feat(microvm): add lifecycle hook service

.github/workflows/lambda.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install dependencies
-        run: yarn install --frozen-lockfile
+        run: yarn install --immutable --mode=skip-build
       - name: Run prettier
         run: yarn format-check
       - name: Run linter
@@ -50,3 +50,42 @@ jobs:
           name: coverage-reports
           path: ./**/coverage
           retention-days: 5
+
+  microvm-lifecycle-hooks:
+    name: Build MicroVM lifecycle hook
+    runs-on: ubuntu-latest
+    container:
+      image: node:24@sha256:aa648b387728c25f81ff811799bbf8de39df66d7e2d9b3ab55cc6300cb9175d9
+    defaults:
+      run:
+        working-directory: ./lambdas
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install dependencies
+        run: yarn install --immutable --mode=skip-build
+
+      - name: Run prettier
+        run: yarn prettier --check "services/microvm-lifecycle-hooks/**/*.{ts,json,md}"
+
+      - name: Run linter
+        run: yarn eslint services/microvm-lifecycle-hooks/src
+
+      - name: Run tests
+        run: yarn nx test @aws-github-runner/microvm-lifecycle-hooks
+
+      - name: Build distribution
+        run: yarn workspace @aws-github-runner/microvm-lifecycle-hooks build
+
+      - name: Verify server distribution
+        run: |
+          test -s services/microvm-lifecycle-hooks/dist/server.js
+          test -f services/microvm-lifecycle-hooks/dist/package.json

.github/workflows/ministack.yml

@@ -51,15 +51,13 @@ jobs:
           - prebuilt
           - default
           - ephemeral
-          - microvm
           - microvm-foundation
           - migration-test
           - multi-runner
-          - multi-runner-v2
           - termination-watcher
     services:
       ministack:
-        image: ghcr.io/ministackorg/ministack:1.5.13@sha256:ce3c906f2866ff953ce4c56f06b1fa3e453bc32e41c00de17b5f5a8672c5a42c
+        image: ghcr.io/ministackorg/ministack:1.5.16@sha256:9813da34285a0760477c761c1c03717e0290d259213c0ca97f551fefd87b292d
         ports:
           - 4566:4566
         env:

