feat(ec2): add tags option to Ec2RunnerProvider

[GilUpstream]

Summary

Adds an tags prop to Ec2RunnerProvider that merges extra tags into the existing RunInstances TagSpecifications (instance + volume).

Why launch-time tags (not job hooks): security monitoring that enrolls hosts by tag needs the tag present from the moment the instance exists. Tagging from ACTIONS_RUNNER_HOOK_JOB_STARTED (the workaround from #524) runs only after the job starts, which is too late for short-lived ephemeral runners — the instance may terminate before the agent is installed. cdk.Tags.of() also does not help, because these instances are created dynamically by Step Functions, not as CloudFormation resources.

This builds on the tags already applied in #909 (Name, GitHubRunners:*) and makes the same mechanism extensible.

API

new Ec2RunnerProvider(this, 'EC2', {
  labels: ['ec2'],
  tags: {
    SecurityMonitoring: 'enabled',
  },
});

Testing

• Unit tests cover TagSpecifications merge for instance + volume, and reserved-key rejection
• pnpm exec jest test/providers.test.ts passes
• API.md regenerated via pnpm docgen

Related: #524 (custom EC2 tags at launch time).

Made with Cursor

[GilUpstream]

@kichik Thoughts on this approach for extending tags? This seemed like a better option rather than the fragile nature of the user data approach.

[kichik]

I've been resisting this for a long time. But I can't deny it's useful. Let me clean it up a tiny bit and merge.

[kichik]

Thanks.

FYI @pharindoko @emmanuelnk

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-07-28 01:58 UTC · Rule: default · triggered by rule Automatic merge on approval and successful build
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-07-28 01:59 UTC · at d895953ec8a237dd9c2eacdfa4024f592992aacd · squash

This pull request spent 31 seconds in the queue, including 7 seconds running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub branch protection] (documentation)
  • feat(ec2): add tags option to Ec2RunnerProvider #961