feat(scale-set): add scale set orchestration in Terraform by edersonbrilhante · Pull Request #5299 · github-aws-runners/terraform-aws-github-runner

edersonbrilhante · 2026-08-26T10:44:25Z

Description

Adds Terraform support for experimental GitHub Actions runner scale-set orchestration in the multi-runner v2 interface.

This PR includes:

A standalone modules/orchestration-providers/scale-set module that deploys one ECS Fargate controller service per resolved controller group, including the ECS cluster/service/task definition, private networking, security groups, CloudWatch logging, health checks, deployment rollback, and hardened task settings.
Plan-known grouping by compute-provider type (the default), runner configuration, or explicit custom membership. Grouping keeps each GitHub scale set and message session independent while packing multiple reconcilers into one controller task.
Versioned non-secret reconciler configuration delivery through SSM Parameter Store and the controller manifest. GitHub App credentials remain SSM parameter references, with task and compute-role permissions restricted to the configured resources.
Validation for GitHub scope and scale-set name ownership, grouping coverage, plan-time for_each inputs, provider contracts, configuration and task-definition size limits, reserved environment variables, wildcard IAM actions, and AWS inline-policy quotas.
A compute-provider capability boundary that carries provider-owned runtime configuration, environment variables, and IAM statements. The EC2 adapter supplies scale-set launch, tagging, termination, JIT-configuration storage, AMI, and related permissions with ownership conditions.
Multi-runner and runner-config wiring, the examples/multi-runner-scale-set example, MiniStack fixtures, and CI updates for the new Terraform path.

The module adopts scale sets that exist in GitHub by name; it does not create or delete GitHub scale-set resources. The TypeScript controller that consumes this Terraform contract is implemented in #5300.

Test Plan

Added focused Terraform tests for the scale-set module, computed-input fixtures, grouping, ownership validation, configuration delivery, IAM policy construction, and quota checks.
Added the multi-runner scale-set example and MiniStack variables/runner coverage.
Terraform formatting, validation/TFLint, and the repository CI workflows cover the updated modules and example paths.

Related Issues

Builds on the multi-runner v2 interface from feat(examples): add multi-runner-v2 example #5367.
Provides the Terraform foundation consumed by feat(scale-set): add service controller #5300.

github-actions · 2026-08-26T10:44:44Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 3 package(s) with unknown licenses.
⚠️ 1 packages with OpenSSF Scorecard issues.

See the Details below.

License Issues

lambdas/services/scale-set/package.json

Package	Version	License	Issue Type
@aws-github-runner/aws-ssm-util		Null	Unknown License
@aws-github-runner/compute-providers		Null	Unknown License
@aws-github-runner/github-actions-scale-set		Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

actions/actions/attest

1e69f48acb82d1966a394da916b4c1698aa569d6

Unknown

actions/docker/build-push-action

53b7df96c91f9c12dcc8a07bcb9ccacbed38856a

🟢 7.5

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 9	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
SAST	🟢 9	SAST tool detected but not run on all commits

actions/docker/login-action

dbcb813823bdd20940b903addbd779551569679f

🟢 8.5

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 9	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Packaging	🟢 10	packaging workflow detected
SAST	🟢 9	SAST tool detected but not run on all commits

actions/docker/setup-buildx-action

37fe631027851001ddb9b187196cc803df7f5f0e

🟢 8.6

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 9	security policy file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits

actions/docker/setup-qemu-action

96fe6ef7f33517b61c61be40b68a1882f3264fb8

🟢 8.4

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 9	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
SAST	🟢 10	SAST tool is run on all commits

npm/@aws-sdk/client-ssm

^3.1009.0

Unknown

npm/@types/node

^22.19.3

Unknown

npm/typescript

^5.9.3

Unknown

npm/@aws-sdk/core

3.977.9

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-cognito-identity

3.972.69

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-env

3.972.70

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-http

3.972.72

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-ini

3.973.15

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-login

3.972.77

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-node

3.972.82

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-process

3.972.70

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-sso

3.973.14

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-provider-web-identity

3.972.76

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/credential-providers

3.1127.0

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/nested-clients

3.997.44

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/signature-v4-multi-region

3.996.46

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/token-providers

3.1116.0

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/types

3.974.5

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws-sdk/xml-builder

3.972.40

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 0	Found 2/30 approved changesets -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 5	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Security-Policy	🟢 10	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Fuzzing	🟢 10	project is fuzzed

npm/@aws/lambda-invoke-store

0.3.0

Unknown

npm/@oxc-project/types

0.148.0

Unknown

npm/@rolldown/binding-android-arm-eabi

1.2.7

Unknown

npm/@rolldown/binding-android-arm64

1.2.7

Unknown

npm/@rolldown/binding-darwin-arm64

1.2.7

Unknown

npm/@rolldown/binding-darwin-x64

1.2.7

Unknown

npm/@rolldown/binding-freebsd-x64

1.2.7

Unknown

npm/@rolldown/binding-linux-arm-gnueabihf

1.2.7

Unknown

npm/@rolldown/binding-linux-arm64-gnu

1.2.7

Unknown

npm/@rolldown/binding-linux-arm64-musl

1.2.7

Unknown

npm/@rolldown/binding-linux-ppc64-gnu

1.2.7

Unknown

npm/@rolldown/binding-linux-s390x-gnu

1.2.7

Unknown

npm/@rolldown/binding-linux-x64-gnu

1.2.7

Unknown

npm/@rolldown/binding-linux-x64-musl

1.2.7

Unknown

npm/@rolldown/binding-openharmony-arm64

1.2.7

Unknown

npm/@rolldown/binding-win32-arm64-msvc

1.2.7

Unknown

npm/@rolldown/binding-win32-x64-msvc

1.2.7

Unknown

npm/@smithy/core

3.33.3

Unknown

npm/@smithy/credential-provider-imds

4.5.2

Unknown

npm/@smithy/fetch-http-handler

5.8.0

Unknown

npm/@smithy/node-http-handler

4.12.1

Unknown

npm/@smithy/signature-v4

5.7.3

Unknown

npm/@smithy/types

4.18.0

Unknown

npm/@vitest/coverage-v8

4.1.11

Unknown

npm/ast-v8-to-istanbul

1.0.6

Unknown

npm/js-tokens

10.0.0

⚠️ 2.9

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 2/23 approved changesets -- score normalized to 0
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 2	dependency not pinned by hash detected -- score normalized to 2
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/magicast

0.5.4

Unknown

npm/rolldown

1.2.7

Unknown

npm/undici

6.28.0

🟢 8.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 8	binaries present in source code
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Vulnerabilities	🟢 6	4 existing vulnerabilities detected
SAST	🟢 10	SAST tool is run on all commits
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 64 contributing companies or organizations

npm/vite

8.2.2

🟢 6.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 8	Found 20/23 approved changesets -- score normalized to 8
Token-Permissions	🟢 7	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	⚠️ 1	binaries present in source code
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	🟢 10	SAST tool is run on all commits

npm/@aws-github-runner/aws-ssm-util

Unknown

npm/@aws-github-runner/compute-providers

Unknown

npm/@aws-github-runner/github-actions-scale-set

Unknown

npm/@aws-sdk/client-ssm

^3.1009.0

Unknown

npm/@aws-sdk/credential-providers

^3.1009.0

Unknown

npm/@octokit/auth-app

8.2.0

🟢 6.8

Details

Check	Score	Reason
Maintained	🟢 5	6 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	🟢 9	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits

npm/@octokit/request

^9.2.2

Unknown

npm/@types/node

^22.19.3

Unknown

npm/@vercel/ncc

0.38.4

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 5	5 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 5
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

npm/typescript

^5.9.3

Unknown

npm/undici

^6.19.2

Unknown

Scanned Files

.github/workflows/release.yml
lambdas/libs/compute-providers/package.json
lambdas/libs/github-actions-scale-set/package.json
lambdas/services/scale-set/package.json
lambdas/yarn.lock

