cdk-github-microvm-runners 0.1.1__py3-none-any.whl

cdk_github_microvm_runners/__init__.py

@@ -0,0 +1,3989 @@
+r'''
+# cdk-github-microvm-runners
+
+[![npm](https://img.shields.io/npm/v/cdk-github-microvm-runners?logo=npm&label=npm)](https://www.npmjs.com/package/cdk-github-microvm-runners) [![PyPI](https://img.shields.io/pypi/v/cdk-github-microvm-runners?logo=pypi&logoColor=white&label=PyPI)](https://pypi.org/project/cdk-github-microvm-runners/) [![CI](https://img.shields.io/github/actions/workflow/status/schuettc/cdk-github-microvm-runners/ci.yml?branch=main&logo=githubactions&logoColor=white&label=CI)](https://github.com/schuettc/cdk-github-microvm-runners/actions/workflows/ci.yml) [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
+
+A CDK construct library that runs GitHub Actions jobs on
+[AWS Lambda MicroVMs](https://docs.aws.amazon.com/lambda/latest/dg/lambda-microvms-guide.html).
+Each job runs on its own MicroVM in your AWS account, created when the job
+starts and removed once it finishes.
+
+## Why this exists
+
+AWS Lambda MicroVMs provides the ability to launch a MicroVM, but nothing that
+connects one to GitHub Actions: there is no runner registration, no path from
+an incoming job to a running VM, and no cleanup when a VM or a runner is left
+behind. AWS CDK provides the individual building blocks — Lambda functions, a
+queue, a table, IAM roles — but not an assembled system. This construct is that
+system. It receives GitHub's `workflow_job` events, launches a MicroVM for each
+job, registers a single-use runner, and reconciles the result afterward, so
+that adopting per-job MicroVM runners is a matter of configuring a construct
+rather than building and operating the surrounding machinery yourself.
+
+Two design decisions shape the rest of the library. The runner VMs hold no AWS
+credentials by default, because a MicroVM's instance metadata service would
+otherwise return any attached role's credentials to the code running in the
+job; a job that needs AWS obtains its own short-lived credentials through GitHub
+OIDC instead. Routing is per job: a workflow job opts in by naming the runner's
+label in its `runs-on`, and every other job continues to run on GitHub-hosted
+runners, so a repository can be moved across one job at a time.
+
+## How it works
+
+A single runner set — one `GithubMicrovmRunners` in a stack — serves a GitHub
+organization or a set of repositories. It is configured with two required
+properties: how it authenticates to GitHub, and which organization or
+repositories it serves.
+
+A runner class pairs a `runs-on` label with the MicroVM size and image that
+jobs carrying that label run on, and a runner set can define more than one.
+Each class builds its own image and runs at its own size, so a workflow can
+send small jobs to one class and memory-heavy jobs to a larger one by choosing
+the matching label. The runner VMs are ARM64, so the tools and container images
+a job pulls need arm64 builds.
+
+<!-- sync:begin lifecycle-diagram -->
+
+```mermaid
+flowchart TD
+    GH["GitHub Actions — workflow_job event"] --> WH["Webhook Lambda — verifies the signature"]
+    WH --> Q["SQS job queue — launch and terminate intents"]
+    Q --> LN["Launcher Lambda — claims the job, obtains a MicroVM"]
+    LN --> VM["MicroVM — runs one job"]
+    LN -.->|registers a single-use runner| GH
+    LN <--> DB[("DynamoDB runner table")]
+    JAN["Janitor Lambda — scheduled sweep"] -.->|reaps stranded VMs, reconciles state| VM
+    JAN <--> DB
+```
+
+<!-- sync:end lifecycle-diagram -->
+
+When GitHub sends a `workflow_job` event, the webhook handler verifies its
+signature and places the job on an SQS queue. The launcher reads the queue,
+records a claim so that a given job is only ever launched once, starts a
+MicroVM (or resumes one from a warm pool, if the runner class keeps one), and
+registers a single-use runner with GitHub. The VM runs that one job and is then
+removed. A janitor runs on a schedule to reconcile the runner set against the
+running VMs and GitHub's view of its runners, terminating anything that was
+stranded and cleaning up records that are no longer needed. The
+[architecture guide](docs/architecture.md) describes the lifecycle, the
+idempotency model, and the checks that keep the janitor from terminating a
+runner that is still working.
+
+## Install
+
+One source, compiled by jsii into two packages. The API is the same in each,
+with names rendered in the target language's conventions.
+
+```bash
+npm install cdk-github-microvm-runners
+```
+
+```bash
+pip install cdk-github-microvm-runners
+```
+
+## Getting started
+
+To deploy, you need an AWS account, a GitHub App connected to the runner set,
+and the App's private key and webhook secret stored in AWS Secrets Manager. The
+[getting-started guide](docs/getting-started.md) walks through all three, and
+includes a helper that performs the GitHub App setup for you.
+
+The example below is TypeScript; [API.md](API.md) carries the same surface for
+every language.
+
+```python
+from aws_cdk import Environment
+from aws_cdk import App, CfnOutput, Stack
+from aws_cdk.aws_secretsmanager import Secret
+from cdk_github_microvm_runners import GithubMicrovmRunners, GithubAppId, GithubAppKey, GithubAuth, RunnerScope, MicrovmSize
+
+app = App()
+stack = Stack(app, "Runners", env=Environment(region="us-east-1"))
+
+# The GitHub App's ID, private key, and webhook secret are read from Secrets
+# Manager at run time, so this stack deploys before the App is created.
+app_id = Secret.from_secret_name_v2(stack, "AppId", "microvm-runner/dev/app-id")
+private_key = Secret.from_secret_name_v2(stack, "AppKey", "microvm-runner/dev/app-private-key")
+webhook_secret = Secret.from_secret_name_v2(stack, "WebhookSecret", "microvm-runner/dev/webhook-secret")
+
+runners = GithubMicrovmRunners(stack, "Runners",
+    github=GithubAuth.app(
+        app_id=GithubAppId.from_secret(app_id),
+        private_key=GithubAppKey.from_secret(private_key),
+        webhook_secret=webhook_secret
+    ),
+    scope=RunnerScope.org("my-org")
+)
+
+# A runner class pairs a label with the MicroVM size it runs on. Workflows
+# reach it through `runs-on: [self-hosted, microvm]`.
+runners.add_runner_class("microvm", size=MicrovmSize.GB4)
+
+CfnOutput(stack, "WebhookUrl", value=runners.webhook_url)
+```
+
+Once the stack is deployed, point the GitHub App's webhook at the stack's
+`WebhookUrl` output — the setup helper reads it from the stack and wires it for
+you, or you can set it by hand — and change a workflow job's `runs-on` to
+`[self-hosted, microvm]`.
+
+## Examples
+
+The samples below extend the runner set above, and each shows only the part it
+adds.
+
+### A runner class with its own image
+
+A runner class that names no image builds from the base image, which carries
+the operating system, the Actions runner, Docker, and the AWS CLI.
+`RunnerImage.fromOptions` describes what to add to that base: system packages,
+setup commands, environment variables, and files.
+
+```python
+runners.add_runner_class("build",
+    size=MicrovmSize.GB8,
+    image=RunnerImage.from_options(
+        system_packages=["jq", "ripgrep"],
+        setup_commands=["npm install -g pnpm@10"]
+    )
+)
+```
+
+Images are built when the stack deploys, so a job that arrives later boots an
+image that already exists. [Runner images](docs/images.md) covers the three
+ways to describe one, including supplying a Dockerfile of your own.
+
+### Language versions baked into the image
+
+`actions/setup-python` and `actions/setup-node` resolve the version a job asks
+for from the image's tool cache. A toolchain is a language runtime placed in
+that cache when the image is built.
+
+```python
+runners.add_runner_class("test",
+    size=MicrovmSize.GB4,
+    image=RunnerImage.from_options(
+        toolchains=[
+            RunnerToolchain.python("3.12.7"),
+            RunnerToolchain.node("22.11.0")
+        ]
+    )
+)
+```
+
+Each toolchain pins a full three-part version, because that version names the
+cache directory it is baked into. A workflow targeting the class then writes
+`actions/setup-python` as it would on a GitHub-hosted runner, and
+[Toolchains](docs/toolchains.md) covers the rest.
+
+### Runners in your own VPC
+
+Network egress belongs to the runner set rather than to a class, and every
+runner class shares it. `RunnerNetwork.vpc` has the construct build a Lambda
+runtime connector from a VPC you pass, so the VMs follow that VPC's subnets,
+security groups, and route tables.
+
+```python
+GithubMicrovmRunners(stack, "Runners",
+    github=github,
+    scope=RunnerScope.org("my-org"),
+    network=RunnerNetwork.vpc(vpc,
+        subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS)
+    )
+)
+```
+
+The connector's network interfaces land in the VPC's private-with-egress
+subnets and get a new security group unless you pass your own. The
+[security guide](docs/security.md) covers attaching a connector you already
+manage, and what the VPC's routing then decides for a job.
+
+## Security
+
+The runner VMs carry no AWS identity by default, so a compromised or malicious
+workflow step has no credentials to read from the instance metadata service. A
+job that needs AWS assumes a role scoped to that job through GitHub OIDC. The
+[security guide](docs/security.md) covers the whole model, including the OIDC
+trust-policy setup and the details that are easy to get wrong.
+
+The webhook is served from a public Lambda Function URL, because GitHub cannot
+sign its webhook deliveries with SigV4. The handler verifies GitHub's
+HMAC-SHA256 signature on every request.
+
+A single property attaches an execution role to the VMs — `vmExecutionRole` —
+for a runner set whose jobs need a standing AWS identity. Because that role's
+credentials become readable from inside the job, it is off by default, and the
+construct never creates a VM identity on your behalf. Runtime console capture
+(`consoleLogs: ConsoleLogs.enabled()`) writes its logs through that same role,
+so it too requires `vmExecutionRole`, and you grant the role the log-write
+actions yourself.
+
+## Documentation
+
+| Guide                                                                                        | What it covers                                                                                 |
+| -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| [Getting started](docs/getting-started.md)                                                   | Prerequisites, GitHub App setup, deploying, and running a first job                            |
+| [Onboarding a repo](docs/onboarding.md)                                                      | Moving an existing repository's CI onto the runners                                            |
+| [Runner images](docs/images.md)                                                              | What an image contains, when it is built, how it changes, and the disk each size allows        |
+| [Toolchains](docs/toolchains.md)                                                             | Baking the Python and Node versions your workflows use into the image                          |
+| [Security](docs/security.md)                                                                 | The security model, per-job AWS access through GitHub OIDC, and the control plane              |
+| [Service quotas](docs/service-quotas.md)                                                     | Sizing for concurrency, and what to do when a quota cannot be raised                           |
+| [Monitoring](docs/monitoring.md)                                                             | Opt-in CloudWatch metrics and the ready-made alarms                                            |
+| [Logging](docs/logging.md)                                                                   | Image build logs and runtime VM console output, and the tradeoff console capture involves      |
+| [Architecture](docs/architecture.md)                                                         | The lifecycle, the idempotency model, and the checks that prevent terminating an active runner |
+| [API reference](API.md)                                                                      | Every construct, property, and default, generated from the source                              |
+| [Security policy](SECURITY.md) · [Contributing](CONTRIBUTING.md) · [Changelog](CHANGELOG.md) | Reporting and project information                                                              |
+
+## Configuration
+
+Beyond the two required properties, every option is optional and has a
+conservative default, so the example above deploys as written. The available
+options include a customer-managed KMS key applied to the
+DynamoDB table, the SQS queues, and the log groups (`encryptionKey`); a
+permissions boundary applied to every role the construct creates
+(`permissionsBoundary`); the removal policy, DynamoDB point-in-time recovery,
+log retention, dead-letter retention, dead-letter redrive count, and Lambda
+memory; and control over the VMs' network egress through `RunnerNetwork`.
+
+## Development
+
+Quality checks run through [`just`](https://github.com/casey/just) and are
+enforced by [lefthook](https://github.com/evilmartians/lefthook) git hooks; CI
+runs the same `just verify`.
+
+```bash
+brew install just lefthook
+pnpm install
+lefthook install
+just verify
+```
+
+<!-- sync:begin branch-model -->
+
+Feature pull requests target `dev`, which is promoted to `main` by pull
+request.
+
+<!-- sync:end branch-model -->
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for local setup and the full workflow.
+
+## License
+
+Released under the [Apache-2.0](LICENSE) license.
+'''
+from __future__ import annotations
+
+from pkgutil import extend_path
+__path__ = extend_path(__path__, __name__)
+
+import abc
+import builtins
+import datetime
+import enum
+import typing
+
+import jsii
+import publication
+import typing_extensions
+
+from jsii._type_checking import cached_type_hints, check_type
+
+
+from ._jsii import *
+
+class _LazyImport:
+    def __init__(self, module_name: str) -> None:
+        self._module_name = module_name
+        self._module: typing.Any = None
+    def __getattr__(self, name: str) -> typing.Any:
+        if self._module is None:
+            import importlib
+            self._module = importlib.import_module(self._module_name)
+        return getattr(self._module, name)
+
+if typing.TYPE_CHECKING:
+
+    import aws_cdk as _aws_cdk_ceddda9d
+    import aws_cdk.aws_cloudwatch as _aws_cdk_aws_cloudwatch_ceddda9d
+    import aws_cdk.aws_dynamodb as _aws_cdk_aws_dynamodb_ceddda9d
+    import aws_cdk.aws_ec2 as _aws_cdk_aws_ec2_ceddda9d
+    import aws_cdk.aws_iam as _aws_cdk_aws_iam_ceddda9d
+    import aws_cdk.aws_kms as _aws_cdk_aws_kms_ceddda9d
+    import aws_cdk.aws_lambda as _aws_cdk_aws_lambda_ceddda9d
+    import aws_cdk.aws_logs as _aws_cdk_aws_logs_ceddda9d
+    import aws_cdk.aws_secretsmanager as _aws_cdk_aws_secretsmanager_ceddda9d
+    import aws_cdk.aws_sqs as _aws_cdk_aws_sqs_ceddda9d
+    import constructs as _constructs_77d1e7e8
+else:
+
+    _aws_cdk_aws_cloudwatch_ceddda9d = _LazyImport("aws_cdk.aws_cloudwatch")
+    _aws_cdk_aws_dynamodb_ceddda9d = _LazyImport("aws_cdk.aws_dynamodb")
+    _aws_cdk_aws_ec2_ceddda9d = _LazyImport("aws_cdk.aws_ec2")
+    _aws_cdk_aws_iam_ceddda9d = _LazyImport("aws_cdk.aws_iam")
+    _aws_cdk_aws_kms_ceddda9d = _LazyImport("aws_cdk.aws_kms")
+    _aws_cdk_aws_lambda_ceddda9d = _LazyImport("aws_cdk.aws_lambda")
+    _aws_cdk_aws_logs_ceddda9d = _LazyImport("aws_cdk.aws_logs")
+    _aws_cdk_aws_secretsmanager_ceddda9d = _LazyImport("aws_cdk.aws_secretsmanager")
+    _aws_cdk_aws_sqs_ceddda9d = _LazyImport("aws_cdk.aws_sqs")
+    _aws_cdk_ceddda9d = _LazyImport("aws_cdk")
+    _constructs_77d1e7e8 = _LazyImport("constructs")
+
+
+class ConsoleLogs(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.ConsoleLogs",
+):
+    '''Runtime console capture for a runner set: everything a VM prints while it boots, runs the runner agent, and runs the job.
+
+    Off unless you add it.
+
+    Console capture needs a VM execution role. The platform writes these logs
+    with the VM's own role, and the construct never creates a VM identity on
+    your behalf, so a runner set that turns console capture on without
+    ``vmExecutionRole`` fails at synth. The two console-write actions on the group
+    are granted by you as well, since the construct does not add policy to a
+    role it did not create::
+
+       runners.vm_console_log_group.grant(role, "logs:CreateLogStream", "logs:PutLogEvents")
+
+    A MicroVM's instance metadata service serves the execution role's
+    credentials to arbitrary job code, so whatever that role can do, every job
+    running on this runner set can do. Console capture on its own needs nothing
+    beyond the two log-write actions above. Job code can also write whatever it
+    likes into the console group, so the contents are as trustworthy as the jobs
+    that produced them.
+
+    ``ImageLogs`` covers the build-time counterpart and needs no role. The two are
+    independent and can both be on.
+
+    Example::
+
+        GithubMicrovmRunners(stack, "Runners",
+            github=github,
+            scope=scope,
+            vm_execution_role=role,
+            console_logs=ConsoleLogs.enabled()
+        )
+    '''
+
+    @jsii.member(jsii_name="enabled")
+    @builtins.classmethod
+    def enabled(
+        cls,
+        log_group: typing.Optional["_aws_cdk_aws_logs_ceddda9d.ILogGroup"] = None,
+    ) -> "ConsoleLogs":
+        '''Capture the runtime console.
+
+        With no argument the construct creates a log
+        group and exposes it as ``runners.vmConsoleLogGroup``. Pass an ``ILogGroup``
+        to use one whose retention and KMS key you control. Either way the runner
+        set needs ``vmExecutionRole``, and that role needs the two console-write
+        actions on the group.
+
+        :param log_group: destination group. Omitted, the construct creates one with the runner set's ``logRetention`` (two weeks by default).
+
+        Example::
+
+            console_capture = ConsoleLogs.enabled(my_console_log_group)
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__0548cfa81769608b199a2a959830e9d47b13bb916b5f4181e977c1f03bfa81c7)
+            check_type(argname="argument log_group", value=log_group, expected_type=type_hints["log_group"])
+        return typing.cast("ConsoleLogs", jsii.sinvoke(cls, "enabled", [log_group]))
+
+    @builtins.property
+    @jsii.member(jsii_name="logGroup")
+    def log_group(self) -> typing.Optional["_aws_cdk_aws_logs_ceddda9d.ILogGroup"]:
+        '''The group console output goes to, when one was passed to ``ConsoleLogs.enabled()``. ``undefined`` means the construct creates one.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_logs_ceddda9d.ILogGroup"], jsii.get(self, "logGroup"))
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.GithubAppAuthProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "app_id": "appId",
+        "private_key": "privateKey",
+        "webhook_secret": "webhookSecret",
+    },
+)
+class GithubAppAuthProps:
+    def __init__(
+        self,
+        *,
+        app_id: "GithubAppId",
+        private_key: "GithubAppKey",
+        webhook_secret: "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret",
+    ) -> None:
+        '''Props for ``GithubAuth.app``.
+
+        :param app_id: The GitHub App's numeric ID, as a literal or a Secrets Manager reference.
+        :param private_key: The App's private key, backed by a secret or a KMS key.
+        :param webhook_secret: Secret holding the webhook secret used to validate inbound deliveries.
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__e6e950b235861eb6ceb59c62bebf431836fac157088b1334fedf915b19dec8a0)
+            check_type(argname="argument app_id", value=app_id, expected_type=type_hints["app_id"])
+            check_type(argname="argument private_key", value=private_key, expected_type=type_hints["private_key"])
+            check_type(argname="argument webhook_secret", value=webhook_secret, expected_type=type_hints["webhook_secret"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "app_id": app_id,
+            "private_key": private_key,
+            "webhook_secret": webhook_secret,
+        }
+
+    @builtins.property
+    def app_id(self) -> "GithubAppId":
+        '''The GitHub App's numeric ID, as a literal or a Secrets Manager reference.'''
+        result = self._values.get("app_id")
+        assert result is not None, "Required property 'app_id' is missing"
+        return typing.cast("GithubAppId", result)
+
+    @builtins.property
+    def private_key(self) -> "GithubAppKey":
+        '''The App's private key, backed by a secret or a KMS key.'''
+        result = self._values.get("private_key")
+        assert result is not None, "Required property 'private_key' is missing"
+        return typing.cast("GithubAppKey", result)
+
+    @builtins.property
+    def webhook_secret(self) -> "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret":
+        '''Secret holding the webhook secret used to validate inbound deliveries.'''
+        result = self._values.get("webhook_secret")
+        assert result is not None, "Required property 'webhook_secret' is missing"
+        return typing.cast("_aws_cdk_aws_secretsmanager_ceddda9d.ISecret", result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "GithubAppAuthProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class GithubAppId(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.GithubAppId",
+):
+    '''Where a GitHub App's numeric ID comes from: a literal known at synth time, or a Secrets Manager secret read at runtime.
+
+    The secret form makes setup single-pass. A GitHub App can only be created
+    once the runner set's webhook URL exists, so an App ID that has to be known
+    at synth means deploying twice. Referencing the ID by secret, the way the
+    private key and webhook secret already are, lets you deploy, then create the
+    App and write its ID into the secret, with no redeploy.
+
+    Build one with the static factories below; the constructor is private.
+
+    Example::
+
+        app_id = GithubAppId.from_secret(
+            Secret.from_secret_name_v2(stack, "AppId", "microvm-runner/dev/app-id"))
+    '''
+
+    @jsii.member(jsii_name="fromSecret")
+    @builtins.classmethod
+    def from_secret(
+        cls,
+        secret: "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret",
+    ) -> "GithubAppId":
+        '''The App ID is read at runtime from a Secrets Manager secret whose value is the numeric ID.
+
+        The secret need not exist at deploy time.
