Replace disable_check_wokflow_job_labels by opt in enable_workflow_job_labels_check, and check all label #1591

npalm · 2022-01-06T07:54:14Z

Description

When support was added for the workflow_job even also the label check was introduced. By default the label check was enabled. And only the custome labels were supposed to be checked. This was creating confusion. When we need a label check we found out we really need a check on all labels, for example to only accept jobs for our our linux runners. There we changed the label check.

Opt-in

The label checks are opt-in by setting enable_workflow_job_labels_check to true

Accept events

Events are still accepted, also if labels are not acceptec. Workflow job events with labels that not match are dropped. The response message contains the reason and statusCode 202.

Matching

The match is now strict, all lavels in the workflow job should match all labels of the runners.

self-hosted label is added by design
runner_os and runner_architecture are used for label check
runner_extra_labels are used for custom labels.

Migration

disable_check_wokflow_job_labels=true simply remove no other change neede
Otherwise, check if you would like to use a strict check on labels. If yes, enable enable_workflow_job_labels_check

…low_job_labels_check, and check all labels.

examples/ephemeral/main.tf

modules/webhook/variables.tf

Co-authored-by: Scott Guymer <scott@scottguymer.co.uk>

## [0.29.0](v0.28.0...v0.29.0) (2022-01-11) ### Features * Strict label check and replace disable_check_wokflow_job_labels by opt in enable_workflow_job_labels_check ([#1591](#1591)) ([405b11d](405b11d))

* chore(release): 0.17.0 [skip ci] * Adding support for new workflow_job event. ([#1019](#1019)) ([a74e10b](a74e10b)) * chore(release): 0.18.0 [skip ci] * add format checking for lambdas in CI ([#899](#899)) ([#1080](#1080)) ([ae9c277](ae9c277)) * add option to overwrite / disable egress [#748](#748) ([#1112](#1112)) ([9c2548d](9c2548d)) * replace depcrated 'request' dependency by 'node-fetch' ([#903](#903)) ([#1082](#1082)) ([fb51756](fb51756)) * chore(release): 0.18.1 [skip ci] * webhook labels for `workflow_job` ([#1133](#1133)) ([4b39fb9](4b39fb9)) * chore(release): 0.19.0 [skip ci] * **scale-down:** Update Owner Logic ([#1065](#1065)) ([ba2536b](ba2536b)), closes [#2](#2) * explicit set region for downloading runner distribution from S3 ([#1204](#1204)) ([439fb1b](439fb1b)) * upgrade jest ([#1219](#1219)) ([c8b8139](c8b8139)) * use dynamic block to ignore null market opts ([#1202](#1202)) ([df9bd78](df9bd78)) * use dynamic block to ignore null market opts ([#1202](#1202)) ([06a5598](06a5598)) * **logging:** Additional Logging ([#1135](#1135)) ([f7f194d](f7f194d)) * **scale-down:** Clearing cache between runs ([#1164](#1164)) ([e72227b](e72227b)) * chore(release): 0.19.1 [skip ci] * `instance_types` from a Set to a List, so instance order preference is preserved ([#1154](#1154)) ([150d227](150d227)) * chore(release): 0.20.0 [skip ci] * Add option to disable SSL verification support for GitHub Enterprise Server ([#1216](#1216)) ([3c3ef19](3c3ef19)), closes [#1207](#1207) * chore(release): 0.20.1 [skip ci] * Upgrade lambda runtime to node 14.x ([#1203](#1203)) ([570949a](570949a)) * **webhook:** remove node fetch ([ca14ac5](ca14ac5)) * **webhook:** replace node-fetch by axios [#1247](#1247) ([80fff4b](80fff4b)) * added more detailed logging for scaling up and down ([#1222](#1222)) ([9aa7456](9aa7456)) * chore(release): 0.21.0 [skip ci] * Ignore github managed labels and add check disable option ([#1244](#1244)) ([859fa38](859fa38)) * remove unused app client since SSH key is used to secure app authorization ([#1223](#1223)) ([4cb5cf1](4cb5cf1)) * upgrade Terraform version of module 1.0.x ([#1254](#1254)) ([2a817dc](2a817dc)) * chore(release): 0.21.1 [skip ci] * **logging:** Adjusting scale logging messages and levels ([#1286](#1286)) ([665e1a6](665e1a6)) * **logging:** Adjusting webhook logs and levels ([#1287](#1287)) ([9df5fb8](9df5fb8)) * Update launch template to use metadata service v2 ([#1278](#1278)) ([ef16287](ef16287)) * chore(release): 0.22.0 [skip ci] * adding message retention seconds ([#1354](#1354)) ([a19929f](a19929f)) * adding var for tags for ec2s ([#1357](#1357)) ([31cf02d](31cf02d)) * add validation to distribution_bucket_name variable ([#1356](#1356)) ([6522317](6522317)) * chore(release): 0.23.0 [skip ci] * add option to format logging in JSON for lambdas ([#1228](#1228)) ([a250b96](a250b96)) * add option to specify SSE config for dist bucket ([#1324](#1324)) ([ae84302](ae84302)) * reducing verbosity of role and profile ([#1358](#1358)) ([922ef99](922ef99)) * chore(release): 0.23.1 [skip ci] * configurable metadata options for runners ([#1377](#1377)) ([f37df23](f37df23)) * chore(release): 0.24.0 [skip ci] * support single line for app private key ([#1368](#1368)) ([14183ac](14183ac)) * update return codes, no error code for job that are ignored ([#1381](#1381)) ([f9f705f](f9f705f)) * chore(release): 0.25.0 [skip ci] * Add option to configure concurrent running scale up lambda ([#1415](#1415)) ([23ee630](23ee630)) * clean up non used variables in examples ([#1416](#1416)) ([fe65a5f](fe65a5f)) * chore(release): 0.25.1 [skip ci] * Add required providers to module ssm ([#1423](#1423)) ([5b68b7b](5b68b7b)) * chore(release): 0.25.2 [skip ci] * add logging context to runner lambda ([#1399](#1399)) ([0ba0930](0ba0930)) * **logging:** Add context to webhook logs ([#1401](#1401)) ([8094576](8094576)) * chore(release): 0.26.0 [skip ci] * Add hooks for prebuilt images (AMI), including amazon linux packer example ([#1444](#1444)) ([060daac](060daac)) * add runners binaries bucket as terraform output ([5809fee](5809fee)) * chore(release): 0.26.1 [skip ci] * Download lambda ([#1480](#1480)) ([f1b99d9](f1b99d9)) * **syncer:** Add tests, coverage report, and refactor lambda / naming ([#1478](#1478)) ([8266442](8266442)) * install_config_runner -> install_runner ([#1479](#1479)) ([de5b93f](de5b93f)) * chore(release): 0.27.0 [skip ci] * add windows support ([#1476](#1476)) ([dbba705](dbba705)) * chore(release): 0.27.1 [skip ci] * add --preserve-env to start-runner.sh to enable RUNNER_ALLOW_RUNASROOT ([#1537](#1537)) ([1cd9cd3](1cd9cd3)) * remove export from install script. ([#1538](#1538)) ([d32ca1b](d32ca1b)) * chore(release): 0.27.2 [skip ci] * Dowload lambda see [#1541](#1541) for details. ([#1542](#1542)) ([7cb73c8](7cb73c8)) * chore(release): 0.28.0 [skip ci] * add option ephemeral runners ([#1374](#1374)) ([2f323d6](2f323d6)), closes [#1399](#1399) [#1444](#1444) * Change default location of runner to `/opt` and fix Ubuntu example ([#1572](#1572)) ([77f350b](77f350b)) * Replace run instance API by create fleet API ([#1556](#1556)) ([27e974d](27e974d)) * Support t4g Graviton instance type ([#1561](#1561)) ([3fa5896](3fa5896)) * Add config for windows ami ([#1525](#1525)) ([7907984](7907984)) * chore(release): 0.29.0 [skip ci] * Strict label check and replace disable_check_wokflow_job_labels by opt in enable_workflow_job_labels_check ([#1591](#1591)) ([405b11d](405b11d)) * chore(release): 0.30.0 [skip ci] * Add scheduled / pull based scaling for org level runners ([#1577](#1577)) ([8197432](8197432)) * chore(release): 0.30.1 [skip ci] * **runnrs:** Pool runners to allow multiple pool_config objects ([#1621](#1621)) ([c9c7c69](c9c7c69)) * chore(release): 0.31.0 [skip ci] * **packer:** add vars and minor clean up ([#1611](#1611)) ([1c897a4](1c897a4)) * **webhook:** depcrated warning on ts-jest mocked ([#1615](#1615)) ([56c1ece](56c1ece)) * chore(release): 0.32.0 [skip ci] * **runner:** Replace patch by install ICU package for ARM runners ([#1624](#1624)) ([74cfa51](74cfa51)) * **images:** use new runner install location ([#1628](#1628)) ([36c1bf5](36c1bf5)) * **packer:** Add missing RUNNER_ARCHITECTURE for amazn-linux2 ([#1647](#1647)) ([ec497a2](ec497a2)) * chore(release): 0.33.0 [skip ci] * **images:** Added ubuntu-focual example packer configuration ([#1644](#1644)) ([997b171](997b171)) * **examples:** Update AMI filter ([#1673](#1673)) ([39c019c](39c019c)) * chore(release): 0.34.0 [skip ci] * Add output image id used in launch template ([#1676](#1676)) ([a49fab4](a49fab4)) * chore(release): 0.34.1 [skip ci] * **syncer:** Fix for windows binaries in action runner syncer ([#1716](#1716)) ([63e0e27](63e0e27)) * chore(release): 0.34.2 [skip ci] * Limit AWS Terraform Provider to 3.* ([#1741](#1741)) ([0cf2b5d](0cf2b5d)) * **runner:** Cannot disable cloudwatch agent ([#1738](#1738)) ([0f798ca](0f798ca)) * chore(release): 0.35.0 [skip ci] * Parameterise delete_on_termination ([#1758](#1758)) ([6282351](6282351)), closes [#1745](#1745) * **runner:** Ability to disable default runner security group creation ([#1718](#1718)) ([94779f8](94779f8)) * chore(release): 0.36.0 [skip ci] * **runner:** Add option to disable auto update ([#1791](#1791)) ([c2a834f](c2a834f)) * chore(release): 0.37.0 [skip ci] * Add associate_public_ip_address variable to windows AMI too ([#1819](#1819)) ([0b8e1fc](0b8e1fc)), closes [/github.com//pull/1816#issuecomment-1060650668](https://github.com/philips-labs//github.com/philips-labs/terraform-aws-github-runner/pull/1816/issues/issuecomment-1060650668) * Add associate_public_ip_address variable ([#1816](#1816)) ([052e9f8](052e9f8)) * Add option for KMS encryption for cloudwatch log groups ([#1833](#1833)) ([3f1a67f](3f1a67f)) * Add SQS queue resource policy to improve security ([#1798](#1798)) ([96def9a](96def9a)) * Add Support for Alternative Partitions in ARNs (like govcloud) ([#1815](#1815)) ([0ba06c8](0ba06c8)) * Add variable to specify custom commands while building the AMI ([#1838](#1838)) ([8f9c342](8f9c342)) * Autoupdate should be disabled by default ([#1797](#1797)) ([828bed6](828bed6)) * Create SQS DLQ policy only if DLQ is created ([#1839](#1839)) ([c88a005](c88a005)) * Upgrade Amazon base AMI to Amazon Linux 2 kernel 5x ([#1812](#1812)) ([9aa5532](9aa5532)) * chore(release): 0.38.0 [skip ci] * Add option for ephemeral to check builds status before scaling ([#1854](#1854)) ([7eb0bda](7eb0bda)) * Retention days was used instead of kms key id for pool ([#1855](#1855)) ([aa29d93](aa29d93)) * chore(release): 0.39.0 [skip ci] * Add possibility to create multiple ebs ([#1845](#1845)) ([7a2ca0d](7a2ca0d)) * Don't delete busy runners ([#1832](#1832)) ([0e9b083](0e9b083)) * chore(release): 0.40.0 [skip ci] * Support multi runner process support for runner scale down. ([#1859](#1859)) ([3658d6a](3658d6a)) * Set the minimal AWS provider to 3.50 ([#1937](#1937)) ([16095d8](16095d8)) * chore(release): 0.40.1 [skip ci] * Avoid non semantic commontes can be merged. ([#1969](#1969)) ([ad1c872](ad1c872)) * chore(release): 0.40.2 [skip ci] * Outputs for pool need to account for complexity ([#1970](#1970)) ([2d92906](2d92906)) * chore(release): 0.40.3 [skip ci] * Volume size is