ECR/Docker Image for JIT Runner

#!/usr/bin/env bash
source logger.sh
RUNNER_USER=$(whoami)
RUNNER_HOME=${RUNNER_HOME:-/home/${RUNNER_USER}/actions-runner}
RUNNER_ARCH=${RUNNER_ARCH:-x64}
RUNNER_CONFIG_RETRIES=${RUNNER_CONFIG_RETRIES:-10}
RUNNER_CONFIG_RETRY_INTERVAL_SECONDS=${RUNNER_CONFIG_RETRY_INTERVAL_SECONDS:-10}
SQS_QUEUE_NAME="${SQS_QUEUE_NAME:-git-actions-wf-job-queue}"

aws_acct=$(aws sts get-caller-identity --query Account --output text)
aws_region=$(aws configure get region)

QUEUE_URL="https://sqs.$aws_region.amazonaws.com/$aws_acct/$SQS_QUEUE_NAME"

trap 'kill -INT -$PID;
echo "Exiting runner";
rm -fr ${RUNNER_HOME}/.runner;
${RUNNER_HOME}/config.sh remove' INT TERM

MSG=$(aws sqs receive-message --queue-url "$QUEUE_URL")

rc=$?

if [[ -n "$MSG" ]] && [[ $rc -eq 0 ]]; then
  labels=$(echo "$MSG" | jq -r '.Messages[]| .ReceiptHandle' |
    (xargs -I {} aws sqs delete-message --queue-url "$QUEUE_URL" --receipt-handle {}) &&
    echo "$MSG" | jq -c '.Messages[].Body|fromjson|.detail.workflow_job.labels')

  log.notice "Received runner labels ${labels}."
  sqs_queue_msg_id=$(echo "$MSG" | jq -r '.Messages[]|[.MessageId]|("SQS Queue Message Id: "+.[])')
  log.notice "Processing ${sqs_queue_msg_id}."
else
  echo "Error: problem with reading sqs queue/labels"
  exit 1
fi

job_run_ids=$(echo "$MSG" | jq -r '.Messages[]|.Body|fromjson|
  [("job_id" + ": " + (.detail.workflow_job.id|tostring)),
  ("run_id" + ": " + (.detail.workflow_job.run_id|tostring))]|join(", ")')

log.notice "Processing for ${job_run_ids}."

job_id=$(echo "$MSG" | jq -r '.Messages[]|.Body|fromjson|.detail.workflow_job.id|tostring')

if [ -n "${STARTUP_DELAY_IN_SECONDS}" ]; then
  log.notice "Delaying startup by ${STARTUP_DELAY_IN_SECONDS} seconds"
  sleep "${STARTUP_DELAY_IN_SECONDS}"
fi

github_api_pfx="https://api.github.com"

if [[ -n "${REPOSITORY}" ]]; then
  rest_api_ep="${github_api_pfx}/repos/${ORGANIZATION}/${REPOSITORY}"
fi

if [[ -n "${ORGANIZATION}" ]]; then
  rest_api_ep="${github_api_pfx}/orgs/${ORGANIZATION}"
fi

if [[ -n "${ENTERPRISE}" ]]; then
  rest_api_ep="${github_api_pfx}/enterprises/${ENTERPRISE}"
fi

rest_api_ep_runners_pfx=${rest_api_ep}/actions/runners

log.notice "Will use GitHub Rest API JIT config prefix ${rest_api_ep_runners_pfx}."

runner_version_maintenance() {

  # Check the official actions/runner public repository for the latest release version tag.
  # Strictly speaking, an ACCESS_TOKEN is not required for for "curling" the runner agent public repository,
  # however, without a token, we are more likely to hit the GitHub API rate limit
  remote_ver=$(curl -s -L \
    -H "Accept: application/vnd.github+json" \
    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
    -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/repos/actions/runner/releases/latest |
    jq -r '.tag_name' | cut -c 2-)

  current_ver="$("$RUNNER_HOME"/config.sh --version)"

  log.notice "Runner agent version bundled in our image is ${current_ver}, latest official release version is ${remote_ver}"

  if [ "${current_ver}" != "${remote_ver}" ]; then
    log.notice "Upgrading runner agent from version ${current_ver}, to latest official release ${remote_ver}"
    rm -fr "$RUNNER_HOME/{"*",".*"}"
    runner_download_url=$(curl -s -L \
      -H "Accept: application/vnd.github+json" \
      -H "Authorization: Bearer ${ACCESS_TOKEN}" \
      -H "X-GitHub-Api-Version: 2022-11-28" https://api.github.com/repos/actions/runner/releases/latest |
      jq -r ".assets[]|select(.name | startswith(\"actions-runner-linux-$RUNNER_ARCH\")).browser_download_url")
    curl -fLo "$RUNNER_HOME"/runner.tar.gz "$runner_download_url"
    tar xzf "$RUNNER_HOME"/runner.tar.gz -C "$RUNNER_HOME"
    rm -f "$RUNNER_HOME"/runner.tar.gz
    "$RUNNER_HOME"/bin/installdependencies.sh
    log.notice "Unpacked upgraded runner from version ${current_ver} to ${remote_ver}"
    export RUNNER_VERSION="${remote_ver}"
  else
    log.notice "Installed and latest available runner versions are identical:- installed: ${current_ver}, latest release: ${remote_ver} ... update not required."
  fi
}

if ! cd "${RUNNER_HOME}"; then
  log.notice "Runner home dir ${RUNNER_HOME} is missing, creating it..."
  mkdir -p "${RUNNER_HOME}"
  chown -R "${RUNNER_USER}":"${RUNNER_USER}" "$RUNNER_HOME"
else
  rm -fr "$RUNNER_HOME/{"*",".*"}"
  runner_version_maintenance
fi

log.notice "Registering..."

retries_left=${RUNNER_CONFIG_RETRIES}

while [[ ${retries_left} -gt 0 ]]; do
  log.debug 'Configuring the runner.'
  jit_json_parms="{\"name\":\"${job_id}\",\"runner_group_id\":1,\"labels\":${labels},\"work_folder\":\"_work\"}"

  data=$(echo -en "$jit_json_parms" | jq -c '.')

  log.notice "Will generate JIT runner config using the following options:"
  log.notice "${data}"

  jit_runner_config=$(curl -sL -X POST \
    -H "Accept: application/vnd.github+json" \
    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
    -H "X-GitHub-Api-Version: 2022-11-28" "${rest_api_ep_runners_pfx}"/generate-jitconfig \
    -d "${data}")

  rc=$?

  if [[ $rc -eq 0 ]]; then
    encoded_jit_config=$(echo -en "$jit_runner_config" | jq -cr '.encoded_jit_config')
    log.debug 'Runner successfully configured.'
    break
  fi

  log.debug 'Configuration failed. Retrying'
  retries_left=$((RUNNER_CONFIG_RETRIES - 1))

  log.debug "Number of retries left before giving up -> ${retries_left} "
  sleep "${RUNNER_CONFIG_RETRY_INTERVAL_SECONDS}"
done

# unset the following to prevent them from being displayed/echoed from the runner environment
unset REPOSITORY ACCESS_TOKEN ORGANIZATION ENTERPRISE STARTUP_DELAY_IN_SECONDS jit_runner_config

log.notice "Spawning runner..."

mapfile -t env </etc/environment
env -- "${env[@]}" ./run.sh --jitconfig "${encoded_jit_config}" &

PID=$!
wait $PID
returnCode=$?

log.notice "Runner background process completed with retun code: $returnCode."
log.notice "Exiting with return code: $returnCode."

exit $returnCode