feat: Allow Lambda provider to use any version of Linux

.projenrc.js

@@ -119,6 +119,7 @@ releaseWorkflow.file.addDeletionOverride('on.push');
 
 // bundle docker images
 project.bundler.bundleTask.exec('cp -r src/providers/docker-images assets');
+project.bundler.bundleTask.exec('cp -r src/providers/lambda-*.sh assets/providers');
 
 // set proper line endings
 project.gitattributes.addAttributes('*.js', 'eol=lf');

src/image-builders/components.ts

@@ -509,7 +509,7 @@ export abstract class RunnerImageComponent {
       name = 'Lambda-Entrypoint';
 
       getCommands(os: Os, _architecture: Architecture) {
-        if (!os.is(Os.LINUX_AMAZON_2) && !os.is(Os.LINUX_AMAZON_2023) && !os.is(Os.LINUX_UBUNTU)) {
+        if (!os.isIn(Os._ALL_LINUX_VERSIONS)) {
           throw new Error(`Unsupported OS for Lambda entrypoint: ${os.name}`);
         }
 
@@ -519,20 +519,19 @@ export abstract class RunnerImageComponent {
       getAssets(_os: Os, _architecture: Architecture): RunnerImageAsset[] {
         return [
           {
-            source: path.join(__dirname, '..', '..', 'assets', 'docker-images', 'lambda', 'linux-x64', 'runner.js'),
-            target: '${LAMBDA_TASK_ROOT}/runner.js',
+            source: path.join(__dirname, '..', '..', 'assets', 'providers', 'lambda-bootstrap.sh'),
+            target: '/bootstrap.sh',
           },
           {
-            source: path.join(__dirname, '..', '..', 'assets', 'docker-images', 'lambda', 'linux-x64', 'runner.sh'),
-            target: '${LAMBDA_TASK_ROOT}/runner.sh',
+            source: path.join(__dirname, '..', '..', 'assets', 'providers', 'lambda-runner.sh'),
+            target: '/runner.sh',
           },
         ];
       }
 
       getDockerCommands(_os: Os, _architecture: Architecture): string[] {
         return [
-          'WORKDIR ${LAMBDA_TASK_ROOT}',
-          'CMD ["runner.handler"]',
+          'ENTRYPOINT ["bash", "/bootstrap.sh"]',
         ];
       }
     };

src/providers/lambda-bootstrap.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -euo pipefail
+
+while true
+do
+  # get data from lambda
+  HEADERS="$(mktemp)"
+  EVENT_DATA=$(curl -sS -LD "$HEADERS" "http://${AWS_LAMBDA_RUNTIME_API}/2018-06-01/runtime/invocation/next")
+  REQUEST_ID=$(grep -Fi Lambda-Runtime-Aws-Request-Id "$HEADERS" | tr -d '[:space:]' | cut -d: -f2)
+
+  # execute runner and respond
+  if bash /runner.sh "$EVENT_DATA"; then
+    curl "http://${AWS_LAMBDA_RUNTIME_API}/2018-06-01/runtime/invocation/$REQUEST_ID/response" -d ""
+  else
+    curl "http://${AWS_LAMBDA_RUNTIME_API}/2018-06-01/runtime/invocation/$REQUEST_ID/error" -d "{\"errorMessage\": \"Runner failed with exit code $?\", \"errorType\": \"Error\", \"stackTrace\": []}"
+  fi
+
+  # cleanup
+  find /tmp -mindepth 1 -maxdepth 1 -exec rm -rf '{}' \;
+done

src/providers/lambda-runner.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -euo pipefail
+
+# workaround for "Cannot get required symbol EVP_rc2_cbc from libssl"
+# lambda docker image for node.js comes with stripped down libssl.so pushed in LD_LIBRARY_PATH
+if [ -f /var/lang/lib/libssl.so ]; then
+  export LD_LIBRARY_PATH=/usr/lib64:$LD_LIBRARY_PATH
+fi
+
+# extract parameters
+OWNER=$(echo "$1" | jq -r .owner)
+REPO=$(echo "$1" | jq -r .repo)
+GITHUB_DOMAIN=$(echo "$1" | jq -r .githubDomain)
+RUNNER_TOKEN=$(echo "$1" | jq -r .token)
+RUNNER_NAME=$(echo "$1" | jq -r .runnerName)
+RUNNER_LABEL=$(echo "$1" | jq -r .label)
+REGISTRATION_URL=$(echo "$1" | jq -r .registrationUrl)
+
+# copy runner code (it needs a writable directory)
+cp -r /home/runner /tmp/
+cd /tmp/runner
+
+# setup home directory
+mkdir /tmp/home
+export HOME=/tmp/home
+
+# start runner
+if [ "${RUNNER_VERSION}" = "latest" ]; then RUNNER_FLAGS=""; else RUNNER_FLAGS="--disableupdate"; fi
+./config.sh --unattended --url "${REGISTRATION_URL}" --token "${RUNNER_TOKEN}" --ephemeral --work _work --labels "${RUNNER_LABEL},cdkghr:started:`date +%s`" --name "${RUNNER_NAME}" ${RUNNER_FLAGS}
+echo Config done
+./run.sh
+echo Run done
+
+# print status for metrics
+STATUS=$(grep -Phors "finish job request for job [0-9a-f\-]+ with result: \K.*" _diag/ | tail -n1)
+[ -n "$STATUS" ] && echo CDKGHA JOB DONE "$RUNNER_LABEL" "$STATUS"

src/providers/lambda.ts

@@ -153,7 +153,7 @@ export class LambdaRunnerProvider extends BaseProvider implements IRunnerProvide
    *
    * You can add components to the image builder by calling `imageBuilder.addComponent()`.
    *
-   * The default OS is Amazon Linux 2 running on x64 architecture.
+   * The default OS is Amazon Linux 2023 running on x64 architecture.
    *
    * Included components:
    *  * `RunnerImageComponent.requiredPackages()`
@@ -163,24 +163,11 @@ export class LambdaRunnerProvider extends BaseProvider implements IRunnerProvide
    *  * `RunnerImageComponent.awsCli()`
    *  * `RunnerImageComponent.githubRunner()`
    *  * `RunnerImageComponent.lambdaEntrypoint()`
-   *
-   *  Base Docker image: `public.ecr.aws/lambda/nodejs:20-x86_64` or `public.ecr.aws/lambda/nodejs:20-arm64`
    */
   public static imageBuilder(scope: Construct, id: string, props?: RunnerImageBuilderProps) {
-    if (props?.os && !Os.LINUX_AMAZON_2.is(props.os) && !props?.baseDockerImage) {
-      // TODO we can support Ubuntu by building our own image https://docs.aws.amazon.com/lambda/latest/dg/nodejs-image.html#nodejs-image-clients
-      throw new Error('Lambda runner provider only supports Amazon Linux 2. Use a different provider or specify a custom `baseDockerImage` that supports your desired OS.');
-    }
-
-    let baseDockerImage = 'public.ecr.aws/lambda/nodejs:20-x86_64';
-    if (props?.architecture === Architecture.ARM64) {
-      baseDockerImage = 'public.ecr.aws/lambda/nodejs:20-arm64';
-    }
-
     return RunnerImageBuilder.new(scope, id, {
       os: Os.LINUX_AMAZON_2023,
-      architecture: props?.architecture ?? Architecture.X86_64,
-      baseDockerImage,
+      architecture: Architecture.X86_64,
       components: [
         RunnerImageComponent.requiredPackages(),
         RunnerImageComponent.runnerUser(),

test/default.integ.snapshot/github-runners-test.assets.json

@@ -40,28 +40,28 @@
         }
       }
     },
-    "68628bab8c925c01632702a86513d4b22840e7fbb138f290bab11c2c2d54c489": {
+    "2fc3b84da69dcc5adb6dc4721b50c1166474fa7e5fd5f242e833d12ac28e09d9": {
       "source": {
-        "path": "asset.68628bab8c925c01632702a86513d4b22840e7fbb138f290bab11c2c2d54c489.js",
+        "path": "asset.2fc3b84da69dcc5adb6dc4721b50c1166474fa7e5fd5f242e833d12ac28e09d9.sh",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "68628bab8c925c01632702a86513d4b22840e7fbb138f290bab11c2c2d54c489.js",
+          "objectKey": "2fc3b84da69dcc5adb6dc4721b50c1166474fa7e5fd5f242e833d12ac28e09d9.sh",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
     },
-    "66540a3450c33faeefad87df9de8684f624030603c76336933c519972d85a072": {
+    "7be6b27ef13a5bba7f44b1d9c6e50fc2c68fdb40d51cef42cee01f27c38842a9": {
       "source": {
-        "path": "asset.66540a3450c33faeefad87df9de8684f624030603c76336933c519972d85a072.sh",
+        "path": "asset.7be6b27ef13a5bba7f44b1d9c6e50fc2c68fdb40d51cef42cee01f27c38842a9.sh",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "66540a3450c33faeefad87df9de8684f624030603c76336933c519972d85a072.sh",
+          "objectKey": "7be6b27ef13a5bba7f44b1d9c6e50fc2c68fdb40d51cef42cee01f27c38842a9.sh",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
@@ -209,15 +209,15 @@
         }
       }
     },
-    "54ea0c28666f3fa077b83dbc9a02d3d6d3304dbd52deb343fc69e6a7ca821b0e": {
+    "8368627222f528d1ca1bdcdde41640c2fe68400d3d98ed2e5699e5ff524c02f3": {
       "source": {
         "path": "github-runners-test.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "54ea0c28666f3fa077b83dbc9a02d3d6d3304dbd52deb343fc69e6a7ca821b0e.json",
+          "objectKey": "8368627222f528d1ca1bdcdde41640c2fe68400d3d98ed2e5699e5ff524c02f3.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }