 @@ Integration with GitHub can be done using an [app](#app-authentication) or [pers
 5. If you want to create an app for your organization:
    1. Choose Organization app
    2. Type in the organization slug (ORGANIZATION from https://github.com/ORGANIZATION/REPO)
+   3. Choose registration level for the runners
 6. Click Create GitHub App to take you to GitHub to finish the setup
 7. Follow the instructions on GitHub
 8. When brought back to the setup wizard, click the install link
@@ -27,10 +28,12 @@ Integration with GitHub can be done using an [app](#app-authentication) or [pers
 3. Setup webhook under the webhook section
     1. For Webhook URL use the value of `github.webhook.url` from `status.json`
     2. Open the URL in `github.webhook.secretUrl` from `status.json`, retrieve the secret value, and use it for webhook secret
-4. In the repository permissions section enable:
-    1. Actions: Read and write
-    2. Administration: Read and write
-    3. Deployments: Read-only
+4. In the permissions section enable:
+   1. Repository    -> Actions: Read and write
+   2. Repository    -> Administration: Read and write
+   3. Repository    -> Deployments: Read-only
+   4. Repository    -> Administration: Read and write (only for repository level runners)
+   5. Organization  -> Self-hosted runners: Read and write (only for organization level runners)
 5. In the event subscription section enable:
     1. Workflow job
 6. Under "Where can this GitHub App be installed?" select "Only on this account"
@@ -40,7 +43,8 @@ Integration with GitHub can be done using an [app](#app-authentication) or [pers
 10. Open the URL in `github.auth.secretUrl` from `status.json` and edit the secret value
     1. If you're using a self-hosted GitHub instance, put its domain in `domain` (e.g. `github.mycompany.com`)
     2. Put the new application id in `appId` (e.g. `34789562`)
-    3. Ignore/delete `dummy` and **leave `personalAuthToken` empty**
+    3. If using organization level registration, add `runnerLevel` with `org` as the value
+    4. Ignore/delete `dummy` and **leave `personalAuthToken` empty**
 11. Open the URL in `github.auth.privateKeySecretUrl` from `status.json` and edit the secret value
     1. Open the downloaded private key with any text editor
     2. Copy the text from the private key as-is into the secret