ingored ([#2014](#2014)) ([b733248](b733248)), closes [#1954](#1954) * chore(release): 0.40.4 [skip ci] * Wrong block device mapping ([#2019](#2019)) ([c42a467](c42a467)) * chore(release): 1.0.0 [skip ci] * var.volume_size replaced by var.block_device_mappings * The module is upgraded to AWS Terraform provider 4.x * Improve syncer s3 kms encryption ([38ed5be](38ed5be)) * Remove var.volume_size in favour of var.block_device_mappings ([4e97048](4e97048)) * Support AWS 4.x Terraform provider ([#1739](#1739)) ([cfb6da2](cfb6da2)) * Wrong block device mapping ([#2019](#2019)) ([185ef20](185ef20)) * chore(release): 1.1.0 [skip ci] * Add option to enable detailed monitoring for runner launch template ([#2024](#2024)) ([e73a267](e73a267)) * chore(release): 1.1.1 [skip ci] * **runner:** Don't treat the string "false" as true. ([#2051](#2051)) ([b67c7dc](b67c7dc)) * chore(release): 1.2.0 [skip ci] * Replace environment variable by prefix ([#1858](#1858)) ([e2f9a27](e2f9a27)) * docs: fix hyperlinks in the Terraform Registry documentation (#2085) This makes the hyperlink correct in the Terraform Registry documentation * chore(release): 1.3.0 [skip ci] * Support arm64 lambda functions ([#2121](#2121)) ([9e2a7b6](9e2a7b6)) * Support Node16 for AWS Lambda ([#2073](#2073)) ([68a2014](68a2014)) * replaced old environment variable ([#2146](#2146)) ([f2072f7](f2072f7)) * set explicit permissions on s3 for syncer lambda ([#2145](#2145)) ([aa7edd1](aa7edd1)) * set kms key on aws_s3_object when encryption is enabled ([#2147](#2147)) ([b4dc706](b4dc706)) * chore(release): 1.4.0 [skip ci] * Add option to match some of the labes instead of all [#2122](#2122) ([#2123](#2123)) ([c5e3c21](c5e3c21)) * don't apply extra labels unless defined ([#2181](#2181)) ([c0b11bb](c0b11bb)) * Remove asterik in permission for runner lambda to describe instances ([9b9da03](9b9da03)) * chore(release): 1.4.1 [skip ci] * added server_side_encryption key to download trigger for distribution ([#2207](#2207)) ([404e3b6](404e3b6)) * chore(release): 1.5.0 [skip ci] * Add ubuntu-jammy example image based on existing ubuntu-focal ([#2102](#2102)) ([486ae91](486ae91)) * **images:** avoid wrong AMI could be selected for ubuntu focal ([#2214](#2214)) ([76be94b](76be94b)) * chore(release): 1.6.0 [skip ci] * Add options extra option to ebs block device mapping ([#2052](#2052)) ([7cd2524](7cd2524)) * Enable node16 default ([#2074](#2074)) ([58aa5ed](58aa5ed)) * Incorrect path of Runner logs ([#2233](#2233)) ([98eff98](98eff98)) * Preventing that lambda webhook fails when it tries to process an installation_repositories event ([#2288](#2288)) ([8656c83](8656c83)) * Update ubuntu example to fix /opt/hostedtoolcache ([#2302](#2302)) ([8eea748](8eea748)) * Webhook lambda misleading log ([#2291](#2291)) ([c6275f9](c6275f9)) * chore(release): 1.7.0 [skip ci] * Webhook accept jobs where not all labels are provided in job. ([#2209](#2209)) ([6d9116f](6d9116f)) * Ignore case for runner labels. ([#2315](#2315)) ([014985a](014985a)) * chore(release): 1.8.0 [skip ci] * Add option to disable lambda to sync runner binaries ([#2314](#2314)) ([9f7d32d](9f7d32d)) * **examples:** Upgrading ubuntu example to 22.04 ([#2250](#2250)) ([d4b7650](d4b7650)), closes [#2103](#2103) * chore(release): 1.8.1 [skip ci] * **runners:** Pass allocation strategy ([#2345](#2345)) ([68d3445](68d3445)) * chore(release): 1.9.0 [skip ci] * Add option to enable access log for API gateway ([#2387](#2387)) ([fcd9fba](fcd9fba)) * add s3_location_runner_distribution var as expandable for userdata ([#2371](#2371)) ([05fe737](05fe737)) * Encrypted data at REST on SQS by default ([#2431](#2431)) ([7f3f4bf](7f3f4bf)) * **images:** Allow passing instance type when building windows image ([#2369](#2369)) ([eca23bf](eca23bf)) * **runners:** Fetch instance environment tag though metadata ([#2346](#2346)) ([27db290](27db290)) * **runners:** Set the default Windows AMI to Server 2022 ([#2325](#2325)) ([78e99d1](78e99d1)) * chore(release): 1.9.1 [skip ci] * **webhook:** Use `x-hub-signature-256` header as default ([#2434](#2434)) ([9c3e495](9c3e495)) * chore(release): 1.10.0 [skip ci] * Download runner release via latest release API ([#2455](#2455)) ([e75e092](e75e092)) * fix: Execute runner in own process, mask token in logs * Add option to disable user_data logging * Enforcing debug is disabled, and introduce option to enable debug logging. * add section related to security considerations * add section related to security considerations Co-authored-by: semantic-release-bot <semantic-release-bot@martynus.net> Co-authored-by: Derek Crosson <derekcrosson18@gmail.com>

