feat(github-app): allow several github apps to be used - #5269
Merged
Conversation
…tftest - Restore iam_overrides conditional and aws_iam_role.runner[0].arn index in scale-up IAM policy (dropped during conflict resolution) - Update pool.tftest.hcl github_app_parameters to list format
- modules/ssm/outputs.tf: use tostring(idx) when indexing for_each resources keyed by stringified indices; bare numeric [idx] would fail with an invalid-index error when additional_github_apps is non-empty - pool.ts: pass appIdx as trailing arg to createRunners so pool-originated JIT-config rate-limit metrics are attributed to the correct app rather than always defaulting to app 0 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…termination-watcher list mismatch The local.github_app_parameters restructure (id/key_base64 became lists, index 0 = primary app) silently broke four consumers of the old single-object shape, none caught by CI since validate defers value evaluation: - outputs.tf: ssm_parameters iterated lists as objects (v.name on a list fails at plan/apply); replace with merge() that keeps the upstream keys id/key_base64/webhook_secret pointing at the primary app plus the new per-app github_app_id_<idx>/github_app_key_base64_<idx>/github_app_webhook_secret keys - modules/multi-runner/outputs.tf: add the same backward-compat keys to the existing merge() so external consumers indexing the old keys keep working - main.tf + modules/multi-runner/termination-watcher.tf: pass id[0]/key_base64[0] (primary app single object) instead of the full list to the termination-watcher module input typed map(string) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Merge PR #5038 onto main, porting the multi-app changes to the compute-provider architecture and restoring the stale-installation 404 fallback. Co-authored-by: Thomas Nemer <thomas.nemer@doctolib.com>
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Brend-Smits
approved these changes
Aug 14, 2026
Brend-Smits
left a comment
Brend-Smits
left a comment
Contributor
There was a problem hiding this comment.
LGTM 
! Thanks for picking this up! Also thanks to @thomasnemer 🚀
Brend-Smits
pushed a commit
that referenced
this pull request
Aug 17, 2026
🤖 I have created a release *beep* *boop* --- ## [7.11.0](v7.10.2...v7.11.0) (2026-08-14) ### Features * **github-app:** allow several github apps to be used ([#5269](#5269)) ([82cb0fd](82cb0fd)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: runners-releaser[bot] <194412594+runners-releaser[bot]@users.noreply.github.com>
This was referenced Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Supersedes #5038 by @thomasnemer, whose branch lives in an org-owned fork that maintainers cannot push to. This PR rebases that work onto current
main(porting it to the compute-provider architecture introduced in #5234/#5267) and addresses the review feedback on #5038. All of Thomas's work is preserved with co-authorship.From the original PR:
additional_github_appsvariable (optional, no breaking changes) accepts extra GitHub Apps withid,key_base64, and optionallyinstallation_id(direct values or SSM references).installation_idwins, the primary app reuses the webhook payload's id, API lookup is the fallback.Changes on top of #5038:
appIndexselection lives in the orchestrators (scale-up.ts,pool.ts,scale-down.ts) and flows to providers viaCreateGitHubRunnerConfig.appIndex, so provider interfaces are unchanged.octokit.test.ts.COMPUTE_PROVIDER_TYPEera and regenerated module docs.Test Plan
vitest: control-plane 348 passed, compute-providers 270 passed, webhook 89 passed.terraform fmt -check -recursive,terraform validate(root, runners, multi-runner, ssm),terraform testinmodules/runners(1 passed).Related Issues
Closes #5037. Supersedes #5038.
Co-authored with @thomasnemer.