.github/workflows/release.yml

@@ -37,7 +37,21 @@ jobs:
           persist-credentials: false
       - name: Build dist
         working-directory: lambdas
-        run: yarn install --frozen-lockfile && yarn run test && yarn dist
+        run: yarn install --immutable --mode=skip-build && yarn run test && yarn dist
+
+      - name: Build MicroVM lifecycle hook
+        working-directory: lambdas
+        run: yarn workspace @aws-github-runner/microvm-lifecycle-hooks build
+
+      - name: Verify MicroVM lifecycle hook distribution
+        working-directory: lambdas
+        run: |
+          test -s services/microvm-lifecycle-hooks/dist/server.js
+          test -f services/microvm-lifecycle-hooks/dist/package.json
+
+      - name: Package MicroVM lifecycle hook
+        working-directory: lambdas/services/microvm-lifecycle-hooks
+        run: (cd dist && zip -r ../microvm-lifecycle-hooks.zip .)
       - name: Get installation token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: token
@@ -61,35 +75,48 @@ jobs:
         uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: '${{ github.workspace }}/lambdas/functions/**/*.zip'
+
+      - name: Attest MicroVM lifecycle hook
+        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        id: lifecycle-hook-attest
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: '${{ github.workspace }}/lambdas/services/microvm-lifecycle-hooks/microvm-lifecycle-hooks.zip'
+
       - name: Update release notes with attestation
         if: ${{ steps.release.outputs.releases_created == 'true' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ github.event.inputs.version }}
           TAG_NAME: ${{ steps.release.outputs.tag_name }}
           ATTESTATION_URL: ${{ steps.attest.outputs.attestation-url }}
+          LIFECYCLE_HOOK_ATTESTATION_URL: ${{ steps.lifecycle-hook-attest.outputs.attestation-url }}
           REPOSITORY: ${{ github.repository }}
         run: |
-          version="${VERSION}"
           tag_name="${TAG_NAME}"
           attestation_url="${ATTESTATION_URL}"
+          lifecycle_hook_attestation_url="${LIFECYCLE_HOOK_ATTESTATION_URL}"
           repository="${REPOSITORY}"
-          gh release view $version --json body -q '.body' > new-release-notes.md
+          gh release view "$tag_name" --json body -q '.body' > new-release-notes.md
           echo "## Attestation" >> new-release-notes.md
-          echo "Attestation url: $attestation_url" >> new-release-notes.md
+          echo "Lambda attestation url: $attestation_url" >> new-release-notes.md
+          echo "MicroVM lifecycle hook attestation url: $lifecycle_hook_attestation_url" >> new-release-notes.md
           echo "Verify the artifacts by running \`gh attestation verify <name_of_artifact> --repo ${repository}\`" >> new-release-notes.md
-          gh release edit $tag_name -F new-release-notes.md -t $tag_name
+          gh release edit "$tag_name" -F new-release-notes.md -t "$tag_name"
+
       - name: Upload release assets
         if: ${{ steps.release.outputs.releases_created == 'true' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG_NAME: ${{ steps.release.outputs.tag_name }}
         run: |
           tag_name="${TAG_NAME}"
-          for f in $(find . -name '*.zip'); do
-            gh release upload $tag_name $f
-          done
-      - name: Attach attestation
+          while IFS= read -r -d '' f; do
+            gh release upload "$tag_name" "$f"
+          done < <(find lambdas/functions -name '*.zip' -print0)
+          gh release upload "$tag_name" \
+            "lambdas/services/microvm-lifecycle-hooks/microvm-lifecycle-hooks.zip"
+
+      - name: Attach Lambda attestation
         if: ${{ steps.release.outputs.releases_created == 'true' }}
         env:
           ATTESTATION_BUNDLE: ${{ steps.attest.outputs.bundle-path }}
@@ -99,13 +126,26 @@ jobs:
         run: |
           # rename attest bundle to github-aws-runners-terraform-aws-github-runner-attestation-$attestation-id.sigstore
           # OpenSSF expects the attestation bundle to be named in this format (*.sigstore)
-          SIGSTORE_BUNDLE=$RUNNER_TEMP/github-aws-runners-terraform-aws-github-runner-attestation-${ATTESTATION_ID}.sigstore
-          INTOTO_BUNDLE=$RUNNER_TEMP/github-aws-runners-terraform-aws-github-runner-attestation-${ATTESTATION_ID}.intoto.jsonl
-          mv ${ATTESTATION_BUNDLE} $SIGSTORE_BUNDLE
-          if [ -z "$SIGSTORE_BUNDLE" ]; then
-            echo "No attestation bundle found, skipping attachment."
-            exit 0
-          fi
-          gh release upload $TAG_NAME "$SIGSTORE_BUNDLE"
-          cat ${SIGSTORE_BUNDLE} | jq -r '.dsseEnvelope | select(.payloadType == "application/vnd.in-toto+json").payload' | base64 -d | jq .> ${INTOTO_BUNDLE}
-          gh release upload $TAG_NAME "${INTOTO_BUNDLE}"
+          sigstore_bundle="$RUNNER_TEMP/github-aws-runners-terraform-aws-github-runner-attestation-${ATTESTATION_ID}.sigstore"
+          intoto_bundle="$RUNNER_TEMP/github-aws-runners-terraform-aws-github-runner-attestation-${ATTESTATION_ID}.intoto.jsonl"
+          cp "$ATTESTATION_BUNDLE" "$sigstore_bundle"
+          gh release upload "$TAG_NAME" "$sigstore_bundle"
+          jq -r '.dsseEnvelope | select(.payloadType == "application/vnd.in-toto+json").payload' "$sigstore_bundle" \
+            | base64 --decode > "$intoto_bundle"
+          gh release upload "$TAG_NAME" "$intoto_bundle"
+
+      - name: Attach MicroVM lifecycle hook attestation
+        if: ${{ steps.release.outputs.releases_created == 'true' }}
+        env:
+          ATTESTATION_BUNDLE: ${{ steps.lifecycle-hook-attest.outputs.bundle-path }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ steps.release.outputs.tag_name }}
+          ATTESTATION_ID: ${{ steps.lifecycle-hook-attest.outputs.attestation-id }}
+        run: |
+          sigstore_bundle="$RUNNER_TEMP/github-aws-runners-microvm-lifecycle-hooks-attestation-${ATTESTATION_ID}.sigstore"
+          intoto_bundle="$RUNNER_TEMP/github-aws-runners-microvm-lifecycle-hooks-attestation-${ATTESTATION_ID}.intoto.jsonl"
+          cp "$ATTESTATION_BUNDLE" "$sigstore_bundle"
+          gh release upload "$TAG_NAME" "$sigstore_bundle"
+          jq -r '.dsseEnvelope | select(.payloadType == "application/vnd.in-toto+json").payload' "$sigstore_bundle" \
+            | base64 --decode > "$intoto_bundle"
+          gh release upload "$TAG_NAME" "$intoto_bundle"

