Sync github_runner profile to modules/ (all environments now identical)

[akuzminsky]

Final step of the promotion path for the bounded boot security upgrade. It has been running in development and sandbox; modules/ was the last copy still on the old unbounded exec.

Two files copied from environments/development, after confirming the global copy had no divergence of its own to clobber:

• manifests/github_runner.pp — bounded exec
• files/github_runner/gha-boot-security-upgrade.sh — new

github_runner is now byte-identical across modules/, environments/development and environments/sandbox.

What changes for production runners

The old exec had timeout => 1200, so one attempt could consume the entire ASG bootstrap lifecycle-hook budget, and adding tries on top would have multiplied that with no cumulative cap. The replacement caps total wall clock at 540s and retries inside it.

That bound matters because a resource failure here is not a slow run — ih-puppet applies with --detailed-exitcodes and exits 4/6 on failure, which trips ih-bootstrap.sh's trap _ih_signal_abandon ERR and ABANDONs the instance immediately.

Validation before promoting

Real gha_runner bootstraps in both environments:

• script deploys, Exec[gha-boot-security-upgrade] succeeds
• the /run/gha-boot-upgrade.done marker stops it re-running on the second catalog pass
• bootstrap lifecycle hook completes CONTINUE

Bounding logic separately verified against stubbed apt-get/unattended-upgrade, 10/10 checks — gives up at its budget with no marker written, retries through transient failure, no needless delay on the fast path, and a hung command cannot overshoot the deadline (exits at 25s against a 600s sleep).

puppet-lint --fail-on-warnings clean on all four module dirs; shellcheck clean.

Deliberately not included

profile::apt_lock_timeout and the profile::repos change that declares it stay development+sandbox only. Production runners therefore get the bounded upgrade without the apt lock timeout. That is still better than today: a lock collision currently fails apt-get instantly and ABANDONs, whereas the bounded script retries and may well succeed. It just is not the full fix yet.

Known, unchanged by this PR

needrestart can restart cloud-final.service mid-bootstrap when the boot upgrade pulls a library — which kills the provisioning run, since that service is the bootstrap. Observed on a sandbox runner. This is pre-existing rather than introduced here, because the old exec ran the same unattended-upgrade; promoting neither causes nor fixes it. Tracked separately.

Refs #289

🤖 Generated with Claude Code