shahar1 opened a new pull request, #87:
URL: https://github.com/apache/airflow-ci-infra/pull/87

   Every job of `apache/airflow` has run on the `runs-on-flex` stack since 
2026-11-01 (apache/airflow#76239, backported to `v3-4-test`), so the `runs-on` 
CloudFormation stack has nothing left to serve. This removes it from the 
repository: `terraform/runs-on`, the **Terraform (RunsOn)** workflow, the 
`runs-on-terraform-plan`, `runs-on-terraform-apply` and 
`runs-on-cloudformation` roles in `terraform/runs-on-access`, and the docs and 
comments that pointed at them. The shared OIDC trust and the 
`runs-on-usage-report` role stay; the Flex roles use them.
   
   The **Terraform (RunsOn Flex)** plan on this PR must show `0 to add, 0 to 
change, 0 to destroy`: the only Flex change is comments.
   
   Order of operations (step 6 of the Flex README plan):
   
   1. **Before merging**, an account admin destroys the stack by hand from a 
checkout of `main` before this PR: remove `prevent_destroy` in 
`terraform/runs-on/main.tf`, then `terraform init` and `terraform destroy` in 
`terraform/runs-on`. The `runs-on-terraform-apply` role can only update the 
stack, so the workflow cannot do this. If the delete fails on the non-empty 
cache bucket, empty it and run the destroy again.
   2. Merge. No apply runs: the old workflow is gone and the Flex workflow 
applies only on changes to `terraform/runs-on-flex`.
   3. An account admin applies `terraform/runs-on-access` by hand. Expected 
plan: `0 to add, 0 to change, 8 to destroy` (the two `runs-on-terraform-*` 
roles, their three inline policies, the `runs-on-cloudformation` role, its 
`AdministratorAccess` attachment and its guardrails policy). Stop on anything 
else.
   4. INFRA ticket to uninstall and delete the old stack's GitHub App 
(separate; the Flex App registered on 2026-10-31 stays).
   5. Delete the SSM parameter `/runs-on/license-key`; nothing reads it any 
more. `/runs-on-flex/license-key` stays.
   
   Not in this PR: `terraform/runs-on-flex` is still not watched by Dependabot 
(it was not before either); adding it would also bump the RunsOn module 
version, which the Flex README asks to review by hand.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to