## [1.12.0](v1.11.0...v1.12.0) (2022-10-12) ### Features * Added the AMI to machine setup info to runner workflows. ([#2451](#2451)) ([e197cbd](e197cbd)) * **images:** add ami for windows core 2022 ([#2390](#2390)) ([97707c2](97707c2)) * Log workflow id in webhook ([#2511](#2511)) ([204acf1](204acf1)) * Security improvements, add option to disable userdata logging ([9a9e2ee](9a9e2ee)), closes [#1019](#1019) [#899](#899) [#1080](#1080) [#748](#748) [#1112](#1112) [#903](#903) [#1082](#1082) [#1133](#1133) [#2](#2) [#1204](#1204) [#1219](#1219) [#1202](#1202) [#1202](#1202) [#1135](#1135) [#1164](#1164) [#1154](#1154) [#1207](#1207) [#1203](#1203) [#1247](#1247) [#1222](#1222) [#1244](#1244) [#1223](#1223) [#1254](#1254) [#1286](#1286) [#1287](#1287) [#1278](#1278) [#1354](#1354) [#1357](#1357) [#1356](#1356) [#1228](#1228) [#1324](#1324) [#1358](#1358) [#1377](#1377) [#1368](#1368) [#1381](#1381) [#1415](#1415) [#1416](#1416) [#1423](#1423) [#1399](#1399) [#1401](#1401) [#1444](#1444) [#1480](#1480) [#1478](#1478) [#1479](#1479) [#1476](#1476) [#1537](#1537) [#1538](#1538) [#1541](#1541) [#1542](#1542) [#1399](#1399) [#1444](#1444) [#1572](#1572) [#1556](#1556) [#1561](#1561) [#1525](#1525) [#1591](#1591) [#1577](#1577) [#1621](#1621) [#1611](#1611) [#1615](#1615) [#1624](#1624) [#1628](#1628) [#1647](#1647) [#1644](#1644) [#1673](#1673) [#1676](#1676) [#1716](#1716) [#1741](#1741) [#1738](#1738) [#1745](#1745) [#1718](#1718) [#1791](#1791) [github.com//pull/1816#issuecomment-1060650668](https://github.com/philips-labs/github.com/philips-labs/terraform-aws-github-runner/pull/1816/issues/issuecomment-1060650668) [#1816](#1816) [#1833](#1833) [#1798](#1798) [#1815](#1815) [#1838](#1838) [#1797](#1797) [#1839](#1839) [#1812](#1812) [#1854](#1854) [#1855](#1855) [#1845](#1845) [#1832](#1832) [#1859](#1859) [#1937](#1937) [#1969](#1969) [#1970](#1970) [#1954](#1954) [#2019](#2019) [#1739](#1739) [#2019](#2019) [#2024](#2024) [#2051](#2051) [#1858](#1858) [#2085](#2085) [#2121](#2121) [#2073](#2073) [#2146](#2146) [#2145](#2145) [#2147](#2147) [#2122](#2122) [#2123](#2123) [#2181](#2181) [#2207](#2207) [#2102](#2102) [#2214](#2214) [#2052](#2052) [#2074](#2074) [#2233](#2233) [#2288](#2288) [#2302](#2302) [#2291](#2291) [#2209](#2209) [#2315](#2315) [#2314](#2314) [#2103](#2103) [#2345](#2345) [#2387](#2387) [#2371](#2371) [#2431](#2431) [#2369](#2369) [#2346](#2346) [#2325](#2325) [#2434](#2434) [#2455](#2455) ### Bug Fixes * Remove resource group from module ([#2512](#2512)) ([2628352](2628352))

