Skip to content

Commit 249efbd

Browse files
kurokkurok
authored
revert: full rollback of Phase 4 bootstrap to Phase 1 known-good (#21)
* revert: full rollback of Phase 4 bootstrap changes Phase 4 attempts #18 (with non-root) and #19 (without non-root but keeping --ephemeral + checksum + set -euo pipefail + runner-version input) BOTH failed the provider dogfood with the same 6m15s runner registration timeout (terraform-provider-namecheap#182 and machulav#183). The fix-forward in #19 narrowed the suspect set from 'all Phase 4 changes' to 'one of: set -euo pipefail, --ephemeral flag, --disableupdate flag, checksum verify, parameterized bash vars'. Still not isolated. Full rollback here restores the known-good Phase 1 bootstrap exactly. Everything else from Phase 1 is preserved (aws-sdk v3, ncc 0.38, jest tests, .gitattributes). Phase 4 work is NOT abandoned — it moves to follow-up issues where each change lands on its own with its own dogfood, so the next failure isolates itself to a single axis instead of requiring bisection across five simultaneous changes. Files reverted to match a1bd2f9 (Phase 1 tip): - action.yml (drops runner-version input) - src/aws.js (original 12-line bash array, yum install libicu make, RUNNER_ALLOW_RUNASROOT=1, no --ephemeral, no checksum verify) - src/config.js (drops runnerVersion field) - tests/config.test.js (drops runner-version test block, 23 -> 21 tests) Dist rebuilt against the reverted src (verify-dist will confirm). Signed-off-by: yuriyryabikov <22548029+kurok@users.noreply.github.com> * ci: revert verify-runner-url extractor to grep src/aws.js Paired with the full Phase 4 revert — now that action.yml no longer has a runner-version default, the Phase 4 version of verify-runner-url that reads action.yml can't find the version. Restore the original extractor that greps the literal URL out of src/aws.js. Signed-off-by: yuriyryabikov <22548029+kurok@users.noreply.github.com> --------- Signed-off-by: yuriyryabikov <22548029+kurok@users.noreply.github.com>
1 parent 78f98d1 commit 249efbd

6 files changed

Lines changed: 16 additions & 109 deletions

File tree

‎.github/workflows/pr.yml‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -68,20 +68,16 @@ jobs:
6868
steps:
6969
- name: Checkout
7070
uses: actions/checkout@v4
71-
- name: Extract default runner version from action.yml
71+
- name: Extract runner version from src/aws.js
7272
id: extract
7373
run: |
74-
# action.yml declares:
75-
# runner-version:
76-
# ...
77-
# default: '2.333.1'
78-
version=$(awk '/^ runner-version:/{found=1} found && /^ default:/{gsub(/[^0-9.]/, "", $2); print $2; exit}' action.yml)
74+
version=$(grep -oE 'actions/runner/releases/download/v[0-9]+\.[0-9]+\.[0-9]+' src/aws.js | head -1 | sed 's|.*/v||')
7975
if [ -z "$version" ]; then
80-
echo "::error::Could not locate the default runner-version in action.yml"
76+
echo "::error::Could not locate the pinned actions/runner version in src/aws.js"
8177
exit 1
8278
fi
8379
echo "version=$version" >> "$GITHUB_OUTPUT"
84-
echo "Default actions/runner: v$version"
80+
echo "Pinned actions/runner: v$version"
8581
- name: HEAD check the Linux x64 release asset
8682
env:
8783
VERSION: ${{ steps.extract.outputs.version }}

‎action.yml‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -70,15 +70,6 @@ inputs:
7070
IAM Role Name to attach to the created EC2 instance.
7171
This requires additional permissions on the AWS role used to launch instances.
7272
required: false
73-
runner-version:
74-
description: >-
75-
Version of the actions/runner binary to download and register.
76-
Must match a released tag from https://github.com/actions/runner/releases
77-
(without the 'v' prefix). Defaults to the version tested with this action release.
78-
Bumping this lets consumers pick up a newer runner (e.g. when GitHub gates
79-
JS actions on a newer node runtime) without waiting for an action release.
80-
required: false
81-
default: '2.333.1'
8273
aws-resource-tags:
8374
description: >-
8475
Tags to attach to the launched EC2 instance and volume.

