From 6eb515349a17ec73ff8c9aa3b3ce31b50106681a Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Thu, 3 Sep 2026 23:23:53 +0200
Subject: [PATCH 01/52] feat(scale-set): add ECS orchestration

---
 .../scale-set/README.md                       | 215 ++++
 .../scale-set/cluster.tf                      |  14 +
 .../scale-set/config-store.tf                 |  27 +
 .../orchestration-providers/scale-set/data.tf |   5 +
 .../orchestration-providers/scale-set/iam.tf  | 163 +++
 .../scale-set/locals.tf                       | 268 +++++
 .../scale-set/logging.tf                      |  19 +
 .../scale-set/networking.tf                   |  27 +
 .../scale-set/outputs.tf                      |  58 ++
 .../scale-set/service.tf                      |  40 +
 .../orchestration-providers/scale-set/task.tf | 112 ++
 .../tests/computed-inputs.tftest.hcl          |  49 +
 .../tests/fixtures/computed-inputs/README.md  |  38 +
 .../tests/fixtures/computed-inputs/main.tf    | 104 ++
 .../fixtures/computed-inputs/versions.tf      |  10 +
 .../scale-set/tests/scale-set.tftest.hcl      | 981 ++++++++++++++++++
 .../scale-set/validations.tf                  | 387 +++++++
 .../scale-set/variables.tf                    | 201 ++++
 .../scale-set/versions.tf                     |  10 +
 19 files changed, 2728 insertions(+)
 create mode 100644 modules/orchestration-providers/scale-set/README.md
 create mode 100644 modules/orchestration-providers/scale-set/cluster.tf
 create mode 100644 modules/orchestration-providers/scale-set/config-store.tf
 create mode 100644 modules/orchestration-providers/scale-set/data.tf
 create mode 100644 modules/orchestration-providers/scale-set/iam.tf
 create mode 100644 modules/orchestration-providers/scale-set/locals.tf
 create mode 100644 modules/orchestration-providers/scale-set/logging.tf
 create mode 100644 modules/orchestration-providers/scale-set/networking.tf
 create mode 100644 modules/orchestration-providers/scale-set/outputs.tf
 create mode 100644 modules/orchestration-providers/scale-set/service.tf
 create mode 100644 modules/orchestration-providers/scale-set/task.tf
 create mode 100644 modules/orchestration-providers/scale-set/tests/computed-inputs.tftest.hcl
 create mode 100644 modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
 create mode 100644 modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
 create mode 100644 modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
 create mode 100644 modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
 create mode 100644 modules/orchestration-providers/scale-set/validations.tf
 create mode 100644 modules/orchestration-providers/scale-set/variables.tf
 create mode 100644 modules/orchestration-providers/scale-set/versions.tf

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
new file mode 100644
index 0000000000..13d0476599
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -0,0 +1,215 @@
+# Scale-set orchestration provider
+
+This internal module deploys long-running GitHub Actions runner scale-set controllers on ECS Fargate. It creates one deployment unit per resolved **controller group**:
+
+```text
+1 ECS service
+1 task definition
+1 running task during normal operation
+1 application container
+1 ScaleSetController supervising N independent reconcilers
+```
+
+Each reconciler still owns exactly one GitHub scale-set ID and one message session. Grouping only packs reconcilers into a shared task; it does not merge scale-set identity, session state, or compute-provider behavior. It does, however, intentionally union task IAM permissions and failure/deployment blast radius across all members of that controller group.
+
+This foundation adopts scale sets that were created elsewhere. It validates the supplied ID, expected name, and optional runner-group ID at runtime, but it does not create or delete the GitHub scale-set resource. The complete compute-provider contract must likewise come from its Terraform adapter; until that adapter and the public runner-config selection are wired, this internal module is not an end-to-end deployment interface.
+
+The normalized `(github.config_url, scale_set.id)` ownership tuple must be globally unique across all groups. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Numeric scale-set IDs may repeat under different GitHub scopes.
+
+## Grouping
+
+`grouping.strategy` selects a plan-known grouping implementation:
+
+- `compute_provider` (default): one group per `compute_provider_contracts[*].type`.
+- `runner_config`: one group per runner-config key.
+- `custom`: explicit groups whose membership covers every runner config exactly once.
+
+```hcl
+grouping = {
+  strategy = "custom"
+  custom = {
+    groups = {
+      general = {
+        runner_configs = ["linux-small", "linux-large"]
+      }
+      critical = {
+        runner_configs = ["production"]
+      }
+    }
+  }
+}
+```
+
+Group names and memberships become Terraform `for_each` identities and must be known during planning. A group may contain at most 1000 runner configs, matching the service loader limit. Additional grouping algorithms can be added later by producing the same internal `map(list(runner_config_name))` shape.
+
+## Compute-provider capability boundary
+
+`compute_provider_contracts` is keyed exactly like `runner_configs`. A compute provider implements the scale-set desired-capacity interface by returning:
+
+```hcl
+{
+  type = "ec2" # plan-known grouping and runtime registry key
+  capabilities = {
+    scale_set = {
+      configuration_json = local.provider_owned_runtime_configuration
+      environment_variables = local.provider_owned_non_secret_environment
+      iam_statements     = local.provider_owned_task_role_statements
+    }
+  }
+}
+```
+
+The symbolic locals above represent outputs from the selected compute-provider Terraform adapter; callers should not recreate the provider payload by hand. The provider-specific adapter owns the runtime configuration schema and the complete IAM statement set. This orchestration module treats configuration JSON as an opaque, non-secret object and combines only the selected group's statements into that group's task role. Provider-owned process environment variables are also non-secret: duplicate names within a group must resolve to the same value, and reserved runtime names cannot be overridden. Runner-config-specific values stay in the SSM reconciler document, while credentials stay behind SSM references. Wildcard IAM actions are rejected. The rendered per-group policy is checked against AWS's 10,240-byte inline role-policy quota with an explicit split-the-group error; group splitting remains the escape hatch when the union is too large or too broad.
+
+## Configuration delivery
+
+Large groups do not embed their full manifest in an ECS task definition. The module writes one non-secret SSM `String` parameter per reconciler:
+
+```text
+/<prefix>/scale-set-controller/<controller-group>/<runner-config>
+```
+
+Each leaf is the flat `ScaleSetReconcilerConfig` consumed by the service:
+
+```json
+{
+  "schemaVersion": 1,
+  "runnerConfigName": "linux-small",
+  "githubConfigUrl": "https://github.com/example",
+  "scaleSetId": 123,
+  "expectedScaleSetName": "linux-small",
+  "expectedRunnerGroupId": null,
+  "minRunners": 0,
+  "maxRunners": 20,
+  "bootTimeoutMinutes": 10,
+  "githubApp": {
+    "appIdParameterName": "/github/app-id",
+    "privateKeyParameterName": "/github/private-key",
+    "installationIdParameterName": "/github/installation-id"
+  },
+  "computeProvider": {
+    "type": "ec2",
+    "configuration": {}
+  }
+}
+```
+
+The task receives only the group name, group path, and a SHA-256 revision. It loads the direct children with `GetParametersByPath`. Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes; Terraform validates every leaf against the selected tier and limits the decoded aggregate for one group to 4 MiB. The group revision changes the task definition whenever any reconciler configuration changes.
+
+Terraform always emits `sessionOwner`. An omitted value normally resolves to `<group>.<runner-config>`; if that would exceed the runtime's 256-character limit, the module truncates both readable components and appends a deterministic hash.
+
+GitHub credential **values** never enter Terraform configuration, task definitions, or controller-config parameters. Each leaf carries only three Parameter Store names. The task role can read the exact credential parameter ARNs for its group and decrypt only explicitly declared KMS keys.
+
+## Container image
+
+The convenience default is:
+
+```text
+ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service:latest
+```
+
+ECS `versionConsistency` is enabled so all tasks in a deployment resolve a tag consistently. Production callers should set `container.image` to the digest published with a release:
+
+```hcl
+container = {
+  image = "ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service@sha256:<release-digest>"
+}
+```
+
+Public registry images need no pull permission. For a private ECR override, set `container.ecr_repository.arn`; the execution role receives repository-scoped layer permissions plus the unavoidable resource-unscoped `ecr:GetAuthorizationToken` action.
+
+For the official GHCR default, verify an anonymous pull after the first package publish. Package visibility may inherit repository or organization settings and must not be inferred only from a successful authenticated workflow push.
+
+## ECS and security behavior
+
+- A managed ECS cluster is created by default. Set `ecs.cluster.mode = "external"` and pass `ecs.cluster.arn` to reuse a cluster. The mode must be known at plan time; the ARN may be computed.
+- Every group gets a separate service, task definition, task role, execution role, log group, and security group.
+- `desired_count` is fixed at one. Deployment percentages are `minimum = 0` and `maximum = 100`, preventing old and new tasks from overlapping while session leasing is unavailable.
+- The ECS deployment circuit breaker and rollback are enabled.
+- Tasks run in supplied private subnets with public IP assignment disabled. Managed security groups have no ingress and allow only TCP/443 egress. The IPv4 Internet default is intended for controlled NAT/firewall paths and can be narrowed.
+- The application container runs with a numeric non-root UID/GID, a read-only root filesystem, init enabled, no privilege, and all Linux capabilities dropped.
+- ECS probes `/healthz` for liveness, and `container.health_path` accepts only that endpoint. `/readyz` remains an application readiness signal; reconnecting to GitHub should not cause ECS to restart every reconciler in a group.
+- CloudWatch encrypts logs at rest with an AWS-owned key by default. Set `logging.kms_key_arn` for a customer-managed key and ensure its key policy allows the regional CloudWatch Logs service.
+
+## Plan-shape requirements
+
+The following values control `for_each`, dynamic IAM statements, or resource ownership and must be known during planning:
+
+- runner-config map keys;
+- compute-contract map keys and provider `type`;
+- grouping strategy, custom group keys, and membership;
+- IAM statement keys and optional KMS/ECR wrapper presence;
+- optional ECS ephemeral-storage wrapper presence;
+- managed versus external cluster mode.
+
+Inner values such as scale-set IDs, SSM/KMS ARNs, provider configuration values, IAM actions/resources, and an external cluster ARN may be computed. Nullable computed values should be placed inside a plan-known wrapper rather than used as the wrapper itself.
