v8.0.0

8.0.0 (2026-10-21)

Release highlights

Version 2 of the Multi-runner system is the future direction for the project. This release introduces a more extensible, provider-based architecture that makes it easier to evolve runner configurations and add compute and orchestration options. V2 is currently experimental and enabled through an explicit feature gate, so its interfaces may evolve as it matures. We plan to deprecate multi-runner v1 in the future, so we recommend starting to evaluate and migrate to v2 now. Please share feedback on what we should improve.

Multi-runner v2: a more extensible foundation

Version 2 of the Multi-runner system separates shared runner configuration from compute and orchestration providers. This gives the project a clearer foundation for supporting different runner backends and evolving the architecture over time.

This release includes a v2 example and configuration guidance, along with migration tooling for existing v1 deployments. The migration process includes a dry run, collision checks, an optional state backup, and verification steps. V1 remains available for now, but we encourage you to try v2 and tell us where the configuration, migration experience, or capabilities could be better. (#5367, #5415)

More flexibility for runner workloads

• Experimental scale-set support: Deploy a scale-set controller on ECS Fargate and route jobs through the new provider architecture. The scale-set integration is experimental, and its interfaces and behavior may evolve. (#5299)
• Choose Spot or On-Demand per job: Use the ghr-ec2-capacity-type:spot or ghr-ec2-capacity-type:on-demand dynamic label to override a runner configuration's default for an individual job. (#5485)
• Configure advanced EC2 networking: Set network interfaces through runner configuration for more control over EC2 launch templates. (#5427)

Improved reliability and lifecycle management

GitHub App selection now considers observed rate-limit budgets, and requests can fail over when an app is rate-limited. Additional app credentials are loaded through an SSM manifest, avoiding Lambda environment-size limits as the app list grows. This release also adds an optional idle-confirmation window before runner termination and opt-in native SSM expiration policies for runner token parameters. (#5391, #5523, #5282, #5397, #5265)

Breaking change and upgrade note

Terraform 1.5.6 or later is now required. Upgrade Terraform before upgrading this module if you are running 1.5.5 or older. The Lambda MicroVM modules also require AWS provider version >= 6.33. (#5261)

Thank you

A massive thank-you to every contributor who helped make this version possible. Your code, reviews, testing, documentation, issue reports, and feedback have all moved the project forward. We especially appreciate everyone who helped build and refine this change, and everyone who tries it and shares ideas for making it better.

The detailed changelog below lists the full set of changes included in this release.

⚠ BREAKING CHANGES

• terraform: require Terraform 1.5.6 (#5261)

Features

• compute-providers: add AWS EC2 provider modules (#5343) (ffa299f)
• dynamic-labels: add a capacity-type label to choose spot or on-demand per job (#5485) (edecd36)
• dynamic-labels: add allow-list mode to the AWS dynamic labels policy (#5411) (05984f6)
• examples: add multi-runner-v2 example (#5367) (f2779cc)
• github-app: select app by rate limit budget (#5391) (668d8da)
• github-app: use ssm manifest for extra apps (#5282) (33c3332)
• multi-runner: add experimental config translation (#5284) (dd24d33)
• multi-runner: consume resolved experimental config (#5340) (ff8bfc2)
• multi-runner: move v1 state into v2 modules (#5415) (e8d7956)
• orchestration-providers: add webhook provider modules (#5344) (c05c9b3)
• runner-config: add provider-aware runner configuration (#5345) (42b1261)
• runners: add network_interfaces for advanced EC2 launch template configuration (#5427) (1e72c14)
• scale-down: opt-in idle confirmation window before terminating not-busy runners (#5397) (595f3e5)
• scale-set: add scale set orchestration in Terraform (#5299) (937fe15)
• storage: add runner config consumer (#5358) (138309c)
• support native SSM expiration policies for runner token parameters (#5265) (2dca7f9)
• terraform: add SSM storage provider boundary (#5454) (d04c5da)
• terraform: require Terraform 1.5.6 (#5261) (f335b32)

Bug Fixes

• allow null amd_sev_snp/nested_virtualization in cpu_options vali… (#5430) (0b5ec3d)
• control-plane: clarify partial runner creation test name (#5339) (b1dd396)
• deps: bump actions/deploy-pages from 5.0.0 to 5.0.1 in the github group (#5418) (1a691ea)
• deps: bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.8 (#5317) (fdb4385)
• deps: bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.5.0 to 2.5.1 (#5331) (1523a66)
• deps: bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#5319) (d798070)
• deps: bump step-security/harden-runner from 2.19.4 to 2.21.0 (#5318) (c81927a)
• deps: bump step-security/harden-runner from 2.19.4 to 2.21.1 (#5386) (48b0c42)
• deps: bump step-security/harden-runner from 2.21.1 to 2.22.1 (#5532) (5ccf8b3)
• deps: bump terraform-linters/setup-tflint from 6.3.0 to 6.3.1 (#5419) (5f0ecef)
• deps: bump terraform-linters/setup-tflint from 6.3.1 to 6.3.2 (#5515) (4c4191f)
• deps: bump the github group with 3 updates (#5330) (ab6edf5)
• deps: bump the github group with 3 updates (#5446) (7bb9280)
• deps: bump the github group with 3 updates (#5504) (aa08de3)
• deps: bump the github group with 5 updates (#5531) (c5b9a47)
• deps: bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#5387) (62aef5d)
• deps: bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#5447) (aa24dc0)
• ec2: avoid launch template tag conflict for on-demand capacity-type overrides (#5522) (dc9e820)
• ec2: improve failure observability (#5335) (91751ef)
• fail over rate-limited GitHub App requests (#5523) (7453956)
• fix typo in variable (#5462) (0786125)
• github-runner: record the rate-limit metric even when the call fails (#5426) (5026cd9)
• lambda: bump @babel/core from 7.23.9 to 7.29.7 in /lambdas (#5181) (3729cf7)
• lambda: bump @humanfs/node from 0.16.6 to 0.16.8 in /lambdas (#5336) (f7dd7cb)
• lambda: bump axios from 1.18.0 to 1.18.1 in /lambdas (#5223) (21d27f1)
• lambda: bump axios from 1.18.1 to 1.20.0 in /lambdas (#5502) (e2f9e5e)
• lambda: bump browserslist from 4.22.3 to 4.28.8 in /lambdas (#5329) (27e7d53)
• lambda: bump fast-uri from 3.1.2 to 3.1.5 in /lambdas (#5242) (9c3e28c)
• lambda: bump fast-uri from 3.1.5 to 3.1.6 in /lambdas (#5337) (07bbc87)
• lambda: bump fast-uri from 3.1.6 to 3.1.8 in /lambdas (#5488) (3062702)
• lambda: bump follow-redirects from 1.16.0 to 1.16.1 in /lambdas (#5540) (a7b6dea)
• lambda: bump js-yaml from 3.15.0 to 3.15.1 in /lambdas (#5264) (a3116bd)
• lambda: bump js-yaml from 3.15.1 to 3.15.2 in /lambdas (#5398) (3db123f)
• lambda: bump proxy-addr from 2.0.7 to 2.0.8 in /lambdas (#5510) (faf57cd)
• lambda: bump source-map-js from 1.2.1 to 1.2.2 in /lambdas (#5511) (e058e05)
• lambda: bump undici from 6.28.0 to 6.28.1 in /lambdas (#5489) (3ff5877)
• lambda: create log groups before functions (#5324) (2f844ab), closes #5323
• migration-test: preserve unreserved job retry concurrency (#5516) (feba645)
• multi-runner: gate v2 routing with experimental feature (#5404) (b448845)
• multi-runner: make v2 inputs independent (#5368) (45d3d0e)
• multi-runner: route v1 and v2 runners separately (#5346) (cfac174)
• pages: configure GitHub Pages deployment environment (#5334) (f081004)
• pool-lambda: grant permission to terminate failed EC2 runners (#5538) (0043890)
• re-indent commands in CONTRIBUTING.md guide (#5305) (547a98b)
• retain arm64 build coverage in lambda workflow (#5535) (80078d7)
• runners: guard SEGMENT against set -u in start-runner.sh (#5233) (182b37d)
• runners: support instance requirements in EC2 Fleet overrides (#5314) (4f80654)
• scale-set: implement review followups (#5477) (445269c)
• ssm: batch housekeeper parameter deletions (#5469) (28a5135)
• ssm: delete expired runner parameters as pages are listed (#5464) (d815b76)
• ssm: restore incremental housekeeper cleanup (#5508) (22b9310)
• storage: add SSM adapter diagnostics (#5385) (d08be31)
• webhook: cache only a successful config load (#5519) (a2fea96)

Attestation

Attestation url: https://github.com/github-aws-runners/terraform-aws-github-runner/attestations/58560720
Verify the artifacts by running gh attestation verify <name_of_artifact> --repo github-aws-runners/terraform-aws-github-runner