package/assets/delete-failed-runner.lambda/index.js

@@ -12865,7 +12865,6 @@ var require_cjs = __commonJS({
     };
     var AC = globalThis.AbortController;
     var AS = globalThis.AbortSignal;
-    var _a;
     if (typeof AC === "undefined") {
       AS = class AbortSignal {
         onabort;
@@ -12882,7 +12881,6 @@ var require_cjs = __commonJS({
         }
         signal = new AS();
         abort(reason) {
-          var _a2, _b;
           if (this.signal.aborted)
             return;
           this.signal.reason = reason;
@@ -12890,10 +12888,10 @@ var require_cjs = __commonJS({
           for (const fn of this.signal._onabort) {
             fn(reason);
           }
-          (_b = (_a2 = this.signal).onabort) == null ? void 0 : _b.call(_a2, reason);
+          this.signal.onabort?.(reason);
         }
       };
-      let printACPolyfillWarning = ((_a = PROCESS.env) == null ? void 0 : _a.LRU_CACHE_IGNORE_AC_WARNING) !== "1";
+      let printACPolyfillWarning = PROCESS.env?.LRU_CACHE_IGNORE_AC_WARNING !== "1";
       const warnACPolyfill = () => {
         if (!printACPolyfillWarning)
           return;
@@ -13548,7 +13546,6 @@ var require_cjs = __commonJS({
        * {@link LRUCache#delete}
        */
       set(k, v, setOptions = {}) {
-        var _a2, _b, _c;
         if (v === void 0) {
           this.delete(k);
           return this;
@@ -13586,10 +13583,10 @@ var require_cjs = __commonJS({
               oldVal.__abortController.abort(new Error("replaced"));
             } else if (!noDisposeOnSet) {
               if (this.#hasDispose) {
-                (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, oldVal, k, "set");
+                this.#dispose?.(oldVal, k, "set");
               }
               if (this.#hasDisposeAfter) {
-                (_b = this.#disposed) == null ? void 0 : _b.push([oldVal, k, "set"]);
+                this.#disposed?.push([oldVal, k, "set"]);
               }
             }
             this.#removeItemSize(index);
@@ -13618,8 +13615,8 @@ var require_cjs = __commonJS({
         if (!noDisposeOnSet && this.#hasDisposeAfter && this.#disposed) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_c = this.#disposeAfter) == null ? void 0 : _c.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
         return this;
@@ -13629,7 +13626,6 @@ var require_cjs = __commonJS({
        * `undefined` if cache is empty.
        */
       pop() {
-        var _a2;
         try {
           while (this.#size) {
             const val = this.#valList[this.#head];
@@ -13646,14 +13642,13 @@ var require_cjs = __commonJS({
           if (this.#hasDisposeAfter && this.#disposed) {
             const dt = this.#disposed;
             let task;
-            while (task = dt == null ? void 0 : dt.shift()) {
-              (_a2 = this.#disposeAfter) == null ? void 0 : _a2.call(this, ...task);
+            while (task = dt?.shift()) {
+              this.#disposeAfter?.(...task);
             }
           }
         }
       }
       #evict(free) {
-        var _a2, _b;
         const head = this.#head;
         const k = this.#keyList[head];
         const v = this.#valList[head];
@@ -13661,10 +13656,10 @@ var require_cjs = __commonJS({
           v.__abortController.abort(new Error("evicted"));
         } else if (this.#hasDispose || this.#hasDisposeAfter) {
           if (this.#hasDispose) {
-            (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "evict");
+            this.#dispose?.(v, k, "evict");
           }
           if (this.#hasDisposeAfter) {
-            (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "evict"]);
+            this.#disposed?.push([v, k, "evict"]);
           }
         }
         this.#removeItemSize(head);
@@ -13739,7 +13734,7 @@ var require_cjs = __commonJS({
         }
         const ac = new AC();
         const { signal } = options;
-        signal == null ? void 0 : signal.addEventListener("abort", () => ac.abort(signal.reason), {
+        signal?.addEventListener("abort", () => ac.abort(signal.reason), {
           signal: ac.signal
         });
         const fetchOpts = {
@@ -13810,8 +13805,7 @@ var require_cjs = __commonJS({
           }
         };
         const pcall = (res, rej) => {
-          var _a2;
-          const fmp = (_a2 = this.#fetchMethod) == null ? void 0 : _a2.call(this, k, v, fetchOpts);
+          const fmp = this.#fetchMethod?.(k, v, fetchOpts);
           if (fmp && fmp instanceof Promise) {
             fmp.then((v2) => res(v2), rej);
           }
@@ -14000,7 +13994,6 @@ var require_cjs = __commonJS({
        * Returns true if the key was deleted, false otherwise.
        */
       delete(k) {
-        var _a2, _b, _c, _d;
         let deleted = false;
         if (this.#size !== 0) {
           const index = this.#keyMap.get(k);
@@ -14015,10 +14008,10 @@ var require_cjs = __commonJS({
                 v.__abortController.abort(new Error("deleted"));
               } else if (this.#hasDispose || this.#hasDisposeAfter) {
                 if (this.#hasDispose) {
-                  (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "delete");
+                  this.#dispose?.(v, k, "delete");
                 }
                 if (this.#hasDisposeAfter) {
-                  (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "delete"]);
+                  this.#disposed?.push([v, k, "delete"]);
                 }
               }
               this.#keyMap.delete(k);
@@ -14037,11 +14030,11 @@ var require_cjs = __commonJS({
             }
           }
         }
-        if (this.#hasDisposeAfter && ((_c = this.#disposed) == null ? void 0 : _c.length)) {
+        if (this.#hasDisposeAfter && this.#disposed?.length) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_d = this.#disposeAfter) == null ? void 0 : _d.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
         return deleted;
@@ -14050,7 +14043,6 @@ var require_cjs = __commonJS({
        * Clear the cache entirely, throwing away all values.
        */
       clear() {
-        var _a2, _b, _c;
         for (const index of this.#rindexes({ allowStale: true })) {
           const v = this.#valList[index];
           if (this.#isBackgroundFetch(v)) {
@@ -14058,10 +14050,10 @@ var require_cjs = __commonJS({
           } else {
             const k = this.#keyList[index];
             if (this.#hasDispose) {
-              (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "delete");
+              this.#dispose?.(v, k, "delete");
             }
             if (this.#hasDisposeAfter) {
-              (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "delete"]);
+              this.#disposed?.push([v, k, "delete"]);
             }
           }
         }
@@ -14083,8 +14075,8 @@ var require_cjs = __commonJS({
         if (this.#hasDisposeAfter && this.#disposed) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_c = this.#disposeAfter) == null ? void 0 : _c.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
       }
@@ -17502,13 +17494,13 @@ var import_auth_app = __toESM(require_dist_node12());
 var import_rest = __toESM(require_dist_node19());
 