npalm added 4 commits January 5, 2022 16:57

Check strict labels

9e05940

feat: Replace disable_check_wokflow_job_labels by opt in enable_workf…

3f77bcf

…low_job_labels_check, and check all labels.

Make check strict

bd837e0

update docs

849cc03

npalm requested a review from ScottGuymer January 6, 2022 07:57

cleanup

e4ace22

npalm enabled auto-merge (squash) January 6, 2022 09:35

ScottGuymer reviewed Jan 7, 2022

View reviewed changes

examples/ephemeral/main.tf Outdated Show resolved Hide resolved

ScottGuymer reviewed Jan 7, 2022

View reviewed changes

modules/webhook/variables.tf Outdated Show resolved Hide resolved

npalm and others added 3 commits January 7, 2022 18:03

Update modules/webhook/variables.tf

e0dde68

Co-authored-by: Scott Guymer <scott@scottguymer.co.uk>

review

cdc3cda

review

71d113d

npalm requested a review from ScottGuymer January 7, 2022 17:08

ScottGuymer approved these changes Jan 10, 2022

View reviewed changes

npalm merged commit 405b11d into develop Jan 10, 2022

npalm deleted the feat/label-chers branch January 10, 2022 10:09

dhaven mentioned this pull request Jan 31, 2022

Syncer lambda is not downloading GitHub runner release into S3 bucket #1541

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace disable_check_wokflow_job_labels by opt in enable_workflow_job_labels_check, and check all label #1591

Replace disable_check_wokflow_job_labels by opt in enable_workflow_job_labels_check, and check all label #1591

npalm commented Jan 6, 2022 •

edited

Loading

Replace disable_check_wokflow_job_labels by opt in enable_workflow_job_labels_check, and check all label #1591

Replace disable_check_wokflow_job_labels by opt in enable_workflow_job_labels_check, and check all label #1591

Conversation

npalm commented Jan 6, 2022 • edited Loading

Description

Opt-in

Accept events

Matching

Related

Migration

npalm commented Jan 6, 2022 •

edited

Loading