feat: pluggable bootstrap — pre-runner-script + user-data-template#58
Merged
Conversation
…nfork Ubuntu et al.)
"Fork and replace the userData array" was a maintenance sentence nobody should
serve. Keep the built-in yum bootstrap as the only supported path, but make the
bootstrap pluggable so any distro/extra-setup need is a template away.
- pre-runner-script (the 80% case): a root snippet injected into the built-in
bootstrap before runner configuration (install docker, mount caches, certs).
Runs under set -euo pipefail with its own phase tag, so a failure surfaces as
failed:pre-runner-script in the diagnostics flow.
- user-data-template (full control): replaces the bootstrap entirely. Repo-
relative file path or inline string. The action substitutes documented
placeholders — {{RUNNER_VERSION}}, {{RUNNER_CHECKSUM_X64/ARM64}},
{{REGISTRATION_TOKEN}}, {{REPO_URL}}, {{LABEL}}, {{TTL_MINUTES}} — and submits
the result. Unknown {{...}} tokens error at render (typo protection).
- The two inputs are mutually exclusive (config error). Rendered payload is
size-guarded against the EC2 16 KB limit. Built-in path with neither input is
byte-identical to today (regression).
- examples/user-data/ubuntu.sh.tpl (community-maintained) + examples/user-data/
README stating the support boundary — converts the perennial Ubuntu ask from
"fork" to "copy one file".
Tests: renderUserDataTemplate (substitution, repeats, unknown-token error, token
rendered), assertUserDataSize (limit + multibyte), pre-runner-script injection +
default-absent, config mutual-exclusion (203 tests total). README support-
boundary section replaces the "fork and replace" paragraph; action.yml inputs.
Closes #46
Signed-off-by: kurok <22548029+kurok@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #46 — roadmap (#49) Phase 3. Soft-depends on bootstrap diagnostics (#41) for failure attribution.
Problem
The README told non-yum users to "fork and replace the userData array." Forks drift and miss security fixes. Keep the built-in yum bootstrap as the only supported path, but make it pluggable so no one forks.
Two escape hatches
pre-runner-script(the 80% case)Root snippet injected into the built-in bootstrap before runner config (install docker, mount caches, certs). Runs under
set -euo pipefailwith its own phase tag → a failure surfaces asfailed:pre-runner-scriptin the fast-fail diagnostics.user-data-template(full control)Replaces the bootstrap entirely — repo-relative path or inline string. The action substitutes documented placeholders and submits the result:
{{RUNNER_VERSION}},{{RUNNER_CHECKSUM_X64}}/{{RUNNER_CHECKSUM_ARM64}},{{REGISTRATION_TOKEN}},{{REPO_URL}},{{LABEL}},{{TTL_MINUTES}}.Guard rails
{{...}}tokens error at render (typo protection).Unfork Ubuntu
examples/user-data/ubuntu.sh.tpl(community-maintained) +examples/user-data/README.mdstating the support boundary — the perennial Ubuntu ask becomes "copy one file."Tests / build
renderUserDataTemplate(substitution, repeats, unused-OK, unknown-token error, token rendered),assertUserDataSize(limit + multibyte),pre-runner-scriptinjection (phase tag, before handoff) + default-absent, config mutual-exclusion. 203 tests pass (was 190). Lint clean, dist rebuilt (verify-dist green).Docs
README top callout rewritten (no more "fork and replace"); "Custom bootstrap" section with placeholder table + support boundary;
action.ymlinputs.Not automated
Booting the Ubuntu template on a real 24.04 AMI is a manual checklist item (can't provision EC2 in CI). Rendering + validation are unit-tested.