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.33 |
+| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_cloudwatch_log_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_ecs_cluster.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource |
+| [aws_ecs_service.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
+| [aws_ecs_task_definition.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource |
+| [aws_iam_role.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_security_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
+| [aws_ssm_parameter.reconciler_config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [terraform_data.validate_config_store](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_contract](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_group_task_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_grouping](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_runtime](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.task_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_compute_provider_contracts"></a> [compute\_provider\_contracts](#input\_compute\_provider\_contracts) | Provider-neutral, scale-set capability fragments keyed exactly like `runner_configs`.<br/><br/>`type` is the plan-known provider discriminator used by the default grouping implementation and the runtime adapter registry. `configuration_json` is provider-owned, valid JSON and must contain no secrets. `environment_variables` contains non-secret provider process settings shared by every reconciler in the same controller group; conflicting values are rejected. IAM statement map keys and optional condition shapes must be known during planning; their action, resource, and condition values may be computed. | <pre>map(object({<br/>    type = string<br/>    capabilities = object({<br/>      scale_set = object({<br/>        configuration_json    = optional(string, "{}")<br/>        environment_variables = optional(map(string), {})<br/>        iam_statements = optional(map(object({<br/>          actions   = set(string)<br/>          resources = set(string)<br/>          conditions = optional(list(object({<br/>            test     = string<br/>            variable = string<br/>            values   = set(string)<br/>          })), [])<br/>        })), {})<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
+| <a name="input_config_store"></a> [config\_store](#input\_config\_store) | Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.<br/><br/>Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`. | <pre>object({<br/>    path_prefix = optional(string, null)<br/>    tier        = optional(string, "Standard")<br/>    tags        = optional(map(string), {})<br/>  })</pre> | `{}` | no |
+| <a name="input_container"></a> [container](#input\_container) | Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health\_path is fixed at /healthz, the ECS liveness endpoint. | <pre>object({<br/>    image                             = optional(string, null)<br/>    user                              = optional(string, "10001:10001")<br/>    health_port                       = optional(number, 8080)<br/>    health_path                       = optional(string, "/healthz")<br/>    health_check_command              = optional(list(string), null)<br/>    health_check_interval             = optional(number, 30)<br/>    health_check_timeout              = optional(number, 5)<br/>    health_check_retries              = optional(number, 3)<br/>    health_check_start_period         = optional(number, 30)<br/>    health_stale_after_seconds        = optional(number, 180)<br/>    shutdown_timeout_seconds          = optional(number, 110)<br/>    session_close_timeout_seconds     = optional(number, 10)<br/>    reconnect_initial_backoff_seconds = optional(number, 1)<br/>    reconnect_max_backoff_seconds     = optional(number, 30)<br/>    stop_timeout_seconds              = optional(number, 120)<br/>    ecr_repository = optional(object({<br/>      arn = string<br/>    }), null)<br/>  })</pre> | `{}` | no |
+| <a name="input_ecs"></a> [ecs](#input\_ecs) | ECS substrate configuration. A managed cluster is created by default. For an external cluster, set `cluster.mode = "external"` and pass its ARN; the mode must be plan-known while the ARN may be computed. | <pre>object({<br/>    cluster = optional(object({<br/>      mode               = optional(string, "managed")<br/>      arn                = optional(string, null)<br/>      name               = optional(string, null)<br/>      container_insights = optional(bool, true)<br/>    }), {})<br/>    task = optional(object({<br/>      cpu              = optional(number, 512)<br/>      memory           = optional(number, 1024)<br/>      cpu_architecture = optional(string, "X86_64")<br/>      ephemeral_storage = optional(object({<br/>        size_in_gib = number<br/>      }), null)<br/>    }), {})<br/>    service = optional(object({<br/>      platform_version = optional(string, "LATEST")<br/>    }), {})<br/>    iam = optional(object({<br/>      path                 = optional(string, "/")<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
+| <a name="input_grouping"></a> [grouping](#input\_grouping) | Packing strategy for scale-set reconcilers. `compute_provider` creates one controller group per compute-provider type and is the default. `runner_config` creates one group per runner config. `custom` uses `custom.groups`; custom membership must cover every runner config exactly once.<br/><br/>The strategy, custom group keys, and memberships select Terraform `for_each` instances and must be known during planning. | <pre>object({<br/>    strategy = optional(string, "compute_provider")<br/>    custom = optional(object({<br/>      groups = map(object({<br/>        runner_configs = set(string)<br/>      }))<br/>    }), null)<br/>  })</pre> | `{}` | no |
+| <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
+| <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
+| <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.ssl_verify` applies TLS verification per reconciler without changing process-global TLS behavior. Parameter and optional KMS ARNs, scale-set IDs, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      config_url = string<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      force_ghes = optional(bool, null)<br/>      ssl_verify = optional(bool, true)<br/>      user_agent = optional(string, null)<br/>    })<br/>    scale_set = object({<br/>      name                 = string<br/>      id                   = number<br/>      runner_group_id      = optional(number, null)<br/>      min_runners          = optional(number, 0)<br/>      max_runners          = optional(number, 10)<br/>      boot_time_in_minutes = optional(number, 10)<br/>      session_owner        = optional(string, null)<br/>    })<br/>    work_folder = optional(string, null)<br/>  }))</pre> | n/a | yes |
+| <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_cluster"></a> [cluster](#output\_cluster) | Managed or external ECS cluster selected for all controller groups. |
+| <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | Controller-group resources keyed by stable resolved group name. |
+| <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | Non-secret SSM controller configuration parameters keyed by `<controller-group>/<runner-config>`. Values are intentionally not exposed. |
+| <a name="output_resolved_container_image"></a> [resolved\_container\_image](#output\_resolved\_container\_image) | Container image reference selected for the controller task definitions. |
+<!-- END_TF_DOCS -->
diff --git a/modules/orchestration-providers/scale-set/cluster.tf b/modules/orchestration-providers/scale-set/cluster.tf
new file mode 100644
index 0000000000..6c9a586da8
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/cluster.tf
@@ -0,0 +1,14 @@
+resource "aws_ecs_cluster" "controller" {
+  count = var.ecs.cluster.mode == "managed" ? 1 : 0
+
+  name = coalesce(var.ecs.cluster.name, "${var.prefix}-scale-set")
+
+  setting {
+    name  = "containerInsights"
+    value = var.ecs.cluster.container_insights ? "enabled" : "disabled"
+  }
+
+  tags = local.common_tags
+
+  depends_on = [terraform_data.validate_runtime]
+}
diff --git a/modules/orchestration-providers/scale-set/config-store.tf b/modules/orchestration-providers/scale-set/config-store.tf
new file mode 100644
index 0000000000..86cb42a73a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/config-store.tf
@@ -0,0 +1,27 @@
+resource "aws_ssm_parameter" "reconciler_config" {
+  for_each = local.reconciler_configs
+
+  name        = "${local.config_store_path_prefix}/${each.value.group_name}/${each.value.runner_name}"
+  description = "Non-secret scale-set reconciler configuration for ${each.value.runner_name}"
+  type        = "String"
+  tier        = var.config_store.tier
+  value       = local.reconciler_config_json[each.key]
+
+  tags = merge(
+    local.group_tags[each.value.group_name],
+    var.config_store.tags,
+  )
+
+  lifecycle {
+    precondition {
+      condition     = local.reconciler_config_bytes[each.key] <= local.config_store_max_bytes
+      error_message = "The encoded reconciler configuration exceeds the selected Parameter Store tier limit."
+    }
+  }
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_config_store,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/data.tf b/modules/orchestration-providers/scale-set/data.tf
new file mode 100644
index 0000000000..99b50de05a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/data.tf
@@ -0,0 +1,5 @@
+data "aws_caller_identity" "current" {}
+
+data "aws_partition" "current" {}
+
+data "aws_region" "current" {}
diff --git a/modules/orchestration-providers/scale-set/iam.tf b/modules/orchestration-providers/scale-set/iam.tf
new file mode 100644
index 0000000000..1c23772f00
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/iam.tf
@@ -0,0 +1,163 @@
+data "aws_iam_policy_document" "task_assume_role" {
+  statement {
+    sid     = "AllowEcsTasks"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceAccount"
+      values   = [data.aws_caller_identity.current.account_id]
+    }
+
+    condition {
+      test     = "ArnLike"
+      variable = "aws:SourceArn"
+      values = [format(
+        "arn:%s:ecs:%s:%s:*",
+        data.aws_partition.current.partition,
+        data.aws_region.current.region,
+        data.aws_caller_identity.current.account_id,
+      )]
+    }
+  }
+}
+
+resource "aws_iam_role" "task" {
+  for_each = local.controller_groups
+
+  name                 = "${local.group_resource_names[each.key]}-task"
+  path                 = var.ecs.iam.path
+  permissions_boundary = var.ecs.iam.permissions_boundary
+  assume_role_policy   = data.aws_iam_policy_document.task_assume_role.json
+  tags                 = local.group_tags[each.key]
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_runtime,
+  ]
+}
+
+data "aws_iam_policy_document" "task" {
+  for_each = local.controller_groups
+
+  source_policy_documents = [local.group_github_kms_policy_json[each.key]]
+
+  statement {
+    sid       = "ReadControllerGroupConfig"
+    effect    = "Allow"
+    actions   = ["ssm:GetParametersByPath"]
+    resources = [local.group_config_path_arns[each.key]]
+  }
+
+  statement {
+    sid    = "ReadGitHubAppParameters"
+    effect = "Allow"
+    actions = [
+      "ssm:GetParameter",
+      "ssm:GetParameters",
+    ]
+    resources = local.group_ssm_parameter_arns[each.key]
+  }
+
+  dynamic "statement" {
+    for_each = local.group_compute_iam_statements[each.key]
+
+    content {
+      effect    = "Allow"
+      actions   = statement.value.actions
+      resources = statement.value.resources
+
+      dynamic "condition" {
+        for_each = statement.value.conditions
+
+        content {
+          test     = condition.value.test
+          variable = condition.value.variable
+          values   = condition.value.values
+        }
+      }
+    }
+  }
+}
+
+resource "aws_iam_role_policy" "task" {
+  for_each = local.controller_groups
+
+  name   = "scale-set-controller"
+  role   = aws_iam_role.task[each.key].name
+  policy = data.aws_iam_policy_document.task[each.key].json
+
+  depends_on = [terraform_data.validate_group_task_policy]
+}
+
+resource "aws_iam_role" "execution" {
+  for_each = local.controller_groups
+
+  name                 = "${local.group_resource_names[each.key]}-exec"
+  path                 = var.ecs.iam.path
+  permissions_boundary = var.ecs.iam.permissions_boundary
+  assume_role_policy   = data.aws_iam_policy_document.task_assume_role.json
+  tags                 = local.group_tags[each.key]
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_runtime,
+  ]
+}
+
+data "aws_iam_policy_document" "execution" {
+  for_each = local.controller_groups
+
+  statement {
+    sid    = "WriteControllerLogs"
+    effect = "Allow"
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents",
+    ]
+    resources = ["${aws_cloudwatch_log_group.controller[each.key].arn}:*"]
+  }
+
+  dynamic "statement" {
+    for_each = var.container.ecr_repository == null ? [] : [var.container.ecr_repository]
+
+    content {
+      sid    = "PullPrivateEcrImage"
+      effect = "Allow"
+      actions = [
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:BatchGetImage",
+        "ecr:GetDownloadUrlForLayer",
+      ]
+      resources = [statement.value.arn]
+    }
+  }
+
+  dynamic "statement" {
+    for_each = var.container.ecr_repository == null ? [] : [1]
+
+    content {
+      # ECR does not support resource-level permissions for authorization tokens.
+      sid       = "AuthorizePrivateEcrPull"
+      effect    = "Allow"
+      actions   = ["ecr:GetAuthorizationToken"]
+      resources = ["*"]
+    }
+  }
+}
+
+resource "aws_iam_role_policy" "execution" {
+  for_each = local.controller_groups
+
+  name   = "scale-set-controller-execution"
+  role   = aws_iam_role.execution[each.key].name
+  policy = data.aws_iam_policy_document.execution[each.key].json
+}
diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
new file mode 100644
index 0000000000..cd74e967a9
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -0,0 +1,268 @@
+locals {
+  configured_runner_names = toset(keys(var.runner_configs))
+  contract_runner_names   = toset(keys(var.compute_provider_contracts))
+  routable_runner_names   = sort(tolist(setintersection(local.configured_runner_names, local.contract_runner_names)))
+
+  normalized_github_config_urls = {
+    for runner_name, runner_config in var.runner_configs : runner_name => replace(
+      trimsuffix(lower(runner_config.github.config_url), "/"),
+      ":443/",
+      "/",
+    )
+  }
+  github_config_url_ports = {
+    for runner_name, runner_config in var.runner_configs : runner_name => try(
+      tonumber(regex("^https://[A-Za-z0-9.-]+:([0-9]+)/", runner_config.github.config_url)[0]),
+      443,
+    )
+  }
+  scale_set_ownership_keys = [
+    for runner_name, runner_config in var.runner_configs :
+    "${local.normalized_github_config_urls[runner_name]}#${runner_config.scale_set.id}"
+  ]
+
+  declared_custom_groups = var.grouping.strategy == "custom" && var.grouping.custom != null ? {
+    for group_name, group in var.grouping.custom.groups : group_name => sort(tolist(group.runner_configs))
+  } : {}
+
+  custom_members = flatten(values(local.declared_custom_groups))
+
+  compute_provider_types = distinct([
+    for runner_name in local.routable_runner_names : var.compute_provider_contracts[runner_name].type
+  ])
+
+  compute_provider_groups = {
+    for provider_type in local.compute_provider_types : provider_type => [
+      for runner_name in local.routable_runner_names : runner_name
+      if var.compute_provider_contracts[runner_name].type == provider_type
+    ]
+  }
+
+  runner_config_groups = {
+    for runner_name in local.routable_runner_names : runner_name => [runner_name]
+  }
+
+  custom_groups = {
+    for group_name, runner_names in local.declared_custom_groups : group_name => [
+      for runner_name in runner_names : runner_name
+      if contains(local.routable_runner_names, runner_name)
+    ]
+  }
+
+  controller_groups = (
+    var.grouping.strategy == "compute_provider" ? local.compute_provider_groups :
+    var.grouping.strategy == "runner_config" ? local.runner_config_groups :
+    var.grouping.strategy == "custom" ? local.custom_groups :
+    {}
+  )
+
+  group_resource_names = {
+    for group_name in keys(local.controller_groups) : group_name => format(
+      "%s-ss-%s-%s",
+      var.prefix,
+      substr(replace(lower(group_name), "/[^a-z0-9_-]/", "-"), 0, 20),
+      substr(sha256(group_name), 0, 8),
+    )
+  }
+
+  official_container_image = "ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service:latest"
+  resolved_container_image = coalesce(var.container.image, local.official_container_image)
+
+  resolved_health_check_command = var.container.health_check_command != null ? var.container.health_check_command : [
+    "CMD",
+    "node",
+    "-e",
+    "fetch('http://127.0.0.1:${var.container.health_port}${var.container.health_path}').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
+  ]
+
+  reconciler_configs = merge([
+    for group_name, runner_names in local.controller_groups : {
+      for runner_name in runner_names : "${group_name}/${runner_name}" => {
+        group_name  = group_name
+        runner_name = runner_name
+        value = merge({
+          schemaVersion         = 1
+          runnerConfigName      = runner_name
+          githubConfigUrl       = var.runner_configs[runner_name].github.config_url
+          scaleSetId            = var.runner_configs[runner_name].scale_set.id
+          expectedScaleSetName  = var.runner_configs[runner_name].scale_set.name
+          expectedRunnerGroupId = var.runner_configs[runner_name].scale_set.runner_group_id
+          minRunners            = var.runner_configs[runner_name].scale_set.min_runners
+          maxRunners            = var.runner_configs[runner_name].scale_set.max_runners
+          bootTimeoutMinutes    = var.runner_configs[runner_name].scale_set.boot_time_in_minutes
+          sslVerify             = var.runner_configs[runner_name].github.ssl_verify
+          sessionOwner = (
+            var.runner_configs[runner_name].scale_set.session_owner != null
+            ? var.runner_configs[runner_name].scale_set.session_owner
+            : length("${group_name}.${runner_name}") <= 256
+            ? "${group_name}.${runner_name}"
+            : "${substr(group_name, 0, 119)}.${substr(runner_name, 0, 119)}.${substr(sha256(format("%s.%s", group_name, runner_name)), 0, 16)}"
+          )
+          githubApp = {
+            appIdParameterName          = var.runner_configs[runner_name].github.app.app_id.name
+            privateKeyParameterName     = var.runner_configs[runner_name].github.app.private_key.name
+            installationIdParameterName = var.runner_configs[runner_name].github.app.installation_id.name
+          }
+          computeProvider = {
+            type          = var.compute_provider_contracts[runner_name].type
+            configuration = jsondecode(var.compute_provider_contracts[runner_name].capabilities.scale_set.configuration_json)
+          }
+          }, var.runner_configs[runner_name].work_folder == null ? {} : {
+          workFolder = var.runner_configs[runner_name].work_folder
+          }, var.runner_configs[runner_name].github.force_ghes == null ? {} : {
+          forceGhes = var.runner_configs[runner_name].github.force_ghes
+          }, var.runner_configs[runner_name].github.user_agent == null ? {} : {
+          userAgent = var.runner_configs[runner_name].github.user_agent
+        })
+      }
+    }
+  ]...)
+
+  config_store_path_prefix = coalesce(var.config_store.path_prefix, "/${var.prefix}/scale-set-controller")
+  group_config_paths = {
+    for group_name in keys(local.controller_groups) : group_name => "${local.config_store_path_prefix}/${group_name}"
+  }
+  group_config_revisions = {
+    for group_name, runner_names in local.controller_groups : group_name => sha256(jsonencode({
+      for runner_name in runner_names : runner_name => local.reconciler_configs["${group_name}/${runner_name}"].value
+    }))
+  }
+
+  group_ssm_parameter_arns = {
+    for group_name, runner_names in local.controller_groups : group_name => flatten([
+      for runner_name in runner_names : [
+        var.runner_configs[runner_name].github.app.app_id.arn,
+        var.runner_configs[runner_name].github.app.private_key.arn,
+        var.runner_configs[runner_name].github.app.installation_id.arn,
+      ]
+    ])
+  }
+
+  group_ssm_kms_key_arns = {
+    for group_name, runner_names in local.controller_groups : group_name => flatten([
+      for runner_name in runner_names : [
+        for parameter in [
+          var.runner_configs[runner_name].github.app.app_id,
+          var.runner_configs[runner_name].github.app.private_key,
+          var.runner_configs[runner_name].github.app.installation_id,
+        ] : parameter.kms_key_arn
+      ]
+    ])
+  }
+
+  group_github_kms_policy_json = {
+    for group_name, kms_key_arns in local.group_ssm_kms_key_arns : group_name => jsonencode({
+      Version = "2012-10-17"
+      Statement = length(compact(kms_key_arns)) == 0 ? [] : [{
+        Sid      = "DecryptGitHubAppParameters"
+        Effect   = "Allow"
+        Action   = ["kms:Decrypt"]
+        Resource = distinct(compact(kms_key_arns))
+      }]
+    })
+  }
+
+  group_compute_iam_statements = {
+    for group_name, runner_names in local.controller_groups : group_name => merge([
+      for runner_name in runner_names : {
+        for statement_name, statement in var.compute_provider_contracts[runner_name].capabilities.scale_set.iam_statements :
+        "${runner_name}/${statement_name}" => statement
+      }
+    ]...)
+  }
+
+  group_compute_environment_entries = {
+    for group_name, runner_names in local.controller_groups : group_name => flatten([
+      for runner_name in runner_names : [
+        for name, value in var.compute_provider_contracts[runner_name].capabilities.scale_set.environment_variables : {
+          runner_name = runner_name
+          name        = name
+          value       = value
+        }
+      ]
+    ])
+  }
+
+  group_compute_environment_variables = {
+    for group_name, entries in local.group_compute_environment_entries : group_name => merge([
+      for entry in entries : { (entry.name) = entry.value }
+    ]...)
+  }
+
+  reserved_environment_variable_names = toset([
+    "PATH",
+    "HOME",
+    "HOSTNAME",
+    "PWD",
+    "SHLVL",
+  ])
+
+  config_store_max_bytes = var.config_store.tier == "Advanced" ? 8192 : 4096
+
+  reconciler_config_json = {
+    for config_key, config in local.reconciler_configs : config_key => jsonencode(config.value)
+  }
+  reconciler_config_base64 = {
+    for config_key, config_json in local.reconciler_config_json : config_key => base64encode(config_json)
+  }
+  reconciler_config_bytes = {
+    for config_key, encoded in local.reconciler_config_base64 : config_key => (
+      floor(length(encoded) * 3 / 4) -
+      (endswith(encoded, "==") ? 2 : endswith(encoded, "=") ? 1 : 0)
+    )
+  }
+  group_reconciler_config_bytes = {
+    for group_name, runner_names in local.controller_groups : group_name => sum([
+      for runner_name in runner_names : local.reconciler_config_bytes["${group_name}/${runner_name}"]
+    ])
+  }
+
+  group_task_policy_base64 = {
+    for group_name, policy in data.aws_iam_policy_document.task : group_name => base64encode(policy.json)
+  }
+  group_task_policy_bytes = {
+    for group_name, encoded in local.group_task_policy_base64 : group_name => (
+      floor(length(encoded) * 3 / 4) -
+      (endswith(encoded, "==") ? 2 : endswith(encoded, "=") ? 1 : 0)
+    )
+  }
+
+  cluster_arn = var.ecs.cluster.mode == "managed" ? aws_ecs_cluster.controller[0].arn : var.ecs.cluster.arn
+
+  group_config_path_arns = {
+    for group_name, config_path in local.group_config_paths : group_name => format(
+      "arn:%s:ssm:%s:%s:parameter%s/*",
+      data.aws_partition.current.partition,
+      data.aws_region.current.region,
+      data.aws_caller_identity.current.account_id,
+      config_path,
+    )
+  }
+
+  fargate_memory_by_cpu = {
+    256   = [512, 1024, 2048]
+    512   = [1024, 2048, 3072, 4096]
+    1024  = range(2048, 9216, 1024)
+    2048  = range(4096, 17408, 1024)
+    4096  = range(8192, 31744, 1024)
+    8192  = range(16384, 65536, 4096)
+    16384 = range(32768, 131072, 8192)
+  }
+
+  common_tags = merge(
+    {
+      "ghr:component" = "scale-set-controller"
+    },
+    var.tags,
+  )
+
+  group_tags = {
+    for group_name, resource_name in local.group_resource_names : group_name => merge(
+      local.common_tags,
+      {
+        Name                   = resource_name
+        "ghr:controller-group" = group_name
+      },
+    )
+  }
+}
diff --git a/modules/orchestration-providers/scale-set/logging.tf b/modules/orchestration-providers/scale-set/logging.tf
new file mode 100644
index 0000000000..974106316a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/logging.tf
@@ -0,0 +1,19 @@
+resource "aws_cloudwatch_log_group" "controller" {
+  for_each = local.controller_groups
+
+  name              = "/aws/ecs/${local.group_resource_names[each.key]}"
+  retention_in_days = var.logging.retention_in_days
+  kms_key_id        = var.logging.kms_key_arn
+  log_group_class   = var.logging.log_group_class
+
+  tags = merge(
+    local.group_tags[each.key],
+    var.logging.tags,
+  )
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_runtime,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/networking.tf b/modules/orchestration-providers/scale-set/networking.tf
new file mode 100644
index 0000000000..5cd9d11203
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/networking.tf
@@ -0,0 +1,27 @@
+resource "aws_security_group" "controller" {
+  for_each = local.controller_groups
+
+  name        = local.group_resource_names[each.key]
+  description = "Private scale-set controller ${each.key}; no ingress and HTTPS-only egress"
+  vpc_id      = var.network.vpc_id
+
+  ingress = []
+
+  egress {
+    description      = "HTTPS to GitHub and AWS APIs"
+    from_port        = 443
+    to_port          = 443
+    protocol         = "tcp"
+    cidr_blocks      = sort(tolist(var.network.https_egress.ipv4_cidrs))
+    ipv6_cidr_blocks = sort(tolist(var.network.https_egress.ipv6_cidrs))
+  }
+
+  revoke_rules_on_delete = true
+  tags                   = local.group_tags[each.key]
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_runtime,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/outputs.tf b/modules/orchestration-providers/scale-set/outputs.tf
new file mode 100644
index 0000000000..fd9d1b8c57
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/outputs.tf
@@ -0,0 +1,58 @@
+output "cluster" {
+  description = "Managed or external ECS cluster selected for all controller groups."
