cloudsnorkel.cdk-github-runners 0.11.5__py3-none-any.whl → 0.12.0__py3-none-any.whl

cloudsnorkel/cdk_github_runners/__init__.py

@@ -207,19 +207,13 @@ new GitHubRunners(this, 'runners', {
 Another way to customize runners is by modifying the image used to spin them up. The image contains the [runner](https://github.com/actions/runner), any required dependencies, and integration code with the provider. You may choose to customize this image by adding more packages, for example.
 
 ```python
-const myBuilder = CodeBuildRunnerProvider.imageBuilder(this, 'image builder', {
-   dockerfilePath: FargateRunner.LINUX_X64_DOCKERFILE_PATH,
-   runnerVersion: RunnerVersion.specific('2.291.0'),
-   rebuildInterval: Duration.days(14),
-});
+const myBuilder = FargateRunnerProvider.imageBuilder(this, 'image builder');
 myBuilder.addComponent(
-  RunnerImageComponent.custom({ commands: ['apt install -y nginx xz-utils'] })
+  RunnerImageComponent.custom({ commands: ['apt install -y nginx xz-utils'] }),
 );
 
 const myProvider = new FargateRunnerProvider(this, 'fargate runner', {
    labels: ['customized-fargate'],
-   vpc: vpc,
-   securityGroups: [runnerSg],
    imageBuilder: myBuilder,
 });
 
@@ -247,24 +241,20 @@ Windows images can also be customized the same way.
 const myWindowsBuilder = FargateRunnerProvider.imageBuilder(this, 'Windows image builder', {
    architecture: Architecture.X86_64,
    os: Os.WINDOWS,
-   runnerVersion: RunnerVersion.specific('2.291.0'),
-   rebuildInterval: Duration.days(14),
 });
 myWindowsBuilder.addComponent(
-        RunnerImageComponent.custom({
-           name: 'Ninja',
-           commands: [
-              'Invoke-WebRequest -UseBasicParsing -Uri "https://github.com/ninja-build/ninja/releases/download/v1.11.1/ninja-win.zip" -OutFile ninja.zip',
-              'Expand-Archive ninja.zip -DestinationPath C:\\actions',
-              'del ninja.zip',
-           ],
-        })
+   RunnerImageComponent.custom({
+     name: 'Ninja',
+     commands: [
+       'Invoke-WebRequest -UseBasicParsing -Uri "https://github.com/ninja-build/ninja/releases/download/v1.11.1/ninja-win.zip" -OutFile ninja.zip',
+       'Expand-Archive ninja.zip -DestinationPath C:\\actions',
+       'del ninja.zip',
+     ],
+   }),
 );
 
 const myProvider = new FargateRunnerProvider(this, 'fargate runner', {
    labels: ['customized-windows-fargate'],
-   vpc: vpc,
-   securityGroups: [runnerSg],
    imageBuilder: myWindowsBuilder,
 });
 
@@ -1562,6 +1552,7 @@ class GitHubRunners(
         idle_timeout: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
         log_options: typing.Optional[typing.Union["LogOptions", typing.Dict[builtins.str, typing.Any]]] = None,
         providers: typing.Optional[typing.Sequence["IRunnerProvider"]] = None,
+        require_self_hosted_label: typing.Optional[builtins.bool] = None,
         retry_options: typing.Optional[typing.Union["ProviderRetryOptions", typing.Dict[builtins.str, typing.Any]]] = None,
         security_group: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup] = None,
         security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
@@ -1579,6 +1570,7 @@ class GitHubRunners(
         :param idle_timeout: (experimental) Time to wait before stopping a runner that remains idle. If the user cancelled the job, or if another runner stole it, this stops the runner to avoid wasting resources. Default: 5 minutes
         :param log_options: (experimental) Logging options for the state machine that manages the runners. Default: no logs
         :param providers: (experimental) List of runner providers to use. At least one provider is required. Provider will be selected when its label matches the labels requested by the workflow job. Default: CodeBuild, Lambda and Fargate runners with all the defaults (no VPC or default account VPC)
+        :param require_self_hosted_label: (experimental) Whether to require the ``self-hosted`` label. If ``true``, the runner will only start if the workflow job explicitly requests the ``self-hosted`` label. Be careful when setting this to ``false``. Avoid setting up providers with generic label requirements like ``linux`` as they may match workflows that are not meant to run on self-hosted runners. Default: true
         :param retry_options: (experimental) Options to retry operation in case of failure like missing capacity, or API quota issues. GitHub jobs time out after not being able to get a runner for 24 hours. You should not retry for more than 24 hours. Total time spent waiting can be calculated with interval * (backoffRate ^ maxAttempts) / (backoffRate - 1). Default: retry 23 times up to about 24 hours
         :param security_group: (deprecated) Security group attached to all management functions. Use this with to provide access to GitHub Enterprise Server hosted inside a VPC.
         :param security_groups: (experimental) Security groups attached to all management functions. Use this with to provide access to GitHub Enterprise Server hosted inside a VPC.
@@ -1600,6 +1592,7 @@ class GitHubRunners(
             idle_timeout=idle_timeout,
             log_options=log_options,
             providers=providers,
+            require_self_hosted_label=require_self_hosted_label,
             retry_options=retry_options,
             security_group=security_group,
             security_groups=security_groups,
@@ -1878,6 +1871,7 @@ class GitHubRunners(
         "idle_timeout": "idleTimeout",
         "log_options": "logOptions",
         "providers": "providers",
+        "require_self_hosted_label": "requireSelfHostedLabel",
         "retry_options": "retryOptions",
         "security_group": "securityGroup",
         "security_groups": "securityGroups",
@@ -1897,6 +1891,7 @@ class GitHubRunnersProps:
         idle_timeout: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
         log_options: typing.Optional[typing.Union["LogOptions", typing.Dict[builtins.str, typing.Any]]] = None,
         providers: typing.Optional[typing.Sequence["IRunnerProvider"]] = None,
+        require_self_hosted_label: typing.Optional[builtins.bool] = None,
         retry_options: typing.Optional[typing.Union["ProviderRetryOptions", typing.Dict[builtins.str, typing.Any]]] = None,
         security_group: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup] = None,
         security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
@@ -1913,6 +1908,7 @@ class GitHubRunnersProps:
         :param idle_timeout: (experimental) Time to wait before stopping a runner that remains idle. If the user cancelled the job, or if another runner stole it, this stops the runner to avoid wasting resources. Default: 5 minutes
         :param log_options: (experimental) Logging options for the state machine that manages the runners. Default: no logs
         :param providers: (experimental) List of runner providers to use. At least one provider is required. Provider will be selected when its label matches the labels requested by the workflow job. Default: CodeBuild, Lambda and Fargate runners with all the defaults (no VPC or default account VPC)
+        :param require_self_hosted_label: (experimental) Whether to require the ``self-hosted`` label. If ``true``, the runner will only start if the workflow job explicitly requests the ``self-hosted`` label. Be careful when setting this to ``false``. Avoid setting up providers with generic label requirements like ``linux`` as they may match workflows that are not meant to run on self-hosted runners. Default: true
         :param retry_options: (experimental) Options to retry operation in case of failure like missing capacity, or API quota issues. GitHub jobs time out after not being able to get a runner for 24 hours. You should not retry for more than 24 hours. Total time spent waiting can be calculated with interval * (backoffRate ^ maxAttempts) / (backoffRate - 1). Default: retry 23 times up to about 24 hours
         :param security_group: (deprecated) Security group attached to all management functions. Use this with to provide access to GitHub Enterprise Server hosted inside a VPC.
         :param security_groups: (experimental) Security groups attached to all management functions. Use this with to provide access to GitHub Enterprise Server hosted inside a VPC.
@@ -1937,6 +1933,7 @@ class GitHubRunnersProps:
             check_type(argname="argument idle_timeout", value=idle_timeout, expected_type=type_hints["idle_timeout"])
             check_type(argname="argument log_options", value=log_options, expected_type=type_hints["log_options"])
             check_type(argname="argument providers", value=providers, expected_type=type_hints["providers"])
+            check_type(argname="argument require_self_hosted_label", value=require_self_hosted_label, expected_type=type_hints["require_self_hosted_label"])
             check_type(argname="argument retry_options", value=retry_options, expected_type=type_hints["retry_options"])
             check_type(argname="argument security_group", value=security_group, expected_type=type_hints["security_group"])
             check_type(argname="argument security_groups", value=security_groups, expected_type=type_hints["security_groups"])
@@ -1956,6 +1953,8 @@ class GitHubRunnersProps:
             self._values["log_options"] = log_options
         if providers is not None:
             self._values["providers"] = providers
+        if require_self_hosted_label is not None:
+            self._values["require_self_hosted_label"] = require_self_hosted_label
         if retry_options is not None:
             self._values["retry_options"] = retry_options
         if security_group is not None:
@@ -2050,6 +2049,21 @@ class GitHubRunnersProps:
         result = self._values.get("providers")
         return typing.cast(typing.Optional[typing.List["IRunnerProvider"]], result)
 
+    @builtins.property
+    def require_self_hosted_label(self) -> typing.Optional[builtins.bool]:
+        '''(experimental) Whether to require the ``self-hosted`` label.
+
+        If ``true``, the runner will only start if the workflow job explicitly requests the ``self-hosted`` label.
+
+        Be careful when setting this to ``false``. Avoid setting up providers with generic label requirements like ``linux`` as they may match workflows that are not meant to run on self-hosted runners.
+
+        :default: true
+
+        :stability: experimental
+        '''
+        result = self._values.get("require_self_hosted_label")
+        return typing.cast(typing.Optional[builtins.bool], result)
+
     @builtins.property
     def retry_options(self) -> typing.Optional["ProviderRetryOptions"]:
         '''(experimental) Options to retry operation in case of failure like missing capacity, or API quota issues.
@@ -2905,6 +2919,27 @@ class ImageBuilderComponent(
 
         jsii.create(self.__class__, self, [scope, id, props])
 
+    @jsii.member(jsii_name="generateVersion")
+    def _generate_version(
+        self,
+        type: builtins.str,
+        name: builtins.str,
+        data: typing.Any,
+    ) -> builtins.str:
+        '''
+        :param type: -
+        :param name: -
+        :param data: -
+
+        :stability: deprecated
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__abecb3decfe8eebf190daa2e93a508111cc10650e6b9fbf65b3a34f3ed07ca24)
+            check_type(argname="argument type", value=type, expected_type=type_hints["type"])
+            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
+            check_type(argname="argument data", value=data, expected_type=type_hints["data"])
+        return typing.cast(builtins.str, jsii.invoke(self, "generateVersion", [type, name, data]))
+
     @jsii.member(jsii_name="grantAssetsRead")
     def grant_assets_read(self, grantee: _aws_cdk_aws_iam_ceddda9d.IGrantable) -> None:
         '''(deprecated) Grants read permissions to the principal on the assets buckets.