+
+        :param secret: -
+
+        Example::
+
+            app_id = GithubAppId.from_secret(
+                Secret.from_secret_name_v2(stack, "AppId", "microvm-runner/dev/app-id"))
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__aba0941864c428347812aa10a096b18df3ae77616773316bd134e2764ae2657c)
+            check_type(argname="argument secret", value=secret, expected_type=type_hints["secret"])
+        return typing.cast("GithubAppId", jsii.sinvoke(cls, "fromSecret", [secret]))
+
+    @jsii.member(jsii_name="fromValue")
+    @builtins.classmethod
+    def from_value(cls, value: builtins.str) -> "GithubAppId":
+        '''The App ID is a literal string known at synth time.
+
+        :param value: -
+
+        Example::
+
+            app_id = GithubAppId.from_value("123456")
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__6b22d9ed14d289886f4ed34dc8cfd25d58e6bbda42419d5097a7a73ea48bd10f)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        return typing.cast("GithubAppId", jsii.sinvoke(cls, "fromValue", [value]))
+
+    @builtins.property
+    @jsii.member(jsii_name="secret")
+    def secret(self) -> typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"]:
+        '''The secret holding the ID, for an ID built with ``fromSecret()``.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"], jsii.get(self, "secret"))
+
+    @builtins.property
+    @jsii.member(jsii_name="value")
+    def value(self) -> typing.Optional[builtins.str]:
+        '''The literal ID, for an ID built with ``fromValue()``.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "value"))
+
+
+class GithubAppKey(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.GithubAppKey",
+):
+    '''Where a GitHub App's private key lives: a Secrets Manager secret holding the PEM, or a KMS key that signs the App's JWTs directly.
+
+    Build one with the static factories below; the constructor is private.
+
+    Example::
+
+        private_key = GithubAppKey.from_secret(
+            Secret.from_secret_name_v2(stack, "AppKey", "microvm-runner/dev/app-private-key"))
+    '''
+
+    @jsii.member(jsii_name="fromKmsKey")
+    @builtins.classmethod
+    def from_kms_key(cls, key: "_aws_cdk_aws_kms_ceddda9d.IKey") -> "GithubAppKey":
+        '''The App's private key lives in KMS and is used via ``kms:Sign``.
+
+        :param key: -
+
+        Example::
+
+            from aws_cdk.aws_kms import Key
+            
+            
+            private_key = GithubAppKey.from_kms_key(
+                Key.from_key_arn(stack, "AppKey", "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"))
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__cc9961f681c63592cc8d260fe3e536a71239765b00a83bdec348eff483581f2b)
+            check_type(argname="argument key", value=key, expected_type=type_hints["key"])
+        return typing.cast("GithubAppKey", jsii.sinvoke(cls, "fromKmsKey", [key]))
+
+    @jsii.member(jsii_name="fromSecret")
+    @builtins.classmethod
+    def from_secret(
+        cls,
+        secret: "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret",
+    ) -> "GithubAppKey":
+        '''The App's private key is stored as a PEM in Secrets Manager.
+
+        :param secret: -
+
+        Example::
+
+            private_key = GithubAppKey.from_secret(
+                Secret.from_secret_name_v2(stack, "AppKey", "microvm-runner/dev/app-private-key"))
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__b690547df91198ce68555c0eef4906781d6764b68601422750750169edd60220)
+            check_type(argname="argument secret", value=secret, expected_type=type_hints["secret"])
+        return typing.cast("GithubAppKey", jsii.sinvoke(cls, "fromSecret", [secret]))
+
+    @builtins.property
+    @jsii.member(jsii_name="kmsKey")
+    def kms_key(self) -> typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"]:
+        '''The signing key, for a key built with ``fromKmsKey()``.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"], jsii.get(self, "kmsKey"))
+
+    @builtins.property
+    @jsii.member(jsii_name="secret")
+    def secret(self) -> typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"]:
+        '''The secret holding the PEM, for a key built with ``fromSecret()``.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"], jsii.get(self, "secret"))
+
+
+class GithubAuth(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.GithubAuth",
+):
+    '''How a runner set authenticates to GitHub: as a GitHub App, whose private key is backed by a secret or a KMS key, or with a personal access token.
+
+    Either
+    form also carries the webhook secret that inbound GitHub deliveries are
+    validated against.
+
+    Build one with the static factories below; the constructor is private.
+
+    Example::
+
+        auth = GithubAuth.app(
+            app_id=GithubAppId.from_secret(
+                Secret.from_secret_name_v2(stack, "AppId", "microvm-runner/dev/app-id")),
+            private_key=GithubAppKey.from_secret(
+                Secret.from_secret_name_v2(stack, "AppKey", "microvm-runner/dev/app-private-key")),
+            webhook_secret=Secret.from_secret_name_v2(stack, "WebhookSecret", "microvm-runner/dev/webhook-secret")
+        )
+    '''
+
+    @jsii.member(jsii_name="app")
+    @builtins.classmethod
+    def app(
+        cls,
+        *,
+        app_id: "GithubAppId",
+        private_key: "GithubAppKey",
+        webhook_secret: "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret",
+    ) -> "GithubAuth":
+        '''Authenticate as a GitHub App.
+
+        :param app_id: The GitHub App's numeric ID, as a literal or a Secrets Manager reference.
+        :param private_key: The App's private key, backed by a secret or a KMS key.
+        :param webhook_secret: Secret holding the webhook secret used to validate inbound deliveries.
+
+        Example::
+
+            auth = GithubAuth.app(
+                app_id=GithubAppId.from_secret(
+                    Secret.from_secret_name_v2(stack, "AppId", "microvm-runner/dev/app-id")),
+                private_key=GithubAppKey.from_secret(
+                    Secret.from_secret_name_v2(stack, "AppKey", "microvm-runner/dev/app-private-key")),
+                webhook_secret=Secret.from_secret_name_v2(stack, "WebhookSecret", "microvm-runner/dev/webhook-secret")
+            )
+        '''
+        props = GithubAppAuthProps(
+            app_id=app_id, private_key=private_key, webhook_secret=webhook_secret
+        )
+
+        return typing.cast("GithubAuth", jsii.sinvoke(cls, "app", [props]))
+
+    @jsii.member(jsii_name="pat")
+    @builtins.classmethod
+    def pat(
+        cls,
+        *,
+        token: "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret",
+        webhook_secret: "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret",
+    ) -> "GithubAuth":
+        '''Authenticate with a personal access token.
+
+        :param token: Secret holding a GitHub personal access token.
+        :param webhook_secret: Secret holding the webhook secret used to validate inbound deliveries.
+
+        Example::
+
+            auth = GithubAuth.pat(
+                token=Secret.from_secret_name_v2(stack, "Pat", "microvm-runner/dev/token"),
+                webhook_secret=Secret.from_secret_name_v2(stack, "WebhookSecret", "microvm-runner/dev/webhook-secret")
+            )
+        '''
+        props = GithubPatAuthProps(token=token, webhook_secret=webhook_secret)
+
+        return typing.cast("GithubAuth", jsii.sinvoke(cls, "pat", [props]))
+
+    @jsii.member(jsii_name="bindEnv")
+    def bind_env(self) -> typing.Mapping[builtins.str, builtins.str]:
+        '''Serialize to the environment variables the runner set's handlers read: ``GH_AUTH_KIND``, ``GH_APP_ID`` or ``GH_APP_ID_SECRET_ARN``, ``GH_KEY_SECRET_ARN`` or ``GH_KEY_KMS_ARN``, ``GH_PAT_SECRET_ARN``, and ``GH_WEBHOOK_SECRET_ARN``.
+
+        Entries that do not apply are left out.
+        '''
+        return typing.cast(typing.Mapping[builtins.str, builtins.str], jsii.invoke(self, "bindEnv", []))
+
+    @jsii.member(jsii_name="grantRead")
+    def grant_read(self, grantee: "_aws_cdk_aws_iam_ceddda9d.IGrantable") -> None:
+        '''Grant ``grantee`` read access to whichever credentials this auth carries: the App's secret-backed key and/or ``kms:Sign`` on its KMS key, plus its secret-backed App ID when one is used, or the PAT secret — plus, in every case, read access to the webhook secret.
+
+        This is the full set, for a handler that has to act as the App. A handler
+        that only verifies signatures wants {@link grantReadWebhookSecret}.
+
+        :param grantee: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__970e66a646e2fc86c035066057cff7cd247b431b227ac9f2d5a8c86ed710c988)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(None, jsii.invoke(self, "grantRead", [grantee]))
+
+    @jsii.member(jsii_name="grantReadWebhookSecret")
+    def grant_read_webhook_secret(
+        self,
+        grantee: "_aws_cdk_aws_iam_ceddda9d.IGrantable",
+    ) -> None:
+        '''Grant ``grantee`` read access to the webhook secret, and nothing else.
+
+        This is all a handler needs to verify the HMAC signature GitHub sends with
+        every delivery. It is deliberately separate from {@link grantRead}, which
+        also hands over the credentials that can act AS the App — minting
+        installation tokens, registering runners. A component that only checks
+        signatures and enqueues has no use for those, and the webhook handler is
+        the one component reachable from the public internet.
+
+        :param grantee: -
+
+        Example::
+
+            github.grant_read_webhook_secret(role)
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__80b1bb7036f50148e74587e4f8bac689760f9f314afddfa588fbc2a86d5062dd)
+            check_type(argname="argument grantee", value=grantee, expected_type=type_hints["grantee"])
+        return typing.cast(None, jsii.invoke(self, "grantReadWebhookSecret", [grantee]))
+
+    @builtins.property
+    @jsii.member(jsii_name="kind")
+    def kind(self) -> "GithubAuthKind":
+        '''Whether this is App or personal-access-token authentication.'''
+        return typing.cast("GithubAuthKind", jsii.get(self, "kind"))
+
+    @builtins.property
+    @jsii.member(jsii_name="webhookSecret")
+    def webhook_secret(self) -> "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret":
+        '''Secret holding the webhook secret inbound deliveries are validated against.'''
+        return typing.cast("_aws_cdk_aws_secretsmanager_ceddda9d.ISecret", jsii.get(self, "webhookSecret"))
+
+    @builtins.property
+    @jsii.member(jsii_name="appId")
+    def app_id(self) -> typing.Optional["GithubAppId"]:
+        '''The App's ID, for App authentication.'''
+        return typing.cast(typing.Optional["GithubAppId"], jsii.get(self, "appId"))
+
+    @builtins.property
+    @jsii.member(jsii_name="privateKey")
+    def private_key(self) -> typing.Optional["GithubAppKey"]:
+        '''The App's private key, for App authentication.'''
+        return typing.cast(typing.Optional["GithubAppKey"], jsii.get(self, "privateKey"))
+
+    @builtins.property
+    @jsii.member(jsii_name="token")
+    def token(self) -> typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"]:
+        '''The personal access token secret, for token authentication.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_secretsmanager_ceddda9d.ISecret"], jsii.get(self, "token"))
+
+
+@jsii.enum(jsii_type="cdk-github-microvm-runners.GithubAuthKind")
+class GithubAuthKind(enum.Enum):
+    '''Which credential flow a ``GithubAuth`` represents.'''
+
+    APP = "APP"
+    '''A GitHub App.'''
+    PAT = "PAT"
+    '''A personal access token.'''
+
+
+class GithubMicrovmRunners(
+    _constructs_77d1e7e8.Construct,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.GithubMicrovmRunners",
+):
+    '''A runner set: one deployment of GitHub Actions runners that run on AWS Lambda MicroVMs, with a fresh VM per job that is thrown away when the job ends.
+
+    The construct deploys a webhook handler for GitHub's ``workflow_job``
+    deliveries, a queue those deliveries become launch and terminate intents on,
+    a launcher that starts a VM and registers it with GitHub for each queued
+    job, and a janitor that sweeps on a schedule for VMs and runners that
+    outlived their job. Every runner class registered through
+    ``addRunnerClass`` adds an image build of its own, and a runner set needs
+    at least one class to synthesize.
+
+    Deploying it takes two props: how to authenticate to GitHub, and which
+    GitHub scope the runners register into. The VMs themselves carry no AWS
+    identity unless ``GithubMicrovmRunnersProps.vmExecutionRole`` gives them
+    one.
+
+    Example::
+
+        runner_set = GithubMicrovmRunners(stack, "Runners",
+            github=GithubAuth.app(
+                app_id=GithubAppId.from_secret(
+                    Secret.from_secret_name_v2(stack, "AppId", "microvm-runner/dev/app-id")),
+                private_key=GithubAppKey.from_secret(
+                    Secret.from_secret_name_v2(stack, "AppKey", "microvm-runner/dev/app-private-key")),
+                webhook_secret=Secret.from_secret_name_v2(stack, "WebhookSecret", "microvm-runner/dev/webhook-secret")
+            ),
+            scope=RunnerScope.org("my-org")
+        )
+        
+        runner_set.add_runner_class("microvm", size=MicrovmSize.GB4)
+    '''
+
+    def __init__(
+        self,
+        scope_: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        github: "GithubAuth",
+        scope: "RunnerScope",
+        additional_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
+        console_logs: typing.Optional["ConsoleLogs"] = None,
+        dead_letter_retention: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        emit_metrics: typing.Optional[builtins.bool] = None,
+        encryption_key: typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"] = None,
+        idle_runner_grace_seconds: typing.Optional[jsii.Number] = None,
+        image_logs: typing.Optional["ImageLogs"] = None,
+        janitor_interval: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        keep_image_versions: typing.Optional[jsii.Number] = None,
+        lambda_memory_size: typing.Optional[jsii.Number] = None,
+        log_retention: typing.Optional["_aws_cdk_aws_logs_ceddda9d.RetentionDays"] = None,
+        max_concurrent_vms: typing.Optional[jsii.Number] = None,
+        max_job_duration: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        max_receive_count: typing.Optional[jsii.Number] = None,
+        network: typing.Optional["RunnerNetwork"] = None,
+        permissions_boundary: typing.Optional["_aws_cdk_aws_iam_ceddda9d.IManagedPolicy"] = None,
+        point_in_time_recovery: typing.Optional[builtins.bool] = None,
+        recover_stuck_launches: typing.Optional[builtins.bool] = None,
+        removal_policy: typing.Optional["_aws_cdk_ceddda9d.RemovalPolicy"] = None,
+        vm_execution_role: typing.Optional["_aws_cdk_aws_iam_ceddda9d.IRole"] = None,
+        warm_pool_interval: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        webhook: typing.Optional["WebhookEndpoint"] = None,
+        webhook_reserved_concurrency: typing.Optional[jsii.Number] = None,
+    ) -> None:
+        '''
+        :param scope_: -
+        :param id: -
+        :param github: How the runner set authenticates to GitHub, as an App or with a personal access token. This also carries the webhook secret.
+        :param scope: Which GitHub scope, an organization or a list of repositories, registered runners are visible to.
+        :param additional_regions: Additional regions to accept as Lambda MicroVMs regions, beyond the ones this library already knows about. Deploying into a region on neither list fails at synth. Default: [] (only the regions this library knows about)
+        :param console_logs: Where a VM's runtime console goes: everything it prints while it boots, runs the runner agent, and runs the job. ``ConsoleLogs.enabled()`` has the construct create the group and expose it as ``vmConsoleLogGroup``, and ``ConsoleLogs.enabled(logGroup)`` uses one you control. The platform writes these logs with the VM's own role, so this requires ``vmExecutionRole``; see ``ConsoleLogs`` for what that role means for job code. Independent of ``imageLogs``. Default: undefined (no runtime console capture)
+        :param dead_letter_retention: How long the dead-letter queue retains a failed launch or terminate intent. SQS allows up to 14 days, which is also how long ``recoverStuckLaunches`` has to re-drive a message before SQS drops it. Default: Duration.days(4) (SQS default)
+        :param emit_metrics: Report this runner set's CloudWatch custom metrics. Those are the janitor's per-sweep counters, the launcher's per-launch outcomes and spin-up timings, and the warm pool's fill numbers — everything ``GithubMicrovmRunnersMetrics`` names. With this off the handlers report none of them. CloudWatch bills custom metrics per metric per month, and this runner set's bill is not a fixed number: the launcher and warm-pool metrics carry a runner-class dimension, so each one becomes a separate billable metric per registered runner class. The two alarms backed by these metrics, ``sweepErrorsAlarm`` and ``stuckLaunchesRecoveredAlarm``, throw at synth unless this is on, since the metric they watch would never report. ``deadLetterQueueNotEmptyAlarm`` watches an SQS metric and works either way. The metric accessors on ``GithubMicrovmRunnersMetrics`` return a ``Metric`` regardless, so a dashboard can be built ahead of turning metrics on. Default: false (no metrics emitted)
+        :param encryption_key: Customer-managed KMS key for this runner set's data at rest: the DynamoDB runner table, the SQS job queue and dead-letter queue, and any log group this construct creates. Log groups you bring yourself, and the GitHub secrets you pass in, keep their own keys. Default: undefined (AWS-managed keys)
+        :param idle_runner_grace_seconds: How many seconds a registered runner may sit idle before the janitor's two-strike sweep treats it as stuck. Default: 600
+        :param image_logs: Where build-time image logs go: the Docker build layers and the ready-probe banner from each image build. ``ImageLogs.enabled()`` sends them to the platform's own CloudWatch group, and ``ImageLogs.enabled(logGroup)`` to a group whose retention and KMS key you control. These are written by the image build role rather than by a VM, so they need no VM execution role. Independent of ``consoleLogs``. Default: undefined (no image logs)
+        :param janitor_interval: How often the janitor sweep runs. Default: Duration.minutes(5)
+        :param keep_image_versions: How many MicroVM image versions to keep per runner class. The janitor prunes inactive versions past this count. Default: 5
+        :param lambda_memory_size: Memory, in MiB, for the handler Lambdas: the webhook, the launcher, the janitor, and the warm pool. The janitor's sweep scans the runner table and reconciles every running VM, so it is the handler most sensitive to this on a busy runner set. Default: 128
+        :param log_retention: Retention for the CloudWatch log groups this construct creates: the handler Lambda log groups and, when console capture is on, the VM console group. Default: logs.RetentionDays.TWO_WEEKS
+        :param max_concurrent_vms: Maximum number of MicroVMs this runner set runs at once. Default: 10
+        :param max_job_duration: How long a job may run before its MicroVM is terminated. The VM is killed five minutes after this value, not at it. The runner set asks the platform for ``maxJobDuration + 5 minutes``, so that a job which reaches its own limit is stopped by the runner — which reports the timeout to GitHub and lets the VM come down cleanly — rather than by the platform removing the machine underneath it. Treat the five minutes as headroom for that shutdown rather than as extra running time. Default: Duration.hours(6)
+        :param max_receive_count: How many times a launch intent is redriven before it dead-letters. A runner set already at ``maxConcurrentVms`` redrives capacity-rejected launches through this same budget, so on a runner set that regularly runs at capacity this count is how long a queued job waits before its launch is dropped. See docs/service-quotas.md. Default: 20
+        :param network: How launched MicroVMs and image builds reach the network. Default: RunnerNetwork.internetEgress()
+        :param permissions_boundary: Permissions boundary applied to every IAM role this construct creates: the handler execution roles, the per-class image build roles, and the network-connector operator role. It is applied once at construct scope, so roles created later also carry it — the warm-pool handler's role, and the build role of any runner class registered after construction. Default: undefined (no boundary)
+        :param point_in_time_recovery: Turn on DynamoDB point-in-time recovery for the runner table. Default: false
+        :param recover_stuck_launches: Recover launches that dead-lettered while GitHub Actions was down. Each janitor sweep re-drives dead-lettered launch messages back onto the job queue, but only for jobs GitHub still reports as queued; a launch whose job has since completed or been cancelled is discarded rather than booting a VM for work nobody is waiting on. Recovery happens once an outage ends, since GitHub dispatches no jobs while it is down. The janitor counts each recovered launch under the ``stuckLaunchesRecovered`` metric, which reports when ``emitMetrics`` is on. Default: false
+        :param removal_policy: Removal policy for this runner set's stateful resources: the runner table and any log group the construct creates. The table holds correlation data for VMs that are currently running, all of which the janitor can rebuild from the MicroVM and GitHub APIs. Default: RemovalPolicy.DESTROY
+        :param vm_execution_role: An AWS identity for this runner set's runner VMs. By default the VMs carry no AWS identity at all: the runner agent talks outbound to GitHub, the just-in-time registration is pushed to the VM over a platform-authenticated channel, and a job that needs AWS assumes its own role through GitHub OIDC. With a role attached, the MicroVM's instance metadata service serves that role's credentials to arbitrary job code, so every job running on this runner set can do whatever the role can do. ``consoleLogs`` requires a role, because the platform writes a VM's console output using it. Default: undefined (the VMs carry no AWS identity)
+        :param warm_pool_interval: How often the warm-pool sweep refills pre-booted VMs. It applies only to runner classes that set ``RunnerClassProps.warmPoolSize``, and the warm-pool handler and its schedule are only created once such a class is registered. A runner set with no warm class never runs this sweep, and never reads this value. Default: Duration.minutes(2)
+        :param webhook: How the webhook handler is exposed to GitHub. Default: WebhookEndpoint.functionUrl()
+        :param webhook_reserved_concurrency: Reserved concurrency for the webhook Lambda, which caps how many webhook deliveries the runner set processes at once. Reserved concurrency is carved out of the account's shared pool of unreserved concurrency, so a runner set that sets it takes that capacity away from every other function in the account. Must be a positive integer when set, since ``0`` would disable the webhook entirely. Default: undefined (no reservation; the webhook draws from the shared pool)
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__f9ccf90cd58a24eaea8e05c002c729a7c0b56c6afdd04d8cd485938eed8facc5)
+            check_type(argname="argument scope_", value=scope_, expected_type=type_hints["scope_"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = GithubMicrovmRunnersProps(
+            github=github,
+            scope=scope,
+            additional_regions=additional_regions,
+            console_logs=console_logs,
+            dead_letter_retention=dead_letter_retention,
+            emit_metrics=emit_metrics,
+            encryption_key=encryption_key,
+            idle_runner_grace_seconds=idle_runner_grace_seconds,
+            image_logs=image_logs,
+            janitor_interval=janitor_interval,
+            keep_image_versions=keep_image_versions,
+            lambda_memory_size=lambda_memory_size,
+            log_retention=log_retention,
+            max_concurrent_vms=max_concurrent_vms,
+            max_job_duration=max_job_duration,
+            max_receive_count=max_receive_count,
+            network=network,
+            permissions_boundary=permissions_boundary,
+            point_in_time_recovery=point_in_time_recovery,
+            recover_stuck_launches=recover_stuck_launches,
+            removal_policy=removal_policy,
+            vm_execution_role=vm_execution_role,
+            warm_pool_interval=warm_pool_interval,
+            webhook=webhook,
+            webhook_reserved_concurrency=webhook_reserved_concurrency,
+        )
+
+        jsii.create(self.__class__, self, [scope_, id, props])
+
+    @jsii.member(jsii_name="addRunnerClass")
+    def add_runner_class(
+        self,
+        label: builtins.str,
+        *,
+        size: "MicrovmSize",
+        idle_policy: typing.Optional[typing.Union["MicrovmIdlePolicy", typing.Dict[builtins.str, typing.Any]]] = None,
+        image: typing.Optional["RunnerImage"] = None,
+        warm_pool_size: typing.Optional[jsii.Number] = None,
+    ) -> "RunnerClass":
+        '''Register a runner class: the ``runs-on`` label a workflow targets, paired with the VM size, and optionally the image, that jobs carrying that label run on.
