@shipfox/api-runners 5.0.0 → 7.0.1

package/src/presentation/routes/runner-enrollment.test.ts

@@ -0,0 +1,319 @@
+import {createLeaseTokenAuthMethod, createRunnerSessionAuthMethod} from '@shipfox/api-auth';
+import {AUTH_PROVISIONER_TOKEN, AUTH_USER, setProvisionerContext} from '@shipfox/api-auth-context';
+import {
+  type AuthMethod,
+  ClientError,
+  closeApp,
+  createApp,
+  extractBearerToken,
+} from '@shipfox/node-fastify';
+import {eq} from 'drizzle-orm';
+import type {FastifyInstance, FastifyRequest} from 'fastify';
+import {db} from '#db/db.js';
+import {reservations} from '#db/schema/reservations.js';
+import {runnerActivationTokens} from '#db/schema/runner-activation-tokens.js';
+import {runnerBootstrapTokens, runnerControlSessions} from '#db/schema/runner-control-sessions.js';
+import {providerRunners} from '#db/schema/runner-instances.js';
+import {
+  createRunnerControlSessionAuthMethod,
+  createRunnerRegistrationTokenAuthMethod,
+} from '#presentation/auth/index.js';
+import {runnersTestAuthClient} from '#test/index.js';
+import {createRunnerRoutes} from './index.js';
+
+const token = 'provisioner-test-token';
+const fakeUserAuth: AuthMethod = {name: AUTH_USER, authenticate: () => Promise.resolve()};
+
+describe('runner enrollment control plane', () => {
+  let app: FastifyInstance;
+  let provisionerId: string;
+  const provisionerAuth: AuthMethod = {
+    name: AUTH_PROVISIONER_TOKEN,
+    authenticate: (request: FastifyRequest) => {
+      if (extractBearerToken(request.headers.authorization) !== token)
+        throw new ClientError('Invalid provisioner token', 'unauthorized', {status: 401});
+      setProvisionerContext(request, {scope: 'installation', provisionerTokenId: provisionerId});
+      return Promise.resolve();
+    },
+  };
+
+  beforeAll(async () => {
+    app = await createApp({
+      auth: [
+        fakeUserAuth,
+        provisionerAuth,
+        createRunnerRegistrationTokenAuthMethod(),
+        createRunnerControlSessionAuthMethod(),
+        createRunnerSessionAuthMethod(),
+        createLeaseTokenAuthMethod(),
+      ],
+      routes: createRunnerRoutes(runnersTestAuthClient),
+      swagger: false,
+    });
+    await app.ready();
+  });
+
+  afterAll(async () => {
+    await closeApp();
+  });
+
+  beforeEach(() => {
+    provisionerId = crypto.randomUUID();
+  });
+
+  it('creates a hashed one-use bootstrap token and restricts its control session to its instance', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {provider_kind: 'docker', runner_instances: [{template_key: 'linux'}]},
+    });
+
+    expect(created.statusCode).toBe(200);
+    const runner = created.json().runner_instances[0];
+    const [storedBootstrap] = await db()
+      .select()
+      .from(runnerBootstrapTokens)
+      .where(eq(runnerBootstrapTokens.runnerInstanceId, runner.runner_instance_id));
+    expect(storedBootstrap?.hashedToken).not.toBe(runner.bootstrap_token);
+    expect(storedBootstrap?.consumedAt).toBeNull();
+
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+
+    expect(exchanged.statusCode).toBe(200);
+    const controlToken = exchanged.json().control_session_token;
+    const reused = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    expect(reused.statusCode).toBe(401);
+
+    const enrolled = await app.inject({
+      method: 'POST',
+      url: '/runner-control/enrollment',
+      headers: {authorization: `Bearer ${controlToken}`},
+      payload: {labels: ['Linux', 'linux'], provider_kind: 'docker', protocol_version: '1'},
+    });
+    expect(enrolled.statusCode).toBe(204);
+
+    const attached = await app.inject({
+      method: 'POST',
+      url: '/runner-control/provider-runner',
+      headers: {authorization: `Bearer ${controlToken}`},
+      payload: {provider_runner_id: 'container-1'},
+    });
+    expect(attached.json()).toEqual({attached: true});
+
+    const [instance] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+    expect(instance).toMatchObject({
+      provisionerId,
+      labels: ['linux'],
+      providerRunnerId: 'container-1',
+      state: 'running',
+      protocolVersion: '1',
+    });
+    const [session] = await db()
+      .select()
+      .from(runnerControlSessions)
+      .where(eq(runnerControlSessions.runnerInstanceId, runner.runner_instance_id));
+    expect(session?.hashedToken).not.toBe(controlToken);
+
+    const jobs = await app.inject({
+      method: 'POST',
+      url: '/runners/jobs/request',
+      headers: {authorization: `Bearer ${controlToken}`},
+    });
+    expect(jobs.statusCode).toBe(401);
+  });
+
+  it('rejects enrollment when the authenticated runner instance is terminal', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {runner_instances: [{}]},
+    });
+    const runner = created.json().runner_instances[0];
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    await db()
+      .update(providerRunners)
+      .set({state: 'failed'})
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+
+    const enrolled = await app.inject({
+      method: 'POST',
+      url: '/runner-control/enrollment',
+      headers: {authorization: `Bearer ${exchanged.json().control_session_token}`},
+      payload: {labels: ['linux'], provider_kind: 'docker', protocol_version: '1'},
+    });
+
+    expect(enrolled.statusCode).toBe(409);
+    expect(enrolled.json()).toMatchObject({code: 'runner-control-session-invalid'});
+  });
+
+  it('assigns an enrolled runner instance only through the owned reservation', async () => {
+    const workspaceId = crypto.randomUUID();
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {runner_instances: [{template_key: 'linux'}]},
+    });
+    const runner = created.json().runner_instances[0];
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    const controlToken = exchanged.json().control_session_token;
+    await app.inject({
+      method: 'POST',
+      url: '/runner-control/enrollment',
+      headers: {authorization: `Bearer ${controlToken}`},
+      payload: {labels: ['linux'], provider_kind: 'docker', protocol_version: '1'},
+    });
+    await app.inject({
+      method: 'POST',
+      url: '/runner-control/provider-runner',
+      headers: {authorization: `Bearer ${controlToken}`},
+      payload: {provider_runner_id: 'container-assignment-test'},
+    });
+    const [reservation] = await db()
+      .insert(reservations)
+      .values({
+        workspaceId,
+        provisionerId,
+        requiredLabels: ['linux'],
+        count: 1,
+        expiresAt: new Date(Date.now() + 60_000),
+      })
+      .returning();
+    if (!reservation) throw new Error('Reservation insert returned no row');
+
+    const assigned = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/assignments',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {reservation_id: reservation.id, runner_instance_ids: [runner.runner_instance_id]},
+    });
+
+    expect(assigned.statusCode).toBe(200);
+    expect(assigned.json()).toEqual({runner_instance_ids: [runner.runner_instance_id]});