 // src/lambda-helpers.ts
-var AWS = __toESM(require("aws-sdk"));
-var sm = new AWS.SecretsManager();
+var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
+var sm = new import_client_secrets_manager.SecretsManagerClient();
 async function getSecretValue(arn) {
   if (!arn) {
     throw new Error("Missing secret ARN");
   }
-  const secret = await sm.getSecretValue({ SecretId: arn }).promise();
+  const secret = await sm.send(new import_client_secrets_manager.GetSecretValueCommand({ SecretId: arn }));
   if (!secret.SecretString) {
     throw new Error(`No SecretString in ${arn}`);
   }
@@ -17575,14 +17567,22 @@ async function getOctokit(installationId) {
     githubSecrets
   };
 }
-async function getRunner(octokit, owner, repo, name) {
+async function getRunner(octokit, runnerLevel, owner, repo, name) {
   let page = 1;
   while (true) {
-    const runners = await octokit.request("GET /repos/{owner}/{repo}/actions/runners?per_page=100&page={page}", {
-      page,
-      owner,
-      repo
-    });
+    let runners;
+    if ((runnerLevel ?? "repo") === "repo") {
+      runners = await octokit.rest.actions.listSelfHostedRunnersForRepo({
+        page,
+        owner,
+        repo
+      });
+    } else {
+      runners = await octokit.rest.actions.listSelfHostedRunnersForOrg({
+        page,
+        org: owner
+      });
+    }
     if (runners.data.runners.length == 0) {
       return;
     }
@@ -17594,6 +17594,20 @@ async function getRunner(octokit, owner, repo, name) {
     page++;
   }
 }
+async function deleteRunner(octokit, runnerLevel, owner, repo, runnerId) {
+  if ((runnerLevel ?? "repo") === "repo") {
+    await octokit.rest.actions.deleteSelfHostedRunnerFromRepo({
+      owner,
+      repo,
+      runner_id: runnerId
+    });
+  } else {
+    await octokit.rest.actions.deleteSelfHostedRunnerFromOrg({
+      org: owner,
+      runner_id: runnerId
+    });
+  }
+}
 
 // src/delete-failed-runner.lambda.ts
 var RunnerBusy = class _RunnerBusy extends Error {
@@ -17612,19 +17626,15 @@ var ReraisedError = class _ReraisedError extends Error {
   }
 };
 async function handler(event) {
-  const { octokit } = await getOctokit(event.installationId);
-  const runner = await getRunner(octokit, event.owner, event.repo, event.runnerName);
+  const { octokit, githubSecrets } = await getOctokit(event.installationId);
+  const runner = await getRunner(octokit, githubSecrets.runnerLevel, event.owner, event.repo, event.runnerName);
   if (!runner) {
     console.error(`Unable to find runner id for ${event.owner}/${event.repo}:${event.runnerName}`);
     throw new ReraisedError(event);
   }
   console.log(`Runner ${event.runnerName} has id #${runner.id}`);
   try {
-    await octokit.rest.actions.deleteSelfHostedRunnerFromRepo({
-      owner: event.owner,
-      repo: event.repo,
-      runner_id: runner.id
-    });
+    await deleteRunner(octokit, githubSecrets.runnerLevel, event.owner, event.repo, runner.id);
   } catch (e) {
     const reqError = e;
     if (reqError.message.includes("is still running a job")) {

package/assets/docker-images/lambda/linux-arm64/runner.js

@@ -11,6 +11,7 @@ exports.handler = async (event, context) => {
         RUNNER_TOKEN: event.token,
         RUNNER_NAME: event.runnerName,
         RUNNER_LABEL: event.label,
+        REGISTRATION_URL: event.registrationUrl,
       },
     });
     shellScript.stdout.on('data', (data) => {

package/assets/docker-images/lambda/linux-arm64/runner.sh

@@ -13,7 +13,7 @@ export HOME=/tmp/home
 
 # start runner
 if [ "${RUNNER_VERSION}" = "latest" ]; then RUNNER_FLAGS=""; else RUNNER_FLAGS="--disableupdate"; fi
-./config.sh --unattended --url "https://${GITHUB_DOMAIN}/${OWNER}/${REPO}" --token "${RUNNER_TOKEN}" --ephemeral --work _work --labels "${RUNNER_LABEL},cdkghr:started:`date +%s`" --name "${RUNNER_NAME}" ${RUNNER_FLAGS}
+./config.sh --unattended --url "${REGISTRATION_URL}" --token "${RUNNER_TOKEN}" --ephemeral --work _work --labels "${RUNNER_LABEL},cdkghr:started:`date +%s`" --name "${RUNNER_NAME}" ${RUNNER_FLAGS}
 echo Config done
 ./run.sh
 echo Run done

package/assets/docker-images/lambda/linux-x64/runner.js

@@ -11,6 +11,7 @@ exports.handler = async (event, context) => {
         RUNNER_TOKEN: event.token,
         RUNNER_NAME: event.runnerName,
         RUNNER_LABEL: event.label,
+        REGISTRATION_URL: event.registrationUrl,
       },
     });
     shellScript.stdout.on('data', (data) => {

package/assets/docker-images/lambda/linux-x64/runner.sh

@@ -13,7 +13,7 @@ export HOME=/tmp/home
 
 # start runner
 if [ "${RUNNER_VERSION}" = "latest" ]; then RUNNER_FLAGS=""; else RUNNER_FLAGS="--disableupdate"; fi
-./config.sh --unattended --url "https://${GITHUB_DOMAIN}/${OWNER}/${REPO}" --token "${RUNNER_TOKEN}" --ephemeral --work _work --labels "${RUNNER_LABEL},cdkghr:started:`date +%s`" --name "${RUNNER_NAME}" ${RUNNER_FLAGS}
+./config.sh --unattended --url "${REGISTRATION_URL}" --token "${RUNNER_TOKEN}" --ephemeral --work _work --labels "${RUNNER_LABEL},cdkghr:started:`date +%s`" --name "${RUNNER_NAME}" ${RUNNER_FLAGS}
 echo Config done
 ./run.sh
 echo Run done