fix: Show consistent setup information for Windows and macOS runners

README.md

@@ -113,7 +113,7 @@ Join our discord community via [this invite link](https://discord.gg/bxgXW8jJGh)
 | <a name="input_ami_housekeeper_lambda_timeout"></a> [ami\_housekeeper\_lambda\_timeout](#input\_ami\_housekeeper\_lambda\_timeout) | Time out of the lambda in seconds. | `number` | `300` | no |
 | <a name="input_ami_housekeeper_lambda_zip"></a> [ami\_housekeeper\_lambda\_zip](#input\_ami\_housekeeper\_lambda\_zip) | File location of the lambda zip file. | `string` | `null` | no |
 | <a name="input_associate_public_ipv4_address"></a> [associate\_public\_ipv4\_address](#input\_associate\_public\_ipv4\_address) | Associate public IPv4 with the runner. Only tested with IPv4 | `bool` | `false` | no |
-| <a name="input_aws_dynamic_labels_policy"></a> [aws\_dynamic\_labels\_policy](#input\_aws\_dynamic\_labels\_policy) | Experimental! Can be removed / changed without trigger a major release.<br/>Optional AWS dynamic label policy evaluated by the webhook dispatcher.<br/>Only effective when `enable_dynamic_labels = true`.<br/><br/>Jobs whose provider-specific dynamic labels violate the policy are rejected<br/>with a 202 and a warning is logged. Currently this policy applies to EC2<br/>override labels using the `ghr-ec2-*` prefix.<br/><br/>Evaluation:<br/>  1. Keys in `blocked_keys` are always rejected.<br/>  2. Keys in `restricted_keys` are allowed only when their value passes the rule.<br/>  3. Keys not listed in `blocked_keys` or `restricted_keys` are allowed.<br/><br/>Schema:<br/>  - `blocked_keys`: keys to reject outright.<br/>  - `restricted_keys`: map of key to value rule:<br/>      `{ allowed = [globs], denied = [globs], max = number|string }`.<br/><br/>Keys use the provider dynamic label suffix, not the full label. For example,<br/>use `instance-type` for `ghr-ec2-instance-type`. | `any` | `null` | no |
+| <a name="input_aws_dynamic_labels_policy"></a> [aws\_dynamic\_labels\_policy](#input\_aws\_dynamic\_labels\_policy) | Experimental! Can be removed / changed without trigger a major release.<br/>Optional AWS dynamic label policy evaluated by the webhook dispatcher.<br/>Only effective when `enable_dynamic_labels = true`.<br/><br/>Jobs whose provider-specific dynamic labels violate the policy are rejected<br/>with a 202 and a warning is logged. Currently this policy applies to EC2<br/>override labels using the `ghr-ec2-*` prefix.<br/><br/>Evaluation:<br/>  1. If `allowed_keys` is set (non-empty), any key not listed in it is rejected;<br/>     everything else in the policy still applies to the keys it does allow.<br/>  2. Keys in `blocked_keys` are always rejected. Cannot be used together with<br/>     `allowed_keys` — see `docs/configuration.md` for why.<br/>  3. Keys in `restricted_keys` are allowed only when their value passes the rule.<br/>  4. A key not listed anywhere above is allowed.<br/><br/>Schema:<br/>  - `allowed_keys`: only these keys are accepted; every other key is rejected.<br/>  - `blocked_keys`: keys to reject outright.<br/>  - `restricted_keys`: map of key to value rule:<br/>      `{ allowed = [globs], denied = [globs], max = number|string }`.<br/><br/>Keys use the provider dynamic label suffix, not the full label. For example,<br/>use `instance-type` for `ghr-ec2-instance-type`. | `any` | `null` | no |
 | <a name="input_aws_partition"></a> [aws\_partition](#input\_aws\_partition) | (optiona) partition in the arn namespace to use if not 'aws' | `string` | `"aws"` | no |
 | <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | AWS region. | `string` | n/a | yes |
 | <a name="input_block_device_mappings"></a> [block\_device\_mappings](#input\_block\_device\_mappings) | The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`, `volume_initialization_rate`. | <pre>list(object({<br/>    delete_on_termination      = optional(bool, true)<br/>    device_name                = optional(string, "/dev/xvda")<br/>    encrypted                  = optional(bool, true)<br/>    iops                       = optional(number)<br/>    kms_key_id                 = optional(string)<br/>    snapshot_id                = optional(string)<br/>    throughput                 = optional(number)<br/>    volume_initialization_rate = optional(number)<br/>    volume_size                = number<br/>    volume_type                = optional(string, "gp3")<br/>  }))</pre> | <pre>[<br/>  {<br/>    "volume_size": 30<br/>  }<br/>]</pre> | no |
@@ -210,6 +210,7 @@ Join our discord community via [this invite link](https://discord.gg/bxgXW8jJGh)
 | <a name="input_runner_log_files"></a> [runner\_log\_files](#input\_runner\_log\_files) | (optional) List of logfiles to send to CloudWatch, will only be used if `enable_cloudwatch_agent` is set to true. Object description: `log_group_name`: Name of the log group, `prefix_log_group`: If true, the log group name will be prefixed with `/github-self-hosted-runners/<var.prefix>`, `file_path`: path to the log file, `log_stream_name`: name of the log stream, `log_class`: The log class of the log group. Valid values are `STANDARD` or `INFREQUENT_ACCESS`. Defaults to `STANDARD`. | <pre>list(object({<br/>    log_group_name   = string<br/>    prefix_log_group = bool<br/>    file_path        = string<br/>    log_stream_name  = string<br/>    log_class        = optional(string, "STANDARD")<br/>  }))</pre> | `null` | no |
 | <a name="input_runner_metadata_options"></a> [runner\_metadata\_options](#input\_runner\_metadata\_options) | Metadata options for the ec2 runner instances. By default, the module uses metadata tags for bootstrapping the runner, only disable `instance_metadata_tags` when using custom scripts for starting the runner. | `map(any)` | <pre>{<br/>  "http_endpoint": "enabled",<br/>  "http_put_response_hop_limit": 1,<br/>  "http_tokens": "required",<br/>  "instance_metadata_tags": "enabled"<br/>}</pre> | no |
 | <a name="input_runner_name_prefix"></a> [runner\_name\_prefix](#input\_runner\_name\_prefix) | The prefix used for the GitHub runner name. The prefix will be used in the default start script to prefix the instance name when register the runner in GitHub. The value is available via an EC2 tag 'ghr:runner\_name\_prefix'. | `string` | `""` | no |
+| <a name="input_runner_network_interfaces"></a> [runner\_network\_interfaces](#input\_runner\_network\_interfaces) | Advanced network interface configuration for the runner launch template. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#network-interfaces for details. Leave unset (default) to keep using associate\_public\_ipv4\_address for a simple single-interface setup; set this to fully control one or more interfaces. | <pre>list(object({<br/>    associate_carrier_ip_address = optional(bool)<br/>    associate_public_ip_address  = optional(bool)<br/>    delete_on_termination        = optional(bool)<br/>    description                  = optional(string)<br/>    device_index                 = optional(number)<br/>    interface_type               = optional(string)<br/>    ipv4_address_count           = optional(number)<br/>    ipv4_addresses               = optional(list(string))<br/>    ipv4_prefix_count            = optional(number)<br/>    ipv4_prefixes                = optional(list(string))<br/>    ipv6_address_count           = optional(number)<br/>    ipv6_addresses               = optional(list(string))<br/>    ipv6_prefix_count            = optional(number)<br/>    ipv6_prefixes                = optional(list(string))<br/>    network_card_index           = optional(number)<br/>    network_interface_id         = optional(string)<br/>    primary_ipv6                 = optional(bool)<br/>    private_ip_address           = optional(string)<br/>    security_groups              = optional(list(string))<br/>    subnet_id                    = optional(string)<br/>    connection_tracking_specification = optional(object({<br/>      tcp_established_timeout = optional(number)<br/>      udp_stream_timeout      = optional(number)<br/>      udp_timeout             = optional(number)<br/>    }))<br/>    ena_srd_specification = optional(object({<br/>      ena_srd_enabled = optional(bool)<br/>      ena_srd_udp_specification = optional(object({<br/>        ena_srd_udp_enabled = optional(bool)<br/>      }))<br/>    }))<br/>  }))</pre> | `[]` | no |
 | <a name="input_runner_os"></a> [runner\_os](#input\_runner\_os) | The EC2 Operating System type to use for action runner instances (linux, osx, windows). | `string` | `"linux"` | no |
 | <a name="input_runner_placement"></a> [runner\_placement](#input\_runner\_placement) | The placement options for the instance. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template#placement for details. | <pre>object({<br/>    affinity                = optional(string)<br/>    availability_zone       = optional(string)<br/>    group_id                = optional(string)<br/>    group_name              = optional(string)<br/>    host_id                 = optional(string)<br/>    host_resource_group_arn = optional(string)<br/>    spread_domain           = optional(string)<br/>    tenancy                 = optional(string)<br/>    partition_number        = optional(number)<br/>  })</pre> | `null` | no |
 | <a name="input_runner_run_as"></a> [runner\_run\_as](#input\_runner\_run\_as) | Run the GitHub actions agent as user. | `string` | `"ec2-user"` | no |