+
+        Each class builds its own image. A runner set needs at least one
+        class, and one that reaches synth with none fails.
+
+        Classes can be registered at any point before synth. Everything that
+        depends on the full set of them — which labels the webhook accepts, which
+        image each label launches, and the janitor's access to each class's image
+        — is resolved once, after the last call.
+
+        Setting ``warmPoolSize`` on a class keeps that many pre-booted VMs ready for
+        it. The first class to do so creates the warm-pool handler and its
+        schedule, which every later warm class then shares.
+
+        :param label: the ``runs-on`` label workflows use to target this class.
+        :param size: VM memory floor for this class.
+        :param idle_policy: Auto-suspend and auto-resume policy for this class's cold-launched VMs. Mutually exclusive with ``warmPoolSize`` on the same class, since both drive the VM's suspended state; setting both throws at ``addRunnerClass`` time. Default: undefined (no idle policy; the platform never auto-suspends)
+        :param image: Image this class builds from. Default: RunnerImage.fromOptions()
+        :param warm_pool_size: How many pre-booted, suspended VMs to keep ready for this class. A job that matches this class resumes one of them instead of cold-launching a new VM, and falls back to a cold launch when none is available. This is a count, not a flag: ``warmPoolSize: 3`` keeps three VMs ready. The runner set refills the pool on the ``warmPoolInterval`` schedule. Default: undefined (no warm pool; every job cold-launches)
+
+        :return:
+
+        the registered ``RunnerClass``, carrying its label, size,
+        image pipeline, and image ARN.
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__48e77fc4d43555e4d6ac3d9e5b13de1cbbb1ef807cfc4ce1e0688ac170b863d1)
+            check_type(argname="argument label", value=label, expected_type=type_hints["label"])
+        props = RunnerClassProps(
+            size=size,
+            idle_policy=idle_policy,
+            image=image,
+            warm_pool_size=warm_pool_size,
+        )
+
+        return typing.cast("RunnerClass", jsii.invoke(self, "addRunnerClass", [label, props]))
+
+    @jsii.member(jsii_name="runnerClass")
+    def runner_class(self, label: builtins.str) -> "RunnerClass":
+        '''The registered ``RunnerClass`` carrying ``label``.
+
+        Throws when no class
+        with that label has been registered.
+
+        :param label: the ``runs-on`` label the class was registered under.
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__e74a92121e3eaec69c4009cc027a299a12257a68eccc613318213d92545265f4)
+            check_type(argname="argument label", value=label, expected_type=type_hints["label"])
+        return typing.cast("RunnerClass", jsii.invoke(self, "runnerClass", [label]))
+
+    @builtins.property
+    @jsii.member(jsii_name="deadLetterQueue")
+    def dead_letter_queue(self) -> "_aws_cdk_aws_sqs_ceddda9d.IQueue":
+        '''Dead-letter queue holding job-queue messages that ran out of redrives.'''
+        return typing.cast("_aws_cdk_aws_sqs_ceddda9d.IQueue", jsii.get(self, "deadLetterQueue"))
+
+    @builtins.property
+    @jsii.member(jsii_name="defaultImageArn")
+    def default_image_arn(self) -> builtins.str:
+        '''The image a job whose labels match no registered runner class launches on: the class labelled ``microvm`` if one is registered, otherwise the first class registered.
+
+        Runner classes can be added right up until synth, so this
+        is a token that resolves once the set of them is final.
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "defaultImageArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="janitorFunction")
+    def janitor_function(self) -> "_aws_cdk_aws_lambda_ceddda9d.IFunction":
+        '''The janitor Lambda, which runs the scheduled sweep.'''
+        return typing.cast("_aws_cdk_aws_lambda_ceddda9d.IFunction", jsii.get(self, "janitorFunction"))
+
+    @builtins.property
+    @jsii.member(jsii_name="jobQueue")
+    def job_queue(self) -> "_aws_cdk_aws_sqs_ceddda9d.IQueue":
+        '''Queue carrying launch and terminate intents from the webhook handler to the launcher.'''
+        return typing.cast("_aws_cdk_aws_sqs_ceddda9d.IQueue", jsii.get(self, "jobQueue"))
+
+    @builtins.property
+    @jsii.member(jsii_name="launcherFunction")
+    def launcher_function(self) -> "_aws_cdk_aws_lambda_ceddda9d.IFunction":
+        '''The launcher Lambda, which reads the job queue and starts and terminates MicroVMs.'''
+        return typing.cast("_aws_cdk_aws_lambda_ceddda9d.IFunction", jsii.get(self, "launcherFunction"))
+
+    @builtins.property
+    @jsii.member(jsii_name="metrics")
+    def metrics(self) -> "GithubMicrovmRunnersMetrics":
+        '''This runner set's CloudWatch metrics and the ready-made alarms over them.'''
+        return typing.cast("GithubMicrovmRunnersMetrics", jsii.get(self, "metrics"))
+
+    @builtins.property
+    @jsii.member(jsii_name="runnerClasses")
+    def runner_classes(self) -> typing.List["RunnerClass"]:
+        '''Every runner class registered through ``addRunnerClass``, in the order they were registered.
+
+        It is empty until the first class is added, and a
+        runner set that reaches synth with none fails. Each call returns a copy, so
+        changing the returned array does not change the runner set.
+        '''
+        return typing.cast(typing.List["RunnerClass"], jsii.get(self, "runnerClasses"))
+
+    @builtins.property
+    @jsii.member(jsii_name="runnerTable")
+    def runner_table(self) -> "_aws_cdk_aws_dynamodb_ceddda9d.ITable":
+        '''DynamoDB table mapping each runner's name to its MicroVM, and holding the janitor's record of which VMs it already suspects.'''
+        return typing.cast("_aws_cdk_aws_dynamodb_ceddda9d.ITable", jsii.get(self, "runnerTable"))
+
+    @builtins.property
+    @jsii.member(jsii_name="setupCommand")
+    def setup_command(self) -> builtins.str:
+        '''The command that creates this runner set's GitHub App and writes its three secrets.
+
+        It carries the scope, the stack name, and the region this runner
+        set was built with, and is pinned to the version of this library that
+        produced it, so the helper and the construct agree about secret names and
+        stack outputs.
+
+        Surface it as a stack output and the deploy ends by printing the line to
+        paste. On a stack built without an explicit ``env``, the region is a token
+        that reads as ``${Token[AWS.Region.N]}`` here and resolves to the real region
+        in the deployed output.
+
+        Example::
+
+            cdk.CfnOutput(stack, "SetupCommand", value=runners.setup_command)
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "setupCommand"))
+
+    @builtins.property
+    @jsii.member(jsii_name="webhookFunction")
+    def webhook_function(self) -> "_aws_cdk_aws_lambda_ceddda9d.IFunction":
+        '''The webhook Lambda, which GitHub's deliveries reach through ``webhookUrl``.'''
+        return typing.cast("_aws_cdk_aws_lambda_ceddda9d.IFunction", jsii.get(self, "webhookFunction"))
+
+    @builtins.property
+    @jsii.member(jsii_name="webhookUrl")
+    def webhook_url(self) -> builtins.str:
+        '''The webhook handler's public Function URL, which is the payload URL to configure on the GitHub App or webhook.'''
+        return typing.cast(builtins.str, jsii.get(self, "webhookUrl"))
+
+    @builtins.property
+    @jsii.member(jsii_name="vmConsoleLogGroup")
+    def vm_console_log_group(
+        self,
+    ) -> typing.Optional["_aws_cdk_aws_logs_ceddda9d.ILogGroup"]:
+        '''Where a VM's runtime console goes when console capture is on: the group the construct created, or the one you supplied.
+
+        ``undefined`` when console capture is off.
+        '''
+        return typing.cast(typing.Optional["_aws_cdk_aws_logs_ceddda9d.ILogGroup"], jsii.get(self, "vmConsoleLogGroup"))
+
+    @builtins.property
+    @jsii.member(jsii_name="vmExecutionRole")
+    def vm_execution_role(self) -> typing.Optional["_aws_cdk_aws_iam_ceddda9d.IRole"]:
+        '''The AWS identity launched MicroVMs run with, passed in as ``GithubMicrovmRunnersProps.vmExecutionRole``, or ``undefined`` when the VMs carry no AWS identity. Console capture runs on this role and requires it. A runner set identifies its own VMs by the image they booted from, not by this role.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_iam_ceddda9d.IRole"], jsii.get(self, "vmExecutionRole"))
+
+    @builtins.property
+    @jsii.member(jsii_name="warmPoolFunction")
+    def warm_pool_function(
+        self,
+    ) -> typing.Optional["_aws_cdk_aws_lambda_ceddda9d.IFunction"]:
+        '''The Lambda that refills the warm pool, or ``undefined`` when no registered runner class sets ``RunnerClassProps.warmPoolSize``. It is created by the first class that does, so a runner set with no warm class deploys neither this function nor its schedule.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_lambda_ceddda9d.IFunction"], jsii.get(self, "warmPoolFunction"))
+
+
+class GithubMicrovmRunnersMetrics(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.GithubMicrovmRunnersMetrics",
+):
+    '''The CloudWatch metrics a runner set reports, and ready-made alarms over them. A ``GithubMicrovmRunners`` exposes its own as ``runners.metrics``.
+
+    The metrics live in the ``MicrovmRunners`` namespace, tagged with the runner
+    set's id. The janitor reports one set of counters per sweep, the launcher
+    one per launch, and the warm pool one per refill sweep. Launcher and
+    warm-pool metrics are also tagged with the runner class the launch belongs
+    to, which is why those accessors take a runner-class label. Every method
+    here names one of those metrics, or the dead-letter queue's own SQS metric;
+    the class carries no data of its own.
+
+    Everything except ``deadLetterQueueDepth`` reports only when
+    ``GithubMicrovmRunnersProps.emitMetrics`` is on. The accessors return a
+    ``Metric`` either way, so a dashboard can be built ahead of turning metrics
+    on. The two alarms over those metrics throw at synth instead, rather than
+    synthesizing an alarm that could never fire.
+
+    Example::
+
+        cw.Alarm(stack, "SweepErrors",
+            metric=runners.metrics.errors(),
+            threshold=1,
+            evaluation_periods=1
+        )
+    '''
+
+    def __init__(
+        self,
+        runner_set_id: builtins.str,
+        dead_letter_queue: "_aws_cdk_aws_sqs_ceddda9d.IQueue",
+        emit_metrics: typing.Optional[builtins.bool] = None,
+    ) -> None:
+        '''
+        :param runner_set_id: -
+        :param dead_letter_queue: -
+        :param emit_metrics: Whether the runner set reports the metrics this class names, which is ``GithubMicrovmRunnersProps.emitMetrics``. Every accessor except ``deadLetterQueueDepth`` depends on it, though they all return a ``Metric`` either way; only the two alarms over those metrics refuse to synthesize.
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__8c3f47f3bf65ddc91d8c105e318179909d2860c56e34cc7b699066e3f7952170)
+            check_type(argname="argument runner_set_id", value=runner_set_id, expected_type=type_hints["runner_set_id"])
+            check_type(argname="argument dead_letter_queue", value=dead_letter_queue, expected_type=type_hints["dead_letter_queue"])
+            check_type(argname="argument emit_metrics", value=emit_metrics, expected_type=type_hints["emit_metrics"])
+        jsii.create(self.__class__, self, [runner_set_id, dead_letter_queue, emit_metrics])
+
+    @jsii.member(jsii_name="cancelledBeforeLaunch")
+    def cancelled_before_launch(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Launches skipped because the job had already stopped waiting for a runner by the time the launch was processed — cancelled, or its run deleted.
+
+        No VM is booted for these, so a rising count is work avoided rather than
+        work lost. It tracks how often jobs are cancelled while still queued,
+        which is routine on a repository using concurrency groups: every re-push
+        cancels the run it superseded. A count that dwarfs ``ColdBoot`` suggests the
+        workflows feeding this runner set are cancelled more often than they
+        finish, which is usually a question about their triggers rather than
+        about the runner set.
+
+        :param runner_class_label: -
+
+        Example::
+
+            cw.Alarm(stack, "MostlyCancelled",
+                metric=runners.metrics.cancelled_before_launch("microvm"),
+                threshold=50,
+                evaluation_periods=3
+            )
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__5f2f67ec6dfaab44c26a53e7bc3669af5ba74fc2c75f8dcd8afb795779d8ddfa)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "cancelledBeforeLaunch", [runner_class_label]))
+
+    @jsii.member(jsii_name="capacityRejected")
+    def capacity_rejected(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Launches the MicroVM service rejected for capacity.
+
+        This is the runner
+        set's quota signal: a value that stays above zero means jobs are queueing
+        behind a MicroVM quota, or behind ``maxConcurrentVms``, rather than running,
+        and each rejected launch spends one of its ``maxReceiveCount`` redrives on
+        the way to the dead-letter queue. See docs/service-quotas.md.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__36d476c29eaf47f8fca7a5205fb5caa5a9749233fb462a093763a6a3200429b4)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "capacityRejected", [runner_class_label]))
+
+    @jsii.member(jsii_name="coldBoot")
+    def cold_boot(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Launches served by booting a new VM, because no warm VM was available or the class keeps no warm pool.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__baf385f806ff6b0b2ae70b9d811654097d3297503bd8bdbafe09f5d9ed879629)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "coldBoot", [runner_class_label]))
+
+    @jsii.member(jsii_name="coldSpinUpMs")
+    def cold_spin_up_ms(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Milliseconds to spin up a cold launch: starting the VM, waiting for it to boot, and pushing the runner's registration.
+
+        Reported as an average rather than a sum.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__75224a1d56fc14f38e94a3639da5e4ae455f069c6e477bb8fa010333e5c6ae4f)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "coldSpinUpMs", [runner_class_label]))
+
+    @jsii.member(jsii_name="deadLetterQueueDepth")
+    def dead_letter_queue_depth(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Messages sitting in the dead-letter queue: a launch or terminate intent SQS gave up redriving.'''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "deadLetterQueueDepth", []))
+
+    @jsii.member(jsii_name="deadLetterQueueNotEmptyAlarm")
+    def dead_letter_queue_not_empty_alarm(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        *,
+        evaluation_periods: typing.Optional[jsii.Number] = None,
+        period: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        threshold: typing.Optional[jsii.Number] = None,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Alarm":
+        '''Alarm when the dead-letter queue is not empty, meaning SQS gave up redriving a launch or terminate intent.
+
+        A runner set that is keeping up
+        holds this at 0, so any sustained depth means jobs are being dropped,
+        unless ``recoverStuckLaunches`` is draining them. It fires on one message
+        over a single 5-minute period; pass ``RunnerAlarmOptions`` to change
+        that, and ``alarm.addAlarmAction()`` to route it.
+
+        This is the one alarm here that works without
+        ``GithubMicrovmRunnersProps.emitMetrics``, because it watches the
+        dead-letter queue's own SQS metric rather than one the handlers report.
+
+        :param scope: -
+        :param evaluation_periods: Consecutive breaching periods before the alarm fires. Default: 1 (3 for the stuck-launch alarm)
+        :param period: Aggregation period for the metric. Default: Duration.minutes(5)
+        :param threshold: Value at or above which the alarm fires. Default: 1
+
+        :default: threshold 1, 1 evaluation period, 5-minute period
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__aca740a7276ae0a556b6b45300b0252ac7d8074b4dd0ab26c6b38fba7adb7eaf)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+        options = RunnerAlarmOptions(
+            evaluation_periods=evaluation_periods, period=period, threshold=threshold
+        )
+
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Alarm", jsii.invoke(self, "deadLetterQueueNotEmptyAlarm", [scope, options]))
+
+    @jsii.member(jsii_name="errors")
+    def errors(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: failures on individual VMs, rows, or image versions during a sweep.
+
+        The sweep isolates each one and still completes.
+        '''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "errors", []))
+
+    @jsii.member(jsii_name="imageVersionsPruned")
+    def image_versions_pruned(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: inactive MicroVM image versions pruned past ``keepImageVersions``.'''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "imageVersionsPruned", []))
+
+    @jsii.member(jsii_name="lifetimeKills")
+    def lifetime_kills(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: VMs terminated for having run longer than ``maxJobDuration`` plus the platform's own grace.'''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "lifetimeKills", []))
+
+    @jsii.member(jsii_name="orphansReaped")
+    def orphans_reaped(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: running VMs that belong to this runner set but have no row in the runner table, reaped once a second sweep has seen the same VM unaccounted for.'''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "orphansReaped", []))
+
+    @jsii.member(jsii_name="poolCurrent")
+    def pool_current(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Warm VMs suspended and available for this class as of the last warm-pool sweep.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__6153c9a068c30f370bb352b26cc502516866238676a7d8139fc2dd0736dff46a)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "poolCurrent", [runner_class_label]))
+
+    @jsii.member(jsii_name="poolLaunched")
+    def pool_launched(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Warm VMs the last warm-pool sweep launched to reach ``warmPoolSize``.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__767e219d8c25f069fd8964ea100816a20869884628a2606dfd2fb3e63b857a8e)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "poolLaunched", [runner_class_label]))
+
+    @jsii.member(jsii_name="poolLaunchFailed")
+    def pool_launch_failed(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Warm-VM launches a warm-pool sweep attempted and failed.
+
+        A value that stays above zero means the pool is not reaching ``warmPoolSize``, so jobs keep booting new VMs instead of resuming warm ones.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__6513962ff7d13ce627041f61f3e7a3b13688b30e0cb4c5bfbc63f79b8a32b595)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "poolLaunchFailed", [runner_class_label]))
+
+    @jsii.member(jsii_name="poolTarget")
+    def pool_target(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''This class's ``warmPoolSize``, as the last warm-pool sweep read it.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__1ba8a40c62efe6c3a58896ea614244a8e6823dd3c7db51567ffbadd71766bd13)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "poolTarget", [runner_class_label]))
+
+    @jsii.member(jsii_name="stuckClaimsRelaunched")
+    def stuck_claims_relaunched(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: launches that were claimed but never served, re-launched from the orphaned claim.
+
+        This is 0 unless ``recoverStuckLaunches`` is on.
+        '''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "stuckClaimsRelaunched", []))
+
+    @jsii.member(jsii_name="stuckLaunchesRecovered")
+    def stuck_launches_recovered(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: dead-lettered launches re-driven onto the job queue, which is 0 unless ``recoverStuckLaunches`` is on.
+
+        A value that stays high means launches are failing for some reason other than a GitHub outage.
+        '''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "stuckLaunchesRecovered", []))
+
+    @jsii.member(jsii_name="stuckLaunchesRecoveredAlarm")
+    def stuck_launches_recovered_alarm(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        *,
+        evaluation_periods: typing.Optional[jsii.Number] = None,
+        period: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        threshold: typing.Optional[jsii.Number] = None,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Alarm":
+        '''Alarm on stuck-launch recoveries, the dead-lettered launches the janitor re-drove, which only happens with ``recoverStuckLaunches`` on.
+
+        Recoveries
+        that keep coming mean launches are failing for some reason other than a
+        GitHub outage. It fires on one recovery in each of three consecutive
+        5-minute periods, which rides out a real outage; pass
+        ``RunnerAlarmOptions`` to change that.
+
+        Requires ``GithubMicrovmRunnersProps.emitMetrics``, and throws at synth
+        without it.