@@ -2936,27 +2971,6 @@ class ImageBuilderComponent(
             check_type(argname="argument commands", value=commands, expected_type=type_hints["commands"])
         return typing.cast(typing.List[builtins.str], jsii.invoke(self, "prefixCommandsWithErrorHandling", [platform, commands]))
 
-    @jsii.member(jsii_name="version")
-    def _version(
-        self,
-        type: builtins.str,
-        name: builtins.str,
-        data: typing.Any,
-    ) -> builtins.str:
-        '''
-        :param type: -
-        :param name: -
-        :param data: -
-
-        :stability: deprecated
-        '''
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__e11323aa6f18ef1898e18067dba5908fdeabd333bfc1604f92c4c244adb28f7f)
-            check_type(argname="argument type", value=type, expected_type=type_hints["type"])
-            check_type(argname="argument name", value=name, expected_type=type_hints["name"])
-            check_type(argname="argument data", value=data, expected_type=type_hints["data"])
-        return typing.cast(builtins.str, jsii.invoke(self, "version", [type, name, data]))
-
     @builtins.property
     @jsii.member(jsii_name="arn")
     def arn(self) -> builtins.str:
@@ -3339,8 +3353,14 @@ class LambdaRunnerProvider(
         security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
         subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
         vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-    ) -> "RunnerImageBuilder":
-        '''(experimental) Create new image builder that builds Lambda specific runner images using Amazon Linux 2.
+    ) -> "IConfigurableRunnerImageBuilder":
+        '''(experimental) Create new image builder that builds Lambda specific runner images.
+
+        You can customize the OS, architecture, VPC, subnet, security groups, etc. by passing in props.
+
+        You can add components to the image builder by calling ``imageBuilder.addComponent()``.
+
+        The default OS is Amazon Linux 2 running on x64 architecture.
 
         Included components:
 
@@ -3396,7 +3416,7 @@ class LambdaRunnerProvider(
             vpc=vpc,
         )
 
-        return typing.cast("RunnerImageBuilder", jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
+        return typing.cast("IConfigurableRunnerImageBuilder", jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
 
     @jsii.member(jsii_name="getStepFunctionTask")
     def get_step_function_task(
@@ -4372,25 +4392,30 @@ class RunnerImageAsset:
         )
 
 
-@jsii.implements(_aws_cdk_aws_ec2_ceddda9d.IConnectable, _aws_cdk_aws_iam_ceddda9d.IGrantable, IRunnerImageBuilder)
-class RunnerImageBuilder(
-    _constructs_77d1e7e8.Construct,
-    metaclass=jsii.JSIIAbstractClass,
-    jsii_type="@cloudsnorkel/cdk-github-runners.RunnerImageBuilder",
-):
-    '''(experimental) GitHub Runner image builder. Builds a Docker image or AMI with GitHub Runner and other requirements installed.
-
-    Images can be customized before passed into the provider by adding or removing components to be installed.
-
-    Images are rebuilt every week by default to ensure that the latest security patches are applied.
-
-    :stability: experimental
-    '''
-
+@jsii.data_type(
+    jsii_type="@cloudsnorkel/cdk-github-runners.RunnerImageBuilderProps",
+    jsii_struct_bases=[],
+    name_mapping={
+        "architecture": "architecture",
+        "aws_image_builder_options": "awsImageBuilderOptions",
+        "base_ami": "baseAmi",
+        "base_docker_image": "baseDockerImage",
+        "builder_type": "builderType",
+        "code_build_options": "codeBuildOptions",
+        "components": "components",
+        "log_removal_policy": "logRemovalPolicy",
+        "log_retention": "logRetention",
+        "os": "os",
+        "rebuild_interval": "rebuildInterval",
+        "runner_version": "runnerVersion",
+        "security_groups": "securityGroups",
+        "subnet_selection": "subnetSelection",
+        "vpc": "vpc",
+    },
+)
+class RunnerImageBuilderProps:
     def __init__(
         self,
-        scope: _constructs_77d1e7e8.Construct,
-        id: builtins.str,
         *,
         architecture: typing.Optional[Architecture] = None,
         aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
@@ -4409,8 +4434,6 @@ class RunnerImageBuilder(
         vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
     ) -> None:
         '''
-        :param scope: -
-        :param id: -
         :param architecture: (experimental) Image architecture. Default: Architecture.X86_64
         :param aws_image_builder_options: (experimental) Options specific to AWS Image Builder. Only used when builderType is RunnerImageBuilderType.AWS_IMAGE_BUILDER.
         :param base_ami: (experimental) Base AMI from which runner AMIs will be built. This can be an actual AMI or an AWS Image Builder ARN that points to the latest AMI. For example ``arn:aws:imagebuilder:us-east-1:aws:image/ubuntu-server-22-lts-x86/x.x.x`` would always use the latest version of Ubuntu 22.04 in each build. If you want a specific version, you can replace ``x.x.x`` with that version. Default: latest Ubuntu 22.04 AMI for Os.LINUX_UBUNTU, latest Amazon Linux 2 AMI for Os.LINUX_AMAZON_2, latest Windows Server 2022 AMI for Os.WINDOWS
@@ -4429,553 +4452,255 @@ class RunnerImageBuilder(
 
         :stability: experimental
         '''
+        if isinstance(aws_image_builder_options, dict):
+            aws_image_builder_options = AwsImageBuilderRunnerImageBuilderProps(**aws_image_builder_options)
+        if isinstance(code_build_options, dict):
+            code_build_options = CodeBuildRunnerImageBuilderProps(**code_build_options)
+        if isinstance(subnet_selection, dict):
+            subnet_selection = _aws_cdk_aws_ec2_ceddda9d.SubnetSelection(**subnet_selection)
         if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__963c9a4884bb9d7400672391dfb47486f969a1b8fe5616bba9cd493e8a71484b)
-            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
-            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
-        props = RunnerImageBuilderProps(
-            architecture=architecture,
-            aws_image_builder_options=aws_image_builder_options,
-            base_ami=base_ami,
-            base_docker_image=base_docker_image,
-            builder_type=builder_type,
-            code_build_options=code_build_options,
-            components=components,
-            log_removal_policy=log_removal_policy,
-            log_retention=log_retention,
-            os=os,
-            rebuild_interval=rebuild_interval,
-            runner_version=runner_version,
-            security_groups=security_groups,
-            subnet_selection=subnet_selection,
-            vpc=vpc,
-        )
+            type_hints = typing.get_type_hints(_typecheckingstub__ab96b7f3871624e8430668114e7f5748ba5d253168db5b8f9a13955d0a82e43d)
+            check_type(argname="argument architecture", value=architecture, expected_type=type_hints["architecture"])
+            check_type(argname="argument aws_image_builder_options", value=aws_image_builder_options, expected_type=type_hints["aws_image_builder_options"])
+            check_type(argname="argument base_ami", value=base_ami, expected_type=type_hints["base_ami"])
+            check_type(argname="argument base_docker_image", value=base_docker_image, expected_type=type_hints["base_docker_image"])
+            check_type(argname="argument builder_type", value=builder_type, expected_type=type_hints["builder_type"])
+            check_type(argname="argument code_build_options", value=code_build_options, expected_type=type_hints["code_build_options"])
+            check_type(argname="argument components", value=components, expected_type=type_hints["components"])
+            check_type(argname="argument log_removal_policy", value=log_removal_policy, expected_type=type_hints["log_removal_policy"])
+            check_type(argname="argument log_retention", value=log_retention, expected_type=type_hints["log_retention"])
+            check_type(argname="argument os", value=os, expected_type=type_hints["os"])
+            check_type(argname="argument rebuild_interval", value=rebuild_interval, expected_type=type_hints["rebuild_interval"])
+            check_type(argname="argument runner_version", value=runner_version, expected_type=type_hints["runner_version"])
+            check_type(argname="argument security_groups", value=security_groups, expected_type=type_hints["security_groups"])
+            check_type(argname="argument subnet_selection", value=subnet_selection, expected_type=type_hints["subnet_selection"])
+            check_type(argname="argument vpc", value=vpc, expected_type=type_hints["vpc"])
+        self._values: typing.Dict[builtins.str, typing.Any] = {}
+        if architecture is not None:
+            self._values["architecture"] = architecture
+        if aws_image_builder_options is not None:
+            self._values["aws_image_builder_options"] = aws_image_builder_options
+        if base_ami is not None:
+            self._values["base_ami"] = base_ami
+        if base_docker_image is not None:
+            self._values["base_docker_image"] = base_docker_image
+        if builder_type is not None:
+            self._values["builder_type"] = builder_type
+        if code_build_options is not None:
+            self._values["code_build_options"] = code_build_options
+        if components is not None:
+            self._values["components"] = components
+        if log_removal_policy is not None:
+            self._values["log_removal_policy"] = log_removal_policy
+        if log_retention is not None:
+            self._values["log_retention"] = log_retention
+        if os is not None:
+            self._values["os"] = os
+        if rebuild_interval is not None:
+            self._values["rebuild_interval"] = rebuild_interval
+        if runner_version is not None:
+            self._values["runner_version"] = runner_version
+        if security_groups is not None:
+            self._values["security_groups"] = security_groups
+        if subnet_selection is not None:
+            self._values["subnet_selection"] = subnet_selection
+        if vpc is not None:
+            self._values["vpc"] = vpc
 
-        jsii.create(self.__class__, self, [scope, id, props])
+    @builtins.property
+    def architecture(self) -> typing.Optional[Architecture]:
+        '''(experimental) Image architecture.
 
-    @jsii.member(jsii_name="new")
-    @builtins.classmethod
-    def new(
-        cls,
-        scope: _constructs_77d1e7e8.Construct,
-        id: builtins.str,
-        *,
-        architecture: typing.Optional[Architecture] = None,
-        aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
-        base_ami: typing.Optional[builtins.str] = None,
-        base_docker_image: typing.Optional[builtins.str] = None,
-        builder_type: typing.Optional["RunnerImageBuilderType"] = None,
-        code_build_options: typing.Optional[typing.Union[CodeBuildRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
-        components: typing.Optional[typing.Sequence["RunnerImageComponent"]] = None,
-        log_removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
-        log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
-        os: typing.Optional[Os] = None,
-        rebuild_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
-        runner_version: typing.Optional["RunnerVersion"] = None,
-        security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
-        subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
-        vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-    ) -> "RunnerImageBuilder":
-        '''(experimental) Create a new image builder based on the provided properties.
+        :default: Architecture.X86_64
 
-        The implementation will differ based on the OS, architecture, and requested builder type.
+        :stability: experimental
+        '''
+        result = self._values.get("architecture")
+        return typing.cast(typing.Optional[Architecture], result)
 
-        :param scope: -
-        :param id: -
-        :param architecture: (experimental) Image architecture. Default: Architecture.X86_64
-        :param aws_image_builder_options: (experimental) Options specific to AWS Image Builder. Only used when builderType is RunnerImageBuilderType.AWS_IMAGE_BUILDER.
-        :param base_ami: (experimental) Base AMI from which runner AMIs will be built. This can be an actual AMI or an AWS Image Builder ARN that points to the latest AMI. For example ``arn:aws:imagebuilder:us-east-1:aws:image/ubuntu-server-22-lts-x86/x.x.x`` would always use the latest version of Ubuntu 22.04 in each build. If you want a specific version, you can replace ``x.x.x`` with that version. Default: latest Ubuntu 22.04 AMI for Os.LINUX_UBUNTU, latest Amazon Linux 2 AMI for Os.LINUX_AMAZON_2, latest Windows Server 2022 AMI for Os.WINDOWS
-        :param base_docker_image: (experimental) Base image from which Docker runner images will be built. Default: public.ecr.aws/lts/ubuntu:22.04 for Os.LINUX_UBUNTU, public.ecr.aws/amazonlinux/amazonlinux:2 for Os.LINUX_AMAZON_2, mcr.microsoft.com/windows/servercore:ltsc2019-amd64 for Os.WINDOWS
-        :param builder_type: Default: CodeBuild for Linux Docker image, AWS Image Builder for Windows Docker image and any AMI
-        :param code_build_options: (experimental) Options specific to CodeBuild image builder. Only used when builderType is RunnerImageBuilderType.CODE_BUILD.
