feat: add bidirectionalLabelMatch option and deprecate exactMatch

[Brend-Smits]

Description

Introduce a new bidirectionalLabelMatch option that performs strict two-way label matching (runner labels must equal workflow labels as a set). This preserves the existing exactMatch behavior (unidirectional subset check) to avoid breaking changes.

The bidirectionalLabelMatch option requires labels to be identical in both directions. Previously, a runner with labels [A, B, C, D] would match a job requesting [A, B, C] when exactMatch was true. With bidirectionalLabelMatch=true, the runner will only match if the job requests exactly [A, B, C, D].

Before: Job [A,B,C] + Runner [A,B,C,D] + exactMatch=true            → Match
After:  Job [A,B,C] + Runner [A,B,C,D] + bidirectionalLabelMatch=true → No Match

exactMatch was supposed to have this behavior, but to avoid breaking changes, the variable will be deprecated to give users time to migrate.

Changes:

• Add bidirectionalLabelMatch to MatcherConfig interface (optional, defaults to false)
• Update canRunJob to support bidirectional matching when enabled — now accepts both bidirectionalLabelMatch and enableDynamicLabels parameters; bidirectional matching correctly respects dynamic label sanitization
• Deprecate exactMatch in Terraform variables with migration guidance
• Add bidirectionalLabelMatch to multi-runner and webhook variable types
• Add new root variable enable_runner_bidirectional_label_match
• Add comprehensive test coverage for bidirectional matching

Migration: To migrate, use bidirectionalLabelMatch instead of exactMatch in your runner configs. Then either:

1. Remove extra labels from runner configurations, or
2. Add the extra labels to your workflow job runs-on

Co-authored-by: Stuart Pearson

Test Plan

• Added/updated unit tests in dispatch.test.ts covering bidirectional label matching, interaction with exactMatch, case-insensitivity, empty labels, and combined use with enableDynamicLabels — 36 tests passing

Related Issues

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Brend-Smits]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in commit 6c68ca4.

Two files had conflicts:

• dispatch.ts: Combined our bidirectionalLabelMatch parameter with main's enableDynamicLabels parameter into a unified 5-parameter canRunJob signature. Both features now work together — bidirectional matching uses the sanitized labels (respecting dynamic label stripping) when enableDynamicLabels is enabled.
• modules/multi-runner/README.md: Took main's updated documentation (macOS runners, dynamic labels, relaxed cpu_options schema) and added our bidirectionalLabelMatch field to the matcherConfig section.

Also updated the test file to correctly pass both parameters (36 tests passing).

[Brend-Smits]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in commit fd11a6a.

8 files had conflicts:

• dispatch.ts: Combined our bidirectionalLabelMatch sort/filter with main's new per-runner dynamic labels policy architecture (enableDynamicLabels/ec2DynamicLabelsPolicy per matcher). The canRunJob function now takes 4 params (removed the top-level enableDynamicLabels param since main moved that logic into handleWorkflowJob).
• dispatch.test.ts: Kept our bidirectional label match tests alongside main's new per-matcher dynamic label dispatch tests. Removed tests that relied on the now-removed 5th enableDynamicLabels param in canRunJob.
• sqs/index.ts: MatcherConfig now includes all fields: exactMatch, bidirectionalLabelMatch, enableDynamicLabels, and ec2DynamicLabelsPolicy.
• main.tf: Matcher config includes both bidirectionalLabelMatch and enableDynamicLabels/ec2DynamicLabelsPolicy.
• modules/multi-runner/variables.tf, modules/webhook/variables.tf: matcherConfig object includes all fields.
• modules/multi-runner/README.md, modules/webhook/README.md: Combined descriptions and type definitions from both branches.

All 92 tests pass.

[edersonbrilhante]

@Brend-Smits Some commits are not signed. I am ready to merge, just need you to fix the commits first

[Brend-Smits]

@Brend-Smits Some commits are not signed. I am ready to merge, just need you to fix the commits first

Thanks for having a look! Apologies for that. I think something went wrong in the merge.... Can you have another look?