+
+        :param scope: -
+        :param evaluation_periods: Consecutive breaching periods before the alarm fires. Default: 1 (3 for the stuck-launch alarm)
+        :param period: Aggregation period for the metric. Default: Duration.minutes(5)
+        :param threshold: Value at or above which the alarm fires. Default: 1
+
+        :default: threshold 1, 3 evaluation periods, 5-minute period
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__e1b4b6b8be54f5289f47b9d302cea17d405e67837d60873b6a6536a2a23457e9)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+        options = RunnerAlarmOptions(
+            evaluation_periods=evaluation_periods, period=period, threshold=threshold
+        )
+
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Alarm", jsii.invoke(self, "stuckLaunchesRecoveredAlarm", [scope, options]))
+
+    @jsii.member(jsii_name="stuckRunnersReaped")
+    def stuck_runners_reaped(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: runners that registered with GitHub and then sat idle past ``idleRunnerGraceSeconds``, reaped once a second sweep has seen them the same way.'''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "stuckRunnersReaped", []))
+
+    @jsii.member(jsii_name="suspectsCleared")
+    def suspects_cleared(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: VMs an earlier sweep had marked as suspect, cleared because this sweep found them accounted for or working again.'''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "suspectsCleared", []))
+
+    @jsii.member(jsii_name="sweepErrorsAlarm")
+    def sweep_errors_alarm(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        *,
+        evaluation_periods: typing.Optional[jsii.Number] = None,
+        period: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        threshold: typing.Optional[jsii.Number] = None,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Alarm":
+        '''Alarm on janitor sweep errors, the per-item failures a sweep isolates and continues past.
+
+        A value that stays above zero means the runner set is
+        failing to reconcile — VMs left running, runners left unreaped — even
+        though each sweep completes. It fires on one error over a single 5-minute
+        period; pass ``RunnerAlarmOptions`` to change that.
+
+        Requires ``GithubMicrovmRunnersProps.emitMetrics``, and throws at synth
+        without it.
+
+        :param scope: -
+        :param evaluation_periods: Consecutive breaching periods before the alarm fires. Default: 1 (3 for the stuck-launch alarm)
+        :param period: Aggregation period for the metric. Default: Duration.minutes(5)
+        :param threshold: Value at or above which the alarm fires. Default: 1
+
+        :default: threshold 1, 1 evaluation period, 5-minute period
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__971f59e7dc4d5b4245765d41b7dcc4075c4dd91870a15df6b9f345ee393cdc61)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+        options = RunnerAlarmOptions(
+            evaluation_periods=evaluation_periods, period=period, threshold=threshold
+        )
+
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Alarm", jsii.invoke(self, "sweepErrorsAlarm", [scope, options]))
+
+    @jsii.member(jsii_name="tableRowsCleaned")
+    def table_rows_cleaned(self) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Janitor sweep count: runner table rows deleted, either because the VM they name is confirmed gone or because a real row superseded an orphaned one.'''
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "tableRowsCleaned", []))
+
+    @jsii.member(jsii_name="warmHit")
+    def warm_hit(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Launches served from the warm pool: a pre-booted VM claimed and resumed rather than a new one launched.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__01d47d24112989967339ef8a2bc09fe442210a13ccc3d3fd9583327ebc550f4f)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "warmHit", [runner_class_label]))
+
+    @jsii.member(jsii_name="warmSpinUpMs")
+    def warm_spin_up_ms(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Milliseconds to spin up a warm launch: claiming the VM, resuming it, and pushing the runner's registration.
+
+        Reported as an average rather than a sum.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__9b66518a0eb395295f3c9719dcc545a363c50d0d387fe70bdcedc10be787b17a)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "warmSpinUpMs", [runner_class_label]))
+
+    @jsii.member(jsii_name="warmThrottled")
+    def warm_throttled(
+        self,
+        runner_class_label: builtins.str,
+    ) -> "_aws_cdk_aws_cloudwatch_ceddda9d.Metric":
+        '''Warm-pool claims that were throttled and fell back to booting a new VM.
+
+        The same launch can also count under ``ColdBoot`` or ``CapacityRejected``.
+
+        :param runner_class_label: -
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__28779afe2a8160e3a792fe0b6661c1c177712ed22d8ddf991f39b625eaa303d6)
+            check_type(argname="argument runner_class_label", value=runner_class_label, expected_type=type_hints["runner_class_label"])
+        return typing.cast("_aws_cdk_aws_cloudwatch_ceddda9d.Metric", jsii.invoke(self, "warmThrottled", [runner_class_label]))
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.GithubMicrovmRunnersProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "github": "github",
+        "scope": "scope",
+        "additional_regions": "additionalRegions",
+        "console_logs": "consoleLogs",
+        "dead_letter_retention": "deadLetterRetention",
+        "emit_metrics": "emitMetrics",
+        "encryption_key": "encryptionKey",
+        "idle_runner_grace_seconds": "idleRunnerGraceSeconds",
+        "image_logs": "imageLogs",
+        "janitor_interval": "janitorInterval",
+        "keep_image_versions": "keepImageVersions",
+        "lambda_memory_size": "lambdaMemorySize",
+        "log_retention": "logRetention",
+        "max_concurrent_vms": "maxConcurrentVms",
+        "max_job_duration": "maxJobDuration",
+        "max_receive_count": "maxReceiveCount",
+        "network": "network",
+        "permissions_boundary": "permissionsBoundary",
+        "point_in_time_recovery": "pointInTimeRecovery",
+        "recover_stuck_launches": "recoverStuckLaunches",
+        "removal_policy": "removalPolicy",
+        "vm_execution_role": "vmExecutionRole",
+        "warm_pool_interval": "warmPoolInterval",
+        "webhook": "webhook",
+        "webhook_reserved_concurrency": "webhookReservedConcurrency",
+    },
+)
+class GithubMicrovmRunnersProps:
+    def __init__(
+        self,
+        *,
+        github: "GithubAuth",
+        scope: "RunnerScope",
+        additional_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
+        console_logs: typing.Optional["ConsoleLogs"] = None,
+        dead_letter_retention: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        emit_metrics: typing.Optional[builtins.bool] = None,
+        encryption_key: typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"] = None,
+        idle_runner_grace_seconds: typing.Optional[jsii.Number] = None,
+        image_logs: typing.Optional["ImageLogs"] = None,
+        janitor_interval: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        keep_image_versions: typing.Optional[jsii.Number] = None,
+        lambda_memory_size: typing.Optional[jsii.Number] = None,
+        log_retention: typing.Optional["_aws_cdk_aws_logs_ceddda9d.RetentionDays"] = None,
+        max_concurrent_vms: typing.Optional[jsii.Number] = None,
+        max_job_duration: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        max_receive_count: typing.Optional[jsii.Number] = None,
+        network: typing.Optional["RunnerNetwork"] = None,
+        permissions_boundary: typing.Optional["_aws_cdk_aws_iam_ceddda9d.IManagedPolicy"] = None,
+        point_in_time_recovery: typing.Optional[builtins.bool] = None,
+        recover_stuck_launches: typing.Optional[builtins.bool] = None,
+        removal_policy: typing.Optional["_aws_cdk_ceddda9d.RemovalPolicy"] = None,
+        vm_execution_role: typing.Optional["_aws_cdk_aws_iam_ceddda9d.IRole"] = None,
+        warm_pool_interval: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        webhook: typing.Optional["WebhookEndpoint"] = None,
+        webhook_reserved_concurrency: typing.Optional[jsii.Number] = None,
+    ) -> None:
+        '''Props for ``GithubMicrovmRunners``.
+
+        :param github: How the runner set authenticates to GitHub, as an App or with a personal access token. This also carries the webhook secret.
+        :param scope: Which GitHub scope, an organization or a list of repositories, registered runners are visible to.
+        :param additional_regions: Additional regions to accept as Lambda MicroVMs regions, beyond the ones this library already knows about. Deploying into a region on neither list fails at synth. Default: [] (only the regions this library knows about)
+        :param console_logs: Where a VM's runtime console goes: everything it prints while it boots, runs the runner agent, and runs the job. ``ConsoleLogs.enabled()`` has the construct create the group and expose it as ``vmConsoleLogGroup``, and ``ConsoleLogs.enabled(logGroup)`` uses one you control. The platform writes these logs with the VM's own role, so this requires ``vmExecutionRole``; see ``ConsoleLogs`` for what that role means for job code. Independent of ``imageLogs``. Default: undefined (no runtime console capture)
+        :param dead_letter_retention: How long the dead-letter queue retains a failed launch or terminate intent. SQS allows up to 14 days, which is also how long ``recoverStuckLaunches`` has to re-drive a message before SQS drops it. Default: Duration.days(4) (SQS default)
+        :param emit_metrics: Report this runner set's CloudWatch custom metrics. Those are the janitor's per-sweep counters, the launcher's per-launch outcomes and spin-up timings, and the warm pool's fill numbers — everything ``GithubMicrovmRunnersMetrics`` names. With this off the handlers report none of them. CloudWatch bills custom metrics per metric per month, and this runner set's bill is not a fixed number: the launcher and warm-pool metrics carry a runner-class dimension, so each one becomes a separate billable metric per registered runner class. The two alarms backed by these metrics, ``sweepErrorsAlarm`` and ``stuckLaunchesRecoveredAlarm``, throw at synth unless this is on, since the metric they watch would never report. ``deadLetterQueueNotEmptyAlarm`` watches an SQS metric and works either way. The metric accessors on ``GithubMicrovmRunnersMetrics`` return a ``Metric`` regardless, so a dashboard can be built ahead of turning metrics on. Default: false (no metrics emitted)
+        :param encryption_key: Customer-managed KMS key for this runner set's data at rest: the DynamoDB runner table, the SQS job queue and dead-letter queue, and any log group this construct creates. Log groups you bring yourself, and the GitHub secrets you pass in, keep their own keys. Default: undefined (AWS-managed keys)
+        :param idle_runner_grace_seconds: How many seconds a registered runner may sit idle before the janitor's two-strike sweep treats it as stuck. Default: 600
+        :param image_logs: Where build-time image logs go: the Docker build layers and the ready-probe banner from each image build. ``ImageLogs.enabled()`` sends them to the platform's own CloudWatch group, and ``ImageLogs.enabled(logGroup)`` to a group whose retention and KMS key you control. These are written by the image build role rather than by a VM, so they need no VM execution role. Independent of ``consoleLogs``. Default: undefined (no image logs)
+        :param janitor_interval: How often the janitor sweep runs. Default: Duration.minutes(5)
+        :param keep_image_versions: How many MicroVM image versions to keep per runner class. The janitor prunes inactive versions past this count. Default: 5
+        :param lambda_memory_size: Memory, in MiB, for the handler Lambdas: the webhook, the launcher, the janitor, and the warm pool. The janitor's sweep scans the runner table and reconciles every running VM, so it is the handler most sensitive to this on a busy runner set. Default: 128
+        :param log_retention: Retention for the CloudWatch log groups this construct creates: the handler Lambda log groups and, when console capture is on, the VM console group. Default: logs.RetentionDays.TWO_WEEKS
+        :param max_concurrent_vms: Maximum number of MicroVMs this runner set runs at once. Default: 10
+        :param max_job_duration: How long a job may run before its MicroVM is terminated. The VM is killed five minutes after this value, not at it. The runner set asks the platform for ``maxJobDuration + 5 minutes``, so that a job which reaches its own limit is stopped by the runner — which reports the timeout to GitHub and lets the VM come down cleanly — rather than by the platform removing the machine underneath it. Treat the five minutes as headroom for that shutdown rather than as extra running time. Default: Duration.hours(6)
+        :param max_receive_count: How many times a launch intent is redriven before it dead-letters. A runner set already at ``maxConcurrentVms`` redrives capacity-rejected launches through this same budget, so on a runner set that regularly runs at capacity this count is how long a queued job waits before its launch is dropped. See docs/service-quotas.md. Default: 20
+        :param network: How launched MicroVMs and image builds reach the network. Default: RunnerNetwork.internetEgress()
+        :param permissions_boundary: Permissions boundary applied to every IAM role this construct creates: the handler execution roles, the per-class image build roles, and the network-connector operator role. It is applied once at construct scope, so roles created later also carry it — the warm-pool handler's role, and the build role of any runner class registered after construction. Default: undefined (no boundary)
+        :param point_in_time_recovery: Turn on DynamoDB point-in-time recovery for the runner table. Default: false
+        :param recover_stuck_launches: Recover launches that dead-lettered while GitHub Actions was down. Each janitor sweep re-drives dead-lettered launch messages back onto the job queue, but only for jobs GitHub still reports as queued; a launch whose job has since completed or been cancelled is discarded rather than booting a VM for work nobody is waiting on. Recovery happens once an outage ends, since GitHub dispatches no jobs while it is down. The janitor counts each recovered launch under the ``stuckLaunchesRecovered`` metric, which reports when ``emitMetrics`` is on. Default: false
+        :param removal_policy: Removal policy for this runner set's stateful resources: the runner table and any log group the construct creates. The table holds correlation data for VMs that are currently running, all of which the janitor can rebuild from the MicroVM and GitHub APIs. Default: RemovalPolicy.DESTROY
+        :param vm_execution_role: An AWS identity for this runner set's runner VMs. By default the VMs carry no AWS identity at all: the runner agent talks outbound to GitHub, the just-in-time registration is pushed to the VM over a platform-authenticated channel, and a job that needs AWS assumes its own role through GitHub OIDC. With a role attached, the MicroVM's instance metadata service serves that role's credentials to arbitrary job code, so every job running on this runner set can do whatever the role can do. ``consoleLogs`` requires a role, because the platform writes a VM's console output using it. Default: undefined (the VMs carry no AWS identity)
+        :param warm_pool_interval: How often the warm-pool sweep refills pre-booted VMs. It applies only to runner classes that set ``RunnerClassProps.warmPoolSize``, and the warm-pool handler and its schedule are only created once such a class is registered. A runner set with no warm class never runs this sweep, and never reads this value. Default: Duration.minutes(2)
+        :param webhook: How the webhook handler is exposed to GitHub. Default: WebhookEndpoint.functionUrl()
+        :param webhook_reserved_concurrency: Reserved concurrency for the webhook Lambda, which caps how many webhook deliveries the runner set processes at once. Reserved concurrency is carved out of the account's shared pool of unreserved concurrency, so a runner set that sets it takes that capacity away from every other function in the account. Must be a positive integer when set, since ``0`` would disable the webhook entirely. Default: undefined (no reservation; the webhook draws from the shared pool)
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__17269a525bc0ad3b7797a5131db455fcbc4ced673bbd2895bc90ea581a540971)
+            check_type(argname="argument github", value=github, expected_type=type_hints["github"])
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument additional_regions", value=additional_regions, expected_type=type_hints["additional_regions"])
+            check_type(argname="argument console_logs", value=console_logs, expected_type=type_hints["console_logs"])
+            check_type(argname="argument dead_letter_retention", value=dead_letter_retention, expected_type=type_hints["dead_letter_retention"])
+            check_type(argname="argument emit_metrics", value=emit_metrics, expected_type=type_hints["emit_metrics"])
+            check_type(argname="argument encryption_key", value=encryption_key, expected_type=type_hints["encryption_key"])
+            check_type(argname="argument idle_runner_grace_seconds", value=idle_runner_grace_seconds, expected_type=type_hints["idle_runner_grace_seconds"])
+            check_type(argname="argument image_logs", value=image_logs, expected_type=type_hints["image_logs"])
+            check_type(argname="argument janitor_interval", value=janitor_interval, expected_type=type_hints["janitor_interval"])
+            check_type(argname="argument keep_image_versions", value=keep_image_versions, expected_type=type_hints["keep_image_versions"])
+            check_type(argname="argument lambda_memory_size", value=lambda_memory_size, expected_type=type_hints["lambda_memory_size"])
+            check_type(argname="argument log_retention", value=log_retention, expected_type=type_hints["log_retention"])
+            check_type(argname="argument max_concurrent_vms", value=max_concurrent_vms, expected_type=type_hints["max_concurrent_vms"])
+            check_type(argname="argument max_job_duration", value=max_job_duration, expected_type=type_hints["max_job_duration"])
+            check_type(argname="argument max_receive_count", value=max_receive_count, expected_type=type_hints["max_receive_count"])
+            check_type(argname="argument network", value=network, expected_type=type_hints["network"])
+            check_type(argname="argument permissions_boundary", value=permissions_boundary, expected_type=type_hints["permissions_boundary"])
+            check_type(argname="argument point_in_time_recovery", value=point_in_time_recovery, expected_type=type_hints["point_in_time_recovery"])
+            check_type(argname="argument recover_stuck_launches", value=recover_stuck_launches, expected_type=type_hints["recover_stuck_launches"])
+            check_type(argname="argument removal_policy", value=removal_policy, expected_type=type_hints["removal_policy"])
+            check_type(argname="argument vm_execution_role", value=vm_execution_role, expected_type=type_hints["vm_execution_role"])
+            check_type(argname="argument warm_pool_interval", value=warm_pool_interval, expected_type=type_hints["warm_pool_interval"])
+            check_type(argname="argument webhook", value=webhook, expected_type=type_hints["webhook"])
+            check_type(argname="argument webhook_reserved_concurrency", value=webhook_reserved_concurrency, expected_type=type_hints["webhook_reserved_concurrency"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "github": github,
+            "scope": scope,
+        }
+        if additional_regions is not None:
+            self._values["additional_regions"] = additional_regions
+        if console_logs is not None:
+            self._values["console_logs"] = console_logs
+        if dead_letter_retention is not None:
+            self._values["dead_letter_retention"] = dead_letter_retention
+        if emit_metrics is not None:
+            self._values["emit_metrics"] = emit_metrics
+        if encryption_key is not None:
+            self._values["encryption_key"] = encryption_key
+        if idle_runner_grace_seconds is not None:
+            self._values["idle_runner_grace_seconds"] = idle_runner_grace_seconds
+        if image_logs is not None:
+            self._values["image_logs"] = image_logs
+        if janitor_interval is not None:
+            self._values["janitor_interval"] = janitor_interval
+        if keep_image_versions is not None:
+            self._values["keep_image_versions"] = keep_image_versions
+        if lambda_memory_size is not None:
+            self._values["lambda_memory_size"] = lambda_memory_size
+        if log_retention is not None:
+            self._values["log_retention"] = log_retention
+        if max_concurrent_vms is not None:
+            self._values["max_concurrent_vms"] = max_concurrent_vms
+        if max_job_duration is not None:
+            self._values["max_job_duration"] = max_job_duration
+        if max_receive_count is not None:
+            self._values["max_receive_count"] = max_receive_count
+        if network is not None:
+            self._values["network"] = network
+        if permissions_boundary is not None:
+            self._values["permissions_boundary"] = permissions_boundary
+        if point_in_time_recovery is not None:
+            self._values["point_in_time_recovery"] = point_in_time_recovery
+        if recover_stuck_launches is not None:
+            self._values["recover_stuck_launches"] = recover_stuck_launches
+        if removal_policy is not None:
+            self._values["removal_policy"] = removal_policy
+        if vm_execution_role is not None:
+            self._values["vm_execution_role"] = vm_execution_role
+        if warm_pool_interval is not None:
+            self._values["warm_pool_interval"] = warm_pool_interval
+        if webhook is not None:
+            self._values["webhook"] = webhook
+        if webhook_reserved_concurrency is not None:
+            self._values["webhook_reserved_concurrency"] = webhook_reserved_concurrency
+
+    @builtins.property
+    def github(self) -> "GithubAuth":
+        '''How the runner set authenticates to GitHub, as an App or with a personal access token.
+
+        This also carries the webhook secret.
+        '''
+        result = self._values.get("github")
+        assert result is not None, "Required property 'github' is missing"
+        return typing.cast("GithubAuth", result)
+
+    @builtins.property
+    def scope(self) -> "RunnerScope":
+        '''Which GitHub scope, an organization or a list of repositories, registered runners are visible to.'''
+        result = self._values.get("scope")
+        assert result is not None, "Required property 'scope' is missing"
+        return typing.cast("RunnerScope", result)
+
+    @builtins.property
+    def additional_regions(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''Additional regions to accept as Lambda MicroVMs regions, beyond the ones this library already knows about.
+
+        Deploying into a region on neither list
+        fails at synth.
+
+        :default: [] (only the regions this library knows about)
+        '''
+        result = self._values.get("additional_regions")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    @builtins.property
+    def console_logs(self) -> typing.Optional["ConsoleLogs"]:
+        '''Where a VM's runtime console goes: everything it prints while it boots, runs the runner agent, and runs the job.
+
+        ``ConsoleLogs.enabled()`` has the
+        construct create the group and expose it as ``vmConsoleLogGroup``, and
+        ``ConsoleLogs.enabled(logGroup)`` uses one you control. The platform writes
+        these logs with the VM's own role, so this requires ``vmExecutionRole``; see
+        ``ConsoleLogs`` for what that role means for job code. Independent of
+        ``imageLogs``.
+
+        :default: undefined (no runtime console capture)
+        '''
+        result = self._values.get("console_logs")
+        return typing.cast(typing.Optional["ConsoleLogs"], result)
+
+    @builtins.property
+    def dead_letter_retention(self) -> typing.Optional["_aws_cdk_ceddda9d.Duration"]:
+        '''How long the dead-letter queue retains a failed launch or terminate intent.
+
+        SQS allows up to 14 days, which is also how long
+        ``recoverStuckLaunches`` has to re-drive a message before SQS drops it.
+
+        :default: Duration.days(4) (SQS default)
+        '''
+        result = self._values.get("dead_letter_retention")
+        return typing.cast(typing.Optional["_aws_cdk_ceddda9d.Duration"], result)
+
+    @builtins.property
+    def emit_metrics(self) -> typing.Optional[builtins.bool]:
+        '''Report this runner set's CloudWatch custom metrics.
