Rebase from origin

.ci/Dockerfile

@@ -1,5 +1,5 @@
 #syntax=docker/dockerfile:1.2
-FROM node:18 as build
+FROM node:20 as build
 WORKDIR /lambdas
 RUN apt-get update \
         && apt-get install -y zip \

.ci/terraform-init-all.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# This script will run terraform init in all subdirectories of the examples directory
+# required to run tflint via pre-commit
+
+# only run the script if a uniique pid file exits if not creat it or --force flag is passed
+pid="/tmp/philips-labs-terraform-aws-github-runner.pid"
+if [ "$1" == "--force" ]; then
+  rm -f /tmp/philips-labs-terraform-aws-github-runner.pid
+fi
+
+if [ ! -f $pid ]; then
+  echo $$ > $pid
+else
+  echo "Init all terraform directories will be skipped. To run the script remove the file $pid or run with --force"
+  exit 0
+fi
+
+# Change to the examples directory
+example_dirs=$(find examples -mindepth 1 -maxdepth 2 -type d | grep -v "templates")
+module_dirs=$(find modules -mindepth 1 -maxdepth 2 -type d | grep -v "templates")
+
+# merge example_dirs and module_dirs in terraform_dirs
+terraform_dirs=$(echo $example_dirs $module_dirs "modules/runners/pool" | tr " " "\n" | sort -u | tr "\n" " ")
+
+for dir in $terraform_dirs; do
+  # Check if the subdirectory exists in Git
+  if git rev-parse --is-inside-work-tree &>/dev/null && git ls-files --error-unmatch "$dir" &>/dev/null; then
+    echo "Running terraform init in ${dir} - supressing output"
+    pushd "$dir" >/dev/null
+    terraform init -lockfile=readonly -backend=false &>/dev/null || true
+    popd >/dev/null
+  fi
+done

.devcontainer/Dockerfile

@@ -0,0 +1,2 @@
+ARG VARIANT="20-bullseye"
+FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:0-${VARIANT}

.devcontainer/bashrc.sh

@@ -0,0 +1,17 @@
+open_workspace() {
+    local workspace_file=$WORKSPACE/.vscode/gh-runners.code-workspace
+
+    if ! [ -f "$workspace_file" ]; then
+        echo "🔴 Missing workspace file"
+        return 1
+    fi
+
+    echo "🟡 Opening workspace"
+    if code "$workspace_file"; then
+        echo "🟢 Workspace opened"
+        return 0
+    else
+        echo "🔴 Failed to open workspace"
+        return 1
+    fi
+}

.devcontainer/devcontainer.json

@@ -0,0 +1,32 @@
+{
+	"name": "GitHub Runners AWS",
+  "build": { "dockerfile": "Dockerfile" },
+  "features": {
+    "ghcr.io/devcontainers/features/github-cli:1": {},
+    "ghcr.io/devcontainers/features/terraform:1": {}
+  },
+
+  "containerEnv": {
+    "WORKSPACE": "${containerWorkspaceFolder}" // e.g. /workspaces/my-project
+  },
+
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "dbaeumer.vscode-eslint",
+        "editorconfig.editorconfig",
+        "esbenp.prettier-vscode",
+        "firsttris.vscode-jest-runner",
+        "hashicorp.hcl",
+        "hashicorp.terraform",
+        "hashicorp.terraform",
+        "orta.vscode-jest",
+        "yzhang.markdown-all-in-one"
+      ]
+    }
+  },
+  "postCreateCommand": {
+    "bash_command": "bash ${containerWorkspaceFolder}/.devcontainer/postCreateScript.sh",
+    "welcome": "sudo cp -v .devcontainer/welcome.txt /usr/local/etc/vscode-dev-containers/first-run-notice.txt || true && sudo cp -v .devcontainer/welcome.txt /workspaces/.codespaces/shared/first-run-notice.txt || true"
+  }
+}

.devcontainer/postCreateScript.sh

@@ -0,0 +1 @@
+printf "source \$WORKSPACE/.devcontainer/bashrc.sh\n" >> ~/.bashrc