-        :param components: (experimental) Components to install on the image. Default: none
-        :param log_removal_policy: (experimental) Removal policy for logs of image builds. If deployment fails on the custom resource, try setting this to ``RemovalPolicy.RETAIN``. This way the CodeBuild logs can still be viewed, and you can see why the build failed. We try to not leave anything behind when removed. But sometimes a log staying behind is useful. Default: RemovalPolicy.DESTROY
-        :param log_retention: (experimental) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. Default: logs.RetentionDays.ONE_MONTH
-        :param os: (experimental) Image OS. Default: OS.LINUX_UBUNTU
-        :param rebuild_interval: (experimental) Schedule the image to be rebuilt every given interval. Useful for keeping the image up-do-date with the latest GitHub runner version and latest OS updates. Set to zero to disable. Default: Duration.days(7)
-        :param runner_version: (experimental) Version of GitHub Runners to install. Default: latest version available
-        :param security_groups: (experimental) Security Groups to assign to this instance.
-        :param subnet_selection: (experimental) Where to place the network interfaces within the VPC. Default: no subnet
-        :param vpc: (experimental) VPC to build the image in. Default: no VPC
+    @builtins.property
+    def aws_image_builder_options(
+        self,
+    ) -> typing.Optional[AwsImageBuilderRunnerImageBuilderProps]:
+        '''(experimental) Options specific to AWS Image Builder.
+
+        Only used when builderType is RunnerImageBuilderType.AWS_IMAGE_BUILDER.
 
         :stability: experimental
         '''
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__c44d5704c54d7fdcf24ad39567c0e9f53f9837163bf8bf3b1b4e652e27c9ec75)
-            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
-            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
-        props = RunnerImageBuilderProps(
-            architecture=architecture,
-            aws_image_builder_options=aws_image_builder_options,
-            base_ami=base_ami,
-            base_docker_image=base_docker_image,
-            builder_type=builder_type,
-            code_build_options=code_build_options,
-            components=components,
-            log_removal_policy=log_removal_policy,
-            log_retention=log_retention,
-            os=os,
-            rebuild_interval=rebuild_interval,
-            runner_version=runner_version,
-            security_groups=security_groups,
-            subnet_selection=subnet_selection,
-            vpc=vpc,
-        )
-
-        return typing.cast("RunnerImageBuilder", jsii.sinvoke(cls, "new", [scope, id, props]))
+        result = self._values.get("aws_image_builder_options")
+        return typing.cast(typing.Optional[AwsImageBuilderRunnerImageBuilderProps], result)
 
-    @jsii.member(jsii_name="addComponent")
-    def add_component(self, component: "RunnerImageComponent") -> None:
-        '''(experimental) Add a component to the image builder.
+    @builtins.property
+    def base_ami(self) -> typing.Optional[builtins.str]:
+        '''(experimental) Base AMI from which runner AMIs will be built.
 
-        The component will be added to the end of the list of components.
+        This can be an actual AMI or an AWS Image Builder ARN that points to the latest AMI. For example ``arn:aws:imagebuilder:us-east-1:aws:image/ubuntu-server-22-lts-x86/x.x.x`` would always use the latest version of Ubuntu 22.04 in each build. If you want a specific version, you can replace ``x.x.x`` with that version.
 
-        :param component: component to add.
+        :default: latest Ubuntu 22.04 AMI for Os.LINUX_UBUNTU, latest Amazon Linux 2 AMI for Os.LINUX_AMAZON_2, latest Windows Server 2022 AMI for Os.WINDOWS
 
         :stability: experimental
         '''
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__9dec4d5fbab87fa223a0eb0a144ad5bd91f9cdd54d3337c971ce6435c76dc049)
-            check_type(argname="argument component", value=component, expected_type=type_hints["component"])
-        return typing.cast(None, jsii.invoke(self, "addComponent", [component]))
-
-    @jsii.member(jsii_name="bindAmi")
-    @abc.abstractmethod
-    def bind_ami(self) -> RunnerAmi:
-        '''(experimental) Build and return an AMI with GitHub Runner installed in it.
+        result = self._values.get("base_ami")
+        return typing.cast(typing.Optional[builtins.str], result)
 
-        Anything that ends up with a launch template pointing to an AMI that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing AMI and nothing else.
+    @builtins.property
+    def base_docker_image(self) -> typing.Optional[builtins.str]:
+        '''(experimental) Base image from which Docker runner images will be built.
 
-        The AMI can be further updated over time manually or using a schedule as long as it is always written to the same launch template.
+        :default: public.ecr.aws/lts/ubuntu:22.04 for Os.LINUX_UBUNTU, public.ecr.aws/amazonlinux/amazonlinux:2 for Os.LINUX_AMAZON_2, mcr.microsoft.com/windows/servercore:ltsc2019-amd64 for Os.WINDOWS
 
         :stability: experimental
         '''
-        ...
+        result = self._values.get("base_docker_image")
+        return typing.cast(typing.Optional[builtins.str], result)
 
-    @jsii.member(jsii_name="bindDockerImage")
-    @abc.abstractmethod
-    def bind_docker_image(self) -> RunnerImage:
-        '''(experimental) Build and return a Docker image with GitHub Runner installed in it.
+    @builtins.property
+    def builder_type(self) -> typing.Optional["RunnerImageBuilderType"]:
+        '''
+        :default: CodeBuild for Linux Docker image, AWS Image Builder for Windows Docker image and any AMI
 
-        Anything that ends up with an ECR repository containing a Docker image that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing image and nothing else.
+        :stability: experimental
+        '''
+        result = self._values.get("builder_type")
+        return typing.cast(typing.Optional["RunnerImageBuilderType"], result)
 
-        It's important that the specified image tag be available at the time the repository is available. Providers usually assume the image is ready and will fail if it's not.
+    @builtins.property
+    def code_build_options(self) -> typing.Optional[CodeBuildRunnerImageBuilderProps]:
+        '''(experimental) Options specific to CodeBuild image builder.
 
-        The image can be further updated over time manually or using a schedule as long as it is always written to the same tag.
+        Only used when builderType is RunnerImageBuilderType.CODE_BUILD.
 
         :stability: experimental
         '''
-        ...
-
-    @jsii.member(jsii_name="removeComponent")
-    def remove_component(self, component: "RunnerImageComponent") -> None:
-        '''(experimental) Remove a component from the image builder.
+        result = self._values.get("code_build_options")
+        return typing.cast(typing.Optional[CodeBuildRunnerImageBuilderProps], result)
 
-        Removal is done by component name. Multiple components with the same name will all be removed.
+    @builtins.property
+    def components(self) -> typing.Optional[typing.List["RunnerImageComponent"]]:
+        '''(experimental) Components to install on the image.
 
-        :param component: component to remove.
+        :default: none
 
         :stability: experimental
         '''
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__1c4318b2834e7865918b5308b85c0fd80f22d29a067d68d4ee8537a6c0c88b3b)
-            check_type(argname="argument component", value=component, expected_type=type_hints["component"])
-        return typing.cast(None, jsii.invoke(self, "removeComponent", [component]))
+        result = self._values.get("components")
+        return typing.cast(typing.Optional[typing.List["RunnerImageComponent"]], result)
 
     @builtins.property
-    @jsii.member(jsii_name="connections")
-    @abc.abstractmethod
-    def connections(self) -> _aws_cdk_aws_ec2_ceddda9d.Connections:
-        '''(experimental) The network connections associated with this resource.
+    def log_removal_policy(self) -> typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy]:
+        '''(experimental) Removal policy for logs of image builds.
+
+        If deployment fails on the custom resource, try setting this to ``RemovalPolicy.RETAIN``. This way the CodeBuild logs can still be viewed, and you can see why the build failed.
+
+        We try to not leave anything behind when removed. But sometimes a log staying behind is useful.
+
+        :default: RemovalPolicy.DESTROY
 
         :stability: experimental
         '''
-        ...
+        result = self._values.get("log_removal_policy")
+        return typing.cast(typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy], result)
 
     @builtins.property
-    @jsii.member(jsii_name="grantPrincipal")
-    @abc.abstractmethod
-    def grant_principal(self) -> _aws_cdk_aws_iam_ceddda9d.IPrincipal:
-        '''(experimental) The principal to grant permissions to.
+    def log_retention(
+        self,
+    ) -> typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays]:
+        '''(experimental) The number of days log events are kept in CloudWatch Logs.
+
+        When updating
+        this property, unsetting it doesn't remove the log retention policy. To
+        remove the retention policy, set the value to ``INFINITE``.
+
+        :default: logs.RetentionDays.ONE_MONTH
 
         :stability: experimental
         '''
-        ...
+        result = self._values.get("log_retention")
+        return typing.cast(typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays], result)
 
     @builtins.property
-    @jsii.member(jsii_name="components")
-    def _components(self) -> typing.List["RunnerImageComponent"]:
-        '''
+    def os(self) -> typing.Optional[Os]:
+        '''(experimental) Image OS.
+
+        :default: OS.LINUX_UBUNTU
+
         :stability: experimental
         '''
-        return typing.cast(typing.List["RunnerImageComponent"], jsii.get(self, "components"))
-
-    @_components.setter
-    def _components(self, value: typing.List["RunnerImageComponent"]) -> None:
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__705c18a1eedaa490aebad511aac32a801519a57162e30be4673a8ab87ca434dc)
-            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "components", value)
+        result = self._values.get("os")
+        return typing.cast(typing.Optional[Os], result)
 
+    @builtins.property
+    def rebuild_interval(self) -> typing.Optional[_aws_cdk_ceddda9d.Duration]:
+        '''(experimental) Schedule the image to be rebuilt every given interval.
 
-class _RunnerImageBuilderProxy(RunnerImageBuilder):
-    @jsii.member(jsii_name="bindAmi")
-    def bind_ami(self) -> RunnerAmi:
-        '''(experimental) Build and return an AMI with GitHub Runner installed in it.
+        Useful for keeping the image up-do-date with the latest GitHub runner version and latest OS updates.
 
-        Anything that ends up with a launch template pointing to an AMI that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing AMI and nothing else.
+        Set to zero to disable.
 
-        The AMI can be further updated over time manually or using a schedule as long as it is always written to the same launch template.
+        :default: Duration.days(7)
 
         :stability: experimental
         '''
-        return typing.cast(RunnerAmi, jsii.invoke(self, "bindAmi", []))
+        result = self._values.get("rebuild_interval")
+        return typing.cast(typing.Optional[_aws_cdk_ceddda9d.Duration], result)
 
-    @jsii.member(jsii_name="bindDockerImage")
-    def bind_docker_image(self) -> RunnerImage:
-        '''(experimental) Build and return a Docker image with GitHub Runner installed in it.
+    @builtins.property
+    def runner_version(self) -> typing.Optional["RunnerVersion"]:
+        '''(experimental) Version of GitHub Runners to install.
 
-        Anything that ends up with an ECR repository containing a Docker image that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing image and nothing else.
+        :default: latest version available
 
-        It's important that the specified image tag be available at the time the repository is available. Providers usually assume the image is ready and will fail if it's not.
+        :stability: experimental
+        '''
+        result = self._values.get("runner_version")
+        return typing.cast(typing.Optional["RunnerVersion"], result)
 
-        The image can be further updated over time manually or using a schedule as long as it is always written to the same tag.
+    @builtins.property
+    def security_groups(
+        self,
+    ) -> typing.Optional[typing.List[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]]:
+        '''(experimental) Security Groups to assign to this instance.