+
+        Those are the
+        janitor's per-sweep counters, the launcher's per-launch outcomes and
+        spin-up timings, and the warm pool's fill numbers — everything
+        ``GithubMicrovmRunnersMetrics`` names. With this off the handlers report
+        none of them.
+
+        CloudWatch bills custom metrics per metric per month, and this runner set's
+        bill is not a fixed number: the launcher and warm-pool metrics carry a
+        runner-class dimension, so each one becomes a separate billable metric per
+        registered runner class.
+
+        The two alarms backed by these metrics, ``sweepErrorsAlarm`` and
+        ``stuckLaunchesRecoveredAlarm``, throw at synth unless this is on, since the
+        metric they watch would never report. ``deadLetterQueueNotEmptyAlarm``
+        watches an SQS metric and works either way. The metric accessors on
+        ``GithubMicrovmRunnersMetrics`` return a ``Metric`` regardless, so a
+        dashboard can be built ahead of turning metrics on.
+
+        :default: false (no metrics emitted)
+        '''
+        result = self._values.get("emit_metrics")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    @builtins.property
+    def encryption_key(self) -> typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"]:
+        '''Customer-managed KMS key for this runner set's data at rest: the DynamoDB runner table, the SQS job queue and dead-letter queue, and any log group this construct creates.
+
+        Log groups you bring yourself, and the GitHub
+        secrets you pass in, keep their own keys.
+
+        :default: undefined (AWS-managed keys)
+        '''
+        result = self._values.get("encryption_key")
+        return typing.cast(typing.Optional["_aws_cdk_aws_kms_ceddda9d.IKey"], result)
+
+    @builtins.property
+    def idle_runner_grace_seconds(self) -> typing.Optional[jsii.Number]:
+        '''How many seconds a registered runner may sit idle before the janitor's two-strike sweep treats it as stuck.
+
+        :default: 600
+        '''
+        result = self._values.get("idle_runner_grace_seconds")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def image_logs(self) -> typing.Optional["ImageLogs"]:
+        '''Where build-time image logs go: the Docker build layers and the ready-probe banner from each image build.
+
+        ``ImageLogs.enabled()`` sends them
+        to the platform's own CloudWatch group, and ``ImageLogs.enabled(logGroup)``
+        to a group whose retention and KMS key you control. These are written by
+        the image build role rather than by a VM, so they need no VM execution
+        role. Independent of ``consoleLogs``.
+
+        :default: undefined (no image logs)
+        '''
+        result = self._values.get("image_logs")
+        return typing.cast(typing.Optional["ImageLogs"], result)
+
+    @builtins.property
+    def janitor_interval(self) -> typing.Optional["_aws_cdk_ceddda9d.Duration"]:
+        '''How often the janitor sweep runs.
+
+        :default: Duration.minutes(5)
+        '''
+        result = self._values.get("janitor_interval")
+        return typing.cast(typing.Optional["_aws_cdk_ceddda9d.Duration"], result)
+
+    @builtins.property
+    def keep_image_versions(self) -> typing.Optional[jsii.Number]:
+        '''How many MicroVM image versions to keep per runner class.
+
+        The janitor prunes inactive versions past this count.
+
+        :default: 5
+        '''
+        result = self._values.get("keep_image_versions")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def lambda_memory_size(self) -> typing.Optional[jsii.Number]:
+        '''Memory, in MiB, for the handler Lambdas: the webhook, the launcher, the janitor, and the warm pool.
+
+        The janitor's sweep scans the runner table and
+        reconciles every running VM, so it is the handler most sensitive to this
+        on a busy runner set.
+
+        :default: 128
+        '''
+        result = self._values.get("lambda_memory_size")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def log_retention(
+        self,
+    ) -> typing.Optional["_aws_cdk_aws_logs_ceddda9d.RetentionDays"]:
+        '''Retention for the CloudWatch log groups this construct creates: the handler Lambda log groups and, when console capture is on, the VM console group.
+
+        :default: logs.RetentionDays.TWO_WEEKS
+        '''
+        result = self._values.get("log_retention")
+        return typing.cast(typing.Optional["_aws_cdk_aws_logs_ceddda9d.RetentionDays"], result)
+
+    @builtins.property
+    def max_concurrent_vms(self) -> typing.Optional[jsii.Number]:
+        '''Maximum number of MicroVMs this runner set runs at once.
+
+        :default: 10
+        '''
+        result = self._values.get("max_concurrent_vms")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def max_job_duration(self) -> typing.Optional["_aws_cdk_ceddda9d.Duration"]:
+        '''How long a job may run before its MicroVM is terminated.
+
+        The VM is killed five minutes after this value, not at it. The runner set
+        asks the platform for ``maxJobDuration + 5 minutes``, so that a job which
+        reaches its own limit is stopped by the runner — which reports the timeout
+        to GitHub and lets the VM come down cleanly — rather than by the platform
+        removing the machine underneath it. Treat the five minutes as headroom for
+        that shutdown rather than as extra running time.
+
+        :default: Duration.hours(6)
+        '''
+        result = self._values.get("max_job_duration")
+        return typing.cast(typing.Optional["_aws_cdk_ceddda9d.Duration"], result)
+
+    @builtins.property
+    def max_receive_count(self) -> typing.Optional[jsii.Number]:
+        '''How many times a launch intent is redriven before it dead-letters.
+
+        A
+        runner set already at ``maxConcurrentVms`` redrives capacity-rejected
+        launches through this same budget, so on a runner set that regularly runs
+        at capacity this count is how long a queued job waits before its launch is
+        dropped. See docs/service-quotas.md.
+
+        :default: 20
+        '''
+        result = self._values.get("max_receive_count")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def network(self) -> typing.Optional["RunnerNetwork"]:
+        '''How launched MicroVMs and image builds reach the network.
+
+        :default: RunnerNetwork.internetEgress()
+        '''
+        result = self._values.get("network")
+        return typing.cast(typing.Optional["RunnerNetwork"], result)
+
+    @builtins.property
+    def permissions_boundary(
+        self,
+    ) -> typing.Optional["_aws_cdk_aws_iam_ceddda9d.IManagedPolicy"]:
+        '''Permissions boundary applied to every IAM role this construct creates: the handler execution roles, the per-class image build roles, and the network-connector operator role.
+
+        It is applied once at construct scope, so
+        roles created later also carry it — the warm-pool handler's role, and the
+        build role of any runner class registered after construction.
+
+        :default: undefined (no boundary)
+        '''
+        result = self._values.get("permissions_boundary")
+        return typing.cast(typing.Optional["_aws_cdk_aws_iam_ceddda9d.IManagedPolicy"], result)
+
+    @builtins.property
+    def point_in_time_recovery(self) -> typing.Optional[builtins.bool]:
+        '''Turn on DynamoDB point-in-time recovery for the runner table.
+
+        :default: false
+        '''
+        result = self._values.get("point_in_time_recovery")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    @builtins.property
+    def recover_stuck_launches(self) -> typing.Optional[builtins.bool]:
+        '''Recover launches that dead-lettered while GitHub Actions was down.
+
+        Each
+        janitor sweep re-drives dead-lettered launch messages back onto the job
+        queue, but only for jobs GitHub still reports as queued; a launch whose job
+        has since completed or been cancelled is discarded rather than booting a
+        VM for work nobody is waiting on. Recovery happens once an outage ends,
+        since GitHub dispatches no jobs while it is down. The janitor counts each
+        recovered launch under the ``stuckLaunchesRecovered`` metric, which reports
+        when ``emitMetrics`` is on.
+
+        :default: false
+        '''
+        result = self._values.get("recover_stuck_launches")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    @builtins.property
+    def removal_policy(self) -> typing.Optional["_aws_cdk_ceddda9d.RemovalPolicy"]:
+        '''Removal policy for this runner set's stateful resources: the runner table and any log group the construct creates.
+
+        The table holds correlation data
+        for VMs that are currently running, all of which the janitor can rebuild
+        from the MicroVM and GitHub APIs.
+
+        :default: RemovalPolicy.DESTROY
+        '''
+        result = self._values.get("removal_policy")
+        return typing.cast(typing.Optional["_aws_cdk_ceddda9d.RemovalPolicy"], result)
+
+    @builtins.property
+    def vm_execution_role(self) -> typing.Optional["_aws_cdk_aws_iam_ceddda9d.IRole"]:
+        '''An AWS identity for this runner set's runner VMs.
+
+        By default the VMs carry
+        no AWS identity at all: the runner agent talks outbound to GitHub, the
+        just-in-time registration is pushed to the VM over a platform-authenticated
+        channel, and a job that needs AWS assumes its own role through GitHub OIDC.
+
+        With a role attached, the MicroVM's instance metadata service serves that
+        role's credentials to arbitrary job code, so every job running on this
+        runner set can do whatever the role can do. ``consoleLogs`` requires a role,
+        because the platform writes a VM's console output using it.
+
+        :default: undefined (the VMs carry no AWS identity)
+        '''
+        result = self._values.get("vm_execution_role")
+        return typing.cast(typing.Optional["_aws_cdk_aws_iam_ceddda9d.IRole"], result)
+
+    @builtins.property
+    def warm_pool_interval(self) -> typing.Optional["_aws_cdk_ceddda9d.Duration"]:
+        '''How often the warm-pool sweep refills pre-booted VMs.
+
+        It applies only to
+        runner classes that set ``RunnerClassProps.warmPoolSize``, and the warm-pool
+        handler and its schedule are only created once such a class is registered.
+        A runner set with no warm class never runs this sweep, and never reads
+        this value.
+
+        :default: Duration.minutes(2)
+        '''
+        result = self._values.get("warm_pool_interval")
+        return typing.cast(typing.Optional["_aws_cdk_ceddda9d.Duration"], result)
+
+    @builtins.property
+    def webhook(self) -> typing.Optional["WebhookEndpoint"]:
+        '''How the webhook handler is exposed to GitHub.
+
+        :default: WebhookEndpoint.functionUrl()
+        '''
+        result = self._values.get("webhook")
+        return typing.cast(typing.Optional["WebhookEndpoint"], result)
+
+    @builtins.property
+    def webhook_reserved_concurrency(self) -> typing.Optional[jsii.Number]:
+        '''Reserved concurrency for the webhook Lambda, which caps how many webhook deliveries the runner set processes at once.
+
+        Reserved concurrency is
+        carved out of the account's shared pool of unreserved concurrency, so a
+        runner set that sets it takes that capacity away from every other function
+        in the account. Must be a positive integer when set, since ``0`` would
+        disable the webhook entirely.
+
+        :default: undefined (no reservation; the webhook draws from the shared pool)
+        '''
+        result = self._values.get("webhook_reserved_concurrency")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "GithubMicrovmRunnersProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.GithubPatAuthProps",
+    jsii_struct_bases=[],
+    name_mapping={"token": "token", "webhook_secret": "webhookSecret"},
+)
+class GithubPatAuthProps:
+    def __init__(
+        self,
+        *,
+        token: "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret",
+        webhook_secret: "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret",
+    ) -> None:
+        '''Props for ``GithubAuth.pat``.
+
+        :param token: Secret holding a GitHub personal access token.
+        :param webhook_secret: Secret holding the webhook secret used to validate inbound deliveries.
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__af35288b9c48eea9cffeb6e1080b684e480ae2227583407499a01041a243a072)
+            check_type(argname="argument token", value=token, expected_type=type_hints["token"])
+            check_type(argname="argument webhook_secret", value=webhook_secret, expected_type=type_hints["webhook_secret"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "token": token,
+            "webhook_secret": webhook_secret,
+        }
+
+    @builtins.property
+    def token(self) -> "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret":
+        '''Secret holding a GitHub personal access token.'''
+        result = self._values.get("token")
+        assert result is not None, "Required property 'token' is missing"
+        return typing.cast("_aws_cdk_aws_secretsmanager_ceddda9d.ISecret", result)
+
+    @builtins.property
+    def webhook_secret(self) -> "_aws_cdk_aws_secretsmanager_ceddda9d.ISecret":
+        '''Secret holding the webhook secret used to validate inbound deliveries.'''
+        result = self._values.get("webhook_secret")
+        assert result is not None, "Required property 'webhook_secret' is missing"
+        return typing.cast("_aws_cdk_aws_secretsmanager_ceddda9d.ISecret", result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "GithubPatAuthProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.ImageAsset",
+    jsii_struct_bases=[],
+    name_mapping={"source": "source", "target": "target"},
+)
+class ImageAsset:
+    def __init__(self, *, source: builtins.str, target: builtins.str) -> None:
+        '''One extra file or directory baked into the image.
+
+        ``source`` is a path on the machine running ``cdk synth``. The image pipeline
+        reads it off disk when it stages the Docker build context, and the rendered
+        Dockerfile copies it to ``target`` inside the image.
+
+        :param source: Path (file or directory) on the build machine to copy into the image.
+        :param target: Absolute path inside the image to copy ``source`` to.
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__d7d3da112d28b428bdfaadffe313adf1b4f0e1018b1cbf217c7687e156912c49)
+            check_type(argname="argument source", value=source, expected_type=type_hints["source"])
+            check_type(argname="argument target", value=target, expected_type=type_hints["target"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "source": source,
+            "target": target,
+        }
+
+    @builtins.property
+    def source(self) -> builtins.str:
+        '''Path (file or directory) on the build machine to copy into the image.'''
+        result = self._values.get("source")
+        assert result is not None, "Required property 'source' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def target(self) -> builtins.str:
+        '''Absolute path inside the image to copy ``source`` to.'''
+        result = self._values.get("target")
+        assert result is not None, "Required property 'target' is missing"
+        return typing.cast(builtins.str, result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "ImageAsset(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class ImageLogs(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.ImageLogs",
+):
+    '''Build-time image logs for a runner set: the Docker build layers and the ready-probe banner an image emits while it is built.
+
+    Off unless you add it.
+
+    These logs are written while the image builds, by the image build role
+    rather than by a VM, so image logging needs no VM execution role and puts no
+    credentials on a runner. ``ConsoleLogs`` covers the runtime counterpart, which
+    does need a role. The two are independent and can both be on.
+
+    Example::
+
+        GithubMicrovmRunners(stack, "Runners",
+            github=github,
+            scope=scope,
+            image_logs=ImageLogs.enabled()
+        )
+    '''
+
+    @jsii.member(jsii_name="enabled")
+    @builtins.classmethod
+    def enabled(
+        cls,
+        log_group: typing.Optional["_aws_cdk_aws_logs_ceddda9d.ILogGroup"] = None,
+    ) -> "ImageLogs":
+        '''Send image-build logs to CloudWatch.
+
+        With no argument they go to the
+        platform's own group (``/aws/lambda-microvms/…``). Pass an ``ILogGroup`` to
+        send them to a group whose retention and KMS key you control.
+
+        :param log_group: destination group. Omitted, the platform's own group.
+
+        Example::
+
+            build_logs = ImageLogs.enabled(my_build_log_group)
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__5c18afa4a05ee3b3cf8019fa8e3bf98a9dc803b4ff31600008a4916dce15cd6a)
+            check_type(argname="argument log_group", value=log_group, expected_type=type_hints["log_group"])
+        return typing.cast("ImageLogs", jsii.sinvoke(cls, "enabled", [log_group]))
+
+    @builtins.property
+    @jsii.member(jsii_name="logGroup")
+    def log_group(self) -> typing.Optional["_aws_cdk_aws_logs_ceddda9d.ILogGroup"]:
+        '''The group build logs go to, when one was passed to ``ImageLogs.enabled()``. ``undefined`` means the platform's own group.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_logs_ceddda9d.ILogGroup"], jsii.get(self, "logGroup"))
+
+
+class ImagePipeline(
+    _constructs_77d1e7e8.Construct,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.ImagePipeline",
+):
+    '''The build behind one runner class's MicroVM image.
+
+    ``addRunnerClass`` creates
+    one for each class it registers and returns it as
+    ``RunnerClass.imagePipeline``, so this is a handle you read rather than a
+    construct you instantiate.
+
+    It stages the class's Dockerfile and build context as a CDK asset, declares
+    the ``AWS::Lambda::MicrovmImage`` resource that CloudFormation builds from it,
+    and creates the IAM role that build runs as. Reading it is how you reach the
+    built image's name and ARN, and the role the build runs as.
+
+    Example::
+
+        build_class = runners.add_runner_class("build",
+            size=MicrovmSize.GB4,
+            image=RunnerImage.from_options(system_packages=["jq"])
+        )
+        
+        cdk.CfnOutput(stack, "BuildImageName",
+            value=build_class.image_pipeline.image_name
+        )
+    '''
+
+    def __init__(
+        self,
+        scope: "_constructs_77d1e7e8.Construct",
+        id: builtins.str,
+        *,
+        image: "RunnerImage",
+        network: "RunnerNetwork",
+        runner_set_id: builtins.str,
+        size: "MicrovmSize",
+        base_image_version: typing.Optional[builtins.str] = None,
+        image_logs: typing.Optional["ImageLogs"] = None,
+        ready_timeout_seconds: typing.Optional[jsii.Number] = None,
+        run_timeout_seconds: typing.Optional[jsii.Number] = None,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param image: The runner image to build: ``RunnerImage.fromOptions()`` for a synthesized Dockerfile, ``RunnerImage.fromInline(text)`` for Dockerfile text, or ``RunnerImage.fromDockerfile(dir)`` for a Dockerfile and build context on disk.
+        :param network: How the build and the VMs reach the network.
+        :param runner_set_id: Identifier for the runner set this image belongs to. It is combined with the first 8 hex characters of the image's ``contentHash`` to form the image's name, so a content change publishes a new image and an unchanged one is a no-op. Must match ``^[a-zA-Z0-9-_]+$``, and must be 55 characters or fewer so that ``<runnerSetId>-<8-hex-chars>`` stays within the service's 64-character name limit.
+        :param size: The size the built image runs at, which becomes its memory floor.
+        :param base_image_version: Version of the managed ``al2023-1`` base image to build from. Default: '0'
+        :param image_logs: Where the build's logs go. Left unset, the build emits no logs; ``ImageLogs.enabled()`` sends them to the platform's group, and ``ImageLogs.enabled(logGroup)`` to a group you supply.
+        :param ready_timeout_seconds: Seconds the service waits for the in-VM agent's ``/ready`` hook before failing the image build. Default: 300
+        :param run_timeout_seconds: Seconds the service waits for the in-VM agent's ``/run`` hook to accept a launch. Service maximum: 60. Default: 60
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__38e8b0a65e40c9bfd130b4244eef3af238aac180d3c10606a513fef86e7aa169)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = ImagePipelineProps(
+            image=image,
+            network=network,
+            runner_set_id=runner_set_id,
+            size=size,
+            base_image_version=base_image_version,
+            image_logs=image_logs,
+            ready_timeout_seconds=ready_timeout_seconds,
+            run_timeout_seconds=run_timeout_seconds,
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+    @builtins.property
+    @jsii.member(jsii_name="buildRole")
+    def build_role(self) -> "_aws_cdk_aws_iam_ceddda9d.IRole":
+        '''IAM role the image build runs as, able to read the staged build context and pull any private container base image.'''
+        return typing.cast("_aws_cdk_aws_iam_ceddda9d.IRole", jsii.get(self, "buildRole"))
+
+    @builtins.property
+    @jsii.member(jsii_name="imageArn")
+    def image_arn(self) -> builtins.str:
+        '''ARN of the built MicroVM image.'''
+        return typing.cast(builtins.str, jsii.get(self, "imageArn"))
+
+    @builtins.property
+    @jsii.member(jsii_name="imageName")
+    def image_name(self) -> builtins.str:
+        '''Name of the built MicroVM image, ``<runnerSetId>-<8 hex characters of the content hash>``.'''
+        return typing.cast(builtins.str, jsii.get(self, "imageName"))
+
+    @builtins.property
+    @jsii.member(jsii_name="imageResource")
+    def image_resource(self) -> "_aws_cdk_aws_lambda_ceddda9d.CfnMicrovmImage":
+        '''The underlying ``AWS::Lambda::MicrovmImage`` resource.'''
+        return typing.cast("_aws_cdk_aws_lambda_ceddda9d.CfnMicrovmImage", jsii.get(self, "imageResource"))
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.ImagePipelineProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "image": "image",
+        "network": "network",
+        "runner_set_id": "runnerSetId",
+        "size": "size",
+        "base_image_version": "baseImageVersion",
+        "image_logs": "imageLogs",
+        "ready_timeout_seconds": "readyTimeoutSeconds",
+        "run_timeout_seconds": "runTimeoutSeconds",
+    },
+)
+class ImagePipelineProps:
+    def __init__(
+        self,
+        *,
+        image: "RunnerImage",
+        network: "RunnerNetwork",
+        runner_set_id: builtins.str,
+        size: "MicrovmSize",
+        base_image_version: typing.Optional[builtins.str] = None,
+        image_logs: typing.Optional["ImageLogs"] = None,
+        ready_timeout_seconds: typing.Optional[jsii.Number] = None,
+        run_timeout_seconds: typing.Optional[jsii.Number] = None,
+    ) -> None:
+        '''Props for ``ImagePipeline``.
+
+        :param image: The runner image to build: ``RunnerImage.fromOptions()`` for a synthesized Dockerfile, ``RunnerImage.fromInline(text)`` for Dockerfile text, or ``RunnerImage.fromDockerfile(dir)`` for a Dockerfile and build context on disk.