.devcontainer/welcome.txt

@@ -0,0 +1,53 @@
+================================================================================
+================================================================================
+=====================================================++++**+++==================
+=================================================+++++=********+================
+=============================================+***+=--:-#********+===============
+==========================================+***+=--:::::-+*#*****+===============
+=======================================+*#%*=--:::::::::::-=====+===============
+=====================================+#%%##%*-:::::::::::::::::+================
+===========================++======*#%%#######=-::::::::::::::=+================
+=======================++==---::-+#%%###########+-:::::::::::-+=================
+====================+==-::::::-=#%%################+=::::::::+==================
+=================++=-:::::::-=#%%%####%%##**########%#*++=-:++==================
+===============+=-:::-------*%%%###%%%#=:...:-*############*+===================
+=====.   .-====-:--++***+++#%%###%#%%+:      .-*###########+====================
+===-.      --:-++**+=====+%%%###%%#%*-        :*#########*======================
+===      .:==++=========*%%%#####%#%*=.      .=#########*=======================
+===:     :: .==========+%%%%#####%%%%#+=-:::-+#########+========================
+====:        :=========#%%%%#####%#**#####*##########+==========================
+====         .=========%%%%%####*+=*%##############=============================
+====-....    :--------=##%%%%#*==*%##############=::++==========================
+========--::---------=-=#%%%#+=#%#############*=-::-*===========================
+======------------=+*=---*#++*%#############+-:::::++===========================
+=====----------=+*+=+---=++*%%%%#########**+-:::::++============================
+===----------+*+=-+*+-=+=*#+=*%%%%%%%#*+==+#=:::-*+=============================
+==---------+**+-=**+===**=-=--=+***+======#+-::=+===============================
+==----------+=-=**=:=+*=--++---==========**=:-++================================
+=---------=*=-=**=::::--=*+----=-:::-===**=-=+==================================
+=--------=*=-+**+::-=*+=*+-----=.    ..=+==+====================================
+=-------==--***+=+**=*+*=------.      -+=..=====================================
+=------=--=***+**+=-+*+------==.    .=+:  .=====================================
+=--------=*****+---++=-----=====   .=:   :======================================
+==------=***+=----==-----======-        -=======================================
+===----=*+=------=-----=========:      .========================================
+====--==------------==============--============================================
+======--------==================================================================
+================================================================================
+================================================================================
+================================================================================
+================================================================================
+==========================================================================-:-=++
+
+
+Welcome to the AWS GitHub runners:
+
+Load the vscode workspace to get started
+
+Option 1: run `open_workspace`
+Option 2: open the workspace file `.vscoe/gh-runners.code-workspace` and load the workspace
+
+Build the lambda:
+- cd lambdas
+- yarn instal & yarn run dist
+

.github/dependabot.yml

@@ -20,6 +20,24 @@ updates:
     directory: "/lambdas"
     schedule:
       interval: "weekly"
+    groups:
+      aws:
+        patterns:
+          - "@aws-sdk/*"
+      octokit:
+        patterns:
+          - "@octokit/*"
+      aws-powertools:
+        patterns:
+          - "@aws-lambda-powertools/*"
+
+    ignore:
+      - dependency-name: "@middy/core"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@octokit/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "eslint"
+        update-types: ["version-update:semver-major"]
     commit-message:
       prefix: "fix(lambda)"
       prefix-development: "chore(lambda)"

.github/lint/tflint.tfvars

@@ -1,4 +1,4 @@
-aws_region = null
+aws_region = "eu-west-1"
 github_app = {
   id             = "0"
   key_base64     = "0"

.github/matchers.json

@@ -0,0 +1,18 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "tflint-compact",
+      "pattern": [
+        {
+          "regexp": "^(.+):(\\d+):(\\d+):\\s(Error|Warning|Notice)\\s-\\s(.+)\\s\\((.+)\\)$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "severity": 4,
+          "message": 5,
+          "code": 6
+        }
+      ]
+    }
+  ]
+}

.github/workflows/lambda.yml

@@ -11,22 +11,30 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [18]
+        node: [20]
     container:
       image: node:${{ matrix.node }}
     defaults:
       run:
         working-directory: ./lambdas
 
     steps:
-      - uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - name: Install dependencies
         run: yarn install --frozen-lockfile
       - name: Run prettier
         run: yarn format-check
       - name: Run linter
         run: yarn lint
       - name: Run tests
+        id: test
         run: yarn test
       - name: Build distribution
         run: yarn build
+      - name: Upload coverage report
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: ${{ failure() }}
+        with:
+          name: coverage-reports
+          path: ./**/coverage
+          retention-days: 5

