update nodejs to 20

.ci/Dockerfile

@@ -1,26 +1,15 @@
 #syntax=docker/dockerfile:1.2
-FROM node:14 as build
-WORKDIR /lambda
+FROM node:20 as build
+WORKDIR /lambdas
 RUN apt-get update \
         && apt-get install -y zip \
         && rm -rf /var/lib/apt/lists/*
 
-FROM build as runner-binaries-syncer
-COPY modules/runner-binaries-syncer/lambdas/runner-binaries-syncer /lambda
-RUN --mount=type=cache,target=/lambda/node_modules,id=runner-binaries-syncer \
-        yarn install && yarn dist
-
-FROM build as runners
-COPY modules/runners/lambdas/runners /lambda
-RUN --mount=type=cache,target=/lambda/node_modules,id=runners \
-        yarn install && yarn dist
-
-FROM build as webhook
-COPY modules/webhook/lambdas/webhook /lambda
-RUN --mount=type=cache,target=/lambda/node_modules,id=webhook \
-        yarn install && yarn dist
+FROM build as lambdas
+COPY lambdas /lambdas
+RUN --mount=type=cache,target=/work/node_modules,id=lambdas \
+        yarn install --frozen-lockfile && yarn dist && \
+        find . -name "*.zip" -exec cp {} . \;
 
 FROM scratch as final
-COPY --from=runner-binaries-syncer /lambda/runner-binaries-syncer.zip /runner-binaries-syncer.zip
-COPY --from=runners                /lambda/runners.zip                /runners.zip
-COPY --from=webhook                /lambda/webhook.zip                /webhook.zip
+COPY --from=lambdas /lambdas/*.zip /

.ci/terraform-init-all.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# This script will run terraform init in all subdirectories of the examples directory
+# required to run tflint via pre-commit
+
+# only run the script if a uniique pid file exits if not creat it or --force flag is passed
+pid="/tmp/philips-labs-terraform-aws-github-runner.pid"
+if [ "$1" == "--force" ]; then
+  rm -f /tmp/philips-labs-terraform-aws-github-runner.pid
+fi
+
+if [ ! -f $pid ]; then
+  echo $$ > $pid
+else
+  echo "Init all terraform directories will be skipped. To run the script remove the file $pid or run with --force"
+  exit 0
+fi
+
+# Change to the examples directory
+example_dirs=$(find examples -mindepth 1 -maxdepth 2 -type d | grep -v "templates")
+module_dirs=$(find modules -mindepth 1 -maxdepth 2 -type d | grep -v "templates")
+
+# merge example_dirs and module_dirs in terraform_dirs
+terraform_dirs=$(echo $example_dirs $module_dirs "modules/runners/pool" | tr " " "\n" | sort -u | tr "\n" " ")
+
+for dir in $terraform_dirs; do
+  # Check if the subdirectory exists in Git
+  if git rev-parse --is-inside-work-tree &>/dev/null && git ls-files --error-unmatch "$dir" &>/dev/null; then
+    echo "Running terraform init in ${dir} - supressing output"
+    pushd "$dir" >/dev/null
+    terraform init -lockfile=readonly -backend=false &>/dev/null || true
+    popd >/dev/null
+  fi
+done

.devcontainer/Dockerfile

@@ -0,0 +1,2 @@
+ARG VARIANT="20-bullseye"
+FROM mcr.microsoft.com/vscode/devcontainers/typescript-node:0-${VARIANT}

.devcontainer/bashrc.sh

@@ -0,0 +1,17 @@
+open_workspace() {
+    local workspace_file=$WORKSPACE/.vscode/gh-runners.code-workspace
+
+    if ! [ -f "$workspace_file" ]; then
+        echo "🔴 Missing workspace file"
+        return 1
+    fi
+
+    echo "🟡 Opening workspace"
+    if code "$workspace_file"; then
+        echo "🟢 Workspace opened"
+        return 0
+    else
+        echo "🔴 Failed to open workspace"
+        return 1
+    fi
+}

.devcontainer/devcontainer.json

@@ -0,0 +1,32 @@
+{
+	"name": "GitHub Runners AWS",
+  "build": { "dockerfile": "Dockerfile" },
+  "features": {
+    "ghcr.io/devcontainers/features/github-cli:1": {},
+    "ghcr.io/devcontainers/features/terraform:1": {}
+  },
+
+  "containerEnv": {
+    "WORKSPACE": "${containerWorkspaceFolder}" // e.g. /workspaces/my-project
+  },
+
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "dbaeumer.vscode-eslint",
+        "editorconfig.editorconfig",
+        "esbenp.prettier-vscode",
+        "firsttris.vscode-jest-runner",
+        "hashicorp.hcl",
+        "hashicorp.terraform",
+        "hashicorp.terraform",
+        "orta.vscode-jest",
+        "yzhang.markdown-all-in-one"
+      ]
+    }
+  },
+  "postCreateCommand": {
+    "bash_command": "bash ${containerWorkspaceFolder}/.devcontainer/postCreateScript.sh",
+    "welcome": "sudo cp -v .devcontainer/welcome.txt /usr/local/etc/vscode-dev-containers/first-run-notice.txt || true && sudo cp -v .devcontainer/welcome.txt /workspaces/.codespaces/shared/first-run-notice.txt || true"
+  }
+}

