@cloudsnorkel/cdk-github-runners 0.9.1 → 0.9.2

package/.jsii

@@ -3828,6 +3828,86 @@
       ],
       "symbolId": "src/providers/image-builders/aws-image-builder/deprecated/ami:AmiBuilderProps"
     },
+    "@cloudsnorkel/cdk-github-runners.ApiGatewayAccessProps": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental"
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.ApiGatewayAccessProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/access.ts",
+        "line": 9
+      },
+      "name": "ApiGatewayAccessProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "If not specified on public API Gateway, all IP addresses are allowed.\n\nIf not specified on private API Gateway, no IP addresses are allowed (but specified security groups are).",
+            "stability": "experimental",
+            "summary": "List of IP addresses in CIDR notation that are allowed to access the API Gateway."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/access.ts",
+            "line": 17
+          },
+          "name": "allowedIps",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Only works for private API Gateways with {@link allowedVpc}.",
+            "stability": "experimental",
+            "summary": "List of security groups that are allowed to access the API Gateway."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/access.ts",
+            "line": 29
+          },
+          "name": "allowedSecurityGroups",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "aws-cdk-lib.aws_ec2.ISecurityGroup"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Creates a private API Gateway and allows access from the specified VPC."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/access.ts",
+            "line": 22
+          },
+          "name": "allowedVpc",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+          }
+        }
+      ],
+      "symbolId": "src/access:ApiGatewayAccessProps"
+    },
     "@cloudsnorkel/cdk-github-runners.Architecture": {
       "assembly": "@cloudsnorkel/cdk-github-runners",
       "docs": {
@@ -7393,7 +7473,7 @@
         },
         "locationInModule": {
           "filename": "src/runner.ts",
-          "line": 191
+          "line": 218
         },
         "parameters": [
           {
@@ -7420,7 +7500,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/runner.ts",
-        "line": 172
+        "line": 199
       },
       "methods": [
         {
@@ -7431,7 +7511,7 @@
           },
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 565
+            "line": 607
           },
           "name": "metricFailed",
           "parameters": [
@@ -7457,7 +7537,7 @@
           },
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 510
+            "line": 552
           },
           "name": "metricJobCompleted",
           "parameters": [
@@ -7483,7 +7563,7 @@
           },
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 556
+            "line": 598
           },
           "name": "metricSucceeded",
           "parameters": [
@@ -7509,7 +7589,7 @@
           },
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 572
+            "line": 614
           },
           "name": "metricTime",
           "parameters": [
@@ -7538,7 +7618,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 176
+            "line": 203
           },
           "name": "providers",
           "type": {
@@ -7558,7 +7638,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 181
+            "line": 208
           },
           "name": "secrets",
           "type": {
@@ -7572,7 +7652,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 191
+            "line": 218
           },
           "name": "props",
           "optional": true,
@@ -7594,7 +7674,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/runner.ts",
-        "line": 29
+        "line": 30
       },
       "name": "GitHubRunnersProps",
       "properties": [
@@ -7609,7 +7689,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 52
+            "line": 53
           },
           "name": "allowPublicSubnet",
           "optional": true,
@@ -7627,7 +7707,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 82
+            "line": 83
           },
           "name": "extraCertificates",
           "optional": true,
@@ -7646,7 +7726,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 89
+            "line": 90
           },
           "name": "idleTimeout",
           "optional": true,
@@ -7664,7 +7744,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 96
+            "line": 97
           },
           "name": "logOptions",
           "optional": true,
@@ -7683,7 +7763,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 35
+            "line": 36
           },
           "name": "providers",
           "optional": true,
@@ -7706,7 +7786,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 57
+            "line": 58
           },
           "name": "securityGroup",
           "optional": true,
@@ -7714,6 +7794,44 @@
             "fqn": "aws-cdk-lib.aws_ec2.ISecurityGroup"
           }
         },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "LambdaAccess.lambdaUrl()",
+            "remarks": "Once you finish the setup process, you can set this to `LambdaAccess.noAccess()` to remove access to the setup function. You can also use `LambdaAccess.apiGateway({ allowedIps: ['my-ip/0']})` to limit access to your IP only.",
+            "stability": "experimental",
+            "summary": "Access configuration for the setup function."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 104
+          },
+          "name": "setupAccess",
+          "optional": true,
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.LambdaAccess"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "LambdaAccess.noAccess()",
+            "remarks": "This function returns a lot of sensitive information about the runner, so you should only allow access to it from trusted IPs, if at all.",
+            "stability": "experimental",
+            "summary": "Access configuration for the status function."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 123
+          },
+          "name": "statusAccess",
+          "optional": true,
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.LambdaAccess"
+          }
+        },
         {
           "abstract": true,
           "docs": {
@@ -7724,7 +7842,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 40
+            "line": 41
           },
           "name": "vpc",
           "optional": true,