.github/workflows/smoke-tests.yml

@@ -2,7 +2,13 @@ name: "Smoke Tests"
 
 on:
   pull_request:
-    paths: ["**/*.tf", "**/*.hcl", ".github/workflows/smoke-tests.yml"]
+    paths:
+      - "**/*.tf"
+      - "**/*.hcl"
+      - "images/microvm-ubuntu/**"
+      - "lambdas/**"
+      - "tests/ministack/**"
+      - ".github/workflows/smoke-tests.yml"
   workflow_dispatch:
 
 concurrency:
@@ -26,10 +32,10 @@ jobs:
   control_plane_smoke:
     name: Run webhook and pool lifecycle smoke test against MiniStack
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    timeout-minutes: 120
     services:
       ministack:
-        image: ghcr.io/ministackorg/ministack:1.5.13@sha256:ce3c906f2866ff953ce4c56f06b1fa3e453bc32e41c00de17b5f5a8672c5a42c
+        image: ghcr.io/ministackorg/ministack:1.5.16@sha256:9813da34285a0760477c761c1c03717e0290d259213c0ca97f551fefd87b292d
         ports:
           - 4566:4566
         options: --add-host=host.docker.internal:host-gateway
@@ -59,15 +65,9 @@ jobs:
           terraform_version: latest
           terraform_wrapper: false
 
-      - name: Install Lambda dependencies
-        working-directory: lambdas
-        run: yarn install --frozen-lockfile
-
-      - name: Build smoke-test Lambda distributions
-        working-directory: lambdas
+      - name: Build Lambda distributions for smoke tests
         run: |
-          yarn workspace @aws-github-runner/webhook dist
-          yarn workspace @aws-github-runner/control-plane dist
+          ./.ci/build.sh
 
       - name: Start MockServer
         id: mockserver
@@ -77,9 +77,28 @@ jobs:
           port: '1080'
           startup-timeout: '60'
 
+      - name: Install boto3
+        run: python3 -m pip install --upgrade boto3 botocore
+
+      - name: Set up ARM64 emulation
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
+        with:
+          platforms: arm64
+
       - name: Run webhook and pool lifecycle smoke test
         env:
           MINISTACK_GITHUB_MOCK_HOST: host.docker.internal
           MINISTACK_GITHUB_MOCK_PORT: "1080"
           MINISTACK_GITHUB_MOCK_URL: ${{ steps.mockserver.outputs.url }}
-        run: sh tests/ministack/run-smoke.sh
+        run: python3 tests/ministack/run-webhook-smoke.py
+
+      - name: Upload MiniStack smoke diagnostics
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ministack-smoke-diagnostics
+          path: |
+            ministack-smoke.log
+            ministack-smoke-checklist.txt
+          if-no-files-found: warn
+          retention-days: 7

.github/workflows/terraform.yml

@@ -50,10 +50,8 @@ env:
     prebuilt
     ephemeral
     termination-watcher
-    microvm
     microvm-foundation
     multi-runner
-    multi-runner-v2
     external-managed-ssm-secrets
   TEST_MODULES: |
     modules/runners

.gitignore

@@ -29,3 +29,7 @@ secrets.auto.tfvars
 
 node_modules/
 site/
+
+__pycache__/
+ministack-smoke-checklist.txt
+ministack-smoke.log

docs/examples/index.md

@@ -5,11 +5,10 @@ Examples are located in the [examples](https://github.com/github-aws-runners/ter
 - _[Default](default.md)_: The default example of the module
 - _[Ephemeral](ephemeral.md)_: Example usages of ephemeral runners based on the default example.
 - _[Multi Runner](multi-runner.md)_ : Example usage of creating a multi runner which creates multiple runners/ configurations with a single deployment. The examples including: "arm64", "windows", and "ubuntu" runners.
-- _[Multi Runner v2](multi-runner-v2.md)_ : Example usage of the experimental v2 multi-runner configuration interface with shared defaults and per-lane overrides.
+- _[Multi Runner Webhook](multi-runner-webhook.md)_: Example usage of one webhook deployment serving EC2 and Lambda MicroVM runner lanes.
 - _[Permissions boundary](permissions-boundary.md)_: Example usages of permissions boundaries.
 - _[Prebuilt Images](prebuilt.md)_: Example usages of deploying runners with a custom prebuilt image.
 - _[Termination watcher](termination-watcher.md)_: Example usages of termination watcher.
 - _[Dedicated Mac Hosts](dedicated-mac-hosts.md)_: Example usage of setting up dedicated hosts for macOS runners.
 - _[Externally managed SSM secrets](external-managed-ssm-secrets.md)_: Example usage of externally managed SSM secrets for the GitHub App credentials.
 - _[MicroVM foundation](microvm-foundation.md)_: Example usage of the regional Lambda MicroVM image-build and Network Connector prerequisites.
-- _[Lambda MicroVM](microvm.md)_: Example usage of Linux ARM64 ephemeral runners backed by Lambda MicroVM images.

docs/examples/multi-runner-webhook.md

@@ -0,0 +1 @@
+--8<-- "examples/multi-runner-webhook/README.md"