 
         :stability: experimental
         '''
-        return typing.cast(RunnerImage, jsii.invoke(self, "bindDockerImage", []))
+        result = self._values.get("security_groups")
+        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]], result)
 
     @builtins.property
-    @jsii.member(jsii_name="connections")
-    def connections(self) -> _aws_cdk_aws_ec2_ceddda9d.Connections:
-        '''(experimental) The network connections associated with this resource.
+    def subnet_selection(
+        self,
+    ) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection]:
+        '''(experimental) Where to place the network interfaces within the VPC.
+
+        :default: no subnet
 
         :stability: experimental
         '''
-        return typing.cast(_aws_cdk_aws_ec2_ceddda9d.Connections, jsii.get(self, "connections"))
+        result = self._values.get("subnet_selection")
+        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection], result)
 
     @builtins.property
-    @jsii.member(jsii_name="grantPrincipal")
-    def grant_principal(self) -> _aws_cdk_aws_iam_ceddda9d.IPrincipal:
-        '''(experimental) The principal to grant permissions to.
+    def vpc(self) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc]:
+        '''(experimental) VPC to build the image in.
+
+        :default: no VPC
 
         :stability: experimental
         '''
-        return typing.cast(_aws_cdk_aws_iam_ceddda9d.IPrincipal, jsii.get(self, "grantPrincipal"))
+        result = self._values.get("vpc")
+        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc], result)
 
-# Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
-typing.cast(typing.Any, RunnerImageBuilder).__jsii_proxy_class__ = lambda : _RunnerImageBuilderProxy
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
 
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
 
-@jsii.data_type(
-    jsii_type="@cloudsnorkel/cdk-github-runners.RunnerImageBuilderProps",
-    jsii_struct_bases=[],
-    name_mapping={
-        "architecture": "architecture",
-        "aws_image_builder_options": "awsImageBuilderOptions",
-        "base_ami": "baseAmi",
-        "base_docker_image": "baseDockerImage",
-        "builder_type": "builderType",
-        "code_build_options": "codeBuildOptions",
-        "components": "components",
-        "log_removal_policy": "logRemovalPolicy",
-        "log_retention": "logRetention",
-        "os": "os",
-        "rebuild_interval": "rebuildInterval",
-        "runner_version": "runnerVersion",
-        "security_groups": "securityGroups",
-        "subnet_selection": "subnetSelection",
-        "vpc": "vpc",
-    },
-)
-class RunnerImageBuilderProps:
-    def __init__(
-        self,
-        *,
-        architecture: typing.Optional[Architecture] = None,
-        aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
-        base_ami: typing.Optional[builtins.str] = None,
-        base_docker_image: typing.Optional[builtins.str] = None,
-        builder_type: typing.Optional["RunnerImageBuilderType"] = None,
-        code_build_options: typing.Optional[typing.Union[CodeBuildRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
-        components: typing.Optional[typing.Sequence["RunnerImageComponent"]] = None,
-        log_removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
-        log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
-        os: typing.Optional[Os] = None,
-        rebuild_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
-        runner_version: typing.Optional["RunnerVersion"] = None,
-        security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
-        subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
-        vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-    ) -> None:
-        '''
-        :param architecture: (experimental) Image architecture. Default: Architecture.X86_64
-        :param aws_image_builder_options: (experimental) Options specific to AWS Image Builder. Only used when builderType is RunnerImageBuilderType.AWS_IMAGE_BUILDER.
-        :param base_ami: (experimental) Base AMI from which runner AMIs will be built. This can be an actual AMI or an AWS Image Builder ARN that points to the latest AMI. For example ``arn:aws:imagebuilder:us-east-1:aws:image/ubuntu-server-22-lts-x86/x.x.x`` would always use the latest version of Ubuntu 22.04 in each build. If you want a specific version, you can replace ``x.x.x`` with that version. Default: latest Ubuntu 22.04 AMI for Os.LINUX_UBUNTU, latest Amazon Linux 2 AMI for Os.LINUX_AMAZON_2, latest Windows Server 2022 AMI for Os.WINDOWS
-        :param base_docker_image: (experimental) Base image from which Docker runner images will be built. Default: public.ecr.aws/lts/ubuntu:22.04 for Os.LINUX_UBUNTU, public.ecr.aws/amazonlinux/amazonlinux:2 for Os.LINUX_AMAZON_2, mcr.microsoft.com/windows/servercore:ltsc2019-amd64 for Os.WINDOWS
-        :param builder_type: Default: CodeBuild for Linux Docker image, AWS Image Builder for Windows Docker image and any AMI
-        :param code_build_options: (experimental) Options specific to CodeBuild image builder. Only used when builderType is RunnerImageBuilderType.CODE_BUILD.
-        :param components: (experimental) Components to install on the image. Default: none
-        :param log_removal_policy: (experimental) Removal policy for logs of image builds. If deployment fails on the custom resource, try setting this to ``RemovalPolicy.RETAIN``. This way the CodeBuild logs can still be viewed, and you can see why the build failed. We try to not leave anything behind when removed. But sometimes a log staying behind is useful. Default: RemovalPolicy.DESTROY
-        :param log_retention: (experimental) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. Default: logs.RetentionDays.ONE_MONTH
-        :param os: (experimental) Image OS. Default: OS.LINUX_UBUNTU
-        :param rebuild_interval: (experimental) Schedule the image to be rebuilt every given interval. Useful for keeping the image up-do-date with the latest GitHub runner version and latest OS updates. Set to zero to disable. Default: Duration.days(7)
-        :param runner_version: (experimental) Version of GitHub Runners to install. Default: latest version available
-        :param security_groups: (experimental) Security Groups to assign to this instance.
-        :param subnet_selection: (experimental) Where to place the network interfaces within the VPC. Default: no subnet
-        :param vpc: (experimental) VPC to build the image in. Default: no VPC
-
-        :stability: experimental
-        '''
-        if isinstance(aws_image_builder_options, dict):
-            aws_image_builder_options = AwsImageBuilderRunnerImageBuilderProps(**aws_image_builder_options)
-        if isinstance(code_build_options, dict):
-            code_build_options = CodeBuildRunnerImageBuilderProps(**code_build_options)
-        if isinstance(subnet_selection, dict):
-            subnet_selection = _aws_cdk_aws_ec2_ceddda9d.SubnetSelection(**subnet_selection)
-        if __debug__:
-            type_hints = typing.get_type_hints(_typecheckingstub__ab96b7f3871624e8430668114e7f5748ba5d253168db5b8f9a13955d0a82e43d)
-            check_type(argname="argument architecture", value=architecture, expected_type=type_hints["architecture"])
-            check_type(argname="argument aws_image_builder_options", value=aws_image_builder_options, expected_type=type_hints["aws_image_builder_options"])
-            check_type(argname="argument base_ami", value=base_ami, expected_type=type_hints["base_ami"])
-            check_type(argname="argument base_docker_image", value=base_docker_image, expected_type=type_hints["base_docker_image"])
-            check_type(argname="argument builder_type", value=builder_type, expected_type=type_hints["builder_type"])
-            check_type(argname="argument code_build_options", value=code_build_options, expected_type=type_hints["code_build_options"])
-            check_type(argname="argument components", value=components, expected_type=type_hints["components"])
-            check_type(argname="argument log_removal_policy", value=log_removal_policy, expected_type=type_hints["log_removal_policy"])
-            check_type(argname="argument log_retention", value=log_retention, expected_type=type_hints["log_retention"])
-            check_type(argname="argument os", value=os, expected_type=type_hints["os"])
-            check_type(argname="argument rebuild_interval", value=rebuild_interval, expected_type=type_hints["rebuild_interval"])
-            check_type(argname="argument runner_version", value=runner_version, expected_type=type_hints["runner_version"])
-            check_type(argname="argument security_groups", value=security_groups, expected_type=type_hints["security_groups"])
-            check_type(argname="argument subnet_selection", value=subnet_selection, expected_type=type_hints["subnet_selection"])
-            check_type(argname="argument vpc", value=vpc, expected_type=type_hints["vpc"])
-        self._values: typing.Dict[builtins.str, typing.Any] = {}
-        if architecture is not None:
-            self._values["architecture"] = architecture
-        if aws_image_builder_options is not None:
-            self._values["aws_image_builder_options"] = aws_image_builder_options
-        if base_ami is not None:
-            self._values["base_ami"] = base_ami
-        if base_docker_image is not None:
-            self._values["base_docker_image"] = base_docker_image
-        if builder_type is not None:
-            self._values["builder_type"] = builder_type
-        if code_build_options is not None:
-            self._values["code_build_options"] = code_build_options
-        if components is not None:
-            self._values["components"] = components
-        if log_removal_policy is not None:
-            self._values["log_removal_policy"] = log_removal_policy
-        if log_retention is not None:
-            self._values["log_retention"] = log_retention
-        if os is not None:
-            self._values["os"] = os
-        if rebuild_interval is not None:
-            self._values["rebuild_interval"] = rebuild_interval
-        if runner_version is not None:
-            self._values["runner_version"] = runner_version
-        if security_groups is not None:
-            self._values["security_groups"] = security_groups
-        if subnet_selection is not None:
-            self._values["subnet_selection"] = subnet_selection
-        if vpc is not None:
-            self._values["vpc"] = vpc
-
-    @builtins.property
-    def architecture(self) -> typing.Optional[Architecture]:
-        '''(experimental) Image architecture.
-
-        :default: Architecture.X86_64
-
-        :stability: experimental
-        '''
-        result = self._values.get("architecture")
-        return typing.cast(typing.Optional[Architecture], result)
-
-    @builtins.property
-    def aws_image_builder_options(
-        self,
-    ) -> typing.Optional[AwsImageBuilderRunnerImageBuilderProps]:
-        '''(experimental) Options specific to AWS Image Builder.
-
-        Only used when builderType is RunnerImageBuilderType.AWS_IMAGE_BUILDER.
-
-        :stability: experimental
-        '''
-        result = self._values.get("aws_image_builder_options")
-        return typing.cast(typing.Optional[AwsImageBuilderRunnerImageBuilderProps], result)
-
-    @builtins.property
-    def base_ami(self) -> typing.Optional[builtins.str]:
-        '''(experimental) Base AMI from which runner AMIs will be built.
-
-        This can be an actual AMI or an AWS Image Builder ARN that points to the latest AMI. For example ``arn:aws:imagebuilder:us-east-1:aws:image/ubuntu-server-22-lts-x86/x.x.x`` would always use the latest version of Ubuntu 22.04 in each build. If you want a specific version, you can replace ``x.x.x`` with that version.
-
-        :default: latest Ubuntu 22.04 AMI for Os.LINUX_UBUNTU, latest Amazon Linux 2 AMI for Os.LINUX_AMAZON_2, latest Windows Server 2022 AMI for Os.WINDOWS
-
-        :stability: experimental
-        '''
-        result = self._values.get("base_ami")
-        return typing.cast(typing.Optional[builtins.str], result)
-
-    @builtins.property
-    def base_docker_image(self) -> typing.Optional[builtins.str]:
-        '''(experimental) Base image from which Docker runner images will be built.