## Description Wire scale-set orchestration through the provider-aware Terraform composition. - Resolve global and per-lane scale-set settings into the canonical runner configuration. - Route scale-set lanes through `runner-config` and the scale-set orchestration provider. - Extend the EC2 provider contract with the scale-set runtime configuration, IAM fragments, and outputs consumed by the controller. - Gate webhook resources by the selected orchestration provider. - Add scale-set validation and Terraform coverage across the affected modules. This PR provides the Terraform wiring used by the scale-set example and the later MiniStack integration PRs. ## Test Plan - Terraform formatting, validation/TFLint, and merge-conflict checks passed through the repository hooks. - Scale-set routing and configuration-resolution tests passed. - Multi-runner and runner-config scale-set Terraform tests passed. - Native provider tests remain subject to the local macOS arm64 plugin-handshake limitation. ## Related Issues Depends on #5299. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Description Restore the multi-runner scale-set orchestration example removed by revert PR #5403, replacing merged PR #5378. The example provides the Terraform configuration, provider locks, outputs, and documentation needed to deploy an ECS scale-set controller with the EC2 runner compute provider. It is intentionally limited to the example and its generated/provider metadata; the reusable MiniStack fixture support and ECS/MockServer lifecycle smoke test are provided by the follow-up PRs. ## Test Plan - Terraform formatting passed through the repository hooks. - Merge-conflict checks passed. - Parent-branch Terraform checks passed after the idle-configuration correction. - No live AWS deployment was performed for this example-only PR; CI validation remains the authoritative deployment check. ## Related Issues Depends on #5350. Replaces #5378. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Description Adds the TypeScript implementation of the GitHub Actions runner scale-set control plane on top of the Terraform orchestration introduced by #5299. This PR includes: - A reusable GitHub Actions scale-set client that supports GitHub.com, GHES, and data-residency endpoints; GitHub App access tokens; runner-group and scale-set discovery/registration; JIT runner configuration; runner removal; and message-session polling, acknowledgement, job acquisition, refresh, and close. - A long-running scale-set controller service for ECS. It loads versioned runner configuration from SSM Parameter Store, runs independent reconcilers for each runner configuration, exposes liveness/readiness endpoints, and performs bounded shutdown and session recovery. - A scale-set compute-provider contract and EC2 implementation. The provider reconciles capacity from `totalAssignedJobs`, generates JIT configurations for launches, tracks provider-owned instances with tags, preserves busy or unknown runners during scale-down, and supports task-role or assumed-role credentials. - Configuration, authentication, transport, retry, cancellation, ownership, lifecycle, health, and reconciliation safeguards. Sensitive tokens, message bodies, and JIT configurations are excluded from manifests and logs; disabling TLS verification is scoped to the relevant client instead of changing global Node.js state. - Unit-test coverage for the scale-set client and HTTP/session behavior, service configuration and credentials, controller lifecycle and health, and EC2 provider configuration, inventory, reconciliation, scale-up, and scale-down. The Terraform documentation and workflow changes are tracked separately in #5347. ## Test Plan - Added focused TypeScript tests alongside the client, service, controller, and compute-provider implementations. - The scale-set service package provides `typecheck`, `build`, `format-check`, `lint`, and `test` targets for CI validation. - End-to-end ECS deployment is not part of this PR; the service consumes the scale-set configuration and IAM contracts supplied by the Terraform stack. ## Related Issues - Stacked on #5299. - Builds on the EC2 orchestration boundary from #5312. - Follow-up documentation and workflow changes: #5347. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Guilherme Caulada <guilherme.caulada@gmail.com>

edersonbrilhante · 2026-09-22T21:53:11Z

@npalm when the time permits, please review this PR.
It was multi-PRs merged into 1 final PR.
Also I added integration tests to give more confidence that is working.

npalm · 2026-09-23T10:44:58Z

@edersonbrilhante will check the PR tonight, can you already update the conflict (readme)

edersonbrilhante requested review from a team as code owners August 26, 2026 10:44

edersonbrilhante marked this pull request as draft August 26, 2026 13:59

edersonbrilhante force-pushed the experimental-multi-runner-config-v2-20260805 branch 2 times, most recently from 5eafe5c to 2b6bb21 Compare September 2, 2026 20:18

edersonbrilhante changed the base branch from experimental-multi-runner-config-v2-20260805 to refactor-runner-config-module September 3, 2026 19:59

edersonbrilhante force-pushed the refactor-runner-config-module branch 2 times, most recently from c979cbb to 4d9e31c Compare September 3, 2026 20:03

edersonbrilhante force-pushed the feat-scale-set-terraform branch from b95c8c0 to 28c31de Compare September 3, 2026 20:05

edersonbrilhante changed the base branch from refactor-runner-config-module to experimental-multi-runner-config-v2-20260805 September 3, 2026 20:05

edersonbrilhante changed the base branch from experimental-multi-runner-config-v2-20260805 to fix-multi-runner-v2-routing September 3, 2026 20:21

edersonbrilhante changed the title ~~feat(scale-set): add ECS orchestration~~ feat(scale-set): add scale set orchestration in Terraform Sep 3, 2026

edersonbrilhante force-pushed the feat-scale-set-terraform branch 2 times, most recently from 5ab14e1 to 4375247 Compare September 3, 2026 21:13

edersonbrilhante force-pushed the fix-multi-runner-v2-routing branch from 00c76ce to 01c4a78 Compare September 3, 2026 21:19

edersonbrilhante force-pushed the feat-scale-set-terraform branch from 4375247 to de5869c Compare September 3, 2026 21:24

edersonbrilhante force-pushed the fix-multi-runner-v2-routing branch from 01c4a78 to 5b2fbf4 Compare September 3, 2026 21:40

edersonbrilhante force-pushed the feat-scale-set-terraform branch from de5869c to 8ac821d Compare September 3, 2026 21:42

edersonbrilhante mentioned this pull request Sep 3, 2026

feat(scale-set): wire orchestration through runner config #5350

Merged

edersonbrilhante force-pushed the fix-multi-runner-v2-routing branch from 5b2fbf4 to afc760b Compare September 3, 2026 21:52

edersonbrilhante force-pushed the feat-scale-set-terraform branch from 8ac821d to a3773f7 Compare September 3, 2026 21:53

edersonbrilhante changed the base branch from fix-multi-runner-v2-routing to microvm-multi-runner-terraform September 3, 2026 22:03

edersonbrilhante changed the base branch from microvm-multi-runner-terraform to microvm-multi-runner-integration-split September 3, 2026 22:04

edersonbrilhante changed the base branch from microvm-multi-runner-integration-split to fix-multi-runner-v2-routing September 3, 2026 22:04

edersonbrilhante force-pushed the fix-multi-runner-v2-routing branch from afc760b to e17ae16 Compare September 4, 2026 17:59

edersonbrilhante changed the base branch from fix-multi-runner-v2-routing to remove-v2-legacy-input-requirements September 4, 2026 18:08

edersonbrilhante changed the base branch from remove-v2-legacy-input-requirements to add-multi-runner-v2-example September 4, 2026 18:10

edersonbrilhante changed the base branch from add-multi-runner-v2-example to main September 4, 2026 18:12

edersonbrilhante changed the base branch from main to add-multi-runner-v2-example September 4, 2026 18:12

edersonbrilhante and others added 10 commits September 17, 2026 23:42

fix(scale-set): remove invalid policy validation reference

c91d8ca

ci: fix multi runner scaleset test

5b52346

docs: auto update terraform docs

0710bc3

fix: fix tests

ec123d2

docs: auto update terraform docs

283484b

fix: fix validations

99ae1bc

fix(multi-runner): validate scale-set installation inputs

4d8cffa

test: fix example and test

ea91c63

edersonbrilhante mentioned this pull request Sep 18, 2026

chore(scale-set): docs and workflows changes #5347

Merged

edersonbrilhante added 3 commits September 18, 2026 14:19

test: fix tofu test

3310bd8

test: add fixture to support tofu tests

4256d6f

docs: auto update terraform docs

f0fa1e8

guicaulada previously approved these changes Sep 21, 2026

View reviewed changes

edersonbrilhante and others added 3 commits September 21, 2026 14:44

Merge branch 'main' into feat-scale-set-terraform

1799908

docs: auto update terraform docs

cf6b86a

guicaulada previously approved these changes Sep 21, 2026

View reviewed changes

Brend-Smits previously approved these changes Sep 21, 2026

View reviewed changes

edersonbrilhante and others added 4 commits September 22, 2026 23:03

Merge remote-tracking branch 'origin/main' into feat-scale-set-terraform

c4c7811

docs: auto update terraform docs

f4c2ce4

fix: fix conflicts

fa85df7

fix: fix conflicts

ddda517

edersonbrilhante and others added 4 commits September 23, 2026 13:00

Merge branch 'main' into feat-scale-set-terraform

17a07eb

docs: auto update terraform docs

23c988f

Merge branch 'main' into feat-scale-set-terraform

8a9498c

docs: auto update terraform docs

7a7bc88

Navigation Menu

feat(scale-set): add scale set orchestration in Terraform - #5299

feat(scale-set): add scale set orchestration in Terraform#5299
edersonbrilhante wants to merge 29 commits into
mainfrom
feat-scale-set-terraform

edersonbrilhante commented Aug 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

edersonbrilhante commented Sep 22, 2026

Uh oh!

npalm commented Sep 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

edersonbrilhante commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Test Plan

Related Issues

Uh oh!

github-actions Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

License Issues

lambdas/services/scale-set/package.json

OpenSSF Scorecard

Scanned Files

Uh oh!

edersonbrilhante commented Sep 22, 2026

Uh oh!

npalm commented Sep 23, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

edersonbrilhante commented Aug 26, 2026 •

edited

Loading

github-actions Bot commented Aug 26, 2026 •

edited

Loading