‎dist/index.js‎

Lines changed: 6 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -87903,52 +87903,19 @@ async function resolveImageId(client) {
8790387903
async function startEc2Instance(label, githubRegistrationToken) {
8790487904
const client = ec2Client();
8790587905

87906-
// User-data runs as root. Phase 4's original attempt to drop to a
87907-
// dedicated 'runner' user via sudo-heredoc broke dogfood in
87908-
// terraform-provider-namecheap#182 — the EC2 instance came up but the
87909-
// runner never registered within the 5 min action timeout. Reverted
87910-
// here to the root-execution path the pre-Phase-4 bootstrap used,
87911-
// isolating the non-root move for a separate investigation.
87912-
//
87913-
// Kept from the Phase 4 work (all verified independently of the
87914-
// root/non-root axis):
87915-
// - set -euo pipefail — fail fast on any bootstrap error.
87916-
// - --ephemeral + --unattended + --disableupdate on config.sh —
87917-
// one-job runner, no interactive prompts, no runner auto-update.
87918-
// - SHA-256 verification of the runner tarball against the
87919-
// published .sha256 sidecar before extraction.
87920-
// - Parameterized runner-version via config.input.runnerVersion.
87921-
const runnerVersion = config.input.runnerVersion;
87922-
const owner = config.githubContext.owner;
87923-
const repo = config.githubContext.repo;
87906+
// User data scripts are run as the root user.
87907+
// Docker and git are necessary for GitHub runner and should be pre-installed on the AMI.
8792487908
const userData = [
8792587909
'#!/bin/bash',
87926-
'set -euo pipefail',
87927-
'',
8792887910
'mount -o remount,size=1G /tmp',
8792987911
'yum install -y libicu make',
87930-
'',
8793187912
'mkdir actions-runner && cd actions-runner',
87932-
'',
87933-
'case "$(uname -m)" in',
87934-
' aarch64) RUNNER_ARCH="arm64" ;;',
87935-
' amd64|x86_64) RUNNER_ARCH="x64" ;;',
87936-
' *) echo "unsupported arch: $(uname -m)" >&2; exit 1 ;;',
87937-
'esac',
87938-
'',
87939-
`RUNNER_VERSION="${runnerVersion}"`,
87940-
'TARBALL="actions-runner-linux-${RUNNER_ARCH}-${RUNNER_VERSION}.tar.gz"',
87941-
'BASE="https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}"',
87942-
'',
87943-
'curl -fsSLo "$TARBALL" "$BASE/$TARBALL"',
87944-
'expected="$(curl -fsSL "$BASE/$TARBALL.sha256" | awk \'{print $1}\')"',
87945-
'echo "$expected $TARBALL" | sha256sum -c -',
87946-
'',
87947-
'tar xzf "$TARBALL"',
87948-
'',
87913+
'case $(uname -m) in aarch64) ARCH="arm64" ;; amd64|x86_64) ARCH="x64" ;; esac && export RUNNER_ARCH=${ARCH}',
87914+
'curl -O -L https://github.com/actions/runner/releases/download/v2.333.1/actions-runner-linux-${RUNNER_ARCH}-2.333.1.tar.gz',
87915+
'tar xzf ./actions-runner-linux-${RUNNER_ARCH}-2.333.1.tar.gz',
8794987916
'export RUNNER_ALLOW_RUNASROOT=1',
8795087917
'export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1',
87951-
`./config.sh --url "https://github.com/${owner}/${repo}" --token "${githubRegistrationToken}" --labels "${label}" --ephemeral --unattended --disableupdate`,
87918+
`./config.sh --url https://github.com/${config.githubContext.owner}/${config.githubContext.repo} --token ${githubRegistrationToken} --labels ${label}`,
8795287919
'./run.sh',
8795387920
];
8795487921

@@ -88036,7 +88003,6 @@ class Config {
8803688003
label: core.getInput('label'),
8803788004
ec2InstanceId: core.getInput('ec2-instance-id'),
8803888005
iamRoleName: core.getInput('iam-role-name'),
88039-
runnerVersion: core.getInput('runner-version') || '2.333.1',
8804088006
};
8804188007

8804288008
const tags = JSON.parse(core.getInput('aws-resource-tags'));

‎src/aws.js‎

Lines changed: 6 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -57,52 +57,19 @@ async function resolveImageId(client) {
5757
async function startEc2Instance(label, githubRegistrationToken) {
5858
const client = ec2Client();
5959

