shahar1 opened a new pull request, #65: URL: https://github.com/apache/airflow-ci-infra/pull/65
[AIP-118](https://cwiki.apache.org/confluence/spaces/AIRFLOW/pages/451974652) selected [RunsOn](https://runs-on.com/) for Airflow's self-hosted GitHub Actions runners. This adds `terraform/runs-on/`, a root module that creates RunsOn's CloudFormation stack for the **apache** organization from the vendor's version-pinned template (`v3.3.2`), with the parameters validated on a fork on 2026-09-25 (full `Tests (AMD)` graph green apart from two non-hermetic tests, details in the [AIP-118 appendix](https://cwiki.apache.org/confluence/spaces/AIRFLOW/pages/451974672)). What is in the module - `aws_cloudformation_stack.runs_on` — stack `runs-on`, `GithubOrganization=apache`, VPC `10.2.0.0/16`, `prevent_destroy`, own S3 state key `tf-state/runs-on.tfstate`. - License key handling: RunsOn accepts `LicenseKey` as the ARN of an SSM SecureString that must be named `/<stack>/license-key`. The parameter is created by hand (README step 1); Terraform reads it **without decryption** only to prove it exists and passes the ARN, so the key never appears in variables, plan output or state. Secrets Manager is not supported by the template. - `runs-on.yml.example` — runner presets for the three size classes (small 4 vCPU/16 GB, medium 8/32, xl 32/128, AMD and ARM), to be committed in `apache/.github-private`. - README with the manual steps (SSM parameter, GitHub App registration via the stack's entry point — needs an org owner / ASF Infra), upgrade/rollback and what was learned in the validation. The fork validation stack `runs-on-shahar1` is deliberately not managed here and must never be imported. Status: applied on 2026-09-25 with a local backend — stack `runs-on` is `CREATE_COMPLETE`, license validated by the control plane. Pending: GitHub App registration for the `apache` organization (ASF Infra), then presets and workflow routing in `apache/airflow`. A GitHub Actions workflow to run this Terraform (OIDC role, S3 state) is a follow-up, not part of this PR. Checks run: `terraform fmt -check`, `terraform validate`, `terraform plan` (1 to add) and `apply` against the account. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Fable 5.1) Generated-by: Claude Code (Fable 5.1) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