+        :param network: How the build and the VMs reach the network.
+        :param runner_set_id: Identifier for the runner set this image belongs to. It is combined with the first 8 hex characters of the image's ``contentHash`` to form the image's name, so a content change publishes a new image and an unchanged one is a no-op. Must match ``^[a-zA-Z0-9-_]+$``, and must be 55 characters or fewer so that ``<runnerSetId>-<8-hex-chars>`` stays within the service's 64-character name limit.
+        :param size: The size the built image runs at, which becomes its memory floor.
+        :param base_image_version: Version of the managed ``al2023-1`` base image to build from. Default: '0'
+        :param image_logs: Where the build's logs go. Left unset, the build emits no logs; ``ImageLogs.enabled()`` sends them to the platform's group, and ``ImageLogs.enabled(logGroup)`` to a group you supply.
+        :param ready_timeout_seconds: Seconds the service waits for the in-VM agent's ``/ready`` hook before failing the image build. Default: 300
+        :param run_timeout_seconds: Seconds the service waits for the in-VM agent's ``/run`` hook to accept a launch. Service maximum: 60. Default: 60
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__c8c6d3e3f7a844305d6a7d687bb74edba13926e6cdb04020bf45116bbb7f2407)
+            check_type(argname="argument image", value=image, expected_type=type_hints["image"])
+            check_type(argname="argument network", value=network, expected_type=type_hints["network"])
+            check_type(argname="argument runner_set_id", value=runner_set_id, expected_type=type_hints["runner_set_id"])
+            check_type(argname="argument size", value=size, expected_type=type_hints["size"])
+            check_type(argname="argument base_image_version", value=base_image_version, expected_type=type_hints["base_image_version"])
+            check_type(argname="argument image_logs", value=image_logs, expected_type=type_hints["image_logs"])
+            check_type(argname="argument ready_timeout_seconds", value=ready_timeout_seconds, expected_type=type_hints["ready_timeout_seconds"])
+            check_type(argname="argument run_timeout_seconds", value=run_timeout_seconds, expected_type=type_hints["run_timeout_seconds"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "image": image,
+            "network": network,
+            "runner_set_id": runner_set_id,
+            "size": size,
+        }
+        if base_image_version is not None:
+            self._values["base_image_version"] = base_image_version
+        if image_logs is not None:
+            self._values["image_logs"] = image_logs
+        if ready_timeout_seconds is not None:
+            self._values["ready_timeout_seconds"] = ready_timeout_seconds
+        if run_timeout_seconds is not None:
+            self._values["run_timeout_seconds"] = run_timeout_seconds
+
+    @builtins.property
+    def image(self) -> "RunnerImage":
+        '''The runner image to build: ``RunnerImage.fromOptions()`` for a synthesized Dockerfile, ``RunnerImage.fromInline(text)`` for Dockerfile text, or ``RunnerImage.fromDockerfile(dir)`` for a Dockerfile and build context on disk.'''
+        result = self._values.get("image")
+        assert result is not None, "Required property 'image' is missing"
+        return typing.cast("RunnerImage", result)
+
+    @builtins.property
+    def network(self) -> "RunnerNetwork":
+        '''How the build and the VMs reach the network.'''
+        result = self._values.get("network")
+        assert result is not None, "Required property 'network' is missing"
+        return typing.cast("RunnerNetwork", result)
+
+    @builtins.property
+    def runner_set_id(self) -> builtins.str:
+        '''Identifier for the runner set this image belongs to.
+
+        It is combined with
+        the first 8 hex characters of the image's ``contentHash`` to form the
+        image's name, so a content change publishes a new image and an unchanged
+        one is a no-op. Must match ``^[a-zA-Z0-9-_]+$``, and must be 55 characters
+        or fewer so that ``<runnerSetId>-<8-hex-chars>`` stays within the service's
+        64-character name limit.
+        '''
+        result = self._values.get("runner_set_id")
+        assert result is not None, "Required property 'runner_set_id' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def size(self) -> "MicrovmSize":
+        '''The size the built image runs at, which becomes its memory floor.'''
+        result = self._values.get("size")
+        assert result is not None, "Required property 'size' is missing"
+        return typing.cast("MicrovmSize", result)
+
+    @builtins.property
+    def base_image_version(self) -> typing.Optional[builtins.str]:
+        '''Version of the managed ``al2023-1`` base image to build from.
+
+        :default: '0'
+        '''
+        result = self._values.get("base_image_version")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def image_logs(self) -> typing.Optional["ImageLogs"]:
+        '''Where the build's logs go.
+
+        Left unset, the build emits no logs; ``ImageLogs.enabled()`` sends them to the platform's group, and ``ImageLogs.enabled(logGroup)`` to a group you supply.
+        '''
+        result = self._values.get("image_logs")
+        return typing.cast(typing.Optional["ImageLogs"], result)
+
+    @builtins.property
+    def ready_timeout_seconds(self) -> typing.Optional[jsii.Number]:
+        '''Seconds the service waits for the in-VM agent's ``/ready`` hook before failing the image build.
+
+        :default: 300
+        '''
+        result = self._values.get("ready_timeout_seconds")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def run_timeout_seconds(self) -> typing.Optional[jsii.Number]:
+        '''Seconds the service waits for the in-VM agent's ``/run`` hook to accept a launch.
+
+        Service maximum: 60.
+
+        :default: 60
+        '''
+        result = self._values.get("run_timeout_seconds")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "ImagePipelineProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.MicrovmIdlePolicy",
+    jsii_struct_bases=[],
+    name_mapping={
+        "max_idle_duration": "maxIdleDuration",
+        "suspended_duration": "suspendedDuration",
+        "auto_resume": "autoResume",
+    },
+)
+class MicrovmIdlePolicy:
+    def __init__(
+        self,
+        *,
+        max_idle_duration: "_aws_cdk_ceddda9d.Duration",
+        suspended_duration: "_aws_cdk_ceddda9d.Duration",
+        auto_resume: typing.Optional[builtins.bool] = None,
+    ) -> None:
+        '''When the platform suspends and resumes a runner class's cold-launched VMs.
+
+        This mirrors the MicroVM service's own ``idlePolicy`` shape, expressed as
+        ``Duration``s rather than raw seconds. Set it on a runner class through
+        ``RunnerClassProps.idlePolicy``.
+
+        :param max_idle_duration: Idle time before the platform auto-suspends the VM.
+        :param suspended_duration: How long a suspended VM is kept before the platform terminates it. Required. The MicroVM service rejects a launch whose idle policy omits this value, and it offers no value meaning "keep the suspended VM indefinitely", so every idle policy names a duration.
+        :param auto_resume: Auto-resume the VM on activity. Default: false
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__299a6933558be6e9144d105ecb8f71fdfa2731d8f7934fa33118eb063140eb10)
+            check_type(argname="argument max_idle_duration", value=max_idle_duration, expected_type=type_hints["max_idle_duration"])
+            check_type(argname="argument suspended_duration", value=suspended_duration, expected_type=type_hints["suspended_duration"])
+            check_type(argname="argument auto_resume", value=auto_resume, expected_type=type_hints["auto_resume"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "max_idle_duration": max_idle_duration,
+            "suspended_duration": suspended_duration,
+        }
+        if auto_resume is not None:
+            self._values["auto_resume"] = auto_resume
+
+    @builtins.property
+    def max_idle_duration(self) -> "_aws_cdk_ceddda9d.Duration":
+        '''Idle time before the platform auto-suspends the VM.'''
+        result = self._values.get("max_idle_duration")
+        assert result is not None, "Required property 'max_idle_duration' is missing"
+        return typing.cast("_aws_cdk_ceddda9d.Duration", result)
+
+    @builtins.property
+    def suspended_duration(self) -> "_aws_cdk_ceddda9d.Duration":
+        '''How long a suspended VM is kept before the platform terminates it.
+
+        Required. The MicroVM service rejects a launch whose idle policy omits
+        this value, and it offers no value meaning "keep the suspended VM
+        indefinitely", so every idle policy names a duration.
+        '''
+        result = self._values.get("suspended_duration")
+        assert result is not None, "Required property 'suspended_duration' is missing"
+        return typing.cast("_aws_cdk_ceddda9d.Duration", result)
+
+    @builtins.property
+    def auto_resume(self) -> typing.Optional[builtins.bool]:
+        '''Auto-resume the VM on activity.
+
+        :default: false
+        '''
+        result = self._values.get("auto_resume")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "MicrovmIdlePolicy(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class MicrovmSize(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.MicrovmSize",
+):
+    '''The memory a MicroVM runs with.
+
+    Each runner class picks one preset, and that preset becomes the memory floor
+    of the image the class builds. Pick from the static presets below; the
+    constructor is private.
+
+    A preset is a **floor, not an allocation**. It is the minimum the image is
+    built with, and the platform provisions above it — measured at roughly four
+    times the request, so a class on ``GB1`` has been observed booting with about
+    4 GB and 2 vCPU, and one on ``GB4`` with about 16 GB and 8 vCPU. Two things
+    follow: a workload usually fits a smaller preset than its memory figure
+    suggests, and the account's memory quota is charged the measured allocation
+    rather than the floor. The service quotas guide carries the arithmetic.
+
+    vCPU and disk follow from the preset and are not separately settable — the
+    image resource takes a memory floor and nothing else.
+
+    Example::
+
+        runners.add_runner_class("microvm-8gb", size=MicrovmSize.GB8)
+    '''
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="GB0_5")
+    def GB0_5(cls) -> "MicrovmSize":
+        '''Memory floor of 0.5 GB.'''
+        return typing.cast("MicrovmSize", jsii.sget(cls, "GB0_5"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="GB1")
+    def GB1(cls) -> "MicrovmSize":
+        '''Memory floor of 1 GB.'''
+        return typing.cast("MicrovmSize", jsii.sget(cls, "GB1"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="GB2")
+    def GB2(cls) -> "MicrovmSize":
+        '''Memory floor of 2 GB.'''
+        return typing.cast("MicrovmSize", jsii.sget(cls, "GB2"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="GB4")
+    def GB4(cls) -> "MicrovmSize":
+        '''Memory floor of 4 GB.'''
+        return typing.cast("MicrovmSize", jsii.sget(cls, "GB4"))
+
+    @jsii.python.classproperty
+    @jsii.member(jsii_name="GB8")
+    def GB8(cls) -> "MicrovmSize":
+        '''Memory floor of 8 GB.'''
+        return typing.cast("MicrovmSize", jsii.sget(cls, "GB8"))
+
+    @builtins.property
+    @jsii.member(jsii_name="memoryGb")
+    def memory_gb(self) -> jsii.Number:
+        '''Memory floor in GB.'''
+        return typing.cast(jsii.Number, jsii.get(self, "memoryGb"))
+
+    @builtins.property
+    @jsii.member(jsii_name="memoryMib")
+    def memory_mib(self) -> jsii.Number:
+        '''Memory in MiB, the unit the MicroVM image's ``minimumMemoryInMiB`` takes.'''
+        return typing.cast(jsii.Number, jsii.get(self, "memoryMib"))
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.RunnerAlarmOptions",
+    jsii_struct_bases=[],
+    name_mapping={
+        "evaluation_periods": "evaluationPeriods",
+        "period": "period",
+        "threshold": "threshold",
+    },
+)
+class RunnerAlarmOptions:
+    def __init__(
+        self,
+        *,
+        evaluation_periods: typing.Optional[jsii.Number] = None,
+        period: typing.Optional["_aws_cdk_ceddda9d.Duration"] = None,
+        threshold: typing.Optional[jsii.Number] = None,
+    ) -> None:
+        '''Tuning for the ready-made alarms on ``GithubMicrovmRunnersMetrics``.
+
+        :param evaluation_periods: Consecutive breaching periods before the alarm fires. Default: 1 (3 for the stuck-launch alarm)
+        :param period: Aggregation period for the metric. Default: Duration.minutes(5)
+        :param threshold: Value at or above which the alarm fires. Default: 1
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__117c59b0a49dcc58de82f614adb71603b95518cace779312d23dbc393e930d0f)
+            check_type(argname="argument evaluation_periods", value=evaluation_periods, expected_type=type_hints["evaluation_periods"])
+            check_type(argname="argument period", value=period, expected_type=type_hints["period"])
+            check_type(argname="argument threshold", value=threshold, expected_type=type_hints["threshold"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if evaluation_periods is not None:
+            self._values["evaluation_periods"] = evaluation_periods
+        if period is not None:
+            self._values["period"] = period
+        if threshold is not None:
+            self._values["threshold"] = threshold
+
+    @builtins.property
+    def evaluation_periods(self) -> typing.Optional[jsii.Number]:
+        '''Consecutive breaching periods before the alarm fires.
+
+        :default: 1 (3 for the stuck-launch alarm)
+        '''
+        result = self._values.get("evaluation_periods")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def period(self) -> typing.Optional["_aws_cdk_ceddda9d.Duration"]:
+        '''Aggregation period for the metric.
+
+        :default: Duration.minutes(5)
+        '''
+        result = self._values.get("period")
+        return typing.cast(typing.Optional["_aws_cdk_ceddda9d.Duration"], result)
+
+    @builtins.property
+    def threshold(self) -> typing.Optional[jsii.Number]:
+        '''Value at or above which the alarm fires.
+
+        :default: 1
+        '''
+        result = self._values.get("threshold")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "RunnerAlarmOptions(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.RunnerClass",
+    jsii_struct_bases=[],
+    name_mapping={
+        "image_arn": "imageArn",
+        "image_pipeline": "imagePipeline",
+        "label": "label",
+        "size": "size",
+    },
+)
+class RunnerClass:
+    def __init__(
+        self,
+        *,
+        image_arn: builtins.str,
+        image_pipeline: "ImagePipeline",
+        label: builtins.str,
+        size: "MicrovmSize",
+    ) -> None:
+        '''Handle returned by ``GithubMicrovmRunners.addRunnerClass``.
+
+        :param image_arn: ARN of this class's built MicroVM image (a CloudFormation token at synth).
+        :param image_pipeline: The image pipeline that builds and publishes this class's MicroVM image.
+        :param label: The ``runs-on`` label workflows target to run on this class.
+        :param size: The VM memory floor this class launches at.
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__23472a12727bc341ce55563246f68a52c49776a6814a52ab825cec01db0cdc89)
+            check_type(argname="argument image_arn", value=image_arn, expected_type=type_hints["image_arn"])
+            check_type(argname="argument image_pipeline", value=image_pipeline, expected_type=type_hints["image_pipeline"])
+            check_type(argname="argument label", value=label, expected_type=type_hints["label"])
+            check_type(argname="argument size", value=size, expected_type=type_hints["size"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "image_arn": image_arn,
+            "image_pipeline": image_pipeline,
+            "label": label,
+            "size": size,
+        }
+
+    @builtins.property
+    def image_arn(self) -> builtins.str:
+        '''ARN of this class's built MicroVM image (a CloudFormation token at synth).'''
+        result = self._values.get("image_arn")
+        assert result is not None, "Required property 'image_arn' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def image_pipeline(self) -> "ImagePipeline":
+        '''The image pipeline that builds and publishes this class's MicroVM image.'''
+        result = self._values.get("image_pipeline")
+        assert result is not None, "Required property 'image_pipeline' is missing"
+        return typing.cast("ImagePipeline", result)
+
+    @builtins.property
+    def label(self) -> builtins.str:
+        '''The ``runs-on`` label workflows target to run on this class.'''
+        result = self._values.get("label")
+        assert result is not None, "Required property 'label' is missing"
+        return typing.cast(builtins.str, result)
+
+    @builtins.property
+    def size(self) -> "MicrovmSize":
+        '''The VM memory floor this class launches at.'''
+        result = self._values.get("size")
+        assert result is not None, "Required property 'size' is missing"
+        return typing.cast("MicrovmSize", result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "RunnerClass(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.RunnerClassProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "size": "size",
+        "idle_policy": "idlePolicy",
+        "image": "image",
+        "warm_pool_size": "warmPoolSize",
+    },
+)
+class RunnerClassProps:
+    def __init__(
+        self,
+        *,
+        size: "MicrovmSize",
+        idle_policy: typing.Optional[typing.Union["MicrovmIdlePolicy", typing.Dict[builtins.str, typing.Any]]] = None,
+        image: typing.Optional["RunnerImage"] = None,
+        warm_pool_size: typing.Optional[jsii.Number] = None,
+    ) -> None:
+        '''Props for ``GithubMicrovmRunners.addRunnerClass``.
+
+        :param size: VM memory floor for this class.
+        :param idle_policy: Auto-suspend and auto-resume policy for this class's cold-launched VMs. Mutually exclusive with ``warmPoolSize`` on the same class, since both drive the VM's suspended state; setting both throws at ``addRunnerClass`` time. Default: undefined (no idle policy; the platform never auto-suspends)
+        :param image: Image this class builds from. Default: RunnerImage.fromOptions()
+        :param warm_pool_size: How many pre-booted, suspended VMs to keep ready for this class. A job that matches this class resumes one of them instead of cold-launching a new VM, and falls back to a cold launch when none is available. This is a count, not a flag: ``warmPoolSize: 3`` keeps three VMs ready. The runner set refills the pool on the ``warmPoolInterval`` schedule. Default: undefined (no warm pool; every job cold-launches)
+        '''
+        if isinstance(idle_policy, dict):
+            idle_policy = MicrovmIdlePolicy(**idle_policy)
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__6e46f2bbd7884caef4f137e6dac784cd99ef109d84b58f3f7acf963f03c723a7)
+            check_type(argname="argument size", value=size, expected_type=type_hints["size"])
+            check_type(argname="argument idle_policy", value=idle_policy, expected_type=type_hints["idle_policy"])
+            check_type(argname="argument image", value=image, expected_type=type_hints["image"])
+            check_type(argname="argument warm_pool_size", value=warm_pool_size, expected_type=type_hints["warm_pool_size"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {
+            "size": size,
+        }
+        if idle_policy is not None:
+            self._values["idle_policy"] = idle_policy
+        if image is not None:
+            self._values["image"] = image
+        if warm_pool_size is not None:
+            self._values["warm_pool_size"] = warm_pool_size
+
+    @builtins.property
+    def size(self) -> "MicrovmSize":
+        '''VM memory floor for this class.'''
+        result = self._values.get("size")
+        assert result is not None, "Required property 'size' is missing"
+        return typing.cast("MicrovmSize", result)
+
+    @builtins.property
+    def idle_policy(self) -> typing.Optional["MicrovmIdlePolicy"]:
+        '''Auto-suspend and auto-resume policy for this class's cold-launched VMs.
+
+        Mutually exclusive with ``warmPoolSize`` on the same class, since both drive
+        the VM's suspended state; setting both throws at ``addRunnerClass`` time.
+
+        :default: undefined (no idle policy; the platform never auto-suspends)
+        '''
+        result = self._values.get("idle_policy")
+        return typing.cast(typing.Optional["MicrovmIdlePolicy"], result)
+
+    @builtins.property
+    def image(self) -> typing.Optional["RunnerImage"]:
+        '''Image this class builds from.
+
+        :default: RunnerImage.fromOptions()
+        '''
+        result = self._values.get("image")
+        return typing.cast(typing.Optional["RunnerImage"], result)
+
+    @builtins.property
+    def warm_pool_size(self) -> typing.Optional[jsii.Number]:
+        '''How many pre-booted, suspended VMs to keep ready for this class.
+
+        A job
+        that matches this class resumes one of them instead of cold-launching a
+        new VM, and falls back to a cold launch when none is available. This is a
+        count, not a flag: ``warmPoolSize: 3`` keeps three VMs ready. The runner set
+        refills the pool on the ``warmPoolInterval`` schedule.
+
+        :default: undefined (no warm pool; every job cold-launches)
+        '''
+        result = self._values.get("warm_pool_size")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "RunnerClassProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class RunnerImage(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.RunnerImage",
+):
+    '''The image a runner class's VMs boot from: one this library synthesizes, or one you author yourself.
+
+    Build one with the static factories below; the constructor is private.
+
+    Example::
+
+        runners.add_runner_class("build",
+            size=MicrovmSize.GB4,
+            image=RunnerImage.from_options(
+                system_packages=["jq", "ripgrep"]
+            )
+        )
+    '''
+
+    @jsii.member(jsii_name="fromDockerfile")
+    @builtins.classmethod
+    def from_dockerfile(cls, dir: builtins.str) -> "RunnerImage":
+        '''Use your own Dockerfile, and the build context around it, from the directory ``dir``.
+
+        The whole directory is staged as the Docker build
+        context, so a Dockerfile that needs to ``COPY`` files of its own belongs
+        here rather than in ``RunnerImage.fromInline``.
+
+        The ``contentHash`` recorded on the returned instance is derived from the
+        path string. The directory's actual contents are read and hashed later,
+        when the image pipeline stages them as a CDK asset.
+
+        A relative ``dir`` is resolved against the process working directory, which
+        is wherever ``cdk`` was invoked. Anchor it to the file that declares the
+        runner class instead by passing ``path.join(__dirname, 'runner-image')``.
+
+        :param dir: -
+
+        Example::
+
+            custom_image = RunnerImage.from_dockerfile("runner-image")
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__979f58111abc04b49545772d5ca529893452a46b62def883e284f0c2b1f0f73d)
+            check_type(argname="argument dir", value=dir, expected_type=type_hints["dir"])
+        return typing.cast("RunnerImage", jsii.sinvoke(cls, "fromDockerfile", [dir]))
+
+    @jsii.member(jsii_name="fromInline")
+    @builtins.classmethod
+    def from_inline(cls, dockerfile: builtins.str) -> "RunnerImage":
+        '''Use your own Dockerfile, supplied as text.