+  value = {
+    arn     = local.cluster_arn
+    managed = var.ecs.cluster.mode == "managed"
+  }
+}
+
+output "controller_groups" {
+  description = "Controller-group resources keyed by stable resolved group name."
+  value = {
+    for group_name, runner_names in local.controller_groups : group_name => {
+      runner_configs  = runner_names
+      config_path     = local.group_config_paths[group_name]
+      config_revision = local.group_config_revisions[group_name]
+      service = {
+        id   = aws_ecs_service.controller[group_name].id
+        name = aws_ecs_service.controller[group_name].name
+      }
+      task_definition = {
+        arn    = aws_ecs_task_definition.controller[group_name].arn
+        family = aws_ecs_task_definition.controller[group_name].family
+      }
+      task_role = {
+        arn  = aws_iam_role.task[group_name].arn
+        name = aws_iam_role.task[group_name].name
+      }
+      execution_role = {
+        arn  = aws_iam_role.execution[group_name].arn
+        name = aws_iam_role.execution[group_name].name
+      }
+      log_group = {
+        arn  = aws_cloudwatch_log_group.controller[group_name].arn
+        name = aws_cloudwatch_log_group.controller[group_name].name
+      }
+      security_group = {
+        arn = aws_security_group.controller[group_name].arn
+        id  = aws_security_group.controller[group_name].id
+      }
+    }
+  }
+}
+
+output "reconciler_config_parameters" {
+  description = "Non-secret SSM controller configuration parameters keyed by `<controller-group>/<runner-config>`. Values are intentionally not exposed."
+  value = {
+    for config_key, parameter in aws_ssm_parameter.reconciler_config : config_key => {
+      arn  = parameter.arn
+      name = parameter.name
+      tier = parameter.tier
+    }
+  }
+}
+
+output "resolved_container_image" {
+  description = "Container image reference selected for the controller task definitions."
+  value       = local.resolved_container_image
+}
diff --git a/modules/orchestration-providers/scale-set/service.tf b/modules/orchestration-providers/scale-set/service.tf
new file mode 100644
index 0000000000..964849f4e7
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/service.tf
@@ -0,0 +1,40 @@
+resource "aws_ecs_service" "controller" {
+  for_each = local.controller_groups
+
+  name             = local.group_resource_names[each.key]
+  cluster          = local.cluster_arn
+  task_definition  = aws_ecs_task_definition.controller[each.key].arn
+  desired_count    = 1
+  launch_type      = "FARGATE"
+  platform_version = var.ecs.service.platform_version
+
+  scheduling_strategy                = "REPLICA"
+  deployment_minimum_healthy_percent = 0
+  deployment_maximum_percent         = 100
+  enable_ecs_managed_tags            = true
+  enable_execute_command             = false
+  propagate_tags                     = "SERVICE"
+
+  deployment_circuit_breaker {
+    enable   = true
+    rollback = true
+  }
+
+  deployment_controller {
+    type = "ECS"
+  }
+
+  network_configuration {
+    assign_public_ip = false
+    security_groups  = [aws_security_group.controller[each.key].id]
+    subnets          = sort(tolist(var.network.subnet_ids))
+  }
+
+  tags = local.group_tags[each.key]
+
+  depends_on = [
+    aws_iam_role_policy.execution,
+    aws_iam_role_policy.task,
+    aws_ssm_parameter.reconciler_config,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/task.tf b/modules/orchestration-providers/scale-set/task.tf
new file mode 100644
index 0000000000..a4d0b89392
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/task.tf
@@ -0,0 +1,112 @@
+resource "aws_ecs_task_definition" "controller" {
+  for_each = local.controller_groups
+
+  family                   = local.group_resource_names[each.key]
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+  cpu                      = tostring(var.ecs.task.cpu)
+  memory                   = tostring(var.ecs.task.memory)
+  task_role_arn            = aws_iam_role.task[each.key].arn
+  execution_role_arn       = aws_iam_role.execution[each.key].arn
+
+  runtime_platform {
+    cpu_architecture        = var.ecs.task.cpu_architecture
+    operating_system_family = "LINUX"
+  }
+
+  dynamic "ephemeral_storage" {
+    for_each = var.ecs.task.ephemeral_storage == null ? [] : [var.ecs.task.ephemeral_storage]
+
+    content {
+      size_in_gib = ephemeral_storage.value.size_in_gib
+    }
+  }
+
+  container_definitions = jsonencode([
+    {
+      name                   = "scale-set-controller"
+      image                  = local.resolved_container_image
+      essential              = true
+      user                   = var.container.user
+      privileged             = false
+      readonlyRootFilesystem = true
+      stopTimeout            = var.container.stop_timeout_seconds
+      versionConsistency     = "enabled"
+      linuxParameters = {
+        initProcessEnabled = true
+        capabilities = {
+          drop = ["ALL"]
+        }
+      }
+      environment = concat(
+        [
+          {
+            name  = "SCALE_SET_CONTROLLER_GROUP_NAME"
+            value = each.key
+          },
+          {
+            name  = "SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH"
+            value = local.group_config_paths[each.key]
+          },
+          {
+            name  = "SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION"
+            value = local.group_config_revisions[each.key]
+          },
+          {
+            name  = "SCALE_SET_HEALTH_PORT"
+            value = tostring(var.container.health_port)
+          },
+          {
+            name  = "SCALE_SET_HEALTH_STALE_AFTER_SECONDS"
+            value = tostring(var.container.health_stale_after_seconds)
+          },
+          {
+            name  = "SCALE_SET_SHUTDOWN_TIMEOUT_SECONDS"
+            value = tostring(var.container.shutdown_timeout_seconds)
+          },
+          {
+            name  = "SCALE_SET_SESSION_CLOSE_TIMEOUT_SECONDS"
+            value = tostring(var.container.session_close_timeout_seconds)
+          },
+          {
+            name  = "SCALE_SET_RECONNECT_INITIAL_BACKOFF_SECONDS"
+            value = tostring(var.container.reconnect_initial_backoff_seconds)
+          },
+          {
+            name  = "SCALE_SET_RECONNECT_MAX_BACKOFF_SECONDS"
+            value = tostring(var.container.reconnect_max_backoff_seconds)
+          },
+        ],
+        [
+          for name in sort(keys(local.group_compute_environment_variables[each.key])) : {
+            name  = name
+            value = local.group_compute_environment_variables[each.key][name]
+          }
+        ],
+      )
+      healthCheck = {
+        command     = local.resolved_health_check_command
+        interval    = var.container.health_check_interval
+        timeout     = var.container.health_check_timeout
+        retries     = var.container.health_check_retries
+        startPeriod = var.container.health_check_start_period
+      }
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          "awslogs-group"         = aws_cloudwatch_log_group.controller[each.key].name
+          "awslogs-region"        = data.aws_region.current.region
+          "awslogs-stream-prefix" = "controller"
+        }
+      }
+    }
+  ])
+
+  tags = local.group_tags[each.key]
+
+  depends_on = [
+    aws_iam_role_policy.execution,
+    aws_iam_role_policy.task,
+    aws_ssm_parameter.reconciler_config,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/tests/computed-inputs.tftest.hcl b/modules/orchestration-providers/scale-set/tests/computed-inputs.tftest.hcl
new file mode 100644
index 0000000000..22640ccd7f
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/computed-inputs.tftest.hcl
@@ -0,0 +1,49 @@
+mock_provider "aws" {
+  mock_data "aws_caller_identity" {
+    defaults = {
+      account_id = "123456789012"
+    }
+  }
+
+  mock_data "aws_partition" {
+    defaults = {
+      partition = "aws"
+    }
+  }
+
+  mock_data "aws_region" {
+    defaults = {
+      region = "eu-west-1"
+    }
+  }
+
+  mock_data "aws_iam_policy_document" {
+    defaults = {
+      json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+    }
+  }
+
+  mock_resource "aws_iam_role" {
+    defaults = {
+      arn = "arn:aws:iam::123456789012:role/computed-test"
+    }
+  }
+}
+
+run "plans_with_computed_values_inside_known_wrappers" {
+  command = plan
+
+  module {
+    source = "./tests/fixtures/computed-inputs"
+  }
+
+  assert {
+    condition = (
+      toset(keys(output.controller_groups)) == toset(["ec2"]) &&
+      toset(output.controller_groups.ec2.runner_configs) == toset(["computed"]) &&
+      !output.cluster.managed &&
+      toset(keys(output.reconciler_config_parameters)) == toset(["ec2/computed"])
+    )
+    error_message = "Computed inner values and explicit nulls must not affect group, ownership, IAM-wrapper, or cluster resource shape."
+  }
+}
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
new file mode 100644
index 0000000000..8ee616b61b
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
@@ -0,0 +1,38 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_subject"></a> [subject](#module\_subject) | ../../.. | n/a |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [terraform_data.computed](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_cluster"></a> [cluster](#output\_cluster) | n/a |
+| <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | n/a |
+| <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | n/a |
+<!-- END_TF_DOCS -->
\ No newline at end of file
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
new file mode 100644
index 0000000000..1bbb74f924
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
@@ -0,0 +1,104 @@
+resource "terraform_data" "computed" {
+  input = {
+    external_cluster_arn = "arn:aws:ecs:eu-west-1:123456789012:cluster/external"
+    github_config_url    = "https://github.com/example"
+    scale_set_id         = 901
+    app_id_arn           = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/app-id"
+    private_key_arn      = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/private-key"
+    installation_id_arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/installation-id"
+    kms_key_arn          = "arn:aws:kms:eu-west-1:123456789012:key/33333333-3333-3333-3333-333333333333"
+    launch_template_name = "lt-computed"
+    action               = "ec2:RunInstances"
+    resource             = "arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-computed"
+  }
+}
+
+module "subject" {
+  source = "../../.."
