feat: Initial release

.editorconfig

@@ -0,0 +1,7 @@
+root = true
+
+[*]
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: ci
+      include: "scope"
+  - package-ecosystem: terraform
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: fix
+      prefix-development: build
+      include: "scope"

.github/mergify.yml

@@ -0,0 +1,16 @@
+pull_request_rules:
+  - name: "Automatic merge when CI passes"
+    conditions:
+      - author=dependabot[bot]
+      - check-success=check-conventional-commits / check-conventional-commits
+    actions:
+      queue:
+        method: merge
+
+queue_rules:
+  - name: dep-update
+    batch_size: 10
+    batch_max_wait_time: 30 min
+    queue_conditions:
+      - author=dependabot[bot]
+      - check-success=check-conventional-commits / check-conventional-commits

.github/workflows/pipeline.yml

@@ -0,0 +1,29 @@
+on:
+  push:
+    branches: ["*"]
+  pull_request:
+
+jobs:
+  check-conventional-commits:
+    uses: armakuni/github-actions/.github/workflows/[email protected]
+
+  lint-pipeline:
+    uses: armakuni/github-actions/.github/workflows/[email protected]
+
+  generate-terraform-docs:
+    if: github.ref == 'refs/heads/main'
+    uses: armakuni/github-actions/.github/workflows/[email protected]
+    with:
+      output-file: README.md
+      # This artifact is referenced by the cog.toml
+      artifact-name: terraform-docs
+
+  create-release:
+    needs:
+    - check-conventional-commits
+    - lint-pipeline
+    if: github.ref == 'refs/heads/main'
+    uses: armakuni/github-actions/.github/workflows/[email protected]
+    secrets: inherit
+    with:
+      download-artifacts: true

.gitignore

@@ -0,0 +1,44 @@
+### Terraform template
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+### Terragrunt template
+# terragrunt cache directories
+**/.terragrunt-cache/*
+
+# Terragrunt debug output file (when using `--terragrunt-debug` option)
+# See: https://terragrunt.gruntwork.io/docs/reference/cli-options/#terragrunt-debug
+terragrunt-debug.tfvars.json
+

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Armakuni
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,57 @@
+# AWS Github Actions Self Hosted Runner
+
+This module allows you to provision a self hosted runner which scales to 0 when not in use.
+
+It is designed to be a "It just works" wrapper around that fantastic  Philips Labs [terraform-aws-github-runner](https://github.com/philips-labs/terraform-aws-github-runner) module.
+
+To get started, you need to create an organisation level GitHub App. This is a one time process and you can follow the [GitHub documentation](https://docs.github.com/en/developers/apps/creating-a-github-app) to do this.
+
+The app should be installed into your organisation and you should have the following permissions in it:
+
+- **Repository permissions**
+  - Administration: Read & write
+  - Checks: Read
+  - Metadata: Read-only
+  - Actions: Read-only
+- **Organization permissions**
+  - Self-hosted runners: Read & write
+  - Webhooks: Read & write
+
+You will need the:
+* App ID
+* App Install ID (you can find this in the URL when viewing the app in the GitHub UI)
+* App Private Key (you can download this from the GitHub, keep it in PEM format)
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_iam_openid_connect_provider.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_github_thumbprint"></a> [github\_thumbprint](#input\_github\_thumbprint) | GitHub OpenID TLS certificate thumbprint (the default is the current value) | `string` | `"6938fd4d98bab03faadb97b34396831e3780aea1"` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_arn"></a> [arn](#output\_arn) | n/a |
+<!-- END_TF_DOCS -->

cog.toml

@@ -0,0 +1,27 @@
+tag_prefix = "v"
+from_latest_tag = false
+ignore_merge_commits = true
+branch_whitelist = ["main"]
+pre_bump_hooks = [
+  # In the pipeline, this will be created by a preceding job
+  "mv ../terraform-docs/README.md README.md"
+]
+post_bump_hooks = [
+    "git push",
+    "git push origin v{{version}}",
+]
+pre_package_bump_hooks = []
+post_package_bump_hooks = []
+
+[git_hooks]
+
+[commit_types]
+
+[changelog]
+path = "CHANGELOG.md"
+template = "remote"
+remote = "github.com"
+repository = "terraform-aws-github-actions-oidc-provider"
+owner = "armakuni"
+
+authors = []

