cdk-github-runner-switch 0.1.1 → 0.2.1

package/README.md

@@ -102,6 +102,7 @@ To flip the switch by hand: `gh variable set RUNNER --body aws` (or `github`).
 | `nodeMajorVersion` | `24` | Node.js installed in the image. |
 | `cachedImages` | `[]` | Container images pulled into the AMI, for faster `services:`. |
 | `extraImageCommands` | `[]` | Extra setup, e.g. `npx -y playwright install-deps chromium`. |
+| `secret` | new secret | Reuse an existing secret with `webhookSecret`, `appId` and `privateKey` (e.g. when migrating). |
 | `imageSchedule` | monthly (day 1, 05:00 UTC) | EventBridge cron for the image rebuild. |
 | `reconcileInterval` / `usageCheckInterval` | 5 min / 30 min | |
 

package/lib/runner-switch.d.ts

@@ -45,6 +45,11 @@ export interface GitHubRunnerSwitchProps {
     readonly extraImageCommands?: string[];
     /** When the image is rebuilt (EventBridge cron, UTC). @default 'cron(0 5 1 * ? *)' — monthly, day 1 at 05:00 */
     readonly imageSchedule?: string;
+    /**
+     * Existing secret with `webhookSecret`, `appId` and `privateKey` (and `billingToken` for personal accounts), e.g. when
+     * migrating an existing setup. @default - a new secret with a generated `webhookSecret`
+     */
+    readonly secret?: secretsmanager.ISecret;
     /** @default Duration.minutes(5) */
     readonly reconcileInterval?: Duration;
     /** @default Duration.minutes(30) */

package/lib/runner-switch.js

@@ -149,7 +149,7 @@ class GitHubRunnerSwitch extends constructs_1.Construct {
         });
         this.imagePipelineArn = pipeline.attrArn;
         // GitHub App credentials: the webhook secret is generated here; the setup script adds appId and privateKey.
-        const secret = new secretsmanager.Secret(this, 'AppSecret', {
+        const secret = props.secret ?? new secretsmanager.Secret(this, 'AppSecret', {
             description: `GitHub App of the runners for ${props.repository} (cdk-github-runner-switch)`,
             generateSecretString: {
                 secretStringTemplate: JSON.stringify({ appId: '', privateKey: '' }),
@@ -167,7 +167,8 @@ class GitHubRunnerSwitch extends constructs_1.Construct {
             logGroup: new logs.LogGroup(this, 'ControlLogs', { retention: logs.RetentionDays.ONE_MONTH, removalPolicy: aws_cdk_lib_1.RemovalPolicy.DESTROY }),
             description: `GitHub runner switch for ${props.repository}: webhook, reconciliation and minutes check`,
             environment: {
-                SECRET_ID: secret.secretArn,
+                // An imported secret is read by name: its grant covers the full ARN (with the random suffix), not a partial ARN.
+                SECRET_ID: props.secret ? props.secret.secretName : secret.secretArn,
                 REPOSITORY: props.repository,
                 BILLING: props.billing ?? BillingScope.ORGANIZATION,
                 LABEL: label,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdk-github-runner-switch",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "AWS CDK construct: GitHub Actions runners that switch from GitHub-hosted free minutes to disposable EC2 Spot (Graviton) machines when the monthly minutes run out — and back when the month resets.",
   "license": "Apache-2.0",
   "author": "uarch-solutions",