Skip to content

Commit fa69895

Browse files
marcoaciernomarcoacierno
committed
change
1 parent 6f167f5 commit fa69895

File tree

6 files changed

+162
-13
lines changed

6 files changed

+162
-13
lines changed

‎.github/workflows/build-backend.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88
jobs:
99
build:
1010
name: Build
11-
runs-on: [self-hosted, arm64-fargate]
11+
runs-on: ${{ format('arm64-fargate-{0}{1}{2}', github.run_id, github.run_number, github.run_attempt) }}
1212
steps:
1313
- uses: actions/checkout@v4
1414
with:

‎infrastructure/tools/github_runner_cluster.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
resource "aws_ecs_cluster" "github_runners" {
2+
name = "github-actions-runners"
3+
}
4+
5+
resource "aws_ecs_cluster_capacity_providers" "github_runners" {
6+
cluster_name = aws_ecs_cluster.github_runners.name
7+
8+
capacity_providers = ["FARGATE_SPOT"]
9+
10+
default_capacity_provider_strategy {
11+
base = 1
12+
weight = 100
13+
capacity_provider = "FARGATE_SPOT"
14+
}
15+
}

‎infrastructure/tools/github_runner_lambda.tf‎

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
data "aws_iam_policy_document" "github_runner_assume_role" {
1+
data "aws_iam_policy_document" "github_runner_webhook_assume_role" {
22
statement {
33
effect = "Allow"
44

@@ -11,14 +11,18 @@ data "aws_iam_policy_document" "github_runner_assume_role" {
1111
}
1212
}
1313

14-
resource "aws_iam_role" "github_runner_iam" {
15-
name = "github_runner_iam"
16-
assume_role_policy = data.aws_iam_policy_document.github_runner_assume_role.json
14+
resource "aws_iam_role" "github_runner_webhook_role" {
15+
name = "github_runner_webhook_role"
16+
assume_role_policy = data.aws_iam_policy_document.github_runner_webhook_assume_role.json
1717
}
1818

19-
resource "aws_iam_role_policy" "github_runner_lambda_policy" {
20-
name = "github_runner_lambda_policy"
21-
role = aws_iam_role.github_runner_iam.id
19+
data "aws_ssm_parameter" "github_token" {
20+
name = "/github-runner/github-token"
21+
}
22+
23+
resource "aws_iam_role_policy" "github_runner_webhook_lambda_policy" {
24+
name = "github_runner_webhook_lambda_policy"
25+
role = aws_iam_role.github_runner_webhook_role.id
2226

2327
policy = jsonencode({
2428
Version = "2012-10-17"
@@ -31,6 +35,15 @@ resource "aws_iam_role_policy" "github_runner_lambda_policy" {
3135
"logs:PutLogEvents"
3236
]
3337
Resource = "*"
38+
},
39+
{
40+
Effect = "Allow"
41+
Action = [
42+
"ssm:GetParameter"
43+
]
44+
Resource = [
45+
data.aws_ssm_parameter.github_token.arn
46+
]
3447
}
3548
]
3649
})
@@ -44,14 +57,16 @@ data "archive_file" "github_runner_webhook_artifact" {
4457

4558
resource "aws_lambda_function" "github_runner_webhook" {
4659
function_name = "github_runner_webhook"
47-
role = aws_iam_role.github_runner_iam.arn
60+
role = aws_iam_role.github_runner_webhook_role.arn
4861
handler = "github_runner_webhook.handler"
4962
runtime = "python3.13"
5063
filename = data.archive_file.github_runner_webhook_artifact.output_path
5164
source_code_hash = data.archive_file.github_runner_webhook_artifact.output_base64sha256
65+
timeout = 60
5266
environment {
5367
variables = {
5468
WEBHOOK_SECRET = random_password.webhook_secret.result
69+
GITHUB_TOKEN_SSM_NAME = data.aws_ssm_parameter.github_token.name
5570
}
5671
}
5772
}