+
+        The text is staged verbatim as
+        the build context's ``Dockerfile``, alongside the ``microvm-runner/``
+        directory the image pipeline injects and nothing else. A Dockerfile that
+        needs to ``COPY`` files of its own belongs with
+        ``RunnerImage.fromDockerfile``, which stages a whole directory.
+
+        The text must ``COPY microvm-runner/agent.mjs`` and start the staged
+        entrypoint, because that agent is what serves the MicroVM lifecycle hooks
+        the platform calls. This is checked here, and a Dockerfile that does not
+        copy the agent throws.
+
+        The ``contentHash`` recorded on the returned instance is a sha256 over the
+        supplied text.
+
+        :param dockerfile: -
+
+        Example::
+
+            inline_image = RunnerImage.from_inline("""
+                FROM public.ecr.aws/lambda/microvms:al2023-minimal
+            
+                RUN dnf install -y git jq
+            
+                COPY microvm-runner/agent.mjs /opt/microvm-runner/agent.mjs
+                COPY microvm-runner/entrypoint.sh /opt/microvm-runner/entrypoint.sh
+                ENTRYPOINT ["/opt/microvm-runner/entrypoint.sh"]
+                """)
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__2d9215b22cc740b2c93f48e4e0744fe50e43a7a33f85974d48dbebd1e184d9d4)
+            check_type(argname="argument dockerfile", value=dockerfile, expected_type=type_hints["dockerfile"])
+        return typing.cast("RunnerImage", jsii.sinvoke(cls, "fromInline", [dockerfile]))
+
+    @jsii.member(jsii_name="fromOptions")
+    @builtins.classmethod
+    def from_options(
+        cls,
+        *,
+        additional_os_capabilities: typing.Optional[typing.Sequence[builtins.str]] = None,
+        assets: typing.Optional[typing.Sequence[typing.Union["ImageAsset", typing.Dict[builtins.str, typing.Any]]]] = None,
+        environment: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+        runner_version: typing.Optional["RunnerVersion"] = None,
+        setup_commands: typing.Optional[typing.Sequence[builtins.str]] = None,
+        system_packages: typing.Optional[typing.Sequence[builtins.str]] = None,
+        toolchains: typing.Optional[typing.Sequence["RunnerToolchain"]] = None,
+    ) -> "RunnerImage":
+        '''Synthesize a Dockerfile from ``opts`` — extra packages, setup commands, assets, environment variables, toolchains, and the ``actions/runner`` release to install.
+
+        The image's ``contentHash`` is computed here, over the
+        rendered Dockerfile text and the list of assets it copies.
+
+        :param additional_os_capabilities: Extra Linux capabilities granted to the MicroVM's operating system. Default: ['ALL']
+        :param assets: Extra files and directories to copy into the image.
+        :param environment: Extra environment variables baked into the image.
+        :param runner_version: ``actions/runner`` release to install. Default: RunnerVersion.latest()
+        :param setup_commands: Extra ``RUN`` commands, executed in order after packages, assets, and environment variables are laid down.
+        :param system_packages: Extra ``dnf`` packages to install alongside the fixed base set.
+        :param toolchains: Language runtimes to bake into the hosted tool cache, so ``actions/setup-*`` finds them without downloading anything. An image with none of these is smaller; one toolchain entry is needed per version your workflows ask for. Default: []
+
+        Example::
+
+            build_image = RunnerImage.from_options(
+                system_packages=["jq", "ripgrep"],
+                setup_commands=["npm install -g pnpm@10"],
+                environment={"LANG": "C.UTF-8"},
+                toolchains=[RunnerToolchain.python("3.12.7")]
+            )
+        '''
+        opts = RunnerImageOptions(
+            additional_os_capabilities=additional_os_capabilities,
+            assets=assets,
+            environment=environment,
+            runner_version=runner_version,
+            setup_commands=setup_commands,
+            system_packages=system_packages,
+            toolchains=toolchains,
+        )
+
+        return typing.cast("RunnerImage", jsii.sinvoke(cls, "fromOptions", [opts]))
+
+    @builtins.property
+    @jsii.member(jsii_name="additionalOsCapabilities")
+    def additional_os_capabilities(self) -> typing.List[builtins.str]:
+        '''Extra Linux capabilities granted to the MicroVM's operating system.
+
+        ``fromOptions()`` takes this from ``RunnerImageOptions``; ``fromDockerfile()``
+        and ``fromInline()`` always carry ``['ALL']``.
+        '''
+        return typing.cast(typing.List[builtins.str], jsii.get(self, "additionalOsCapabilities"))
+
+    @builtins.property
+    @jsii.member(jsii_name="contentHash")
+    def content_hash(self) -> builtins.str:
+        '''sha256 content hash, part of the built image's name.
+
+        For
+        ``fromOptions()`` it covers the rendered Dockerfile and the options that
+        produced it; for ``fromInline()``, the supplied Dockerfile text; for
+        ``fromDockerfile()``, the directory path.
+        '''
+        return typing.cast(builtins.str, jsii.get(self, "contentHash"))
+
+    @builtins.property
+    @jsii.member(jsii_name="assets")
+    def assets(self) -> typing.Optional[typing.List["ImageAsset"]]:
+        '''The ``{source, target}`` pairs from ``RunnerImageOptions.assets``. Set for ``fromOptions()``, whose rendered Dockerfile copies each one into the image. ``undefined`` for ``fromDockerfile()``, which stages your whole directory instead, and for ``fromInline()``, whose build context holds the Dockerfile and the injected agent and nothing else.'''
+        return typing.cast(typing.Optional[typing.List["ImageAsset"]], jsii.get(self, "assets"))
+
+    @builtins.property
+    @jsii.member(jsii_name="dockerfile")
+    def dockerfile(self) -> typing.Optional[builtins.str]:
+        '''Dockerfile text: rendered for ``fromOptions()``, supplied by you for ``fromInline()``.
+
+        ``undefined`` for ``fromDockerfile()``, whose Dockerfile
+        lives on disk under ``dockerfileDir``.
+        '''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "dockerfile"))
+
+    @builtins.property
+    @jsii.member(jsii_name="dockerfileDir")
+    def dockerfile_dir(self) -> typing.Optional[builtins.str]:
+        '''The directory holding your own Dockerfile and build context.
+
+        Set for
+        ``fromDockerfile()``, ``undefined`` for ``fromOptions()`` and ``fromInline()``,
+        which both carry their Dockerfile as ``dockerfile`` text.
+        '''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "dockerfileDir"))
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.RunnerImageOptions",
+    jsii_struct_bases=[],
+    name_mapping={
+        "additional_os_capabilities": "additionalOsCapabilities",
+        "assets": "assets",
+        "environment": "environment",
+        "runner_version": "runnerVersion",
+        "setup_commands": "setupCommands",
+        "system_packages": "systemPackages",
+        "toolchains": "toolchains",
+    },
+)
+class RunnerImageOptions:
+    def __init__(
+        self,
+        *,
+        additional_os_capabilities: typing.Optional[typing.Sequence[builtins.str]] = None,
+        assets: typing.Optional[typing.Sequence[typing.Union["ImageAsset", typing.Dict[builtins.str, typing.Any]]]] = None,
+        environment: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+        runner_version: typing.Optional["RunnerVersion"] = None,
+        setup_commands: typing.Optional[typing.Sequence[builtins.str]] = None,
+        system_packages: typing.Optional[typing.Sequence[builtins.str]] = None,
+        toolchains: typing.Optional[typing.Sequence["RunnerToolchain"]] = None,
+    ) -> None:
+        '''Options for ``RunnerImage.fromOptions``.
+
+        :param additional_os_capabilities: Extra Linux capabilities granted to the MicroVM's operating system. Default: ['ALL']
+        :param assets: Extra files and directories to copy into the image.
+        :param environment: Extra environment variables baked into the image.
+        :param runner_version: ``actions/runner`` release to install. Default: RunnerVersion.latest()
+        :param setup_commands: Extra ``RUN`` commands, executed in order after packages, assets, and environment variables are laid down.
+        :param system_packages: Extra ``dnf`` packages to install alongside the fixed base set.
+        :param toolchains: Language runtimes to bake into the hosted tool cache, so ``actions/setup-*`` finds them without downloading anything. An image with none of these is smaller; one toolchain entry is needed per version your workflows ask for. Default: []
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__6fd3c247efc1bf4be6517722f43505c0df1d4ecea290c5f473194c94910a6cb8)
+            check_type(argname="argument additional_os_capabilities", value=additional_os_capabilities, expected_type=type_hints["additional_os_capabilities"])
+            check_type(argname="argument assets", value=assets, expected_type=type_hints["assets"])
+            check_type(argname="argument environment", value=environment, expected_type=type_hints["environment"])
+            check_type(argname="argument runner_version", value=runner_version, expected_type=type_hints["runner_version"])
+            check_type(argname="argument setup_commands", value=setup_commands, expected_type=type_hints["setup_commands"])
+            check_type(argname="argument system_packages", value=system_packages, expected_type=type_hints["system_packages"])
+            check_type(argname="argument toolchains", value=toolchains, expected_type=type_hints["toolchains"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if additional_os_capabilities is not None:
+            self._values["additional_os_capabilities"] = additional_os_capabilities
+        if assets is not None:
+            self._values["assets"] = assets
+        if environment is not None:
+            self._values["environment"] = environment
+        if runner_version is not None:
+            self._values["runner_version"] = runner_version
+        if setup_commands is not None:
+            self._values["setup_commands"] = setup_commands
+        if system_packages is not None:
+            self._values["system_packages"] = system_packages
+        if toolchains is not None:
+            self._values["toolchains"] = toolchains
+
+    @builtins.property
+    def additional_os_capabilities(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''Extra Linux capabilities granted to the MicroVM's operating system.
+
+        :default: ['ALL']
+        '''
+        result = self._values.get("additional_os_capabilities")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    @builtins.property
+    def assets(self) -> typing.Optional[typing.List["ImageAsset"]]:
+        '''Extra files and directories to copy into the image.'''
+        result = self._values.get("assets")
+        return typing.cast(typing.Optional[typing.List["ImageAsset"]], result)
+
+    @builtins.property
+    def environment(
+        self,
+    ) -> typing.Optional[typing.Mapping[builtins.str, builtins.str]]:
+        '''Extra environment variables baked into the image.'''
+        result = self._values.get("environment")
+        return typing.cast(typing.Optional[typing.Mapping[builtins.str, builtins.str]], result)
+
+    @builtins.property
+    def runner_version(self) -> typing.Optional["RunnerVersion"]:
+        '''``actions/runner`` release to install.
+
+        :default: RunnerVersion.latest()
+        '''
+        result = self._values.get("runner_version")
+        return typing.cast(typing.Optional["RunnerVersion"], result)
+
+    @builtins.property
+    def setup_commands(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''Extra ``RUN`` commands, executed in order after packages, assets, and environment variables are laid down.'''
+        result = self._values.get("setup_commands")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    @builtins.property
+    def system_packages(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''Extra ``dnf`` packages to install alongside the fixed base set.'''
+        result = self._values.get("system_packages")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    @builtins.property
+    def toolchains(self) -> typing.Optional[typing.List["RunnerToolchain"]]:
+        '''Language runtimes to bake into the hosted tool cache, so ``actions/setup-*`` finds them without downloading anything.
+
+        An image with none of these is smaller; one toolchain entry is needed per version your workflows ask for.
+
+        :default: []
+        '''
+        result = self._values.get("toolchains")
+        return typing.cast(typing.Optional[typing.List["RunnerToolchain"]], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "RunnerImageOptions(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class RunnerNetwork(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.RunnerNetwork",
+):
+    '''How a runner set's MicroVMs reach the network: direct internet egress, Lambda VPC runtime connectors you already have, or a connector the construct builds from a CDK VPC.
+
+    Build one with the static factories below; the constructor is private.
+
+    Example::
+
+        GithubMicrovmRunners(stack, "Runners",
+            github=github,
+            scope=scope,
+            network=RunnerNetwork.vpc(vpc)
+        )
+    '''
+
+    @jsii.member(jsii_name="internetEgress")
+    @builtins.classmethod
+    def internet_egress(cls) -> "RunnerNetwork":
+        '''Runners egress directly to the internet (no VPC connector).
+
+        Example::
+
+            network = RunnerNetwork.internet_egress()
+        '''
+        return typing.cast("RunnerNetwork", jsii.sinvoke(cls, "internetEgress", []))
+
+    @jsii.member(jsii_name="vpc")
+    @builtins.classmethod
+    def vpc(
+        cls,
+        vpc: "_aws_cdk_aws_ec2_ceddda9d.IVpc",
+        *,
+        security_groups: typing.Optional[typing.Sequence["_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup"]] = None,
+        subnets: typing.Optional[typing.Union["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection", typing.Dict[builtins.str, typing.Any]]] = None,
+    ) -> "RunnerNetwork":
+        '''Runners egress through a network connector the construct builds from the given CDK VPC, along with the security group and the ENI-management operator role that connector needs.
+
+        You supply the VPC; no connector ARN
+        is required. ``connectorArns`` is empty on the returned instance, and the
+        construct fills in the connector's real ARN at synth.
+
+        :param vpc: -
+        :param security_groups: Security groups attached to the connector's ENIs. Default: - a new security group is created on the VPC
+        :param subnets: Which of the VPC's subnets the connector's ENIs land in. Default: - the VPC's private-with-egress subnets (CDK's ``selectSubnets()`` default; falls back to isolated, then public, subnets if the VPC has none of the preceding kind)
+
+        Example::
+
+            network = RunnerNetwork.vpc(vpc,
+                subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_ISOLATED),
+                security_groups=[my_security_group]
+            )
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__d2491e4912faff169fbaad1c4fb389eb29f77ce187a242a0af01526ea53ad4d7)
+            check_type(argname="argument vpc", value=vpc, expected_type=type_hints["vpc"])
+        opts = RunnerNetworkVpcOptions(
+            security_groups=security_groups, subnets=subnets
+        )
+
+        return typing.cast("RunnerNetwork", jsii.sinvoke(cls, "vpc", [vpc, opts]))
+
+    @jsii.member(jsii_name="vpcConnector")
+    @builtins.classmethod
+    def vpc_connector(
+        cls,
+        connector_arns: typing.Sequence[builtins.str],
+    ) -> "RunnerNetwork":
+        '''Runners are attached to the given Lambda runtime connector ARNs.
+
+        :param connector_arns: -
+
+        Example::
+
+            network = RunnerNetwork.vpc_connector(["arn:aws:lambda:us-east-1:111122223333:network-connector:my-connector"
+            ])
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__6db194aaaafe63c89cd0b5bfe1846487e92f6c50fdaa2c8c2e3d8689ff54dfd1)
+            check_type(argname="argument connector_arns", value=connector_arns, expected_type=type_hints["connector_arns"])
+        return typing.cast("RunnerNetwork", jsii.sinvoke(cls, "vpcConnector", [connector_arns]))
+
+    @builtins.property
+    @jsii.member(jsii_name="connectorArns")
+    def connector_arns(self) -> typing.List[builtins.str]:
+        '''Runtime connector ARNs.
+
+        Empty for direct internet egress, and empty for
+        a ``vpc()`` network until the construct builds its connector at synth.
+        '''
+        return typing.cast(typing.List[builtins.str], jsii.get(self, "connectorArns"))
+
+    @builtins.property
+    @jsii.member(jsii_name="kind")
+    def kind(self) -> "RunnerNetworkKind":
+        '''Which networking mode this instance carries.'''
+        return typing.cast("RunnerNetworkKind", jsii.get(self, "kind"))
+
+    @builtins.property
+    @jsii.member(jsii_name="securityGroups")
+    def security_groups(
+        self,
+    ) -> typing.Optional[typing.List["_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup"]]:
+        '''Security groups for the built connector, set only for a ``vpc()`` network.'''
+        return typing.cast(typing.Optional[typing.List["_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup"]], jsii.get(self, "securityGroups"))
+
+    @builtins.property
+    @jsii.member(jsii_name="sourceVpc")
+    def source_vpc(self) -> typing.Optional["_aws_cdk_aws_ec2_ceddda9d.IVpc"]:
+        '''The VPC to build a connector from, set only for a ``vpc()`` network.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_ec2_ceddda9d.IVpc"], jsii.get(self, "sourceVpc"))
+
+    @builtins.property
+    @jsii.member(jsii_name="subnets")
+    def subnets(self) -> typing.Optional["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection"]:
+        '''Subnet selection for the built connector, set only for a ``vpc()`` network.'''
+        return typing.cast(typing.Optional["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection"], jsii.get(self, "subnets"))
+
+
+@jsii.enum(jsii_type="cdk-github-microvm-runners.RunnerNetworkKind")
+class RunnerNetworkKind(enum.Enum):
+    '''Which networking mode a ``RunnerNetwork`` carries.'''
+
+    INTERNET = "INTERNET"
+    '''Direct internet egress, with no Lambda VPC runtime connector.'''
+    CONNECTORS = "CONNECTORS"
+    '''Runners attached to caller-supplied Lambda runtime connector ARNs.'''
+    VPC = "VPC"
+    '''Runners attached to a connector the construct builds from a CDK VPC.'''
+
+
+@jsii.data_type(
+    jsii_type="cdk-github-microvm-runners.RunnerNetworkVpcOptions",
+    jsii_struct_bases=[],
+    name_mapping={"security_groups": "securityGroups", "subnets": "subnets"},
+)
+class RunnerNetworkVpcOptions:
+    def __init__(
+        self,
+        *,
+        security_groups: typing.Optional[typing.Sequence["_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup"]] = None,
+        subnets: typing.Optional[typing.Union["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection", typing.Dict[builtins.str, typing.Any]]] = None,
+    ) -> None:
+        '''Options for ``RunnerNetwork.vpc``.
+
+        :param security_groups: Security groups attached to the connector's ENIs. Default: - a new security group is created on the VPC
+        :param subnets: Which of the VPC's subnets the connector's ENIs land in. Default: - the VPC's private-with-egress subnets (CDK's ``selectSubnets()`` default; falls back to isolated, then public, subnets if the VPC has none of the preceding kind)
+        '''
+        if isinstance(subnets, dict):
+            subnets = _aws_cdk_aws_ec2_ceddda9d.SubnetSelection(**subnets)
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__940d8682a239c73072340b0492130025e2f1d8c0d2614466732fa878426abf8c)
+            check_type(argname="argument security_groups", value=security_groups, expected_type=type_hints["security_groups"])
+            check_type(argname="argument subnets", value=subnets, expected_type=type_hints["subnets"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if security_groups is not None:
+            self._values["security_groups"] = security_groups
+        if subnets is not None:
+            self._values["subnets"] = subnets
+
+    @builtins.property
+    def security_groups(
+        self,
+    ) -> typing.Optional[typing.List["_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup"]]:
+        '''Security groups attached to the connector's ENIs.
+
+        :default: - a new security group is created on the VPC
+        '''
+        result = self._values.get("security_groups")
+        return typing.cast(typing.Optional[typing.List["_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup"]], result)
+
+    @builtins.property
+    def subnets(self) -> typing.Optional["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection"]:
+        '''Which of the VPC's subnets the connector's ENIs land in.
+
+        :default:
+
+        - the VPC's private-with-egress subnets (CDK's
+        ``selectSubnets()`` default; falls back to isolated, then public, subnets
+        if the VPC has none of the preceding kind)
+        '''
+        result = self._values.get("subnets")
+        return typing.cast(typing.Optional["_aws_cdk_aws_ec2_ceddda9d.SubnetSelection"], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "RunnerNetworkVpcOptions(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+class RunnerScope(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.RunnerScope",
+):
+    '''Which GitHub scope registered runners are visible to: an entire organization, or an explicit list of ``owner/repo`` repositories.
+
+    Build one with the static factories below; the constructor is private.
+
+    Example::
+
+        org_scope = RunnerScope.org("my-org")
+    '''
+
+    @jsii.member(jsii_name="org")
+    @builtins.classmethod
+    def org(cls, org: builtins.str) -> "RunnerScope":
+        '''Runners are registered at the organization level.
+
+        :param org: -
+
+        Example::
+
+            org_scope = RunnerScope.org("my-org")
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__a306ec12ac8b86304298f1b4650c1ad69974d0773eef2b6f6245b92666d89c8f)
+            check_type(argname="argument org", value=org, expected_type=type_hints["org"])
+        return typing.cast("RunnerScope", jsii.sinvoke(cls, "org", [org]))
+
+    @jsii.member(jsii_name="repos")
+    @builtins.classmethod
+    def repos(cls, repos: typing.Sequence[builtins.str]) -> "RunnerScope":
+        '''Runners are registered against an explicit list of ``owner/repo`` repos.
+
+        :param repos: -
+
+        Example::
+
+            repo_scope = RunnerScope.repos(["my-org/api", "my-org/web"])
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__a81b46da719563a103d6a4dc08b1337ad955b8bb3e417594cba8689ec1b3990e)
+            check_type(argname="argument repos", value=repos, expected_type=type_hints["repos"])
+        return typing.cast("RunnerScope", jsii.sinvoke(cls, "repos", [repos]))
+
+    @jsii.member(jsii_name="toJson")
+    def to_json(self) -> builtins.str:
+        '''Serialize this scope to the JSON form the runner set's handlers read at runtime.'''