.github/workflows/packer-build.yml

@@ -16,16 +16,16 @@ jobs:
     name: Verify packer
     runs-on: ubuntu-latest
     container:
-      image: index.docker.io/hashicorp/packer@sha256:297bbbbbbf3ce9e0431ac1e8f02934b20e1197613f877b55dfdb1ebfd94eb748 # ratchet:index.docker.io/hashicorp/packer:1.8.6
+      image: index.docker.io/hashicorp/packer@sha256:12c441b8a3994e7df9f0e2692d9298f14c387e70bcc06139420977dbf80a137b # 1.11.2
     strategy:
       matrix:
-        image: ["linux-amzn2", "windows-core-2019", "windows-core-2022", "ubuntu-focal", "ubuntu-jammy", "ubuntu-jammy-arm64"]
+        image: ["linux-al2023", "windows-core-2019", "windows-core-2022", "ubuntu-focal", "ubuntu-jammy", "ubuntu-jammy-arm64"]
     defaults:
       run:
         working-directory: images/${{ matrix.image }}
     steps:
       - name: "Checkout"
-        uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # ratchet:actions/checkout@v3
+        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - name: packer init
         run: packer init .
       - name: check packer formatting

.github/workflows/release.yml

@@ -14,33 +14,32 @@ jobs:
       contents: write
       actions: write
     steps:
-      - uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
+      - uses: actions/setup-node@0a44ba7841725637a19e28fa30b79a866c81b0a6 # v4.0.4
         with:
-          node-version: 16
-      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # ratchet:actions/checkout@v3
+          node-version: 20
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - name: Build dist
         working-directory: lambdas
-        run: yarn install && yarn run test && yarn dist
+        run: yarn install --frozen-lockfile && yarn run test && yarn dist
       - name: Get installation token
-        uses: philips-software/app-token-action@a37926571e4cec6f219e06727136efdd073d8657 # ratchet:philips-software/app-token-action@v1.1.2
+        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
         id: token
         with:
-          app_id: ${{ secrets.FOREST_RELEASER_APP_ID }}
-          app_base64_private_key: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY_BASE64 }}
-          auth_type: installation
+          app-id: ${{ secrets.FOREST_RELEASER_APP_ID }}
+          private-key: ${{ secrets.FOREST_RELEASER_APP_PRIVATE_KEY }}
       - name: Extract branch name
         id: branch
         shell: bash
         run: echo "name=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
       - name: Release
         id: release
-        uses: google-github-actions/release-please-action@c078ea33917ab8cfa5300e48f4b7e6b16606aede # ratchet:google-github-actions/release-please-action@v3
+        uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1
         with:
-          default-branch: ${{ steps.branch.outputs.name }}
+          target-branch: ${{ steps.branch.outputs.name }}
           release-type: terraform-module
           token: ${{ steps.token.outputs.token }}
       - name: Upload Release Asset
-        if: ${{ steps.release.outputs.releases_created }}
+        if: ${{ steps.release.outputs.releases_created == 'true' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |

.github/workflows/semantic-check.yml

@@ -13,8 +13,8 @@ jobs:
     name: Semantic Commit Message Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # ratchet:actions/checkout@v3
-      - uses: amannn/action-semantic-pull-request@c3cd5d1ea3580753008872425915e343e351ab54 # ratchet:amannn/action-semantic-pull-request@v5
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
         name: Check PR for Semantic Commit Message
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale.yml

@@ -10,15 +10,15 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@1160a2240286f5da8ec72b1c0816ce2481aabf84 # ratchet:actions/stale@v7
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           stale-issue-message: >
             This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed if no further activity occurs.  Thank you for your contributions.
 
           stale-pr-message: >
             This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed if no further activity occurs. Thank you for your contributions.
 
-          days-before-stale: 30
-          days-before-close: 10
+          days-before-stale: 90
+          days-before-close: 14
           close-issue-label: "abandoned"
           exempt-issue-labels: "stale:exempt"