-
-        :default: public.ecr.aws/lts/ubuntu:22.04 for Os.LINUX_UBUNTU, public.ecr.aws/amazonlinux/amazonlinux:2 for Os.LINUX_AMAZON_2, mcr.microsoft.com/windows/servercore:ltsc2019-amd64 for Os.WINDOWS
-
-        :stability: experimental
-        '''
-        result = self._values.get("base_docker_image")
-        return typing.cast(typing.Optional[builtins.str], result)
-
-    @builtins.property
-    def builder_type(self) -> typing.Optional["RunnerImageBuilderType"]:
-        '''
-        :default: CodeBuild for Linux Docker image, AWS Image Builder for Windows Docker image and any AMI
-
-        :stability: experimental
-        '''
-        result = self._values.get("builder_type")
-        return typing.cast(typing.Optional["RunnerImageBuilderType"], result)
-
-    @builtins.property
-    def code_build_options(self) -> typing.Optional[CodeBuildRunnerImageBuilderProps]:
-        '''(experimental) Options specific to CodeBuild image builder.
-
-        Only used when builderType is RunnerImageBuilderType.CODE_BUILD.
-
-        :stability: experimental
-        '''
-        result = self._values.get("code_build_options")
-        return typing.cast(typing.Optional[CodeBuildRunnerImageBuilderProps], result)
-
-    @builtins.property
-    def components(self) -> typing.Optional[typing.List["RunnerImageComponent"]]:
-        '''(experimental) Components to install on the image.
-
-        :default: none
-
-        :stability: experimental
-        '''
-        result = self._values.get("components")
-        return typing.cast(typing.Optional[typing.List["RunnerImageComponent"]], result)
-
-    @builtins.property
-    def log_removal_policy(self) -> typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy]:
-        '''(experimental) Removal policy for logs of image builds.
-
-        If deployment fails on the custom resource, try setting this to ``RemovalPolicy.RETAIN``. This way the CodeBuild logs can still be viewed, and you can see why the build failed.
-
-        We try to not leave anything behind when removed. But sometimes a log staying behind is useful.
-
-        :default: RemovalPolicy.DESTROY
-
-        :stability: experimental
-        '''
-        result = self._values.get("log_removal_policy")
-        return typing.cast(typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy], result)
-
-    @builtins.property
-    def log_retention(
-        self,
-    ) -> typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays]:
-        '''(experimental) The number of days log events are kept in CloudWatch Logs.
-
-        When updating
-        this property, unsetting it doesn't remove the log retention policy. To
-        remove the retention policy, set the value to ``INFINITE``.
-
-        :default: logs.RetentionDays.ONE_MONTH
-
-        :stability: experimental
-        '''
-        result = self._values.get("log_retention")
-        return typing.cast(typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays], result)
-
-    @builtins.property
-    def os(self) -> typing.Optional[Os]:
-        '''(experimental) Image OS.
-
-        :default: OS.LINUX_UBUNTU
-
-        :stability: experimental
-        '''
-        result = self._values.get("os")
-        return typing.cast(typing.Optional[Os], result)
-
-    @builtins.property
-    def rebuild_interval(self) -> typing.Optional[_aws_cdk_ceddda9d.Duration]:
-        '''(experimental) Schedule the image to be rebuilt every given interval.
-
-        Useful for keeping the image up-do-date with the latest GitHub runner version and latest OS updates.
-
-        Set to zero to disable.
-
-        :default: Duration.days(7)
-
-        :stability: experimental
-        '''
-        result = self._values.get("rebuild_interval")
-        return typing.cast(typing.Optional[_aws_cdk_ceddda9d.Duration], result)
-
-    @builtins.property
-    def runner_version(self) -> typing.Optional["RunnerVersion"]:
-        '''(experimental) Version of GitHub Runners to install.
-
-        :default: latest version available
-
-        :stability: experimental
-        '''
-        result = self._values.get("runner_version")
-        return typing.cast(typing.Optional["RunnerVersion"], result)
-
-    @builtins.property
-    def security_groups(
-        self,
-    ) -> typing.Optional[typing.List[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]]:
-        '''(experimental) Security Groups to assign to this instance.
-
-        :stability: experimental
-        '''
-        result = self._values.get("security_groups")
-        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]], result)
-
-    @builtins.property
-    def subnet_selection(
-        self,
-    ) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection]:
-        '''(experimental) Where to place the network interfaces within the VPC.
-
-        :default: no subnet
-
-        :stability: experimental
-        '''
-        result = self._values.get("subnet_selection")
-        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection], result)
-
-    @builtins.property
-    def vpc(self) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc]:
-        '''(experimental) VPC to build the image in.
-
-        :default: no VPC
-
-        :stability: experimental
-        '''
-        result = self._values.get("vpc")
-        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc], result)
-
-    def __eq__(self, rhs: typing.Any) -> builtins.bool:
-        return isinstance(rhs, self.__class__) and rhs._values == self._values
-
-    def __ne__(self, rhs: typing.Any) -> builtins.bool:
-        return not (rhs == self)
-
-    def __repr__(self) -> str:
-        return "RunnerImageBuilderProps(%s)" % ", ".join(
-            k + "=" + repr(v) for k, v in self._values.items()
-        )
+    def __repr__(self) -> str:
+        return "RunnerImageBuilderProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
 
 
 @jsii.enum(jsii_type="@cloudsnorkel/cdk-github-runners.RunnerImageBuilderType")
@@ -5047,7 +4772,7 @@ class RunnerImageComponent(
         :param assets: (experimental) Assets to copy into the built image.
         :param commands: (experimental) Commands to run in the built image.
         :param docker_commands: (experimental) Docker commands to run in the built image. For example: ``['ENV foo=bar', 'RUN echo $foo']`` These commands are ignored when building AMIs.
-        :param name: (experimental) Component name used for (1) image build logging and (2) identifier for {@link ImageRunnerBuilder.removeComponent }. Name must only contain alphanumeric characters and dashes.
+        :param name: (experimental) Component name used for (1) image build logging and (2) identifier for {@link IConfigurableRunnerImageBuilder.removeComponent }. Name must only contain alphanumeric characters and dashes.
 
         :stability: experimental
         '''
@@ -5248,7 +4973,7 @@ class RunnerImageComponent(
     def name(self) -> builtins.str:
         '''(experimental) Component name.
 
-        Used to identify component in image build logs, and for {@link RunnerImageBuilder.removeComponent }
+        Used to identify component in image build logs, and for {@link IConfigurableRunnerImageBuilder.removeComponent }
 
         :stability: experimental
         '''
@@ -5282,7 +5007,7 @@ class _RunnerImageComponentProxy(RunnerImageComponent):
     def name(self) -> builtins.str:
         '''(experimental) Component name.
 
-        Used to identify component in image build logs, and for {@link RunnerImageBuilder.removeComponent }
+        Used to identify component in image build logs, and for {@link IConfigurableRunnerImageBuilder.removeComponent }
 
         :stability: experimental
         '''
@@ -5315,7 +5040,7 @@ class RunnerImageComponentCustomProps:
         :param assets: (experimental) Assets to copy into the built image.
         :param commands: (experimental) Commands to run in the built image.
         :param docker_commands: (experimental) Docker commands to run in the built image. For example: ``['ENV foo=bar', 'RUN echo $foo']`` These commands are ignored when building AMIs.
-        :param name: (experimental) Component name used for (1) image build logging and (2) identifier for {@link ImageRunnerBuilder.removeComponent }. Name must only contain alphanumeric characters and dashes.
+        :param name: (experimental) Component name used for (1) image build logging and (2) identifier for {@link IConfigurableRunnerImageBuilder.removeComponent }. Name must only contain alphanumeric characters and dashes.
 
         :stability: experimental
         '''
@@ -5368,7 +5093,7 @@ class RunnerImageComponentCustomProps:
 
     @builtins.property
     def name(self) -> typing.Optional[builtins.str]:
-        '''(experimental) Component name used for (1) image build logging and (2) identifier for {@link ImageRunnerBuilder.removeComponent }.
+        '''(experimental) Component name used for (1) image build logging and (2) identifier for {@link IConfigurableRunnerImageBuilder.removeComponent }.
 
         Name must only contain alphanumeric characters and dashes.
 
@@ -6584,8 +6309,14 @@ class CodeBuildRunnerProvider(
         security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
         subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
         vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-    ) -> RunnerImageBuilder:
-        '''(experimental) Create new image builder that builds CodeBuild specific runner images using Ubuntu.
+    ) -> "IConfigurableRunnerImageBuilder":
+        '''(experimental) Create new image builder that builds CodeBuild specific runner images.
+
+        You can customize the OS, architecture, VPC, subnet, security groups, etc. by passing in props.
+
+        You can add components to the image builder by calling ``imageBuilder.addComponent()``.
+
+        The default OS is Ubuntu running on x64 architecture.
 
         Included components:
 
@@ -6639,7 +6370,7 @@ class CodeBuildRunnerProvider(
             vpc=vpc,
         )
 
-        return typing.cast(RunnerImageBuilder, jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
+        return typing.cast("IConfigurableRunnerImageBuilder", jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
 
     @jsii.member(jsii_name="getStepFunctionTask")
     def get_step_function_task(
@@ -7522,8 +7253,14 @@ class Ec2RunnerProvider(
         security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
         subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
         vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-    ) -> RunnerImageBuilder:
-        '''(experimental) Create new image builder that builds EC2 specific runner images using Ubuntu.
+    ) -> "IConfigurableRunnerImageBuilder":
+        '''(experimental) Create new image builder that builds EC2 specific runner images.
+
+        You can customize the OS, architecture, VPC, subnet, security groups, etc. by passing in props.
+
+        You can add components to the image builder by calling ``imageBuilder.addComponent()``.
+
+        The default OS is Ubuntu running on x64 architecture.
 
         Included components:
 
@@ -7577,7 +7314,7 @@ class Ec2RunnerProvider(
             vpc=vpc,
         )
 
-        return typing.cast(RunnerImageBuilder, jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
+        return typing.cast("IConfigurableRunnerImageBuilder", jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
 
     @jsii.member(jsii_name="getStepFunctionTask")
     def get_step_function_task(
@@ -8140,8 +7877,14 @@ class EcsRunnerProvider(
         security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
         subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
         vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-    ) -> RunnerImageBuilder:
-        '''(experimental) Create new image builder that builds ECS specific runner images using Ubuntu.
+    ) -> "IConfigurableRunnerImageBuilder":
+        '''(experimental) Create new image builder that builds ECS specific runner images.
+
+        You can customize the OS, architecture, VPC, subnet, security groups, etc. by passing in props.
+
+        You can add components to the image builder by calling ``imageBuilder.addComponent()``.
+
+        The default OS is Ubuntu running on x64 architecture.
 
         Included components:
 
@@ -8195,7 +7938,7 @@ class EcsRunnerProvider(
             vpc=vpc,
         )
 
-        return typing.cast(RunnerImageBuilder, jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
+        return typing.cast("IConfigurableRunnerImageBuilder", jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
 
     @jsii.member(jsii_name="getStepFunctionTask")
     def get_step_function_task(
@@ -8848,8 +8591,14 @@ class FargateRunnerProvider(
         security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
         subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
         vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-    ) -> RunnerImageBuilder:
-        '''(experimental) Create new image builder that builds Fargate specific runner images using Ubuntu.
+    ) -> "IConfigurableRunnerImageBuilder":
+        '''(experimental) Create new image builder that builds Fargate specific runner images.
+
+        You can customize the OS, architecture, VPC, subnet, security groups, etc. by passing in props.
+
+        You can add components to the image builder by calling ``imageBuilder.addComponent()``.
+
+        The default OS is Ubuntu running on x64 architecture.