60-
// User-data runs as root. Phase 4's original attempt to drop to a
61-
// dedicated 'runner' user via sudo-heredoc broke dogfood in
62-
// terraform-provider-namecheap#182 — the EC2 instance came up but the
63-
// runner never registered within the 5 min action timeout. Reverted
64-
// here to the root-execution path the pre-Phase-4 bootstrap used,
65-
// isolating the non-root move for a separate investigation.
66-
//
67-
// Kept from the Phase 4 work (all verified independently of the
68-
// root/non-root axis):
69-
// - set -euo pipefail — fail fast on any bootstrap error.
70-
// - --ephemeral + --unattended + --disableupdate on config.sh —
71-
// one-job runner, no interactive prompts, no runner auto-update.
72-
// - SHA-256 verification of the runner tarball against the
73-
// published .sha256 sidecar before extraction.
74-
// - Parameterized runner-version via config.input.runnerVersion.
75-
const runnerVersion = config.input.runnerVersion;
76-
const owner = config.githubContext.owner;
77-
const repo = config.githubContext.repo;
60+
// User data scripts are run as the root user.
61+
// Docker and git are necessary for GitHub runner and should be pre-installed on the AMI.
7862
const userData = [
7963
'#!/bin/bash',
80-
'set -euo pipefail',
81-
'',
8264
'mount -o remount,size=1G /tmp',
8365
'yum install -y libicu make',
84-
'',
8566
'mkdir actions-runner && cd actions-runner',
86-
'',
87-
'case "$(uname -m)" in',
88-
' aarch64) RUNNER_ARCH="arm64" ;;',
89-
' amd64|x86_64) RUNNER_ARCH="x64" ;;',
90-
' *) echo "unsupported arch: $(uname -m)" >&2; exit 1 ;;',
91-
'esac',
92-
'',
93-
`RUNNER_VERSION="${runnerVersion}"`,
94-
'TARBALL="actions-runner-linux-${RUNNER_ARCH}-${RUNNER_VERSION}.tar.gz"',
95-
'BASE="https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}"',
96-
'',
97-
'curl -fsSLo "$TARBALL" "$BASE/$TARBALL"',
98-
'expected="$(curl -fsSL "$BASE/$TARBALL.sha256" | awk \'{print $1}\')"',
99-
'echo "$expected $TARBALL" | sha256sum -c -',
100-
'',
101-
'tar xzf "$TARBALL"',
102-
'',
67+
'case $(uname -m) in aarch64) ARCH="arm64" ;; amd64|x86_64) ARCH="x64" ;; esac && export RUNNER_ARCH=${ARCH}',
68+
'curl -O -L https://github.com/actions/runner/releases/download/v2.333.1/actions-runner-linux-${RUNNER_ARCH}-2.333.1.tar.gz',
69+
'tar xzf ./actions-runner-linux-${RUNNER_ARCH}-2.333.1.tar.gz',
10370
'export RUNNER_ALLOW_RUNASROOT=1',
10471
'export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1',
105-
`./config.sh --url "https://github.com/${owner}/${repo}" --token "${githubRegistrationToken}" --labels "${label}" --ephemeral --unattended --disableupdate`,
72+
`./config.sh --url https://github.com/${config.githubContext.owner}/${config.githubContext.repo} --token ${githubRegistrationToken} --labels ${label}`,
10673
'./run.sh',
10774
];
10875

‎src/config.js‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ class Config {
1616
label: core.getInput('label'),
1717
ec2InstanceId: core.getInput('ec2-instance-id'),
1818
iamRoleName: core.getInput('iam-role-name'),
19-
runnerVersion: core.getInput('runner-version') || '2.333.1',
2019
};
2120

2221
const tags = JSON.parse(core.getInput('aws-resource-tags'));

‎tests/config.test.js‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -131,18 +131,6 @@ describe('Config — mode validation', () => {
131131
});
132132
});
133133

134-
describe('Config — runner-version input', () => {
135-
test('defaults to 2.333.1 when input is unset', () => {
136-
const config = loadConfig(startModeInputs);
137-
expect(config.input.runnerVersion).toBe('2.333.1');
138-
});
139-
140-
test('honors an explicit runner-version override', () => {
141-
const config = loadConfig({ ...startModeInputs, 'runner-version': '2.340.0' });
142-
expect(config.input.runnerVersion).toBe('2.340.0');
143-
});
144-
});
145-
146134
describe('Config — generateUniqueLabel', () => {
147135
test('returns a 5-character alphanumeric string', () => {
148136
const config = loadConfig(startModeInputs);

0 commit comments

Comments
 (0)