@@ -7742,13 +7860,32 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 45
+            "line": 46
           },
           "name": "vpcSubnets",
           "optional": true,
           "type": {
             "fqn": "aws-cdk-lib.aws_ec2.SubnetSelection"
           }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "LambdaAccess.lambdaUrl()",
+            "remarks": "This function is called by GitHub when a new workflow job is scheduled. For an extra layer of security, you can set this to `LambdaAccess.apiGateway({ allowedIps: LambdaAccess.githubWebhookIps() })`.\n\nYou can also set this to `LambdaAccess.privateApiGateway()` if your GitHub Enterprise Server is hosted in a VPC. This will create an API Gateway endpoint that's only accessible from within the VPC.\n\n*WARNING*: changing access type may change the URL. When the URL changes, you must update GitHub as well.",
+            "stability": "experimental",
+            "summary": "Access configuration for the webhook function."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 116
+          },
+          "name": "webhookAccess",
+          "optional": true,
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.LambdaAccess"
+          }
         }
       ],
       "symbolId": "src/runner:GitHubRunnersProps"
@@ -8566,6 +8703,116 @@
       ],
       "symbolId": "src/providers/image-builders/aws-image-builder/builder:ImageBuilderComponentProperties"
     },
+    "@cloudsnorkel/cdk-github-runners.LambdaAccess": {
+      "abstract": true,
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "docs": {
+        "remarks": "Use this to limit access to these functions.",
+        "stability": "experimental",
+        "summary": "Access configuration options for Lambda functions like setup and webhook function."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.LambdaAccess",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        }
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/access.ts",
+        "line": 35
+      },
+      "methods": [
+        {
+          "docs": {
+            "remarks": "This is the most secure option, but requires additional configuration. It allows you to limit access to specific IP addresses and even to a specific VPC.\n\nTo limit access to GitHub.com use:\n\n```\nLambdaAccess.apiGateway({\n  allowedIps: LambdaAccess.githubWebhookIps(),\n});\n```\n\nAlternatively, get and manually update the list manually with:\n\n```\ncurl https://api.github.com/meta | jq .hooks\n```",
+            "stability": "experimental",
+            "summary": "Provide access using API Gateway."
+          },
+          "locationInModule": {
+            "filename": "src/access.ts",
+            "line": 67
+          },
+          "name": "apiGateway",
+          "parameters": [
+            {
+              "name": "props",
+              "optional": true,
+              "type": {
+                "fqn": "@cloudsnorkel/cdk-github-runners.ApiGatewayAccessProps"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "@cloudsnorkel/cdk-github-runners.LambdaAccess"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "Note that downloading dynamic data during deployment is not recommended in CDK. This is a workaround for the lack of a better solution.",
+            "stability": "experimental",
+            "summary": "Downloads the list of IP addresses used by GitHub.com for webhooks."
+          },
+          "locationInModule": {
+            "filename": "src/access.ts",
+            "line": 76
+          },
+          "name": "githubWebhookIps",
+          "returns": {
+            "type": {
+              "collection": {
+                "elementtype": {
+                  "primitive": "string"
+                },
+                "kind": "array"
+              }
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "This is the default and simplest option. It puts no limits on the requester, but the Lambda functions themselves authenticate every request.",
+            "stability": "experimental",
+            "summary": "Provide access using Lambda URL."
+          },
+          "locationInModule": {
+            "filename": "src/access.ts",
+            "line": 46
+          },
+          "name": "lambdaUrl",
+          "returns": {
+            "type": {
+              "fqn": "@cloudsnorkel/cdk-github-runners.LambdaAccess"
+            }
+          },
+          "static": true
+        },
+        {
+          "docs": {
+            "remarks": "This is useful for the setup function after setup is done.",
+            "stability": "experimental",
+            "summary": "Disables access to the configured Lambda function."
+          },
+          "locationInModule": {
+            "filename": "src/access.ts",
+            "line": 39
+          },
+          "name": "noAccess",
+          "returns": {
+            "type": {
+              "fqn": "@cloudsnorkel/cdk-github-runners.LambdaAccess"
+            }
+          },
+          "static": true
+        }
+      ],
+      "name": "LambdaAccess",
+      "symbolId": "src/access:LambdaAccess"
+    },
     "@cloudsnorkel/cdk-github-runners.LambdaRunner": {
       "assembly": "@cloudsnorkel/cdk-github-runners",
       "base": "@cloudsnorkel/cdk-github-runners.LambdaRunnerProvider",
@@ -9552,7 +9799,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/runner.ts",
-        "line": 102
+        "line": 129
       },
       "name": "LogOptions",
       "properties": [
@@ -9566,7 +9813,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 113
+            "line": 140
           },
           "name": "includeExecutionData",
           "optional": true,
@@ -9584,7 +9831,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 120
+            "line": 147
           },
           "name": "level",
           "optional": true,
@@ -9601,7 +9848,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 106
+            "line": 133
           },
           "name": "logGroupName",
           "optional": true,
@@ -9620,7 +9867,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/runner.ts",
-            "line": 129
+            "line": 156
           },
           "name": "logRetention",
           "optional": true,
@@ -11974,6 +12221,6 @@
       "symbolId": "src/providers/image-builders/aws-image-builder/deprecated/windows-components:WindowsComponents"
     }
   },
-  "version": "0.9.1",
-  "fingerprint": "pN+Ba8VB2RduK8aFdSqAxG4DnTY/Z9GUJWMHEucUgjc="
+  "version": "0.9.2",
+  "fingerprint": "zmHG8ogvxM4UnuobG3q57zcoNzxuIu+sExYrdG2uOo8="
 }