+    const [instance] = await db()
+      .select()
+      .from(providerRunners)
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+    expect(instance).toMatchObject({
+      workspaceId,
+      reservationId: reservation.id,
+      assignedAt: expect.any(Date),
+    });
+  });
+
+  it('returns an activation token only for its assigned runner and closes control access after registration', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {runner_instances: [{}]},
+    });
+    const runner = created.json().runner_instances[0];
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    const controlToken = exchanged.json().control_session_token;
+    const workspaceId = crypto.randomUUID();
+    await db()
+      .update(providerRunners)
+      .set({
+        workspaceId,
+        reservationId: crypto.randomUUID(),
+        providerRunnerId: 'runner-activation-test',
+        state: 'running',
+      })
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+
+    const assignment = await app.inject({
+      method: 'GET',
+      url: '/runner-control/assignment',
+      headers: {authorization: `Bearer ${controlToken}`},
+    });
+    expect(assignment.statusCode).toBe(200);
+    const activationToken = assignment.json().activation_token;
+    expect(typeof activationToken).toBe('string');
+
+    const registered = await app.inject({
+      method: 'POST',
+      url: '/runners/register',
+      headers: {authorization: `Bearer ${activationToken}`},
+      payload: {labels: ['linux']},
+    });
+    expect(registered.statusCode).toBe(200);
+    expect(registered.json()).toMatchObject({mode: 'activation', max_claims: 1});
+
+    const closed = await app.inject({
+      method: 'POST',
+      url: '/runner-control/heartbeat',
+      headers: {authorization: `Bearer ${controlToken}`},
+    });
+    expect(closed.statusCode).toBe(401);
+  });
+
+  it('rejects registration with an expired activation token', async () => {
+    const created = await app.inject({
+      method: 'POST',
+      url: '/provisioners/runner-instances/batch',
+      headers: {authorization: `Bearer ${token}`},
+      payload: {runner_instances: [{}]},
+    });
+    const runner = created.json().runner_instances[0];
+    const exchanged = await app.inject({
+      method: 'POST',
+      url: '/runner-enrollment/exchange',
+      payload: {bootstrap_token: runner.bootstrap_token},
+    });
+    const workspaceId = crypto.randomUUID();
+    await db()
+      .update(providerRunners)
+      .set({
+        workspaceId,
+        reservationId: crypto.randomUUID(),
+        providerRunnerId: 'runner-expired',
+        state: 'running',
+      })
+      .where(eq(providerRunners.id, runner.runner_instance_id));
+    const assignment = await app.inject({
+      method: 'GET',
+      url: '/runner-control/assignment',
+      headers: {authorization: `Bearer ${exchanged.json().control_session_token}`},
+    });
+    const activationToken = assignment.json().activation_token;
+    await db()
+      .update(runnerActivationTokens)
+      .set({expiresAt: new Date(Date.now() - 1_000)})
+      .where(eq(runnerActivationTokens.runnerInstanceId, runner.runner_instance_id));
+
+    const registered = await app.inject({
+      method: 'POST',
+      url: '/runners/register',
+      headers: {authorization: `Bearer ${activationToken}`},
+      payload: {labels: ['linux']},
+    });
+
+    expect(registered.statusCode).toBe(401);
+  });
+});

package/src/presentation/routes/runner-enrollment.ts

@@ -0,0 +1,196 @@
+import {
+  requireProvisionerContext,
+  requireRunnerControlSessionContext,
+} from '@shipfox/api-auth-context';
+import {
+  attachRunnerControlProviderIdBodySchema,
+  createRunnerInstancesBodySchema,
+  createRunnerInstancesResponseSchema,
+  runnerAssignmentPollResponseSchema,
+  runnerBootstrapExchangeBodySchema,
+  runnerBootstrapExchangeResponseSchema,
+  runnerControlHeartbeatResponseSchema,
+  runnerEnrollmentBodySchema,
+} from '@shipfox/api-runners-dto';
+import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {z} from 'zod';
+import {config} from '#config.js';
+import {getRunnerAssignment, issueRunnerActivationToken} from '#core/runner-activation.js';
+import {
+  attachRunnerControlProviderId,
+  createRunnerInstancesWithBootstrapTokens,
+  enrollRunnerControlSession,
+  exchangeRunnerBootstrapToken,
+  RunnerBootstrapTokenInvalidError,
+  RunnerControlSessionInvalidError,
+  touchRunnerControlSession,
+} from '#core/runner-control-sessions.js';
+import {attachRunnerInstanceProviderId} from '#core/runner-instances.js';
+import {runnerBootstrapExchangeCount, runnerControlHeartbeatCount} from '#metrics/instance.js';
+import {authenticateRunnerControlSession} from '#presentation/auth/index.js';
+
+export const createRunnerInstancesRoute = defineRoute({
+  method: 'POST',
+  path: '/runner-instances/batch',
+  description:
+    'Create provisioner-owned runner instances and one-use bootstrap tokens before launch',
+  schema: {
+    body: createRunnerInstancesBodySchema,
+    response: {200: createRunnerInstancesResponseSchema},
+  },
+  handler: async (request) => {
+    const {provisionerTokenId} = requireProvisionerContext(request);
+    const results = await createRunnerInstancesWithBootstrapTokens({
+      provisionerId: provisionerTokenId,
+      ...(request.body.provider_kind ? {providerKind: request.body.provider_kind} : {}),
+      runnerInstances: request.body.runner_instances.map((runner) =>
+        runner.template_key ? {templateKey: runner.template_key} : {},
+      ),
+      ttlSeconds: config.RUNNER_BOOTSTRAP_TOKEN_TTL_SECONDS,
+    });
+    return {
+      runner_instances: results.map((result) => ({
+        runner_instance_id: result.runnerInstanceId,
+        bootstrap_token: result.bootstrapToken,
+      })),
+    };
+  },
+});
+
+export const attachRunnerInstanceProviderIdRoute = defineRoute({
+  method: 'POST',
+  path: '/runner-instances/:runnerInstanceId/provider-runner',
+  description: 'Attach the provider identity after the provisioner launches a runner instance',
+  schema: {
+    params: z.object({runnerInstanceId: z.string().uuid()}),
+    body: attachRunnerControlProviderIdBodySchema,
+    response: {200: z.object({attached: z.boolean()})},
+  },
+  handler: async (request) => {
+    const {provisionerTokenId} = requireProvisionerContext(request);
+    return {
+      attached: await attachRunnerInstanceProviderId({
+        runnerInstanceId: request.params.runnerInstanceId,
+        provisionerId: provisionerTokenId,
+        providerRunnerId: request.body.provider_runner_id,
+      }),
+    };
+  },
+});
+
+export const exchangeRunnerBootstrapRoute = defineRoute({
+  method: 'POST',
+  path: '/exchange',
+  description: 'Exchange a one-use runner bootstrap token for a workspace-neutral control session',
+  schema: {
+    body: runnerBootstrapExchangeBodySchema,
+    response: {200: runnerBootstrapExchangeResponseSchema},
+  },
+  errorHandler: (error) => {
+    if (error instanceof RunnerBootstrapTokenInvalidError)
+      runnerBootstrapExchangeCount.add(1, {outcome: 'rejected'});
+    if (error instanceof RunnerBootstrapTokenInvalidError)
+      throw new ClientError(error.message, 'runner-bootstrap-token-invalid', {status: 401});
+    throw error;
+  },
+  handler: async (request) => {