 
         Included components:
 
@@ -8902,7 +8651,7 @@ class FargateRunnerProvider(
             vpc=vpc,
         )
 
-        return typing.cast(RunnerImageBuilder, jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
+        return typing.cast("IConfigurableRunnerImageBuilder", jsii.sinvoke(cls, "imageBuilder", [scope, id, props]))
 
     @jsii.member(jsii_name="getStepFunctionTask")
     def get_step_function_task(
@@ -9502,19 +9251,112 @@ class FargateRunnerProviderProps(RunnerProviderProps):
         )
 
 
-class LambdaRunner(
-    LambdaRunnerProvider,
-    metaclass=jsii.JSIIMeta,
-    jsii_type="@cloudsnorkel/cdk-github-runners.LambdaRunner",
+@jsii.interface(
+    jsii_type="@cloudsnorkel/cdk-github-runners.IConfigurableRunnerImageBuilder"
+)
+class IConfigurableRunnerImageBuilder(
+    IRunnerImageBuilder,
+    _aws_cdk_aws_ec2_ceddda9d.IConnectable,
+    _aws_cdk_aws_iam_ceddda9d.IGrantable,
+    typing_extensions.Protocol,
 ):
-    '''
-    :deprecated: use {@link LambdaRunnerProvider }
+    '''(experimental) Interface for constructs that build an image that can be used in {@link IRunnerProvider }.
 
-    :stability: deprecated
+    The image can be configured by adding or removing components. The image builder can be configured by adding grants or allowing connections.
+
+    An image can be a Docker image or AMI.
+
+    :stability: experimental
     '''
 
-    def __init__(
-        self,
+    @jsii.member(jsii_name="addComponent")
+    def add_component(self, component: RunnerImageComponent) -> None:
+        '''(experimental) Add a component to the image builder.
+
+        The component will be added to the end of the list of components.
+
+        :param component: component to add.
+
+        :stability: experimental
+        '''
+        ...
+
+    @jsii.member(jsii_name="removeComponent")
+    def remove_component(self, component: RunnerImageComponent) -> None:
+        '''(experimental) Remove a component from the image builder.
+
+        Removal is done by component name. Multiple components with the same name will all be removed.
+
+        :param component: component to remove.
+
+        :stability: experimental
+        '''
+        ...
+
+
+class _IConfigurableRunnerImageBuilderProxy(
+    jsii.proxy_for(IRunnerImageBuilder), # type: ignore[misc]
+    jsii.proxy_for(_aws_cdk_aws_ec2_ceddda9d.IConnectable), # type: ignore[misc]
+    jsii.proxy_for(_aws_cdk_aws_iam_ceddda9d.IGrantable), # type: ignore[misc]
+):
+    '''(experimental) Interface for constructs that build an image that can be used in {@link IRunnerProvider }.
+
+    The image can be configured by adding or removing components. The image builder can be configured by adding grants or allowing connections.
+
+    An image can be a Docker image or AMI.
+
+    :stability: experimental
+    '''
+
+    __jsii_type__: typing.ClassVar[str] = "@cloudsnorkel/cdk-github-runners.IConfigurableRunnerImageBuilder"
+
+    @jsii.member(jsii_name="addComponent")
+    def add_component(self, component: RunnerImageComponent) -> None:
+        '''(experimental) Add a component to the image builder.
+
+        The component will be added to the end of the list of components.
+
+        :param component: component to add.
+
+        :stability: experimental
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__dc4625ad41fc3631b6e9812ae4ab86d19fc28eb849f5a5bf3a3ed7c4ebbeb066)
+            check_type(argname="argument component", value=component, expected_type=type_hints["component"])
+        return typing.cast(None, jsii.invoke(self, "addComponent", [component]))
+
+    @jsii.member(jsii_name="removeComponent")
+    def remove_component(self, component: RunnerImageComponent) -> None:
+        '''(experimental) Remove a component from the image builder.
+
+        Removal is done by component name. Multiple components with the same name will all be removed.
+
+        :param component: component to remove.
+
+        :stability: experimental
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__3aa11e0e95269ba6ec5fded5dd768fb588157de9643a5fce8b09fc9b4e2a18c0)
+            check_type(argname="argument component", value=component, expected_type=type_hints["component"])
+        return typing.cast(None, jsii.invoke(self, "removeComponent", [component]))
+
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the interface
+typing.cast(typing.Any, IConfigurableRunnerImageBuilder).__jsii_proxy_class__ = lambda : _IConfigurableRunnerImageBuilderProxy
+
+
+class LambdaRunner(
+    LambdaRunnerProvider,
+    metaclass=jsii.JSIIMeta,
+    jsii_type="@cloudsnorkel/cdk-github-runners.LambdaRunner",
+):
+    '''
+    :deprecated: use {@link LambdaRunnerProvider }
+
+    :stability: deprecated
+    '''
+
+    def __init__(
+        self,
         scope: _constructs_77d1e7e8.Construct,
         id: builtins.str,
         *,
@@ -9744,100 +9586,395 @@ class LambdaRunnerProviderProps(RunnerProviderProps):
 
         :stability: experimental
         '''
-        result = self._values.get("labels")
-        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+        result = self._values.get("labels")
+        return typing.cast(typing.Optional[typing.List[builtins.str]], result)
+
+    @builtins.property
+    def memory_size(self) -> typing.Optional[jsii.Number]:
+        '''(experimental) The amount of memory, in MB, that is allocated to your Lambda function.
+
+        Lambda uses this value to proportionally allocate the amount of CPU
+        power. For more information, see Resource Model in the AWS Lambda
+        Developer Guide.
+
+        :default: 2048
+
+        :stability: experimental
+        '''
+        result = self._values.get("memory_size")
+        return typing.cast(typing.Optional[jsii.Number], result)
+
+    @builtins.property
+    def security_group(
+        self,
+    ) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]:
+        '''(deprecated) Security group to assign to this instance.
+
+        :default: public lambda with no security group
+
+        :deprecated: use {@link securityGroups }
+
+        :stability: deprecated
+        '''
+        result = self._values.get("security_group")
+        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup], result)
+
+    @builtins.property
+    def security_groups(
+        self,
+    ) -> typing.Optional[typing.List[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]]:
+        '''(experimental) Security groups to assign to this instance.
+
+        :default: public lambda with no security group
+
+        :stability: experimental
+        '''
+        result = self._values.get("security_groups")
+        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]], result)
+
+    @builtins.property
+    def subnet_selection(
+        self,
+    ) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection]:
+        '''(experimental) Where to place the network interfaces within the VPC.
+
+        :default: no subnet
+
+        :stability: experimental
+        '''
+        result = self._values.get("subnet_selection")
+        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection], result)
+
+    @builtins.property
+    def timeout(self) -> typing.Optional[_aws_cdk_ceddda9d.Duration]:
+        '''(experimental) The function execution time (in seconds) after which Lambda terminates the function.
+
+        Because the execution time affects cost, set this value
+        based on the function's expected execution time.
+
+        :default: Duration.minutes(15)
+
+        :stability: experimental
+        '''
+        result = self._values.get("timeout")
+        return typing.cast(typing.Optional[_aws_cdk_ceddda9d.Duration], result)
+
+    @builtins.property
+    def vpc(self) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc]:
+        '''(experimental) VPC to launch the runners in.
+
+        :default: no VPC
+
+        :stability: experimental
+        '''
+        result = self._values.get("vpc")
+        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc], result)
+
+    def __eq__(self, rhs: typing.Any) -> builtins.bool:
+        return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+    def __ne__(self, rhs: typing.Any) -> builtins.bool:
+        return not (rhs == self)
+
+    def __repr__(self) -> str:
+        return "LambdaRunnerProviderProps(%s)" % ", ".join(
+            k + "=" + repr(v) for k, v in self._values.items()
+        )
+
+
+@jsii.implements(IConfigurableRunnerImageBuilder)
+class RunnerImageBuilder(
+    _constructs_77d1e7e8.Construct,
+    metaclass=jsii.JSIIAbstractClass,
+    jsii_type="@cloudsnorkel/cdk-github-runners.RunnerImageBuilder",
+):
+    '''(experimental) GitHub Runner image builder. Builds a Docker image or AMI with GitHub Runner and other requirements installed.
+
+    Images can be customized before passed into the provider by adding or removing components to be installed.
+
+    Images are rebuilt every week by default to ensure that the latest security patches are applied.
+
+    :stability: experimental
+    '''
+
+    def __init__(
+        self,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        architecture: typing.Optional[Architecture] = None,
+        aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
+        base_ami: typing.Optional[builtins.str] = None,
+        base_docker_image: typing.Optional[builtins.str] = None,
+        builder_type: typing.Optional[RunnerImageBuilderType] = None,
+        code_build_options: typing.Optional[typing.Union[CodeBuildRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
+        components: typing.Optional[typing.Sequence[RunnerImageComponent]] = None,
+        log_removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
+        log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
+        os: typing.Optional[Os] = None,
+        rebuild_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+        runner_version: typing.Optional[RunnerVersion] = None,
+        security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
+        subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+        vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
+    ) -> None:
+        '''
+        :param scope: -
+        :param id: -
+        :param architecture: (experimental) Image architecture. Default: Architecture.X86_64
+        :param aws_image_builder_options: (experimental) Options specific to AWS Image Builder. Only used when builderType is RunnerImageBuilderType.AWS_IMAGE_BUILDER.
+        :param base_ami: (experimental) Base AMI from which runner AMIs will be built. This can be an actual AMI or an AWS Image Builder ARN that points to the latest AMI. For example ``arn:aws:imagebuilder:us-east-1:aws:image/ubuntu-server-22-lts-x86/x.x.x`` would always use the latest version of Ubuntu 22.04 in each build. If you want a specific version, you can replace ``x.x.x`` with that version. Default: latest Ubuntu 22.04 AMI for Os.LINUX_UBUNTU, latest Amazon Linux 2 AMI for Os.LINUX_AMAZON_2, latest Windows Server 2022 AMI for Os.WINDOWS
+        :param base_docker_image: (experimental) Base image from which Docker runner images will be built. Default: public.ecr.aws/lts/ubuntu:22.04 for Os.LINUX_UBUNTU, public.ecr.aws/amazonlinux/amazonlinux:2 for Os.LINUX_AMAZON_2, mcr.microsoft.com/windows/servercore:ltsc2019-amd64 for Os.WINDOWS
+        :param builder_type: Default: CodeBuild for Linux Docker image, AWS Image Builder for Windows Docker image and any AMI
+        :param code_build_options: (experimental) Options specific to CodeBuild image builder. Only used when builderType is RunnerImageBuilderType.CODE_BUILD.
+        :param components: (experimental) Components to install on the image. Default: none
+        :param log_removal_policy: (experimental) Removal policy for logs of image builds. If deployment fails on the custom resource, try setting this to ``RemovalPolicy.RETAIN``. This way the CodeBuild logs can still be viewed, and you can see why the build failed. We try to not leave anything behind when removed. But sometimes a log staying behind is useful. Default: RemovalPolicy.DESTROY
+        :param log_retention: (experimental) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. Default: logs.RetentionDays.ONE_MONTH
+        :param os: (experimental) Image OS. Default: OS.LINUX_UBUNTU
+        :param rebuild_interval: (experimental) Schedule the image to be rebuilt every given interval. Useful for keeping the image up-do-date with the latest GitHub runner version and latest OS updates. Set to zero to disable. Default: Duration.days(7)
+        :param runner_version: (experimental) Version of GitHub Runners to install. Default: latest version available
+        :param security_groups: (experimental) Security Groups to assign to this instance.