+
+  prefix = "computed-test"
+
+  runner_configs = {
+    computed = {
+      github = {
+        config_url = terraform_data.computed.output.github_config_url
+        app = {
+          app_id = {
+            name = "/github/computed/app-id"
+            arn  = terraform_data.computed.output.app_id_arn
+          }
+          private_key = {
+            name        = "/github/computed/private-key"
+            arn         = terraform_data.computed.output.private_key_arn
+            kms_key_arn = terraform_data.computed.output.kms_key_arn
+          }
+          installation_id = {
+            name = "/github/computed/installation-id"
+            arn  = terraform_data.computed.output.installation_id_arn
+          }
+        }
+      }
+      scale_set = {
+        id              = terraform_data.computed.output.scale_set_id
+        name            = "computed"
+        runner_group_id = null
+      }
+    }
+  }
+
+  compute_provider_contracts = {
+    computed = {
+      type = "ec2"
+      capabilities = {
+        scale_set = {
+          configuration_json = jsonencode({
+            region                 = "eu-west-1"
+            environment            = "computed-test"
+            runnerOwner            = "example"
+            runnerType             = "Org"
+            runnerNamePrefix       = "computed-"
+            jitConfigParameterPath = "/computed-test/runners/tokens"
+            subnets                = ["subnet-12345678"]
+            launchTemplateName     = terraform_data.computed.output.launch_template_name
+            ec2instanceCriteria = {
+              instanceTypes              = ["m7i.large"]
+              targetCapacityType         = "on-demand"
+              instanceAllocationStrategy = "lowest-price"
+            }
+            scaleErrors = []
+          })
+          iam_statements = {
+            run_instances = {
+              actions   = [terraform_data.computed.output.action]
+              resources = [terraform_data.computed.output.resource]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  ecs = {
+    cluster = {
+      mode = "external"
+      arn  = terraform_data.computed.output.external_cluster_arn
+    }
+  }
+
+  network = {
+    vpc_id     = "vpc-12345678"
+    subnet_ids = ["subnet-12345678"]
+  }
+}
+
+output "controller_groups" {
+  value = module.subject.controller_groups
+}
+
+output "cluster" {
+  value = module.subject.cluster
+}
+
+output "reconciler_config_parameters" {
+  value = module.subject.reconciler_config_parameters
+}
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
new file mode 100644
index 0000000000..3ef011ea0a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.4.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.33"
+    }
+  }
+}
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
new file mode 100644
index 0000000000..f90142015f
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -0,0 +1,981 @@
+mock_provider "aws" {
+  mock_data "aws_caller_identity" {
+    defaults = {
+      account_id = "123456789012"
+    }
+  }
+
+  mock_data "aws_partition" {
+    defaults = {
+      partition = "aws"
+    }
+  }
+
+  mock_data "aws_region" {
+    defaults = {
+      region = "eu-west-1"
+    }
+  }
+
+  mock_data "aws_iam_policy_document" {
+    defaults = {
+      json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+    }
+  }
+
+  mock_resource "aws_iam_role" {
+    defaults = {
+      arn = "arn:aws:iam::123456789012:role/scale-set-test"
+    }
+  }
+
+  mock_resource "aws_ecs_cluster" {
+    defaults = {
+      arn = "arn:aws:ecs:eu-west-1:123456789012:cluster/scale-set-test"
+    }
+  }
+}
+
+variables {
+  prefix = "scale-set-test"
+
+  runner_configs = {
+    linux-small = {
+      github = {
+        config_url = "https://github.com/example"
+        app = {
+          app_id = {
+            name = "/github/linux-small/app-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/app-id"
+          }
+          private_key = {
+            name        = "/github/linux-small/private-key"
+            arn         = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/private-key"
+            kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/11111111-1111-1111-1111-111111111111"
+          }
+          installation_id = {
+            name = "/github/linux-small/installation-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/installation-id"
+          }
+        }
+        user_agent = "scale-set-test"
+        ssl_verify = false
+      }
+      scale_set = {
+        id              = 101
+        name            = "linux-small"
+        runner_group_id = 1
+        min_runners     = 1
+        max_runners     = 10
+      }
+    }
+    linux-large = {
+      github = {
+        config_url = "https://github.com/example"
+        app = {
+          app_id = {
+            name = "/github/linux-large/app-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/app-id"
+          }
+          private_key = {
+            name = "/github/linux-large/private-key"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/private-key"
+          }
+          installation_id = {
+            name = "/github/linux-large/installation-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/installation-id"
+          }
+        }
+      }
+      scale_set = {
+        id          = 102
+        name        = "linux-large"
+        min_runners = 0
+        max_runners = 20
+      }
+      work_folder = "_work/linux-large"
+    }
+    microvm = {
+      github = {
+        config_url = "https://github.com/example/repository"
+        app = {
+          app_id = {
+            name = "/github/microvm/app-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/app-id"
+          }
+          private_key = {
+            name = "/github/microvm/private-key"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/private-key"
+          }
+          installation_id = {
+            name = "/github/microvm/installation-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/installation-id"
+          }
+        }
+        force_ghes = false
+      }
+      scale_set = {
+        id            = 201
+        name          = "microvm"
+        min_runners   = 0
+        max_runners   = 5
+        session_owner = "test.microvm"
+      }
+    }
+  }
+
+  compute_provider_contracts = {
+    linux-small = {
+      type = "ec2"
+      capabilities = {
+        scale_set = {
+          configuration_json = jsonencode({
+            region                 = "eu-west-1"
+            environment            = "scale-set-test"
+            runnerOwner            = "example"
+            runnerType             = "Org"
+            runnerNamePrefix       = "small-"
+            jitConfigParameterPath = "/scale-set-test/runners/tokens"
+            subnets                = ["subnet-11111111"]
+            launchTemplateName     = "lt-small"
+            ec2instanceCriteria = {
+              instanceTypes              = ["m7i.large"]
+              targetCapacityType         = "on-demand"
+              instanceAllocationStrategy = "lowest-price"
+            }
+            scaleErrors = []
+          })
+          environment_variables = {
+            EC2_CONTROLLER_MODE = "grouped"
+          }
+          iam_statements = {
+            run_instances = {
+              actions   = ["ec2:RunInstances"]
+              resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-small"]
+            }
+          }
+        }
+      }
+    }
+    linux-large = {
+      type = "ec2"
+      capabilities = {
+        scale_set = {
+          configuration_json = jsonencode({
+            region                 = "eu-west-1"
+            environment            = "scale-set-test"
+            runnerOwner            = "example"
+            runnerType             = "Org"
+            runnerNamePrefix       = "large-"
+            jitConfigParameterPath = "/scale-set-test/runners/tokens"
+            subnets                = ["subnet-22222222"]
+            launchTemplateName     = "lt-large"
+            ec2instanceCriteria = {
+              instanceTypes              = ["m7i.xlarge"]
+              targetCapacityType         = "on-demand"
+              instanceAllocationStrategy = "lowest-price"
+            }
+            scaleErrors = []
+          })
+          environment_variables = {
+            EC2_CONTROLLER_MODE = "grouped"
+          }
+          iam_statements = {
+            run_instances = {
+              actions   = ["ec2:RunInstances"]
+              resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-large"]
+            }
+          }
+        }
+      }
+    }
+    microvm = {
+      # Future provider used only to prove grouping remains provider-neutral.
+      type = "microvm"
+      capabilities = {
+        scale_set = {
+          configuration_json = jsonencode({ image_arn = "arn:aws:lambda:eu-west-1:123456789012:runtime-management-config:microvm" })
+          iam_statements = {
+            run_microvm = {
+              actions   = ["lambda:InvokeFunction"]
+              resources = ["arn:aws:lambda:eu-west-1:123456789012:function:microvm"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  network = {
+    vpc_id     = "vpc-12345678"
+    subnet_ids = ["subnet-11111111", "subnet-22222222"]
+  }
+
+  logging = {
+    kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/22222222-2222-2222-2222-222222222222"
+  }
+
+  tags = {
+    Test = "scale-set"
+  }
+}
+
+run "groups_by_compute_provider_and_hardens_each_task" {
+  command = plan
+
+  assert {
+    condition = (
+      toset(keys(output.controller_groups)) == toset(["ec2", "microvm"]) &&
+      toset(output.controller_groups["ec2"].runner_configs) == toset(["linux-small", "linux-large"]) &&
+      toset(output.controller_groups["microvm"].runner_configs) == toset(["microvm"])
+    )
+    error_message = "The default strategy must create one controller group per compute-provider type."
+  }
+
+  assert {
+    condition = (
+      length(aws_ecs_service.controller) == 2 &&
+      length(aws_ecs_task_definition.controller) == 2 &&
+      length(aws_iam_role.task) == 2 &&
+      length(aws_cloudwatch_log_group.controller) == 2 &&
+      length(aws_security_group.controller) == 2 &&
+      length(aws_ssm_parameter.reconciler_config) == 3
+    )
+    error_message = "Every group must own one service, task definition, task role, log group, and security group while every reconciler gets one config parameter."
+  }
+
+  assert {
+    condition = alltrue([
+      for service in values(aws_ecs_service.controller) : (
+        service.desired_count == 1 &&
+        service.deployment_minimum_healthy_percent == 0 &&
+        service.deployment_maximum_percent == 100 &&
+        service.deployment_circuit_breaker[0].enable &&
+        service.deployment_circuit_breaker[0].rollback &&
+        !service.network_configuration[0].assign_public_ip &&
+        length(service.network_configuration[0].security_groups) == 1
+      )
+    ])
+    error_message = "Services must run one private task and use stop-first deployment with circuit-breaker rollback."
+  }
+
+  assert {
+    condition = alltrue([
+      for task in values(aws_ecs_task_definition.controller) : (
+        length(jsondecode(task.container_definitions)) == 1 &&
+        jsondecode(task.container_definitions)[0].image == "ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service:latest" &&
+        jsondecode(task.container_definitions)[0].versionConsistency == "enabled" &&
+        jsondecode(task.container_definitions)[0].readonlyRootFilesystem &&
+        !jsondecode(task.container_definitions)[0].privileged &&
+        jsondecode(task.container_definitions)[0].user == "10001:10001" &&
+        jsondecode(task.container_definitions)[0].linuxParameters.capabilities.drop == ["ALL"] &&
+        jsondecode(task.container_definitions)[0].healthCheck.command[3] == "fetch('http://127.0.0.1:8080/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" &&
+        !contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_MANIFEST")
+      )
+    ])
+    error_message = "Each task definition must contain one hardened controller container using group-path configuration and /healthz liveness."
+  }
+
+  assert {
+    condition = one([
+      for entry in jsondecode(aws_ecs_task_definition.controller["ec2"].container_definitions)[0].environment :
+      entry.value if entry.name == "EC2_CONTROLLER_MODE"
+    ]) == "grouped"
+    error_message = "Provider-owned non-secret environment variables must be merged into their controller group task."
+  }
+
+  assert {
+    condition = (
+      length(aws_security_group.controller["ec2"].ingress) == 0 &&
+      length(aws_security_group.controller["ec2"].egress) == 1 &&
+      one(aws_security_group.controller["ec2"].egress).from_port == 443 &&
+      one(aws_security_group.controller["ec2"].egress).to_port == 443 &&
+      aws_cloudwatch_log_group.controller["ec2"].kms_key_id == var.logging.kms_key_arn
+    )
+    error_message = "Controller networking must have no ingress and only HTTPS egress, and logs must honor customer-managed encryption."
+  }
+
+  assert {
+    condition = (
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).schemaVersion == 1 &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).runnerConfigName == "linux-small" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).scaleSetId == 101 &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).expectedScaleSetName == "linux-small" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).bootTimeoutMinutes == 10 &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).sslVerify == false &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubApp.privateKeyParameterName == "/github/linux-small/private-key" &&
+      !contains(keys(jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value))), "runnerConfig")
+    )
+    error_message = "Each SSM leaf must use the frozen flat reconciler schema and contain references instead of GitHub credential values."
+  }
+
+  assert {
+    condition = (
+      contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/private-key") &&
+      !contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/private-key") &&
+      contains(jsondecode(local.group_github_kms_policy_json["ec2"]).Statement[0].Resource, "arn:aws:kms:eu-west-1:123456789012:key/11111111-1111-1111-1111-111111111111") &&
+      length(jsondecode(local.group_github_kms_policy_json["microvm"]).Statement) == 0 &&
+      contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/scale-set-controller/ec2/*")
+    )
+    error_message = "Task IAM must be scoped to its group config prefix, credential parameters, KMS keys, and compute resources."
+  }
+}
+
+run "supports_one_group_per_runner_config" {
+  command = plan
+
+  variables {
+    grouping = {
+      strategy = "runner_config"
+    }
+    container = {
+      image = "ghcr.io/example/scale-set-controller@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+  }
+
+  assert {
+    condition = (
+      toset(keys(output.controller_groups)) == toset(["linux-small", "linux-large", "microvm"]) &&
+      length(aws_ecs_service.controller) == 3 &&
+      output.resolved_container_image == "ghcr.io/example/scale-set-controller@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    )
+    error_message = "runner_config grouping must create one independently deployable controller task per runner config and honor an image override."
+  }
+}
+
+run "supports_exact_custom_groups" {
+  command = plan
+
+  variables {
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          general = {
+            runner_configs = ["linux-small", "microvm"]
+          }
+          isolated = {
+            runner_configs = ["linux-large"]
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      toset(keys(output.controller_groups)) == toset(["general", "isolated"]) &&
+      toset(output.controller_groups.general.runner_configs) == toset(["linux-small", "microvm"]) &&
+      toset(output.controller_groups.isolated.runner_configs) == toset(["linux-large"])
+    )
+    error_message = "Custom grouping must preserve the exact declared assignment."
+  }
+}
+
+run "rejects_duplicate_custom_membership" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          first = {
+            runner_configs = ["linux-small", "linux-large"]
+          }
+          second = {
+            runner_configs = ["linux-small", "microvm"]
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_incomplete_custom_membership" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          partial = {
+            runner_configs = ["linux-small", "linux-large"]
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_contract_key_mismatch" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    compute_provider_contracts = {
+      linux-small = var.compute_provider_contracts.linux-small
+      linux-large = var.compute_provider_contracts.linux-large
+    }
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_readiness_path_as_ecs_liveness" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_runtime]
+  }
+
+  variables {
+    container = {
+      health_path = "/readyz"
+    }
+  }
+
+  expect_failures = [terraform_data.validate_runtime]
+}
+
+run "rejects_oversized_standard_parameter" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_config_store]
+  }
+
+  variables {
+    compute_provider_contracts = merge(var.compute_provider_contracts, {
+      linux-small = merge(var.compute_provider_contracts.linux-small, {
+        capabilities = {
+          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
+            configuration_json = jsonencode({ payload = join("", [for index in range(1000) : "xxxxxx"]) })
+          })
+        }
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_config_store]
+}
+
+run "accepts_advanced_parameter_within_eight_kib" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_config_store]
+  }
+
+  variables {
+    config_store = {
+      tier = "Advanced"
+    }
+    compute_provider_contracts = merge(var.compute_provider_contracts, {
+      linux-small = merge(var.compute_provider_contracts.linux-small, {
+        capabilities = {
+          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
+            configuration_json = jsonencode({ payload = join("", [for index in range(800) : "xxxxxx"]) })
+          })
+        }
+      })
+    })
+  }
+
+  assert {
+    condition     = local.reconciler_config_bytes["ec2/linux-small"] > 4096 && local.reconciler_config_bytes["ec2/linux-small"] <= 8192
+    error_message = "Advanced Parameter Store tier must accept reconciler JSON between four and eight KiB."
+  }
+}
+
+run "rejects_duplicate_scale_set_ownership_across_groups" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          config_url = "https://GITHUB.COM:443/example/"
+        })
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          id = 101
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_leading_zero_default_port_spelling" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          config_url = "https://github.com:0443/example/"
+        })
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          id = 101
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_port_above_url_maximum" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          config_url = "https://github.com:65536/example"
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_non_ascii_scale_set_name" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          name = "microvm-☃"
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_invalid_compute_provider_type_identifier" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    compute_provider_contracts = merge(var.compute_provider_contracts, {
+      microvm = merge(var.compute_provider_contracts.microvm, {
+        type = "AWS.MicroVM"
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_scale_set_id_above_runtime_integer_maximum" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          id = 2147483648
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_runner_group_id_above_runtime_integer_maximum" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          runner_group_id = 2147483648
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_credential_arn_name_mismatch" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          app = merge(var.runner_configs.microvm.github.app, {
+            app_id = merge(var.runner_configs.microvm.github.app.app_id, {
+              arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/another/app-id"
+            })
+          })
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_cross_account_credential_parameter" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          app = merge(var.runner_configs.microvm.github.app, {
+            app_id = merge(var.runner_configs.microvm.github.app.app_id, {
+              arn = "arn:aws:ssm:eu-west-1:210987654321:parameter/github/microvm/app-id"
+            })
+          })
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "allows_same_numeric_scale_set_id_in_another_github_scope" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          id = 101
+        })
+      })
+    })
+  }
+
+  assert {
+    condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
+    error_message = "Scale-set IDs are scoped to their normalized GitHub configuration URL."
+  }
+}
+
+run "bounds_default_session_owner_for_maximum_names" {
+  command = plan
+
+  variables {
+    grouping = {
+      strategy = "runner_config"
+    }
+    runner_configs = {
+      (join("", [for index in range(128) : "a"])) = {
+        github = {
+          config_url = "https://github.com/example"
+          app = {
+            app_id = {
+              name = "/github/max/app-id"
+              arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/max/app-id"
+            }
+            private_key = {
+              name = "/github/max/private-key"
+              arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/max/private-key"
+            }
+            installation_id = {
+              name = "/github/max/installation-id"
+              arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/max/installation-id"
+            }
+          }
+        }
+        scale_set = {
+          id   = 301
+          name = "maximum-name"
+        }
+      }
+    }
+    compute_provider_contracts = {
+      (join("", [for index in range(128) : "a"])) = {
+        type = "ec2"
+        capabilities = {
+          scale_set = {
+            configuration_json = "{}"
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      length(one(values(local.reconciler_configs)).value.sessionOwner) == 256 &&
+      can(regex("^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$", one(values(local.reconciler_configs)).value.sessionOwner))
+    )
+    error_message = "A generated session owner must remain deterministic and within the runtime's 256-character limit."
+  }
+}
+
+run "rejects_controller_group_policy_above_inline_quota" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_group_task_policy["ec2"]]
+  }
+
+  override_data {
+    target = data.aws_iam_policy_document.task["ec2"]
+    values = {
+      json = <<-JSON
+        {"payload":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}
+      JSON
+    }
+  }
+
+  expect_failures = [terraform_data.validate_group_task_policy["ec2"]]
+}
+
+run "rejects_conflicting_group_environment_variables" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    compute_provider_contracts = merge(var.compute_provider_contracts, {
+      linux-large = merge(var.compute_provider_contracts.linux-large, {
+        capabilities = {
+          scale_set = merge(var.compute_provider_contracts.linux-large.capabilities.scale_set, {
+            environment_variables = {
+              EC2_CONTROLLER_MODE = "isolated"
+            }
+          })
+        }
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_controller_group_environment_above_task_definition_budget" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    compute_provider_contracts = merge(var.compute_provider_contracts, {
+      linux-small = merge(var.compute_provider_contracts.linux-small, {
+        capabilities = {
+          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
+            environment_variables = merge(
+              var.compute_provider_contracts.linux-small.capabilities.scale_set.environment_variables,
+              {
+                for index in range(16) : format("EC2_QUOTA_%02d", index) => join("", [for part in range(1024) : "xxxx"])
+              },
+            )
+          })
+        }
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_reserved_provider_environment_variables" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    compute_provider_contracts = merge(var.compute_provider_contracts, {
+      linux-small = merge(var.compute_provider_contracts.linux-small, {
+        capabilities = {
+          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
+            environment_variables = {
+              SCALE_SET_OVERRIDE = "unsafe"
+            }
+          })
+        }
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_invalid_boot_timeout" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        scale_set = merge(var.runner_configs.linux-small.scale_set, {
+          boot_time_in_minutes = 0
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_controller_group_above_runtime_reconciler_limit" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    runner_configs = {
+      for index in range(1001) : format("runner-%04d", index) => var.runner_configs.linux-small
+    }
+    compute_provider_contracts = {
+      for index in range(1001) : format("runner-%04d", index) => var.compute_provider_contracts.linux-small
+    }
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          oversized = {
+            runner_configs = toset([for index in range(1001) : format("runner-%04d", index)])
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_controller_group_above_runtime_config_bytes" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    config_store = {
+      tier = "Advanced"
+    }
+    runner_configs = {
+      for index in range(900) : format("runner-%04d", index) => var.runner_configs.linux-small
+    }
+    compute_provider_contracts = {
+      for index in range(900) : format("runner-%04d", index) => merge(var.compute_provider_contracts.linux-small, {
+        capabilities = {
+          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
+            configuration_json = jsonencode({
+              payload = join("", [for part in range(1000) : "xxxxx"])
+            })
+          })
+        }
+      })
+    }
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          oversized = {
+            runner_configs = toset([for index in range(900) : format("runner-%04d", index)])
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_runtime_invalid_credential_parameter_name" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          app = merge(var.runner_configs.microvm.github.app, {
+            app_id = {
+              name = "/github/microvm/bad app-id"
+              arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/bad app-id"
+            }
+          })
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
new file mode 100644
index 0000000000..0d29a31e5d
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -0,0 +1,387 @@
+locals {
+  group_compute_environment_base64 = {
+    for group_name, environment_variables in local.group_compute_environment_variables : group_name => base64encode(jsonencode([
+      for name in sort(keys(environment_variables)) : {
+        name  = name
+        value = environment_variables[name]
+      }
+    ]))
+  }
+  group_compute_environment_bytes = {
+    for group_name, encoded in local.group_compute_environment_base64 : group_name => (
+      floor(length(encoded) * 3 / 4) -
+      (endswith(encoded, "==") ? 2 : endswith(encoded, "=") ? 1 : 0)
+    )
+  }
+}
+
+resource "terraform_data" "validate_contract" {
+  lifecycle {
+    precondition {
+      condition = (
+        length(var.prefix) >= 1 &&
+        length(var.prefix) <= 20 &&
+        can(regex("^[a-z0-9][a-z0-9-]*$", var.prefix))
+      )
+      error_message = "prefix must contain 1 to 20 lowercase ASCII letters, digits, or hyphens and start with a letter or digit."
+    }
+
+    precondition {
+      condition = (
+        length(setsubtract(local.configured_runner_names, local.contract_runner_names)) == 0 &&
+        length(setsubtract(local.contract_runner_names, local.configured_runner_names)) == 0
+      )
+      error_message = "runner_configs and compute_provider_contracts must have exactly the same keys."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_name in keys(var.runner_configs) : (
+          length(runner_name) >= 1 &&
+          length(runner_name) <= 128 &&
+          can(regex("^[A-Za-z0-9][A-Za-z0-9._-]*$", runner_name))
+        )
+      ])
+      error_message = "runner-config keys must contain 1 to 128 ASCII letters, digits, dots, underscores, or hyphens and start with a letter or digit."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_name, runner_config in var.runner_configs : (
+          can(regex("^https://[A-Za-z0-9.-]+(:[1-9][0-9]{0,4})?/[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)?/?$", runner_config.github.config_url)) &&
+          local.github_config_url_ports[runner_name] <= 65535
+        )
+      ])
+      error_message = "Each github.config_url must be an HTTPS GitHub organization, repository, or enterprise URL without credentials, query, fragment, or whitespace."