+    const result = await exchangeRunnerBootstrapToken({
+      rawToken: request.body.bootstrap_token,
+      ttlSeconds: config.RUNNER_CONTROL_SESSION_TTL_SECONDS,
+    });
+    runnerBootstrapExchangeCount.add(1, {outcome: 'accepted'});
+    return {
+      runner_instance_id: result.runnerInstanceId,
+      control_session_token: result.controlSessionToken,
+      expires_at: result.expiresAt.toISOString(),
+    };
+  },
+});
+
+export const enrollRunnerRoute = defineRoute({
+  method: 'POST',
+  path: '/enrollment',
+  description: 'Declare the authenticated runner instance labels and protocol capabilities',
+  schema: {body: runnerEnrollmentBodySchema, response: {204: z.null()}},
+  preHandler: authenticateRunnerControlSession,
+  errorHandler: (error) => {
+    if (error instanceof RunnerControlSessionInvalidError)
+      throw new ClientError(error.message, 'runner-control-session-invalid', {status: 409});
+    throw error;
+  },
+  handler: async (request, reply) => {
+    const session = requireRunnerControlSessionContext(request);
+    await enrollRunnerControlSession({
+      runnerInstanceId: session.runnerInstanceId,
+      provisionerId: session.provisionerId,
+      labels: request.body.labels,
+      ...(request.body.capabilities ? {capabilities: request.body.capabilities} : {}),
+      providerKind: request.body.provider_kind,
+      protocolVersion: request.body.protocol_version,
+    });
+    return await reply.code(204).send();
+  },
+});
+
+export const attachRunnerControlProviderIdRoute = defineRoute({
+  method: 'POST',
+  path: '/provider-runner',
+  description: 'Attach the authenticated runner instance provider identity once',
+  schema: {
+    body: attachRunnerControlProviderIdBodySchema,
+    response: {200: z.object({attached: z.boolean()})},
+  },
+  preHandler: authenticateRunnerControlSession,
+  handler: async (request) => {
+    const session = requireRunnerControlSessionContext(request);
+    return {
+      attached: await attachRunnerControlProviderId({
+        ...session,
+        providerRunnerId: request.body.provider_runner_id,
+      }),
+    };
+  },
+});
+
+export const runnerControlHeartbeatRoute = defineRoute({
+  method: 'POST',
+  path: '/heartbeat',
+  description: 'Record liveness for only the authenticated runner instance',
+  schema: {response: {200: runnerControlHeartbeatResponseSchema}},
+  preHandler: authenticateRunnerControlSession,
+  handler: async (request) => {
+    const session = requireRunnerControlSessionContext(request);
+    await touchRunnerControlSession(session.runnerInstanceId, session.provisionerId);
+    runnerControlHeartbeatCount.add(1);
+    return {ok: true};
+  },
+});
+
+export const runnerAssignmentPollRoute = defineRoute({
+  method: 'GET',
+  path: '/assignment',
+  description: 'Wait for only the authenticated runner instance assignment',
+  schema: {response: {200: runnerAssignmentPollResponseSchema}},
+  preHandler: authenticateRunnerControlSession,
+  handler: async (request, reply) => {
+    const session = requireRunnerControlSessionContext(request);
+    const deadline = Date.now() + config.RUNNER_ASSIGNMENT_POLL_MAX_WAIT_SECONDS * 1000;
+    const abortController = new AbortController();
+    reply.raw.on('close', () => abortController.abort());
+    while (Date.now() <= deadline) {
+      if (abortController.signal.aborted) return {activation_token: null};
+      const assignment = await getRunnerAssignment(session);
+      if (assignment) {
+        const activationToken = await issueRunnerActivationToken({
+          ...session,
+          ttlSeconds: config.RUNNER_ACTIVATION_TOKEN_TTL_SECONDS,
+        });
+        return {activation_token: activationToken};
+      }
+      await new Promise((resolve) =>
+        setTimeout(resolve, config.RUNNER_ASSIGNMENT_POLL_INTERVAL_MS),
+      );
+    }
+    return {activation_token: null};
+  },
+});