+        :param subnet_selection: (experimental) Where to place the network interfaces within the VPC. Default: no subnet
+        :param vpc: (experimental) VPC to build the image in. Default: no VPC
+
+        :stability: experimental
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__963c9a4884bb9d7400672391dfb47486f969a1b8fe5616bba9cd493e8a71484b)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = RunnerImageBuilderProps(
+            architecture=architecture,
+            aws_image_builder_options=aws_image_builder_options,
+            base_ami=base_ami,
+            base_docker_image=base_docker_image,
+            builder_type=builder_type,
+            code_build_options=code_build_options,
+            components=components,
+            log_removal_policy=log_removal_policy,
+            log_retention=log_retention,
+            os=os,
+            rebuild_interval=rebuild_interval,
+            runner_version=runner_version,
+            security_groups=security_groups,
+            subnet_selection=subnet_selection,
+            vpc=vpc,
+        )
+
+        jsii.create(self.__class__, self, [scope, id, props])
+
+    @jsii.member(jsii_name="new")
+    @builtins.classmethod
+    def new(
+        cls,
+        scope: _constructs_77d1e7e8.Construct,
+        id: builtins.str,
+        *,
+        architecture: typing.Optional[Architecture] = None,
+        aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
+        base_ami: typing.Optional[builtins.str] = None,
+        base_docker_image: typing.Optional[builtins.str] = None,
+        builder_type: typing.Optional[RunnerImageBuilderType] = None,
+        code_build_options: typing.Optional[typing.Union[CodeBuildRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
+        components: typing.Optional[typing.Sequence[RunnerImageComponent]] = None,
+        log_removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
+        log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
+        os: typing.Optional[Os] = None,
+        rebuild_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+        runner_version: typing.Optional[RunnerVersion] = None,
+        security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
+        subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+        vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
+    ) -> IConfigurableRunnerImageBuilder:
+        '''(experimental) Create a new image builder based on the provided properties.
+
+        The implementation will differ based on the OS, architecture, and requested builder type.
+
+        :param scope: -
+        :param id: -
+        :param architecture: (experimental) Image architecture. Default: Architecture.X86_64
+        :param aws_image_builder_options: (experimental) Options specific to AWS Image Builder. Only used when builderType is RunnerImageBuilderType.AWS_IMAGE_BUILDER.
+        :param base_ami: (experimental) Base AMI from which runner AMIs will be built. This can be an actual AMI or an AWS Image Builder ARN that points to the latest AMI. For example ``arn:aws:imagebuilder:us-east-1:aws:image/ubuntu-server-22-lts-x86/x.x.x`` would always use the latest version of Ubuntu 22.04 in each build. If you want a specific version, you can replace ``x.x.x`` with that version. Default: latest Ubuntu 22.04 AMI for Os.LINUX_UBUNTU, latest Amazon Linux 2 AMI for Os.LINUX_AMAZON_2, latest Windows Server 2022 AMI for Os.WINDOWS
+        :param base_docker_image: (experimental) Base image from which Docker runner images will be built. Default: public.ecr.aws/lts/ubuntu:22.04 for Os.LINUX_UBUNTU, public.ecr.aws/amazonlinux/amazonlinux:2 for Os.LINUX_AMAZON_2, mcr.microsoft.com/windows/servercore:ltsc2019-amd64 for Os.WINDOWS
+        :param builder_type: Default: CodeBuild for Linux Docker image, AWS Image Builder for Windows Docker image and any AMI
+        :param code_build_options: (experimental) Options specific to CodeBuild image builder. Only used when builderType is RunnerImageBuilderType.CODE_BUILD.
+        :param components: (experimental) Components to install on the image. Default: none
+        :param log_removal_policy: (experimental) Removal policy for logs of image builds. If deployment fails on the custom resource, try setting this to ``RemovalPolicy.RETAIN``. This way the CodeBuild logs can still be viewed, and you can see why the build failed. We try to not leave anything behind when removed. But sometimes a log staying behind is useful. Default: RemovalPolicy.DESTROY
+        :param log_retention: (experimental) The number of days log events are kept in CloudWatch Logs. When updating this property, unsetting it doesn't remove the log retention policy. To remove the retention policy, set the value to ``INFINITE``. Default: logs.RetentionDays.ONE_MONTH
+        :param os: (experimental) Image OS. Default: OS.LINUX_UBUNTU
+        :param rebuild_interval: (experimental) Schedule the image to be rebuilt every given interval. Useful for keeping the image up-do-date with the latest GitHub runner version and latest OS updates. Set to zero to disable. Default: Duration.days(7)
+        :param runner_version: (experimental) Version of GitHub Runners to install. Default: latest version available
+        :param security_groups: (experimental) Security Groups to assign to this instance.
+        :param subnet_selection: (experimental) Where to place the network interfaces within the VPC. Default: no subnet
+        :param vpc: (experimental) VPC to build the image in. Default: no VPC
+
+        :stability: experimental
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__c44d5704c54d7fdcf24ad39567c0e9f53f9837163bf8bf3b1b4e652e27c9ec75)
+            check_type(argname="argument scope", value=scope, expected_type=type_hints["scope"])
+            check_type(argname="argument id", value=id, expected_type=type_hints["id"])
+        props = RunnerImageBuilderProps(
+            architecture=architecture,
+            aws_image_builder_options=aws_image_builder_options,
+            base_ami=base_ami,
+            base_docker_image=base_docker_image,
+            builder_type=builder_type,
+            code_build_options=code_build_options,
+            components=components,
+            log_removal_policy=log_removal_policy,
+            log_retention=log_retention,
+            os=os,
+            rebuild_interval=rebuild_interval,
+            runner_version=runner_version,
+            security_groups=security_groups,
+            subnet_selection=subnet_selection,
+            vpc=vpc,
+        )
+
+        return typing.cast(IConfigurableRunnerImageBuilder, jsii.sinvoke(cls, "new", [scope, id, props]))
+
+    @jsii.member(jsii_name="addComponent")
+    def add_component(self, component: RunnerImageComponent) -> None:
+        '''(experimental) Add a component to the image builder.
+
+        The component will be added to the end of the list of components.
+
+        :param component: -
+
+        :stability: experimental
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__9dec4d5fbab87fa223a0eb0a144ad5bd91f9cdd54d3337c971ce6435c76dc049)
+            check_type(argname="argument component", value=component, expected_type=type_hints["component"])
+        return typing.cast(None, jsii.invoke(self, "addComponent", [component]))
+
+    @jsii.member(jsii_name="bindAmi")
+    @abc.abstractmethod
+    def bind_ami(self) -> RunnerAmi:
+        '''(experimental) Build and return an AMI with GitHub Runner installed in it.
+
+        Anything that ends up with a launch template pointing to an AMI that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing AMI and nothing else.
+
+        The AMI can be further updated over time manually or using a schedule as long as it is always written to the same launch template.
+
+        :stability: experimental
+        '''
+        ...
+
+    @jsii.member(jsii_name="bindDockerImage")
+    @abc.abstractmethod
+    def bind_docker_image(self) -> RunnerImage:
+        '''(experimental) Build and return a Docker image with GitHub Runner installed in it.
+
+        Anything that ends up with an ECR repository containing a Docker image that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing image and nothing else.
+
+        It's important that the specified image tag be available at the time the repository is available. Providers usually assume the image is ready and will fail if it's not.
+
+        The image can be further updated over time manually or using a schedule as long as it is always written to the same tag.
+
+        :stability: experimental
+        '''
+        ...
+
+    @jsii.member(jsii_name="removeComponent")
+    def remove_component(self, component: RunnerImageComponent) -> None:
+        '''(experimental) Remove a component from the image builder.
+
+        Removal is done by component name. Multiple components with the same name will all be removed.
+
+        :param component: -
+
+        :stability: experimental
+        '''
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__1c4318b2834e7865918b5308b85c0fd80f22d29a067d68d4ee8537a6c0c88b3b)
+            check_type(argname="argument component", value=component, expected_type=type_hints["component"])
+        return typing.cast(None, jsii.invoke(self, "removeComponent", [component]))
+
+    @builtins.property
+    @jsii.member(jsii_name="connections")
+    @abc.abstractmethod
+    def connections(self) -> _aws_cdk_aws_ec2_ceddda9d.Connections:
+        '''(experimental) The network connections associated with this resource.
+
+        :stability: experimental
+        '''
+        ...
 
     @builtins.property
-    def memory_size(self) -> typing.Optional[jsii.Number]:
-        '''(experimental) The amount of memory, in MB, that is allocated to your Lambda function.
-
-        Lambda uses this value to proportionally allocate the amount of CPU
-        power. For more information, see Resource Model in the AWS Lambda
-        Developer Guide.
-
-        :default: 2048
+    @jsii.member(jsii_name="grantPrincipal")
+    @abc.abstractmethod
+    def grant_principal(self) -> _aws_cdk_aws_iam_ceddda9d.IPrincipal:
+        '''(experimental) The principal to grant permissions to.
 
         :stability: experimental
         '''
-        result = self._values.get("memory_size")
-        return typing.cast(typing.Optional[jsii.Number], result)
+        ...
 
     @builtins.property
-    def security_group(
-        self,
-    ) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]:
-        '''(deprecated) Security group to assign to this instance.
+    @jsii.member(jsii_name="components")
+    def _components(self) -> typing.List[RunnerImageComponent]:
+        '''
+        :stability: experimental
+        '''
+        return typing.cast(typing.List[RunnerImageComponent], jsii.get(self, "components"))
 
-        :default: public lambda with no security group
+    @_components.setter
+    def _components(self, value: typing.List[RunnerImageComponent]) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__705c18a1eedaa490aebad511aac32a801519a57162e30be4673a8ab87ca434dc)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "components", value)
 
-        :deprecated: use {@link securityGroups }
 
-        :stability: deprecated
-        '''
-        result = self._values.get("security_group")
-        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup], result)
+class _RunnerImageBuilderProxy(RunnerImageBuilder):
+    @jsii.member(jsii_name="bindAmi")
+    def bind_ami(self) -> RunnerAmi:
+        '''(experimental) Build and return an AMI with GitHub Runner installed in it.
 
-    @builtins.property
-    def security_groups(
-        self,
-    ) -> typing.Optional[typing.List[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]]:
-        '''(experimental) Security groups to assign to this instance.
+        Anything that ends up with a launch template pointing to an AMI that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing AMI and nothing else.
 
-        :default: public lambda with no security group
+        The AMI can be further updated over time manually or using a schedule as long as it is always written to the same launch template.
 
         :stability: experimental
         '''
-        result = self._values.get("security_groups")
-        return typing.cast(typing.Optional[typing.List[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]], result)
+        return typing.cast(RunnerAmi, jsii.invoke(self, "bindAmi", []))
 
-    @builtins.property
-    def subnet_selection(
-        self,
-    ) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection]:
-        '''(experimental) Where to place the network interfaces within the VPC.
+    @jsii.member(jsii_name="bindDockerImage")
+    def bind_docker_image(self) -> RunnerImage:
+        '''(experimental) Build and return a Docker image with GitHub Runner installed in it.
 
-        :default: no subnet
+        Anything that ends up with an ECR repository containing a Docker image that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing image and nothing else.
+
+        It's important that the specified image tag be available at the time the repository is available. Providers usually assume the image is ready and will fail if it's not.
+
+        The image can be further updated over time manually or using a schedule as long as it is always written to the same tag.
 
         :stability: experimental
         '''
-        result = self._values.get("subnet_selection")
-        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection], result)
+        return typing.cast(RunnerImage, jsii.invoke(self, "bindDockerImage", []))
 
     @builtins.property
-    def timeout(self) -> typing.Optional[_aws_cdk_ceddda9d.Duration]:
-        '''(experimental) The function execution time (in seconds) after which Lambda terminates the function.