+    }
+
+    precondition {
+      condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
+      error_message = "Each normalized github.config_url and scale_set.id tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : (
+          alltrue([
+            for parameter in [
+              runner_config.github.app.app_id,
+              runner_config.github.app.private_key,
+              runner_config.github.app.installation_id,
+              ] : (
+              length(parameter.name) <= 2048 &&
+              can(regex("^/[A-Za-z0-9_./-]+$", parameter.name)) &&
+              !endswith(parameter.name, "/") &&
+              !strcontains(parameter.name, "//") &&
+              parameter.arn == format(
+                "arn:%s:ssm:%s:%s:parameter%s",
+                data.aws_partition.current.partition,
+                data.aws_region.current.region,
+                data.aws_caller_identity.current.account_id,
+                parameter.name,
+              ) &&
+              (parameter.kms_key_arn == null ? true : can(regex("^arn:[^:]+:kms:[^:]+:[0-9]{12}:key/.+$", parameter.kms_key_arn)))
+            )
+          ])
+        )
+      ])
+      error_message = "GitHub App credentials must use valid absolute SSM parameter names and exact same-account, same-region parameter ARNs; optional KMS references must be key ARNs."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : (
+          can(regex("^[ -~]{1,128}$", runner_config.scale_set.name)) &&
+          runner_config.scale_set.id >= 1 &&
+          runner_config.scale_set.id <= 2147483647 &&
+          floor(runner_config.scale_set.id) == runner_config.scale_set.id &&
+          (runner_config.scale_set.runner_group_id == null ? true : (
+            runner_config.scale_set.runner_group_id >= 1 &&
+            runner_config.scale_set.runner_group_id <= 2147483647 &&
+            floor(runner_config.scale_set.runner_group_id) == runner_config.scale_set.runner_group_id
+          )) &&
+          runner_config.scale_set.min_runners >= 0 &&
+          floor(runner_config.scale_set.min_runners) == runner_config.scale_set.min_runners &&
+          runner_config.scale_set.max_runners >= 1 &&
+          runner_config.scale_set.max_runners <= 10000 &&
+          floor(runner_config.scale_set.max_runners) == runner_config.scale_set.max_runners &&
+          runner_config.scale_set.min_runners <= runner_config.scale_set.max_runners &&
+          runner_config.scale_set.boot_time_in_minutes >= 1 &&
+          runner_config.scale_set.boot_time_in_minutes <= 120 &&
+          floor(runner_config.scale_set.boot_time_in_minutes) == runner_config.scale_set.boot_time_in_minutes &&
+          (runner_config.scale_set.session_owner == null ? true : can(regex("^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$", runner_config.scale_set.session_owner))) &&
+          (runner_config.work_folder == null ? true : (
+            length(runner_config.work_folder) <= 128 &&
+            !startswith(runner_config.work_folder, "/") &&
+            !strcontains(runner_config.work_folder, "\\") &&
+            can(regex("^[A-Za-z0-9._/-]+$", runner_config.work_folder)) &&
+            alltrue([for part in split("/", runner_config.work_folder) : !contains(["", ".", ".."], part)])
+          )) &&
+          (runner_config.github.user_agent == null ? true : (
+            length(runner_config.github.user_agent) <= 256 &&
+            can(regex("^[ -~]+$", runner_config.github.user_agent))
+          ))
+        )
+      ])
+      error_message = "Scale-set names and IDs must be valid, boot_time_in_minutes must be an integer from 1 through 120, optional session/work-folder/user-agent values must match runtime constraints, and min_runners must be between zero and max_runners (maximum 10000)."
+    }
+
+    precondition {
+      condition = alltrue([
+        for contract in values(var.compute_provider_contracts) : (
+          can(regex("^[a-z][a-z0-9_-]{0,63}$", contract.type)) &&
+          can(keys(jsondecode(contract.capabilities.scale_set.configuration_json))) &&
+          length(contract.capabilities.scale_set.environment_variables) <= 64 &&
+          alltrue([
+            for name, value in contract.capabilities.scale_set.environment_variables : (
+              can(regex("^[A-Z][A-Z0-9_]{0,127}$", name)) &&
+              !contains(local.reserved_environment_variable_names, name) &&
+              alltrue([
+                for prefix in ["AWS_", "ECS_", "GITHUB_", "SCALE_SET_", "NODE_"] :
+                !startswith(name, prefix)
+              ]) &&
+              length(regexall("[\\x00-\\x1F\\x7F]", value)) == 0 &&
+              (
+                floor(length(base64encode(value)) * 3 / 4) -
+                (endswith(base64encode(value), "==") ? 2 : endswith(base64encode(value), "=") ? 1 : 0)
+              ) <= 4096
+            )
+          ]) &&
+          alltrue([
+            for statement_name, statement in contract.capabilities.scale_set.iam_statements : (
+              can(regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$", statement_name)) &&
+              length(statement.actions) > 0 &&
+              length(statement.resources) > 0 &&
+              alltrue([for action in statement.actions : !strcontains(action, "*")]) &&
+              alltrue([
+                for condition in statement.conditions : (
+                  length(condition.test) > 0 &&
+                  length(condition.variable) > 0 &&
+                  length(condition.values) > 0
+                )
+              ])
+            )
+          ])
+        )
+      ])
+      error_message = "Each compute-provider scale-set capability must have safe identifiers, object-shaped configuration JSON, non-secret environment variables with safe unreserved names and bounded values, and non-empty least-privilege IAM statements without wildcard actions."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, entries in local.group_compute_environment_entries : alltrue([
+          for name in distinct([for entry in entries : entry.name]) :
+          length(distinct([for entry in entries : entry.value if entry.name == name])) <= 1
+        ])
+      ])
+      error_message = "Compute-provider environment variables grouped into the same controller task must use identical values for duplicate names. Use a different grouping strategy when providers require conflicting process settings."
+    }
+  }
+}
+
+resource "terraform_data" "validate_grouping" {
+  lifecycle {
+    precondition {
+      condition     = contains(["compute_provider", "runner_config", "custom"], var.grouping.strategy)
+      error_message = "grouping.strategy must be compute_provider, runner_config, or custom."
+    }
+
+    precondition {
+      condition = (
+        var.grouping.strategy == "custom"
+        ? var.grouping.custom != null && length(var.grouping.custom.groups) > 0
+        : var.grouping.custom == null
+      )
+      error_message = "grouping.custom must be non-null and non-empty only when grouping.strategy is custom."
+    }
+
+    precondition {
+      condition = var.grouping.strategy != "custom" ? true : alltrue([
+        for group_name, group in var.grouping.custom.groups : (
+          can(regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$", group_name)) &&
+          length(group.runner_configs) > 0
+        )
+      ])
+      error_message = "Custom group names must be stable, safe identifiers of at most 64 characters, and every group must contain at least one runner config."
+    }
+
+    precondition {
+      condition = var.grouping.strategy != "custom" ? true : (
+        length(local.custom_members) == length(distinct(local.custom_members)) &&
+        length(setsubtract(toset(local.custom_members), local.configured_runner_names)) == 0 &&
+        length(setsubtract(local.configured_runner_names, toset(local.custom_members))) == 0
+      )
+      error_message = "Custom groups must contain every runner config exactly once and cannot contain unknown runner configs."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, runner_names in local.controller_groups : (
+          can(regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", group_name)) &&
+          length(runner_names) > 0 &&
+          length(runner_names) <= 1000
+        )
+      ])
+      error_message = "Resolved controller groups must have safe, non-empty, plan-known names and contain at most 1000 runner configs."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, decoded_bytes in local.group_reconciler_config_bytes : decoded_bytes <= 4 * 1024 * 1024
+      ])
+      error_message = "A controller group's decoded reconciler configuration must not exceed the runtime's 4 MiB aggregate limit. Split the group or reduce provider configuration size."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, environment_bytes in local.group_compute_environment_bytes : environment_bytes <= 48 * 1024
+      ])
+      error_message = "A controller group's compute-provider environment JSON must not exceed 49152 bytes. This reserves 16 KiB of AWS's 64 KiB ECS task-definition quota for the fixed task definition; split the group or reduce provider environment settings."
+    }
+  }
+}
+
+resource "terraform_data" "validate_runtime" {
+  lifecycle {
+    precondition {
+      condition = (
+        var.container.image == null ? true : (
+          length(trimspace(var.container.image)) > 0 &&
+          length(regexall("[[:space:]]", var.container.image)) == 0
+      ))
+      error_message = "Container image references must be non-empty and cannot contain whitespace."
+    }
+
+    precondition {
+      condition = (
+        can(regex("^[1-9][0-9]{0,9}(:[1-9][0-9]{0,9})?$", var.container.user)) &&
+        var.container.health_port >= 1 && var.container.health_port <= 65535 &&
+        (var.container.health_check_command == null ? true : (
+          length(var.container.health_check_command) >= 2 &&
+          contains(["CMD", "CMD-SHELL"], var.container.health_check_command[0])
+        ))
+      )
+      error_message = "The container must use a numeric non-root UID (and optional GID), a valid health port, and a valid ECS health-check command."
+    }
+
+    precondition {
+      condition     = var.container.health_path == "/healthz"
+      error_message = "container.health_path must be /healthz, the scale-set service liveness endpoint."
+    }
+
+    precondition {
+      condition = (
+        var.container.health_check_interval >= 5 && var.container.health_check_interval <= 300 &&
+        var.container.health_check_timeout >= 2 && var.container.health_check_timeout <= 60 &&
+        var.container.health_check_timeout < var.container.health_check_interval &&
+        var.container.health_check_retries >= 1 && var.container.health_check_retries <= 10 &&
+        var.container.health_check_start_period >= 0 && var.container.health_check_start_period <= 300 &&
+        var.container.health_stale_after_seconds >= 30 && var.container.health_stale_after_seconds <= 3600 &&
+        var.container.shutdown_timeout_seconds >= 1 && var.container.shutdown_timeout_seconds <= 119 &&
+        var.container.session_close_timeout_seconds >= 1 && var.container.session_close_timeout_seconds <= 60 &&
+        var.container.reconnect_initial_backoff_seconds >= 1 && var.container.reconnect_initial_backoff_seconds <= 300 &&
+        var.container.reconnect_max_backoff_seconds >= 1 && var.container.reconnect_max_backoff_seconds <= 3600 &&
+        var.container.reconnect_initial_backoff_seconds <= var.container.reconnect_max_backoff_seconds &&
+        var.container.stop_timeout_seconds >= 2 && var.container.stop_timeout_seconds <= 120 &&
+        var.container.shutdown_timeout_seconds < var.container.stop_timeout_seconds
+      )
+      error_message = "Container health and shutdown timings must be within ECS limits, with health timeout below interval and application shutdown below task stop timeout."
+    }
+
+    precondition {
+      condition = (
+        contains(keys(local.fargate_memory_by_cpu), tostring(var.ecs.task.cpu)) &&
+        contains(lookup(local.fargate_memory_by_cpu, tostring(var.ecs.task.cpu), []), var.ecs.task.memory)
+      )
+      error_message = "ecs.task.cpu and ecs.task.memory must be a supported Fargate CPU/memory combination."
+    }
+
+    precondition {
+      condition = (
+        contains(["X86_64", "ARM64"], var.ecs.task.cpu_architecture) &&
+        (var.ecs.task.ephemeral_storage == null ? true : (
+          var.ecs.task.ephemeral_storage.size_in_gib >= 21 && var.ecs.task.ephemeral_storage.size_in_gib <= 200
+        ))
+      )
+      error_message = "ecs.task.cpu_architecture must be X86_64 or ARM64, and optional ephemeral storage must be between 21 and 200 GiB."
+    }
+
+    precondition {
+      condition = (
+        contains(["managed", "external"], var.ecs.cluster.mode) &&
+        (var.ecs.cluster.mode == "external" ? (
+          var.ecs.cluster.arn != null && can(regex("^arn:[^:]+:ecs:[^:]+:[0-9]{12}:cluster/.+$", var.ecs.cluster.arn))
+          ) : (
+          var.ecs.cluster.arn == null &&
+          (var.ecs.cluster.name == null ? true : can(regex("^[A-Za-z0-9_-]{1,255}$", var.ecs.cluster.name)))
+        ))
+      )
+      error_message = "Use a valid external ECS cluster ARN only with cluster.mode external; managed cluster names may contain letters, digits, underscores, and hyphens."
+    }
+
+    precondition {
+      condition = (
+        startswith(var.ecs.iam.path, "/") &&
+        endswith(var.ecs.iam.path, "/") &&
+        length(var.ecs.iam.path) <= 512
+      )
+      error_message = "ecs.iam.path must start and end with a slash and be at most 512 characters."
+    }
+
+    precondition {
+      condition = (
+        length(var.network.vpc_id) > 0 &&
+        length(var.network.subnet_ids) > 0 &&
+        length(var.network.https_egress.ipv4_cidrs) + length(var.network.https_egress.ipv6_cidrs) > 0 &&
+        alltrue([for cidr in var.network.https_egress.ipv4_cidrs : can(cidrnetmask(cidr))]) &&
+        alltrue([for cidr in var.network.https_egress.ipv6_cidrs : can(cidrhost(cidr, 0)) && strcontains(cidr, ":")])
+      )
+      error_message = "network must select a VPC and at least one subnet, and HTTPS egress must contain valid IPv4 or IPv6 CIDRs."