.devcontainer/postCreateScript.sh

@@ -0,0 +1 @@
+printf "source \$WORKSPACE/.devcontainer/bashrc.sh\n" >> ~/.bashrc

.devcontainer/welcome.txt

@@ -0,0 +1,53 @@
+================================================================================
+================================================================================
+=====================================================++++**+++==================
+=================================================+++++=********+================
+=============================================+***+=--:-#********+===============
+==========================================+***+=--:::::-+*#*****+===============
+=======================================+*#%*=--:::::::::::-=====+===============
+=====================================+#%%##%*-:::::::::::::::::+================
+===========================++======*#%%#######=-::::::::::::::=+================
+=======================++==---::-+#%%###########+-:::::::::::-+=================
+====================+==-::::::-=#%%################+=::::::::+==================
+=================++=-:::::::-=#%%%####%%##**########%#*++=-:++==================
+===============+=-:::-------*%%%###%%%#=:...:-*############*+===================
+=====.   .-====-:--++***+++#%%###%#%%+:      .-*###########+====================
+===-.      --:-++**+=====+%%%###%%#%*-        :*#########*======================
+===      .:==++=========*%%%#####%#%*=.      .=#########*=======================
+===:     :: .==========+%%%%#####%%%%#+=-:::-+#########+========================
+====:        :=========#%%%%#####%#**#####*##########+==========================
+====         .=========%%%%%####*+=*%##############=============================
+====-....    :--------=##%%%%#*==*%##############=::++==========================
+========--::---------=-=#%%%#+=#%#############*=-::-*===========================
+======------------=+*=---*#++*%#############+-:::::++===========================
+=====----------=+*+=+---=++*%%%%#########**+-:::::++============================
+===----------+*+=-+*+-=+=*#+=*%%%%%%%#*+==+#=:::-*+=============================
+==---------+**+-=**+===**=-=--=+***+======#+-::=+===============================
+==----------+=-=**=:=+*=--++---==========**=:-++================================
+=---------=*=-=**=::::--=*+----=-:::-===**=-=+==================================
+=--------=*=-+**+::-=*+=*+-----=.    ..=+==+====================================
+=-------==--***+=+**=*+*=------.      -+=..=====================================
+=------=--=***+**+=-+*+------==.    .=+:  .=====================================
+=--------=*****+---++=-----=====   .=:   :======================================
+==------=***+=----==-----======-        -=======================================
+===----=*+=------=-----=========:      .========================================
+====--==------------==============--============================================
+======--------==================================================================
+================================================================================
+================================================================================
+================================================================================
+================================================================================
+==========================================================================-:-=++
+
+
+Welcome to the AWS GitHub runners:
+
+Load the vscode workspace to get started
+
+Option 1: run `open_workspace`
+Option 2: open the workspace file `.vscoe/gh-runners.code-workspace` and load the workspace
+
+Build the lambda:
+- cd lambdas
+- yarn instal & yarn run dist
+

.editorconfig

@@ -1,2 +1,13 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
 [*]
+indent_style = space
+indent_size = 2
+tab_width = 2
 end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.github/dependabot.yml

@@ -3,6 +3,10 @@
 # Please see the documentation for all configuration options:
 # https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
+# NPM production dependencies are part of the generated Lambda JavaScript.
+# Therefore updates on production are prefixed with fix(component) to trigger releases.
+# Development updates are prefixed with chore, and not triggering a release.
+
 version: 2
 updates:
   - package-ecosystem: "github-actions"
@@ -13,21 +17,27 @@ updates:
       interval: "weekly"
 
   - package-ecosystem: "npm"
-    directory: "/modules/runner-binaries-syncer/lambdas/runner-binaries-syncer"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "npm"
-    directory: "/modules/webhook/lambdas/webhook"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "npm"
-    directory: "/modules/runners/lambdas/runners"
+    directory: "/lambdas"
     schedule:
       interval: "weekly"
+    groups:
+      aws:
+        patterns:
+          - "@aws-sdk/*"
+      octokit:
+        patterns:
+          - "@octokit/*"
+      aws-powertools:
+        patterns:
+          - "@aws-lambda-powertools/*"
 
-  - package-ecosystem: "npm"
-    directory: "/.release"
-    schedule:
-      interval: "weekly"
+    ignore:
+      - dependency-name: "@middy/core"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@octokit/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "eslint"
+        update-types: ["version-update:semver-major"]
+    commit-message:
+      prefix: "fix(lambda)"
+      prefix-development: "chore(lambda)"

.github/lint/tflint.tfvars

@@ -0,0 +1,8 @@
+aws_region = "eu-west-1"
+github_app = {
+  id             = "0"
+  key_base64     = "0"
+  webhook_secret = "0"
+}
+subnet_ids = []
+vpc_id     = null

.github/matchers.json

@@ -0,0 +1,18 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "tflint-compact",
+      "pattern": [
+        {
+          "regexp": "^(.+):(\\d+):(\\d+):\\s(Error|Warning|Notice)\\s-\\s(.+)\\s\\((.+)\\)$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "severity": 4,
+          "message": 5,
+          "code": 6
+        }
+      ]
+    }
+  ]
+}

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main", "develop", "v1" ]
+  pull_request:
+    branches: [ "main", "develop", "v1" ]
+    paths-ignore:
+      - '**/*.md'
+  schedule:
+    - cron: '25 19 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: javascript-typescript
+          build-mode: none
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
+      with:
+        category: "/language:${{matrix.language}}"