Skip to content

refactor(compute-providers): rename runner providers - #5267

Merged
edersonbrilhante merged 4 commits into
mainfrom
refactor-compute-providers
Aug 14, 2026
Merged

refactor(compute-providers): rename runner providers#5267
edersonbrilhante merged 4 commits into
mainfrom
refactor-compute-providers

Conversation

@edersonbrilhante

@edersonbrilhante edersonbrilhante commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Description

  • Rename the Lambda provider workspace, imports, exported types, registries, templates, and contract-test helpers from runner-provider terminology to compute-provider terminology.
  • Rename runnerProvider to computeProvider and RUNNER_PROVIDER_TYPE to COMPUTE_PROVIDER_TYPE.
  • Update Terraform wiring, tests, the lockfile, and generated module documentation.
  • Preserve migration behavior: webhook configurations without computeProvider and control-plane deployments without COMPUTE_PROVIDER_TYPE default to EC2.
  • Keep runtime behavior otherwise unchanged; EC2 remains the only supported compute provider.

This intentionally changes the internal workspace package/import API and the direct modules/webhook matcher object shape. Custom consumers of the old package path, matcher field, or environment variable must migrate.

Test Plan

  • Ran yarn install --frozen-lockfile.
  • Ran formatting and lint checks for compute-providers, webhook, and control-plane.
  • Ran the affected workspace test suites: 685 tests passed.
  • Ran the focused scale-up suite after adding the EC2 migration fallback regression: 109 tests passed.
  • Built the webhook and control-plane Lambda bundles.
  • Ran terraform validate for the webhook and runners modules.
  • Ran the runners Terraform test: 1 passed, 0 failed.
  • Confirmed the changed Terraform files pass formatting and tflint.
  • Confirmed modules/webhook/README.md is current with terraform-docs v0.20.0.
  • Confirmed no stale runner-provider references remain.
  • Confirmed git diff --check.

Related Issues

N/A

@edersonbrilhante
edersonbrilhante requested a review from a team as a code owner August 12, 2026 21:52
@github-actions

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 5 package(s) with unknown licenses.
See the Details below.

License Issues

lambdas/functions/control-plane/package.json

PackageVersionLicenseIssue Type
@aws-github-runner/compute-providersNullUnknown License

lambdas/functions/webhook/package.json

PackageVersionLicenseIssue Type
@aws-github-runner/compute-providersNullUnknown License

lambdas/libs/compute-providers/package.json

PackageVersionLicenseIssue Type
@aws-github-runner/aws-powertools-utilNullUnknown License
@aws-github-runner/aws-ssm-utilNullUnknown License
@aws-sdk/client-ec2^3.1009.0NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@aws-github-runner/compute-providers UnknownUnknown
npm/@aws-github-runner/compute-providers UnknownUnknown
npm/@aws-github-runner/aws-powertools-util UnknownUnknown
npm/@aws-github-runner/aws-ssm-util UnknownUnknown
npm/@aws-sdk/client-ec2 ^3.1009.0 UnknownUnknown
npm/@octokit/rest 22.0.1 🟢 7.2
Details
CheckScoreReason
Security-Policy🟢 9security policy file detected
Code-Review⚠️ -1Found no human activity in the last 30 changesets
Maintained🟢 1020 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
npm/aws-sdk-client-mock ^4.1.0 UnknownUnknown
npm/aws-sdk-client-mock-jest ^4.1.0 UnknownUnknown
npm/moment 2.29.4 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 3Found 9/30 approved changesets -- score normalized to 3
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1013 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/nock ^14.0.10 UnknownUnknown
npm/yn 3.1.1 🟢 3.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 4Found 12/30 approved changesets -- score normalized to 4
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • lambdas/functions/control-plane/package.json
  • lambdas/functions/webhook/package.json
  • lambdas/libs/compute-providers/package.json
  • lambdas/libs/runner-providers/package.json

@edersonbrilhante
edersonbrilhante enabled auto-merge (squash) August 12, 2026 22:13
@edersonbrilhante edersonbrilhante changed the title refactor(compute-providers): rename runner providers refactor(compute-providers): rename runner providerse Aug 13, 2026
@edersonbrilhante

Copy link
Copy Markdown
Contributor Author

@Brend-Smits @stuartp44 when the time permits. Check this PR. It normalized the naming for compute providers.

@edersonbrilhante edersonbrilhante changed the title refactor(compute-providers): rename runner providerse refactor(compute-providers): rename runner providers Aug 13, 2026

@guicaulada guicaulada left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a pure rename. Grep finds zero stale references. The default handles migration correctly and falls back to ec2.

This intentionally changes the internal workspace package/import API and the direct modules/webhook matcher object shape. Custom consumers of the old package path, matcher field, or environment variable must migrate.

Would this be a breaking change?

Should we rename it to refactor()!: or add a BREAKING CHANGE footer, or update docs/configuration.md to document this change?

Otherwise LGTM!

@edersonbrilhante
edersonbrilhante merged commit 02fb5a3 into main Aug 14, 2026
48 of 49 checks passed
@edersonbrilhante
edersonbrilhante deleted the refactor-compute-providers branch August 14, 2026 10:46
guicaulada added a commit that referenced this pull request Aug 14, 2026
## Description

Supersedes #5038 by @thomasnemer, whose branch lives in an org-owned
fork that maintainers cannot push to. This PR rebases that work onto
current `main` (porting it to the compute-provider architecture
introduced in #5234/#5267) and addresses the review feedback on #5038.
All of Thomas's work is preserved with co-authorship.

From the original PR:

- New `additional_github_apps` variable (optional, no breaking changes)
accepts extra GitHub Apps with `id`, `key_base64`, and optionally
`installation_id` (direct values or SSM references).
- The control-plane lambdas (scale-up, scale-down, pool, job-retry)
select one app per invocation and thread the selection through the JWT →
installation token → API call chain, spreading load across N × 15,000
req/hour rate-limit buckets.
- Installation ID resolution: pre-configured `installation_id` wins, the
primary app reuses the webhook payload's id, API lookup is the fallback.

Changes on top of #5038:

- **Ported to the compute-provider layout**: the `appIndex` selection
lives in the orchestrators (`scale-up.ts`, `pool.ts`, `scale-down.ts`)
and flows to providers via `CreateGitHubRunnerConfig.appIndex`, so
provider interfaces are unchanged.
- **Restored the 404 stale-installation fallback** ([review
feedback](#5038 (review))):
when installation auth fails with 404 (app uninstalled/reinstalled while
messages were in flight), the flow re-resolves the installation via the
API and retries once with the same app. This now also covers stale
pre-configured installation ids, and has regression tests in
`octokit.test.ts`.
- Updated env wiring for the `COMPUTE_PROVIDER_TYPE` era and regenerated
module docs.

## Test Plan

- `vitest`: control-plane 348 passed, compute-providers 270 passed,
webhook 89 passed.
- New regression tests: stale-payload 404 retry, same-id rethrow,
non-404 rethrow.
- ESLint and Prettier clean on all touched packages.
- `terraform fmt -check -recursive`, `terraform validate` (root,
runners, multi-runner, ssm), `terraform test` in `modules/runners` (1
passed).
- READMEs regenerated with terraform-docs.

## Related Issues

Closes #5037. Supersedes #5038.

Co-authored with @thomasnemer.

---------

Co-authored-by: Thomas Nemer <thomas.nemer@doctolib.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants