feat(termination-watcher): support additional GitHub Apps - #5467
Open
guicaulada wants to merge 1 commit into
Open
guicaulada wants to merge 1 commit into
guicaulada wants to merge 1 commit into
Conversation
guicaulada
force-pushed
the
gc/feat/janitor-multi-app
branch
from
September 23, 2026 14:36
89ee01e to
bfe90f4
Compare
guicaulada
changed the title
guicaulada
changed the base branch from
gc/feat/registration-janitor
to
main
September 23, 2026 14:36
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
guicaulada
marked this pull request as ready for review
September 23, 2026 14:44
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Termination-watcher deregistration currently uses only the first GitHub App credential, and its Terraform wiring omits the additional-App manifest. Configured additional Apps therefore cannot contribute quota to termination cleanup or its SQS retry path.
Load all credentials through the existing manifest-backed store. Select an App using observed installation quota, skip Apps in a one-minute throttling cooldown when another is available, and use a random initial offset for unknown quotas. Keep App JWT and installation-token authentication paired, resolve installation access for the requested owner, and try another configured App if authentication fails. Each termination or retry operation selects an App; authenticated-operation failures retain existing error handling. Single-App configurations remain supported.
Pass the optional manifest reference and credential parameter ARNs through termination-watcher Terraform, including automatic forwarding from multi-runner. Grant scoped
GetParameteraccess for the manifest andGetParametersaccess for batched credential reads. Omit the optional environment key when no manifest is configured. Deregistration retries retain the configured GHES endpoint.Validation: 52 termination-watcher package tests and three mocked Terraform tests pass. Coverage includes additional-App deregistration, paired credentials, quota exhaustion, secondary-limit cooldown, authentication fallback, manifest/IAM wiring, disabled deregistration, and single-App defaults. Runtime TypeScript, ESLint, Prettier, Terraform formatting, generated documentation, Lambda bundle build, and diff checks pass. No live GitHub/AWS changes were performed. TFLint is unavailable locally; existing package-wide coverage thresholds remain unchanged.
This PR targets main and changes only termination-watcher authentication, configuration, permissions, and retries.