data.tf

@@ -0,0 +1,12 @@
+
+data "aws_availability_zones" "available" {
+  filter {
+    name   = "state"
+    values = ["available"]
+  }
+  filter {
+    name   = "region-name"
+    values = [var.aws_region]
+  }
+
+}

locals.tf

@@ -0,0 +1,10 @@
+locals {
+  aws_lambda_s3_bucket_name = "${var.aws_resource_prefix}-lambda-sources"
+  aws_lambda_s3_syncer_key  = "runner-binaries-syncer.zip"
+  aws_lambda_s3_runners_key = "runners.zip"
+  aws_lambda_s3_webhook_key = "webhook.zip"
+
+  az_count       = var.aws_vpc_cidr.azs_count
+  azs            = slice(data.aws_availability_zones.available.names, 0, local.az_count)
+  gh_key_pem_b64 = base64encode(var.github_app_key)
+}

main.tf

@@ -0,0 +1,68 @@
+resource "random_id" "webhook_secret" {
+  byte_length = 20
+}
+
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "5.1.2"
+
+  name = "${var.aws_resource_prefix}-vpc"
+  cidr = var.aws_vpc_cidr.cidr
+
+  azs             = local.azs
+  private_subnets = [for k, v in local.azs : cidrsubnet(var.aws_vpc_cidr.cidr, var.aws_vpc_cidr.newbits, k)]
+  public_subnets = [
+    for k, v in local.azs : cidrsubnet(var.aws_vpc_cidr.cidr, var.aws_vpc_cidr.newbits, var.aws_vpc_cidr.azs_count + k)
+  ]
+
+  enable_dns_hostnames    = true
+  enable_nat_gateway      = true
+  map_public_ip_on_launch = false
+  single_nat_gateway      = true
+}
+
+
+module "github_runner" {
+  depends_on = [module.runners_zip, module.webhook_zip, module.syncer_zip]
+  source     = "philips-labs/github-runner/aws"
+  version    = "4.4.1"
+
+  aws_region                      = var.aws_region
+  vpc_id                          = module.vpc.vpc_id
+  subnet_ids                      = module.vpc.private_subnets
+  create_service_linked_role_spot = true
+
+  prefix = var.aws_resource_prefix
+
+  github_app = {
+    id             = var.github_app_id
+    key_base64     = local.gh_key_pem_b64
+    webhook_secret = random_id.webhook_secret.hex
+  }
+
+  enable_organization_runners = true
+
+  lambda_s3_bucket      = local.aws_lambda_s3_bucket_name
+  webhook_lambda_s3_key = local.aws_lambda_s3_webhook_key
+  runners_lambda_s3_key = local.aws_lambda_s3_runners_key
+  syncer_lambda_s3_key  = local.aws_lambda_s3_syncer_key
+
+  userdata_template = var.userdata_template
+  ami_owners        = [var.ami_owner_filter] # Canonical's Amazon account ID
+
+  ami_filter = {
+    name  = [var.ami_name_filter],
+    state = ["available"]
+  }
+}
+
+resource "github_organization_webhook" "webhook" {
+  events = [
+    "workflow_job",
+  ]
+  configuration {
+    url          = module.github_runner.webhook["endpoint"]
+    content_type = "json"
+    secret       = random_id.webhook_secret.hex
+  }
+}

providers.tf

@@ -0,0 +1,34 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.18.1"
+    }
+
+    github = {
+      source  = "integrations/github"
+      version = "~> 5.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.5.1"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.4.0"
+    }
+    http = {
+      source  = "hashicorp/http"
+      version = "~> 3.4.0 "
+    }
+  }
+}
+
+provider "github" {
+  owner = var.github_organisation
+  app_auth {
+    id              = var.github_app_id
+    installation_id = var.github_app_install_id
+    pem_file        = var.github_app_key
+  }
+}