‎infrastructure/tools/github_runner_task.tf‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
data "aws_iam_policy_document" "github_runner_execution_assume_role" {
2+
statement {
3+
effect = "Allow"
4+
5+
principals {
6+
type = "Service"
7+
identifiers = ["ecs.amazonaws.com", "ecs-tasks.amazonaws.com"]
8+
}
9+
10+
actions = ["sts:AssumeRole"]
11+
}
12+
}
13+
14+
resource "aws_iam_role" "github_runner_execution_role" {
15+
name = "github_runner_execution_role"
16+
assume_role_policy = data.aws_iam_policy_document.github_runner_execution_assume_role.json
17+
}
18+
19+
resource "aws_iam_role_policy" "github_runner_execution_role_policy" {
20+
name = "github_runner_execution_role_policy"
21+
role = aws_iam_role.github_runner_execution_role.id
22+
23+
policy = jsonencode({
24+
Version = "2012-10-17"
25+
Statement = [
26+
{
27+
Effect = "Allow"
28+
Action = [
29+
"logs:CreateLogStream",
30+
"logs:PutLogEvents"
31+
]
32+
Resource = [
33+
aws_cloudwatch_log_group.github_runner.arn,
34+
"${aws_cloudwatch_log_group.github_runner.arn}*"
35+
]
36+
},
37+
{
38+
Effect = "Allow"
39+
Action = [
40+
"ecr:GetAuthorizationToken",
41+
"ecr:BatchCheckLayerAvailability",
42+
"ecr:GetDownloadUrlForLayer",
43+
"ecr:BatchGetImage",
44+
]
45+
Resource = "*"
46+
}
47+
]
48+
})
49+
}
50+
51+
52+
resource "aws_cloudwatch_log_group" "github_runner" {
53+
name = "/github-runner/"
54+
retention_in_days = 1
55+
}
56+
57+
resource "aws_ecs_task_definition" "github_runner" {
58+
family = "github-runner"
59+
requires_compatibilities = ["FARGATE"]
60+
network_mode = "awsvpc"
61+
cpu = 1024
62+
memory = 2048
63+
execution_role_arn = aws_iam_role.github_runner_execution_role.arn
64+
65+
container_definitions = jsonencode([
66+
{
67+
name = "runner"
68+
image = "ghcr.io/actions/actions-runner:2.321.0"
69+
essential = true
70+
portMappings = []
71+
logConfiguration = {
72+
logDriver = "awslogs"
73+
options = {
74+
"awslogs-group" = aws_cloudwatch_log_group.github_runner.name
75+
"awslogs-region" = "eu-central-1"
76+
"awslogs-stream-prefix" = "runner"
77+
}
78+
}
79+
},
80+
])
81+
82+
runtime_platform {
83+
operating_system_family = "LINUX"
84+
cpu_architecture = "ARM64"
85+
}
86+
}

‎infrastructure/tools/lambdas/github_runner_webhook.py‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
1+
import boto3
12
import json
23
import os
34
import hashlib
45
import hmac
6+
from urllib import request
57

68
WEBHOOK_SECRET = os.environ["WEBHOOK_SECRET"]
9+
GITHUB_TOKEN_SSM_NAME = os.environ["GITHUB_TOKEN_SSM_NAME"]
710

811

912
def handler(event, context):
@@ -42,7 +45,40 @@ def handle_workflow_job(body, context):
4245
if labels != ["self-hosted", "arm64-fargate"]:
4346
return
4447

45-
print("Handling workflow job - start?")
48+
ssm_client = boto3.client("ssm")
49+
github_token = ssm_client.get_parameter(Name=GITHUB_TOKEN_SSM_NAME)["Parameter"][
50+
"Value"
51+
]
52+
53+
payload = {
54+
"name": "Test from Lambda",
55+
"runner_group_id": 3,
56+
"labels": [
57+
"lambda-test"
58+
# 'self-hosted',
59+
# 'arm64-fargate',
60+
],
61+
}
62+
payload_encoded = json.dumps(payload).encode("utf-8")
63+
print("sending payload:", payload_encoded)
64+
req = request.Request(
65+
"https://api.github.com/orgs/pythonitalia/actions/runners/generate-jitconfig",
66+
data=payload_encoded,
67+
method="POST",
68+
headers={
69+
"Authorization": f"Bearer {github_token}",
70+
"Accept": "application/vnd.github.v3+json",
71+
"X-GitHub-Api-Version": "2022-11-28",
72+
},
73+
)
74+
75+
with request.urlopen(req) as response:
76+
response_data = response.read().decode("utf-8")
77+
print(response_data)
78+
79+
jit_config = json.loads(response_data)["encoded_jit_config"]
80+
81+
print("Handling workflow job - start?", jit_config)
4682
print("Body:", body)
4783
print("Context:", context)
4884

‎infrastructure/tools/runners-cluster.tf‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

0 commit comments

Comments
 (0)