package/src/temporal/activities/index.ts

@@ -3,7 +3,7 @@ import {
   deleteExpiredReservationsActivity,
   deleteExpiredRunnerSessionsActivity,
   detectAndExpireStuckJobsActivity,
-  reapStaleProvisionedRunnersActivity,
+  reapStaleRunnerInstancesActivity,
 } from './maintenance-activities.js';
 
 export function createRunnersMaintenanceActivities() {
@@ -12,6 +12,6 @@ export function createRunnersMaintenanceActivities() {
     deleteExpiredReservationsActivity,
     deleteExpiredRunnerSessionsActivity,
     detectAndExpireStuckJobsActivity,
-    reapStaleProvisionedRunnersActivity,
+    reapStaleRunnerInstancesActivity,
   };
 }

package/src/temporal/activities/maintenance-activities.test.ts

@@ -3,14 +3,14 @@ import {
   deleteExpiredRunnerReservations,
   deleteExpiredRunnerSessions,
   detectAndExpireStuckJobs,
-  reapStaleProvisionedRunners,
+  reapStaleRunnerInstances,
 } from '#core/maintenance.js';
 import {
   deleteExpiredEphemeralRegistrationTokensActivity,
   deleteExpiredReservationsActivity,
   deleteExpiredRunnerSessionsActivity,
   detectAndExpireStuckJobsActivity,
-  reapStaleProvisionedRunnersActivity,
+  reapStaleRunnerInstancesActivity,
 } from './maintenance-activities.js';
 
 vi.mock('#core/maintenance.js', () => ({
@@ -18,7 +18,7 @@ vi.mock('#core/maintenance.js', () => ({
   deleteExpiredRunnerReservations: vi.fn(),
   deleteExpiredRunnerSessions: vi.fn(),
   detectAndExpireStuckJobs: vi.fn(),
-  reapStaleProvisionedRunners: vi.fn(),
+  reapStaleRunnerInstances: vi.fn(),
 }));
 
 beforeEach(() => {
@@ -47,20 +47,20 @@ describe('deleteExpiredReservationsActivity', () => {
   });
 });
 
-describe('reapStaleProvisionedRunnersActivity', () => {
+describe('reapStaleRunnerInstancesActivity', () => {
   it('delegates to core maintenance', async () => {
-    vi.mocked(reapStaleProvisionedRunners).mockResolvedValueOnce({
+    vi.mocked(reapStaleRunnerInstances).mockResolvedValueOnce({
       reaped: 4,
       reservationsReleased: 2,
     });
 
-    const result = await reapStaleProvisionedRunnersActivity({
+    const result = await reapStaleRunnerInstancesActivity({
       thresholdSeconds: 300,
       limit: 100,
     });
 
     expect(result).toEqual({reaped: 4, reservationsReleased: 2});
-    expect(reapStaleProvisionedRunners).toHaveBeenCalledWith({
+    expect(reapStaleRunnerInstances).toHaveBeenCalledWith({
       thresholdSeconds: 300,
       limit: 100,
     });

package/src/temporal/activities/maintenance-activities.ts

@@ -3,7 +3,7 @@ import {
   deleteExpiredRunnerReservations,
   deleteExpiredRunnerSessions,
   detectAndExpireStuckJobs,
-  reapStaleProvisionedRunners,
+  reapStaleRunnerInstances,
 } from '#core/maintenance.js';
 
 export function detectAndExpireStuckJobsActivity(params: {
@@ -18,11 +18,11 @@ export function deleteExpiredReservationsActivity(params?: {
   return deleteExpiredRunnerReservations(params);
 }
 
-export function reapStaleProvisionedRunnersActivity(params?: {
+export function reapStaleRunnerInstancesActivity(params?: {
   thresholdSeconds: number;
   limit: number;
 }): Promise<{reaped: number; reservationsReleased: number}> {
-  return reapStaleProvisionedRunners(params);
+  return reapStaleRunnerInstances(params);
 }
 
 export function deleteExpiredRunnerSessionsActivity(params?: {

package/src/temporal/workflows/stuck-job-detector.test.ts

@@ -3,7 +3,7 @@ const mocks = vi.hoisted(() => ({
   deleteExpiredReservationsActivity: vi.fn(),
   deleteExpiredRunnerSessionsActivity: vi.fn(),
   detectAndExpireStuckJobsActivity: vi.fn(),
-  reapStaleProvisionedRunnersActivity: vi.fn(),
+  reapStaleRunnerInstancesActivity: vi.fn(),
   info: vi.fn(),
   warn: vi.fn(),
 }));
@@ -19,7 +19,7 @@ vi.mock('@temporalio/workflow', () => ({
     deleteExpiredReservationsActivity: mocks.deleteExpiredReservationsActivity,
     deleteExpiredRunnerSessionsActivity: mocks.deleteExpiredRunnerSessionsActivity,
     detectAndExpireStuckJobsActivity: mocks.detectAndExpireStuckJobsActivity,
-    reapStaleProvisionedRunnersActivity: mocks.reapStaleProvisionedRunnersActivity,
+    reapStaleRunnerInstancesActivity: mocks.reapStaleRunnerInstancesActivity,
   })),
 }));
 
@@ -30,7 +30,7 @@ describe('stuckJobDetector', () => {
     mocks.deleteExpiredReservationsActivity.mockResolvedValue({deleted: 0});
     mocks.deleteExpiredRunnerSessionsActivity.mockResolvedValue({deleted: 0});
     mocks.detectAndExpireStuckJobsActivity.mockResolvedValue({expired: 0});
-    mocks.reapStaleProvisionedRunnersActivity.mockResolvedValue({
+    mocks.reapStaleRunnerInstancesActivity.mockResolvedValue({
       reaped: 0,
       reservationsReleased: 0,
     });

package/src/temporal/workflows/stuck-job-detector.ts

@@ -8,7 +8,7 @@ const {
   deleteExpiredReservationsActivity,
   deleteExpiredRunnerSessionsActivity,
   detectAndExpireStuckJobsActivity,
-  reapStaleProvisionedRunnersActivity,
+  reapStaleRunnerInstancesActivity,
 } = proxyActivities<ReturnType<typeof createRunnersMaintenanceActivities>>({
   startToCloseTimeout: '60s',
 });
@@ -57,7 +57,7 @@ export async function stuckJobDetector(): Promise<void> {
     });
   }
 
-  const {reaped, reservationsReleased} = await reapStaleProvisionedRunnersActivity();
+  const {reaped, reservationsReleased} = await reapStaleRunnerInstancesActivity();
   if (reaped > 0) {
     log.info('Stuck-job detector reaped stale provisioned runners', {
       reaped,

package/test/env.ts

@@ -5,7 +5,5 @@ process.env.POSTGRES_PASSWORD ??= 'password';
 process.env.POSTGRES_DATABASE = 'api_test';
 process.env.POSTGRES_MAX_CONNECTIONS ??= '5';
 process.env.WORKSPACE_JWT_SECRET = 'test-secret';
-process.env.AUTH_JWT_SECRET = 'test-secret';
-process.env.AUTH_JOB_LEASE_TOKEN_SECRET = 'test-lease-secret';
-process.env.AUTH_RUNNER_SESSION_TOKEN_SECRET = 'test-runner-session-secret';
+process.env.AUTH_ROOT_KEY = 'MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=';
 process.env.TZ = 'UTC';

package/test/factories/ephemeral-registration-token.ts

@@ -18,7 +18,7 @@ export const ephemeralRegistrationTokenFactory = Factory.define<
       workspaceId: token.workspaceId,
       provisionerId: token.provisionerId,
       reservationId: token.reservationId,
-      provisionedRunnerId: token.provisionedRunnerId,
+      providerRunnerId: token.providerRunnerId,
       hashedToken: token.hashedToken,
       prefix: token.prefix,
       expiresAt: token.expiresAt,
@@ -30,7 +30,7 @@ export const ephemeralRegistrationTokenFactory = Factory.define<
     workspaceId: crypto.randomUUID(),
     provisionerId: crypto.randomUUID(),
     reservationId: null,
-    provisionedRunnerId: `provisioned-runner-${crypto.randomUUID()}`,
+    providerRunnerId: `provisioned-runner-${crypto.randomUUID()}`,
     hashedToken: hashOpaqueToken(rawToken),
     prefix: extractDisplayPrefix(rawToken),
     expiresAt: new Date(Date.now() + 60_000),