-
-        Because the execution time affects cost, set this value
-        based on the function's expected execution time.
-
-        :default: Duration.minutes(15)
+    @jsii.member(jsii_name="connections")
+    def connections(self) -> _aws_cdk_aws_ec2_ceddda9d.Connections:
+        '''(experimental) The network connections associated with this resource.
 
         :stability: experimental
         '''
-        result = self._values.get("timeout")
-        return typing.cast(typing.Optional[_aws_cdk_ceddda9d.Duration], result)
+        return typing.cast(_aws_cdk_aws_ec2_ceddda9d.Connections, jsii.get(self, "connections"))
 
     @builtins.property
-    def vpc(self) -> typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc]:
-        '''(experimental) VPC to launch the runners in.
-
-        :default: no VPC
+    @jsii.member(jsii_name="grantPrincipal")
+    def grant_principal(self) -> _aws_cdk_aws_iam_ceddda9d.IPrincipal:
+        '''(experimental) The principal to grant permissions to.
 
         :stability: experimental
         '''
-        result = self._values.get("vpc")
-        return typing.cast(typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc], result)
-
-    def __eq__(self, rhs: typing.Any) -> builtins.bool:
-        return isinstance(rhs, self.__class__) and rhs._values == self._values
-
-    def __ne__(self, rhs: typing.Any) -> builtins.bool:
-        return not (rhs == self)
+        return typing.cast(_aws_cdk_aws_iam_ceddda9d.IPrincipal, jsii.get(self, "grantPrincipal"))
 
-    def __repr__(self) -> str:
-        return "LambdaRunnerProviderProps(%s)" % ", ".join(
-            k + "=" + repr(v) for k, v in self._values.items()
-        )
+# Adding a "__jsii_proxy_class__(): typing.Type" function to the abstract class
+typing.cast(typing.Any, RunnerImageBuilder).__jsii_proxy_class__ = lambda : _RunnerImageBuilderProxy
 
 
 class CodeBuildRunner(
@@ -10086,6 +10223,7 @@ __all__ = [
     "FargateRunnerProviderProps",
     "GitHubRunners",
     "GitHubRunnersProps",
+    "IConfigurableRunnerImageBuilder",
     "IRunnerAmiStatus",
     "IRunnerImageBuilder",
     "IRunnerImageStatus",
@@ -10228,6 +10366,7 @@ def _typecheckingstub__c1a45de07d09ed9f4fd0b9051aeff4571ceda633f49c0b30a5058ad6d
     idle_timeout: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
     log_options: typing.Optional[typing.Union[LogOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     providers: typing.Optional[typing.Sequence[IRunnerProvider]] = None,
+    require_self_hosted_label: typing.Optional[builtins.bool] = None,
     retry_options: typing.Optional[typing.Union[ProviderRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     security_group: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup] = None,
     security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
@@ -10247,6 +10386,7 @@ def _typecheckingstub__4db12e50ec9bf1582f493963c13640e2d81a3a4afae3df834ecce0bf8
     idle_timeout: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
     log_options: typing.Optional[typing.Union[LogOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     providers: typing.Optional[typing.Sequence[IRunnerProvider]] = None,
+    require_self_hosted_label: typing.Optional[builtins.bool] = None,
     retry_options: typing.Optional[typing.Union[ProviderRetryOptions, typing.Dict[builtins.str, typing.Any]]] = None,
     security_group: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup] = None,
     security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
@@ -10293,6 +10433,14 @@ def _typecheckingstub__363ebaab8a0bcbaea3d32a9c7e3cb241f08cf49d6eea02ba40eaaef9a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__abecb3decfe8eebf190daa2e93a508111cc10650e6b9fbf65b3a34f3ed07ca24(
+    type: builtins.str,
+    name: builtins.str,
+    data: typing.Any,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__a450535474a302df6d17ac0b627edd05f72f54c900f36380517d39fc0a3b15e4(
     grantee: _aws_cdk_aws_iam_ceddda9d.IGrantable,
 ) -> None:
@@ -10306,14 +10454,6 @@ def _typecheckingstub__bae848cd8ee55808c4c98a6e69173dc05ae5472e3b1443ee6fbc64e32
     """Type checking stubs"""
     pass
 
-def _typecheckingstub__e11323aa6f18ef1898e18067dba5908fdeabd333bfc1604f92c4c244adb28f7f(
-    type: builtins.str,
-    name: builtins.str,
-    data: typing.Any,
-) -> None:
-    """Type checking stubs"""
-    pass
-
 def _typecheckingstub__b86439e194b36e470271c572c251444f98c4b86a68fa7e63cf41ae1fa9628d4a(
     *,
     commands: typing.Sequence[builtins.str],
@@ -10525,70 +10665,6 @@ def _typecheckingstub__21bedad36e17a5840ddb719458c9e0eb15a89e493efa80af28f6031d1
     """Type checking stubs"""
     pass
 
-def _typecheckingstub__963c9a4884bb9d7400672391dfb47486f969a1b8fe5616bba9cd493e8a71484b(
-    scope: _constructs_77d1e7e8.Construct,
-    id: builtins.str,
-    *,
-    architecture: typing.Optional[Architecture] = None,
-    aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
-    base_ami: typing.Optional[builtins.str] = None,
-    base_docker_image: typing.Optional[builtins.str] = None,
-    builder_type: typing.Optional[RunnerImageBuilderType] = None,
-    code_build_options: typing.Optional[typing.Union[CodeBuildRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
-    components: typing.Optional[typing.Sequence[RunnerImageComponent]] = None,
-    log_removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
-    log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
-    os: typing.Optional[Os] = None,
-    rebuild_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
-    runner_version: typing.Optional[RunnerVersion] = None,
-    security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
-    subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
-    vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-) -> None:
-    """Type checking stubs"""
-    pass
-
-def _typecheckingstub__c44d5704c54d7fdcf24ad39567c0e9f53f9837163bf8bf3b1b4e652e27c9ec75(
-    scope: _constructs_77d1e7e8.Construct,
-    id: builtins.str,
-    *,
-    architecture: typing.Optional[Architecture] = None,
-    aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
-    base_ami: typing.Optional[builtins.str] = None,
-    base_docker_image: typing.Optional[builtins.str] = None,
-    builder_type: typing.Optional[RunnerImageBuilderType] = None,
-    code_build_options: typing.Optional[typing.Union[CodeBuildRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
-    components: typing.Optional[typing.Sequence[RunnerImageComponent]] = None,
-    log_removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
-    log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
-    os: typing.Optional[Os] = None,
-    rebuild_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
-    runner_version: typing.Optional[RunnerVersion] = None,
-    security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
-    subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
-    vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
-) -> None:
-    """Type checking stubs"""
-    pass
-
-def _typecheckingstub__9dec4d5fbab87fa223a0eb0a144ad5bd91f9cdd54d3337c971ce6435c76dc049(
-    component: RunnerImageComponent,
-) -> None:
-    """Type checking stubs"""
-    pass
-
-def _typecheckingstub__1c4318b2834e7865918b5308b85c0fd80f22d29a067d68d4ee8537a6c0c88b3b(
-    component: RunnerImageComponent,
-) -> None:
-    """Type checking stubs"""
-    pass
-
-def _typecheckingstub__705c18a1eedaa490aebad511aac32a801519a57162e30be4673a8ab87ca434dc(
-    value: typing.List[RunnerImageComponent],
-) -> None:
-    """Type checking stubs"""
-    pass
-
 def _typecheckingstub__ab96b7f3871624e8430668114e7f5748ba5d253168db5b8f9a13955d0a82e43d(
     *,
     architecture: typing.Optional[Architecture] = None,
@@ -11337,6 +11413,18 @@ def _typecheckingstub__26cdeb87df1adf5c49e0f9c1c061c7138af674da9af221212e1505fc1
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__dc4625ad41fc3631b6e9812ae4ab86d19fc28eb849f5a5bf3a3ed7c4ebbeb066(
+    component: RunnerImageComponent,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__3aa11e0e95269ba6ec5fded5dd768fb588157de9643a5fce8b09fc9b4e2a18c0(
+    component: RunnerImageComponent,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__80e9b84ecba02bdef856d3ee3f48a5e0a5e58ad813554fd529c0abe3af88217d(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,
@@ -11375,6 +11463,70 @@ def _typecheckingstub__45a4a92b817689da2d55675d278ad5c96699269cc41f3406b7fca6d7a
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__963c9a4884bb9d7400672391dfb47486f969a1b8fe5616bba9cd493e8a71484b(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    architecture: typing.Optional[Architecture] = None,
+    aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
+    base_ami: typing.Optional[builtins.str] = None,
+    base_docker_image: typing.Optional[builtins.str] = None,
+    builder_type: typing.Optional[RunnerImageBuilderType] = None,
+    code_build_options: typing.Optional[typing.Union[CodeBuildRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
+    components: typing.Optional[typing.Sequence[RunnerImageComponent]] = None,
+    log_removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
+    log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
+    os: typing.Optional[Os] = None,
+    rebuild_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    runner_version: typing.Optional[RunnerVersion] = None,
+    security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
+    subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+    vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__c44d5704c54d7fdcf24ad39567c0e9f53f9837163bf8bf3b1b4e652e27c9ec75(
+    scope: _constructs_77d1e7e8.Construct,
+    id: builtins.str,
+    *,
+    architecture: typing.Optional[Architecture] = None,
+    aws_image_builder_options: typing.Optional[typing.Union[AwsImageBuilderRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
+    base_ami: typing.Optional[builtins.str] = None,
+    base_docker_image: typing.Optional[builtins.str] = None,
+    builder_type: typing.Optional[RunnerImageBuilderType] = None,
+    code_build_options: typing.Optional[typing.Union[CodeBuildRunnerImageBuilderProps, typing.Dict[builtins.str, typing.Any]]] = None,
+    components: typing.Optional[typing.Sequence[RunnerImageComponent]] = None,
+    log_removal_policy: typing.Optional[_aws_cdk_ceddda9d.RemovalPolicy] = None,
+    log_retention: typing.Optional[_aws_cdk_aws_logs_ceddda9d.RetentionDays] = None,
+    os: typing.Optional[Os] = None,
+    rebuild_interval: typing.Optional[_aws_cdk_ceddda9d.Duration] = None,
+    runner_version: typing.Optional[RunnerVersion] = None,
+    security_groups: typing.Optional[typing.Sequence[_aws_cdk_aws_ec2_ceddda9d.ISecurityGroup]] = None,
+    subnet_selection: typing.Optional[typing.Union[_aws_cdk_aws_ec2_ceddda9d.SubnetSelection, typing.Dict[builtins.str, typing.Any]]] = None,
+    vpc: typing.Optional[_aws_cdk_aws_ec2_ceddda9d.IVpc] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__9dec4d5fbab87fa223a0eb0a144ad5bd91f9cdd54d3337c971ce6435c76dc049(
+    component: RunnerImageComponent,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__1c4318b2834e7865918b5308b85c0fd80f22d29a067d68d4ee8537a6c0c88b3b(
+    component: RunnerImageComponent,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__705c18a1eedaa490aebad511aac32a801519a57162e30be4673a8ab87ca434dc(
+    value: typing.List[RunnerImageComponent],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__1ab9454b0ecfcd12fc0ab07c0f0f4d7ce646a5a928f5e14092b0a6c42a4c3b79(
     scope: _constructs_77d1e7e8.Construct,
     id: builtins.str,