+        return typing.cast(builtins.str, jsii.invoke(self, "toJson", []))
+
+    @builtins.property
+    @jsii.member(jsii_name="kind")
+    def kind(self) -> "RunnerScopeKind":
+        '''Whether this scope is an organization or a list of repositories.'''
+        return typing.cast("RunnerScopeKind", jsii.get(self, "kind"))
+
+    @builtins.property
+    @jsii.member(jsii_name="organization")
+    def organization(self) -> typing.Optional[builtins.str]:
+        '''The organization, for a scope built with ``RunnerScope.org()``.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "organization"))
+
+    @builtins.property
+    @jsii.member(jsii_name="repositories")
+    def repositories(self) -> typing.Optional[typing.List[builtins.str]]:
+        '''The ``owner/repo`` list, for a scope built with ``RunnerScope.repos()``.'''
+        return typing.cast(typing.Optional[typing.List[builtins.str]], jsii.get(self, "repositories"))
+
+
+@jsii.enum(jsii_type="cdk-github-microvm-runners.RunnerScopeKind")
+class RunnerScopeKind(enum.Enum):
+    '''Which GitHub scope a ``RunnerScope`` represents.'''
+
+    ORG = "ORG"
+    '''Runners are registered at the organization level.'''
+    REPOS = "REPOS"
+    '''Runners are registered against an explicit list of repositories.'''
+
+
+class RunnerToolchain(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.RunnerToolchain",
+):
+    '''A language runtime baked into the runner image's hosted tool cache at ``/opt/hostedtoolcache``, where ``actions/setup-python`` and ``actions/setup-node`` find it without downloading anything.
+
+    Those actions otherwise fetch
+    OS-specific prebuilt runtimes, which are not published for the AL2023 image
+    these runners use.
+
+    Several versions can be baked in at once, and a workflow asking for
+    ``python-version: "3.12"`` matches a baked ``3.12.7``.
+
+    Build one with the static factories below; the constructor is private.
+
+    Example::
+
+        test_image = RunnerImage.from_options(
+            toolchains=[
+                RunnerToolchain.python("3.12.7"),
+                RunnerToolchain.node("22.11.0")
+            ]
+        )
+    '''
+
+    @jsii.member(jsii_name="node")
+    @builtins.classmethod
+    def node(cls, version: builtins.str) -> "RunnerToolchain":
+        '''Node.js, from the official arm64 tarball. Full semver, e.g. ``'22.11.0'``.
+
+        :param version: -
+
+        Example::
+
+            node = RunnerToolchain.node("22.11.0")
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__8065d4439361f9bbc84bece8879c41a0993b4a423dfaaebe72c927aabc755b9f)
+            check_type(argname="argument version", value=version, expected_type=type_hints["version"])
+        return typing.cast("RunnerToolchain", jsii.sinvoke(cls, "node", [version]))
+
+    @jsii.member(jsii_name="python")
+    @builtins.classmethod
+    def python(cls, version: builtins.str) -> "RunnerToolchain":
+        '''CPython, built from source.
+
+        ``version`` is a full semver, e.g. ``'3.12.7'``.
+
+        :param version: -
+
+        Example::
+
+            python = RunnerToolchain.python("3.12.7")
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__4f0bd7c1b2e6ac73b706efb23ff6a848ee29451cef59db547c475ce88a7b1cd8)
+            check_type(argname="argument version", value=version, expected_type=type_hints["version"])
+        return typing.cast("RunnerToolchain", jsii.sinvoke(cls, "python", [version]))
+
+    @builtins.property
+    @jsii.member(jsii_name="kind")
+    def kind(self) -> "ToolchainKind":
+        '''Which runtime this is.'''
+        return typing.cast("ToolchainKind", jsii.get(self, "kind"))
+
+    @builtins.property
+    @jsii.member(jsii_name="version")
+    def version(self) -> builtins.str:
+        '''The full semver release baked in, e.g. ``'3.12.7'``.'''
+        return typing.cast(builtins.str, jsii.get(self, "version"))
+
+
+class RunnerVersion(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.RunnerVersion",
+):
+    '''Which ``actions/runner`` release to install on the MicroVM image.
+
+    Build one with the static factories below; the constructor is private.
+
+    Example::
+
+        pinned_image = RunnerImage.from_options(
+            runner_version=RunnerVersion.of("2.328.0")
+        )
+    '''
+
+    @jsii.member(jsii_name="latest")
+    @builtins.classmethod
+    def latest(cls) -> "RunnerVersion":
+        '''Use the ``actions/runner`` release this library currently pins (``DEFAULT_RUNNER_VERSION``).
+
+        No version is carried on the instance; the
+        image build fills the pinned value in at synth.
+
+        Example::
+
+            runner_version = RunnerVersion.latest()
+        '''
+        return typing.cast("RunnerVersion", jsii.sinvoke(cls, "latest", []))
+
+    @jsii.member(jsii_name="of")
+    @builtins.classmethod
+    def of(cls, version: builtins.str) -> "RunnerVersion":
+        '''Pin an explicit ``actions/runner`` release, e.g. ``"2.319.1"``.
+
+        :param version: -
+
+        Example::
+
+            pinned_runner = RunnerVersion.of("2.328.0")
+        '''
+        if __debug__:
+            type_hints = cached_type_hints(_typecheckingstub__3a8918cc0c6992425d68b709ebd9491ff2eb553b34ff18a312fc59f3604f2a65)
+            check_type(argname="argument version", value=version, expected_type=type_hints["version"])
+        return typing.cast("RunnerVersion", jsii.sinvoke(cls, "of", [version]))
+
+    @builtins.property
+    @jsii.member(jsii_name="version")
+    def version(self) -> typing.Optional[builtins.str]:
+        '''The pinned release, for a version built with ``RunnerVersion.of()``. ``undefined`` for ``RunnerVersion.latest()``.'''
+        return typing.cast(typing.Optional[builtins.str], jsii.get(self, "version"))
+
+
+@jsii.enum(jsii_type="cdk-github-microvm-runners.ToolchainKind")
+class ToolchainKind(enum.Enum):
+    '''How a toolchain is installed into the image's hosted tool cache.'''
+
+    PYTHON = "PYTHON"
+    '''CPython, built from source (``configure --prefix … --enable-shared``) on AL2023.'''
+    NODE = "NODE"
+    '''Node.js, unpacked from the official nodejs.org linux-arm64 tarball.'''
+
+
+class WebhookEndpoint(
+    metaclass=jsii.JSIIMeta,
+    jsii_type="cdk-github-microvm-runners.WebhookEndpoint",
+):
+    '''How the webhook handler is exposed to GitHub's ``workflow_job`` deliveries.
+
+    The one form today is a Lambda Function URL. It is created with
+    ``authType: NONE``; the auth boundary is the HMAC-SHA256 signature GitHub
+    sends with every delivery, which the handler verifies against the webhook
+    secret before it does anything else.
+
+    Example::
+
+        GithubMicrovmRunners(stack, "Runners",
+            github=github,
+            scope=scope,
+            webhook=WebhookEndpoint.function_url()
+        )
+    '''
+
+    @jsii.member(jsii_name="functionUrl")
+    @builtins.classmethod
+    def function_url(cls) -> "WebhookEndpoint":
+        '''Expose the webhook handler on a Lambda Function URL.
+
+        Example::
+
+            webhook = WebhookEndpoint.function_url()
+        '''
+        return typing.cast("WebhookEndpoint", jsii.sinvoke(cls, "functionUrl", []))
+
+    @builtins.property
+    @jsii.member(jsii_name="kind")
+    def kind(self) -> "WebhookEndpointKind":
+        '''Which form of endpoint this instance represents.'''
+        return typing.cast("WebhookEndpointKind", jsii.get(self, "kind"))
+
+
+@jsii.enum(jsii_type="cdk-github-microvm-runners.WebhookEndpointKind")
+class WebhookEndpointKind(enum.Enum):
+    '''Which form of endpoint a ``WebhookEndpoint`` represents.'''
+
+    FUNCTION_URL = "FUNCTION_URL"
+    '''A Lambda Function URL.'''
+
+
+__all__ = [
+    "ConsoleLogs",
+    "GithubAppAuthProps",
+    "GithubAppId",
+    "GithubAppKey",
+    "GithubAuth",
+    "GithubAuthKind",
+    "GithubMicrovmRunners",
+    "GithubMicrovmRunnersMetrics",
+    "GithubMicrovmRunnersProps",
+    "GithubPatAuthProps",
+    "ImageAsset",
+    "ImageLogs",
+    "ImagePipeline",
+    "ImagePipelineProps",
+    "MicrovmIdlePolicy",
+    "MicrovmSize",
+    "RunnerAlarmOptions",
+    "RunnerClass",
+    "RunnerClassProps",
+    "RunnerImage",
+    "RunnerImageOptions",
+    "RunnerNetwork",
+    "RunnerNetworkKind",
+    "RunnerNetworkVpcOptions",
+    "RunnerScope",
+    "RunnerScopeKind",
+    "RunnerToolchain",
+    "RunnerVersion",
+    "ToolchainKind",
+    "WebhookEndpoint",
+    "WebhookEndpointKind",
+]
+
+publication.publish()
+
+def _typecheckingstub__0548cfa81769608b199a2a959830e9d47b13bb916b5f4181e977c1f03bfa81c7(
+    log_group: typing.Optional[_aws_cdk_aws_logs_ceddda9d.ILogGroup] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__e6e950b235861eb6ceb59c62bebf431836fac157088b1334fedf915b19dec8a0(
+    *,
+    app_id: GithubAppId,
+    private_key: GithubAppKey,
+    webhook_secret: _aws_cdk_aws_secretsmanager_ceddda9d.ISecret,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__aba0941864c428347812aa10a096b18df3ae77616773316bd134e2764ae2657c(
+    secret: _aws_cdk_aws_secretsmanager_ceddda9d.ISecret,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6b22d9ed14d289886f4ed34dc8cfd25d58e6bbda42419d5097a7a73ea48bd10f(
+    value: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__cc9961f681c63592cc8d260fe3e536a71239765b00a83bdec348eff483581f2b(
+    key: _aws_cdk_aws_kms_ceddda9d.IKey,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__b690547df91198ce68555c0eef4906781d6764b68601422750750169edd60220(
+    secret: _aws_cdk_aws_secretsmanager_ceddda9d.ISecret,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__970e66a646e2fc86c035066057cff7cd247b431b227ac9f2d5a8c86ed710c988(
+    grantee: _aws_cdk_aws_iam_ceddda9d.IGrantable,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__80b1bb7036f50148e74587e4f8bac689760f9f314afddfa588fbc2a86d5062dd(
+    grantee: _aws_cdk_aws_iam_ceddda9d.IGrantable,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__f9ccf90cd58a24eaea8e05c002c729a7c0b56c6afdd04d8cd485938eed8facc5(
+    scope_: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    github: GithubAuth,
+    scope: RunnerScope,
+    additional_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
+    console_logs: typing.Optional[ConsoleLogs] = None,
+    dead_letter_retention: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    emit_metrics: typing.Optional[builtins.bool] = None,
+    encryption_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
+    idle_runner_grace_seconds: typing.Optional[jsii.Number] = None,
+    image_logs: typing.Optional[ImageLogs] = None,
+    janitor_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    keep_image_versions: typing.Optional[jsii.Number] = None,
+    lambda_memory_size: typing.Optional[jsii.Number] = None,
+    log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
+    max_concurrent_vms: typing.Optional[jsii.Number] = None,
+    max_job_duration: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    max_receive_count: typing.Optional[jsii.Number] = None,
+    network: typing.Optional[RunnerNetwork] = None,
+    permissions_boundary: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IManagedPolicy] = None,
+    point_in_time_recovery: typing.Optional[builtins.bool] = None,
+    recover_stuck_launches: typing.Optional[builtins.bool] = None,
+    removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
+    vm_execution_role: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole] = None,
+    warm_pool_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    webhook: typing.Optional[WebhookEndpoint] = None,
+    webhook_reserved_concurrency: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__48e77fc4d43555e4d6ac3d9e5b13de1cbbb1ef807cfc4ce1e0688ac170b863d1(
+    label: builtins.str,
+    *,
+    size: MicrovmSize,
+    idle_policy: typing.Optional[typing.Union[MicrovmIdlePolicy, typing.Dict[builtins.str, typing.Any]]] = None,
+    image: typing.Optional[RunnerImage] = None,
+    warm_pool_size: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__e74a92121e3eaec69c4009cc027a299a12257a68eccc613318213d92545265f4(
+    label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__8c3f47f3bf65ddc91d8c105e318179909d2860c56e34cc7b699066e3f7952170(
+    runner_set_id: builtins.str,
+    dead_letter_queue: _aws_cdk_aws_sqs_ceddda9d.IQueue,
+    emit_metrics: typing.Optional[builtins.bool] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__5f2f67ec6dfaab44c26a53e7bc3669af5ba74fc2c75f8dcd8afb795779d8ddfa(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__36d476c29eaf47f8fca7a5205fb5caa5a9749233fb462a093763a6a3200429b4(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__baf385f806ff6b0b2ae70b9d811654097d3297503bd8bdbafe09f5d9ed879629(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__75224a1d56fc14f38e94a3639da5e4ae455f069c6e477bb8fa010333e5c6ae4f(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__aca740a7276ae0a556b6b45300b0252ac7d8074b4dd0ab26c6b38fba7adb7eaf(
+    scope: _constructs_77d1e7e8.Construct,
+    *,
+    evaluation_periods: typing.Optional[jsii.Number] = None,
+    period: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    threshold: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6153c9a068c30f370bb352b26cc502516866238676a7d8139fc2dd0736dff46a(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__767e219d8c25f069fd8964ea100816a20869884628a2606dfd2fb3e63b857a8e(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6513962ff7d13ce627041f61f3e7a3b13688b30e0cb4c5bfbc63f79b8a32b595(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__1ba8a40c62efe6c3a58896ea614244a8e6823dd3c7db51567ffbadd71766bd13(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__e1b4b6b8be54f5289f47b9d302cea17d405e67837d60873b6a6536a2a23457e9(
+    scope: _constructs_77d1e7e8.Construct,
+    *,
+    evaluation_periods: typing.Optional[jsii.Number] = None,
+    period: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    threshold: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__971f59e7dc4d5b4245765d41b7dcc4075c4dd91870a15df6b9f345ee393cdc61(
+    scope: _constructs_77d1e7e8.Construct,
+    *,
+    evaluation_periods: typing.Optional[jsii.Number] = None,
+    period: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    threshold: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__01d47d24112989967339ef8a2bc09fe442210a13ccc3d3fd9583327ebc550f4f(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__9b66518a0eb395295f3c9719dcc545a363c50d0d387fe70bdcedc10be787b17a(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__28779afe2a8160e3a792fe0b6661c1c177712ed22d8ddf991f39b625eaa303d6(
+    runner_class_label: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__17269a525bc0ad3b7797a5131db455fcbc4ced673bbd2895bc90ea581a540971(
+    *,
+    github: GithubAuth,
+    scope: RunnerScope,
+    additional_regions: typing.Optional[typing.Sequence[builtins.str]] = None,
+    console_logs: typing.Optional[ConsoleLogs] = None,
+    dead_letter_retention: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    emit_metrics: typing.Optional[builtins.bool] = None,
+    encryption_key: typing.Optional[_aws_cdk_aws_kms_ceddda9d.IKey] = None,
+    idle_runner_grace_seconds: typing.Optional[jsii.Number] = None,
+    image_logs: typing.Optional[ImageLogs] = None,
+    janitor_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    keep_image_versions: typing.Optional[jsii.Number] = None,
+    lambda_memory_size: typing.Optional[jsii.Number] = None,
+    log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
+    max_concurrent_vms: typing.Optional[jsii.Number] = None,
+    max_job_duration: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    max_receive_count: typing.Optional[jsii.Number] = None,
+    network: typing.Optional[RunnerNetwork] = None,
+    permissions_boundary: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IManagedPolicy] = None,
+    point_in_time_recovery: typing.Optional[builtins.bool] = None,
+    recover_stuck_launches: typing.Optional[builtins.bool] = None,
+    removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
+    vm_execution_role: typing.Optional[_aws_cdk_aws_iam_ceddda9d.IRole] = None,
+    warm_pool_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    webhook: typing.Optional[WebhookEndpoint] = None,
+    webhook_reserved_concurrency: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__af35288b9c48eea9cffeb6e1080b684e480ae2227583407499a01041a243a072(
+    *,
+    token: _aws_cdk_aws_secretsmanager_ceddda9d.ISecret,
+    webhook_secret: _aws_cdk_aws_secretsmanager_ceddda9d.ISecret,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__d7d3da112d28b428bdfaadffe313adf1b4f0e1018b1cbf217c7687e156912c49(
+    *,
+    source: builtins.str,
+    target: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__5c18afa4a05ee3b3cf8019fa8e3bf98a9dc803b4ff31600008a4916dce15cd6a(
+    log_group: typing.Optional[_aws_cdk_aws_logs_ceddda9d.ILogGroup] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__38e8b0a65e40c9bfd130b4244eef3af238aac180d3c10606a513fef86e7aa169(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    image: RunnerImage,
+    network: RunnerNetwork,
+    runner_set_id: builtins.str,
+    size: MicrovmSize,
+    base_image_version: typing.Optional[builtins.str] = None,
+    image_logs: typing.Optional[ImageLogs] = None,
+    ready_timeout_seconds: typing.Optional[jsii.Number] = None,
+    run_timeout_seconds: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__c8c6d3e3f7a844305d6a7d687bb74edba13926e6cdb04020bf45116bbb7f2407(
+    *,
+    image: RunnerImage,
+    network: RunnerNetwork,
+    runner_set_id: builtins.str,
+    size: MicrovmSize,
+    base_image_version: typing.Optional[builtins.str] = None,
+    image_logs: typing.Optional[ImageLogs] = None,
+    ready_timeout_seconds: typing.Optional[jsii.Number] = None,
+    run_timeout_seconds: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__299a6933558be6e9144d105ecb8f71fdfa2731d8f7934fa33118eb063140eb10(
+    *,
+    max_idle_duration: _aws_cdk_ceddda9d.Duration,
+    suspended_duration: _aws_cdk_ceddda9d.Duration,
+    auto_resume: typing.Optional[builtins.bool] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__117c59b0a49dcc58de82f614adb71603b95518cace779312d23dbc393e930d0f(
+    *,
+    evaluation_periods: typing.Optional[jsii.Number] = None,
+    period: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    threshold: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__23472a12727bc341ce55563246f68a52c49776a6814a52ab825cec01db0cdc89(
+    *,
+    image_arn: builtins.str,
+    image_pipeline: ImagePipeline,
+    label: builtins.str,
+    size: MicrovmSize,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6e46f2bbd7884caef4f137e6dac784cd99ef109d84b58f3f7acf963f03c723a7(
+    *,
+    size: MicrovmSize,
+    idle_policy: typing.Optional[typing.Union[MicrovmIdlePolicy, typing.Dict[builtins.str, typing.Any]]] = None,
+    image: typing.Optional[RunnerImage] = None,
+    warm_pool_size: typing.Optional[jsii.Number] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__979f58111abc04b49545772d5ca529893452a46b62def883e284f0c2b1f0f73d(
+    dir: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__2d9215b22cc740b2c93f48e4e0744fe50e43a7a33f85974d48dbebd1e184d9d4(
+    dockerfile: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6fd3c247efc1bf4be6517722f43505c0df1d4ecea290c5f473194c94910a6cb8(
+    *,
+    additional_os_capabilities: typing.Optional[typing.Sequence[builtins.str]] = None,
+    assets: typing.Optional[typing.Sequence[typing.Union[ImageAsset, typing.Dict[builtins.str, typing.Any]]]] = None,
+    environment: typing.Optional[typing.Mapping[builtins.str, builtins.str]] = None,
+    runner_version: typing.Optional[RunnerVersion] = None,
+    setup_commands: typing.Optional[typing.Sequence[builtins.str]] = None,
+    system_packages: typing.Optional[typing.Sequence[builtins.str]] = None,
+    toolchains: typing.Optional[typing.Sequence[RunnerToolchain]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__d2491e4912faff169fbaad1c4fb389eb29f77ce187a242a0af01526ea53ad4d7(
+    vpc: _aws_cdk_aws_ec2_ceddda9d.IVpc,
+    *,
+    security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
+    subnets: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__6db194aaaafe63c89cd0b5bfe1846487e92f6c50fdaa2c8c2e3d8689ff54dfd1(
+    connector_arns: typing.Sequence[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__940d8682a239c73072340b0492130025e2f1d8c0d2614466732fa878426abf8c(
+    *,
+    security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
+    subnets: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__a306ec12ac8b86304298f1b4650c1ad69974d0773eef2b6f6245b92666d89c8f(
+    org: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__a81b46da719563a103d6a4dc08b1337ad955b8bb3e417594cba8689ec1b3990e(
+    repos: typing.Sequence[builtins.str],
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__8065d4439361f9bbc84bece8879c41a0993b4a423dfaaebe72c927aabc755b9f(
+    version: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__4f0bd7c1b2e6ac73b706efb23ff6a848ee29451cef59db547c475ce88a7b1cd8(
+    version: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__3a8918cc0c6992425d68b709ebd9491ff2eb553b34ff18a312fc59f3604f2a65(
+    version: builtins.str,
+) -> None:
+    """Type checking stubs"""
+    pass