+    }
+
+    precondition {
+      condition = (
+        contains(["STANDARD", "INFREQUENT_ACCESS"], var.logging.log_group_class) &&
+        contains([1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653], var.logging.retention_in_days) &&
+        (var.logging.kms_key_arn == null ? true : can(regex("^arn:[^:]+:kms:[^:]+:[0-9]{12}:key/.+$", var.logging.kms_key_arn)))
+      )
+      error_message = "logging must use a supported class and retention period; kms_key_arn must be a KMS key ARN when set."
+    }
+  }
+}
+
+resource "terraform_data" "validate_config_store" {
+  lifecycle {
+    precondition {
+      condition = (
+        contains(["Standard", "Advanced"], var.config_store.tier) &&
+        startswith(local.config_store_path_prefix, "/") &&
+        !endswith(local.config_store_path_prefix, "/") &&
+        length(local.config_store_path_prefix) >= 2 &&
+        can(regex("^/[A-Za-z0-9_.\\/-]+$", local.config_store_path_prefix))
+      )
+      error_message = "config_store must use Standard or Advanced tier and a valid absolute SSM path prefix without a trailing slash."
+    }
+
+    precondition {
+      condition = alltrue([
+        for config_key, config in local.reconciler_configs : (
+          length("${local.config_store_path_prefix}/${config.group_name}/${config.runner_name}") <= 1011 &&
+          local.reconciler_config_bytes[config_key] <= local.config_store_max_bytes
+        )
+      ])
+      error_message = "Each reconciler SSM parameter name and encoded JSON value must fit the selected Parameter Store tier. Split large controller groups or reduce provider configuration when necessary."
+    }
+  }
+}
+
+resource "terraform_data" "validate_group_task_policy" {
+  for_each = local.controller_groups
+
+  lifecycle {
+    precondition {
+      condition     = local.group_task_policy_bytes[each.key] <= 10240
+      error_message = "Controller group ${each.key} produces a ${local.group_task_policy_bytes[each.key]}-byte task-role policy, exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
+    }
+  }
+}
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
new file mode 100644
index 0000000000..c1b854d5f2
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -0,0 +1,201 @@
+variable "prefix" {
+  description = "Stable prefix used for scale-set controller resources."
+  type        = string
+  default     = "github-actions"
+  nullable    = false
+}
+
+variable "runner_configs" {
+  description = <<-EOT
+    Normalized scale-set runner configurations keyed by stable runner-config name.
+
+    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.ssl_verify` applies TLS verification per reconciler without changing process-global TLS behavior. Parameter and optional KMS ARNs, scale-set IDs, and other inner values may remain unknown until apply.
+  EOT
+  type = map(object({
+    github = object({
+      config_url = string
+      app = object({
+        app_id = object({
+          name        = string
+          arn         = string
+          kms_key_arn = optional(string, null)
+        })
+        private_key = object({
+          name        = string
+          arn         = string
+          kms_key_arn = optional(string, null)
+        })
+        installation_id = object({
+          name        = string
+          arn         = string
+          kms_key_arn = optional(string, null)
+        })
+      })
+      force_ghes = optional(bool, null)
+      ssl_verify = optional(bool, true)
+      user_agent = optional(string, null)
+    })
+    scale_set = object({
+      name                 = string
+      id                   = number
+      runner_group_id      = optional(number, null)
+      min_runners          = optional(number, 0)
+      max_runners          = optional(number, 10)
+      boot_time_in_minutes = optional(number, 10)
+      session_owner        = optional(string, null)
+    })
+    work_folder = optional(string, null)
+  }))
+  nullable = false
+}
+
+variable "compute_provider_contracts" {
+  description = <<-EOT
+    Provider-neutral, scale-set capability fragments keyed exactly like `runner_configs`.
+
+    `type` is the plan-known provider discriminator used by the default grouping implementation and the runtime adapter registry. `configuration_json` is provider-owned, valid JSON and must contain no secrets. `environment_variables` contains non-secret provider process settings shared by every reconciler in the same controller group; conflicting values are rejected. IAM statement map keys and optional condition shapes must be known during planning; their action, resource, and condition values may be computed.
+  EOT
+  type = map(object({
+    type = string
+    capabilities = object({
+      scale_set = object({
+        configuration_json    = optional(string, "{}")
+        environment_variables = optional(map(string), {})
+        iam_statements = optional(map(object({
+          actions   = set(string)
+          resources = set(string)
+          conditions = optional(list(object({
+            test     = string
+            variable = string
+            values   = set(string)
+          })), [])
+        })), {})
+      })
+    })
+  }))
+  nullable = false
+}
+
+variable "grouping" {
+  description = <<-EOT
+    Packing strategy for scale-set reconcilers. `compute_provider` creates one controller group per compute-provider type and is the default. `runner_config` creates one group per runner config. `custom` uses `custom.groups`; custom membership must cover every runner config exactly once.
+
+    The strategy, custom group keys, and memberships select Terraform `for_each` instances and must be known during planning.
+  EOT
+  type = object({
+    strategy = optional(string, "compute_provider")
+    custom = optional(object({
+      groups = map(object({
+        runner_configs = set(string)
+      }))
+    }), null)
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "container" {
+  description = "Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health_path is fixed at /healthz, the ECS liveness endpoint."
+  type = object({
+    image                             = optional(string, null)
+    user                              = optional(string, "10001:10001")
+    health_port                       = optional(number, 8080)
+    health_path                       = optional(string, "/healthz")
+    health_check_command              = optional(list(string), null)
+    health_check_interval             = optional(number, 30)
+    health_check_timeout              = optional(number, 5)
+    health_check_retries              = optional(number, 3)
+    health_check_start_period         = optional(number, 30)
+    health_stale_after_seconds        = optional(number, 180)
+    shutdown_timeout_seconds          = optional(number, 110)
+    session_close_timeout_seconds     = optional(number, 10)
+    reconnect_initial_backoff_seconds = optional(number, 1)
+    reconnect_max_backoff_seconds     = optional(number, 30)
+    stop_timeout_seconds              = optional(number, 120)
+    ecr_repository = optional(object({
+      arn = string
+    }), null)
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "config_store" {
+  description = <<-EOT
+    Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.
+
+    Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`.
+  EOT
+  type = object({
+    path_prefix = optional(string, null)
+    tier        = optional(string, "Standard")
+    tags        = optional(map(string), {})
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "ecs" {
+  description = <<-EOT
+    ECS substrate configuration. A managed cluster is created by default. For an external cluster, set `cluster.mode = "external"` and pass its ARN; the mode must be plan-known while the ARN may be computed.
+  EOT
+  type = object({
+    cluster = optional(object({
+      mode               = optional(string, "managed")
+      arn                = optional(string, null)
+      name               = optional(string, null)
+      container_insights = optional(bool, true)
+    }), {})
+    task = optional(object({
+      cpu              = optional(number, 512)
+      memory           = optional(number, 1024)
+      cpu_architecture = optional(string, "X86_64")
+      ephemeral_storage = optional(object({
+        size_in_gib = number
+      }), null)
+    }), {})
+    service = optional(object({
+      platform_version = optional(string, "LATEST")
+    }), {})
+    iam = optional(object({
+      path                 = optional(string, "/")
+      permissions_boundary = optional(string, null)
+    }), {})
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "network" {
+  description = <<-EOT
+    Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required.
+  EOT
+  type = object({
+    vpc_id     = string
+    subnet_ids = set(string)
+    https_egress = optional(object({
+      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])
+      ipv6_cidrs = optional(set(string), [])
+    }), {})
+  })
+  nullable = false
+}
+
+variable "logging" {
+  description = "CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key."
+  type = object({
+    retention_in_days = optional(number, 30)
+    kms_key_arn       = optional(string, null)
+    log_group_class   = optional(string, "STANDARD")
+    tags              = optional(map(string), {})
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "tags" {
+  description = "Tags applied to scale-set orchestration resources."
+  type        = map(string)
+  default     = {}
+  nullable    = false
+}
diff --git a/modules/orchestration-providers/scale-set/versions.tf b/modules/orchestration-providers/scale-set/versions.tf
new file mode 100644
index 0000000000..3ef011ea0a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.4.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.33"
+    }
+  }
+}

From fe2000fd627e947855b8bf1091853efab920773c Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Fri, 11 Sep 2026 11:46:33 +0200
Subject: [PATCH 02/52] fix(terraform): raise minimum to 1.5.6

---
 examples/multi-runner-v2/versions.tf                            | 2 +-
 examples/multi-runner/versions.tf                               | 2 +-
 modules/compute-providers/aws/ec2/trust-policy/versions.tf      | 2 +-
 modules/compute-providers/aws/ec2/versions.tf                   | 2 +-
 .../scale-set/tests/fixtures/computed-inputs/versions.tf        | 2 +-
 modules/orchestration-providers/scale-set/versions.tf           | 2 +-
 modules/orchestration-providers/webhook/job-retry/versions.tf   | 2 +-
 modules/orchestration-providers/webhook/pool/versions.tf        | 2 +-
 .../orchestration-providers/webhook/scale-runners/versions.tf   | 2 +-
 modules/orchestration-providers/webhook/versions.tf             | 2 +-
 modules/runner-config/versions.tf                               | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/examples/multi-runner-v2/versions.tf b/examples/multi-runner-v2/versions.tf
index 1dfb3e5774..6af69ab915 100644
--- a/examples/multi-runner-v2/versions.tf
+++ b/examples/multi-runner-v2/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 }
diff --git a/examples/multi-runner/versions.tf b/examples/multi-runner/versions.tf
index 1dfb3e5774..6af69ab915 100644
--- a/examples/multi-runner/versions.tf
+++ b/examples/multi-runner/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 }
diff --git a/modules/compute-providers/aws/ec2/trust-policy/versions.tf b/modules/compute-providers/aws/ec2/trust-policy/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/compute-providers/aws/ec2/trust-policy/versions.tf
+++ b/modules/compute-providers/aws/ec2/trust-policy/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/compute-providers/aws/ec2/versions.tf b/modules/compute-providers/aws/ec2/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/compute-providers/aws/ec2/versions.tf
+++ b/modules/compute-providers/aws/ec2/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/scale-set/versions.tf b/modules/orchestration-providers/scale-set/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/orchestration-providers/scale-set/versions.tf
+++ b/modules/orchestration-providers/scale-set/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/job-retry/versions.tf b/modules/orchestration-providers/webhook/job-retry/versions.tf
index fcec7c620d..1238b79cc3 100644
--- a/modules/orchestration-providers/webhook/job-retry/versions.tf
+++ b/modules/orchestration-providers/webhook/job-retry/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/pool/versions.tf b/modules/orchestration-providers/webhook/pool/versions.tf
index fcec7c620d..1238b79cc3 100644
--- a/modules/orchestration-providers/webhook/pool/versions.tf
+++ b/modules/orchestration-providers/webhook/pool/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/scale-runners/versions.tf b/modules/orchestration-providers/webhook/scale-runners/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/orchestration-providers/webhook/scale-runners/versions.tf
+++ b/modules/orchestration-providers/webhook/scale-runners/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/versions.tf b/modules/orchestration-providers/webhook/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/orchestration-providers/webhook/versions.tf
+++ b/modules/orchestration-providers/webhook/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/runner-config/versions.tf b/modules/runner-config/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/runner-config/versions.tf
+++ b/modules/runner-config/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {

From 9d10f2190b72ff714e7636b3c13c87dae2df89b9 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Fri, 11 Sep 2026 12:06:45 +0200
Subject: [PATCH 03/52] fix(terraform): limit minimum to scale-set module

---
 examples/multi-runner-v2/versions.tf                          | 2 +-
 examples/multi-runner/versions.tf                             | 2 +-
 modules/compute-providers/aws/ec2/trust-policy/versions.tf    | 2 +-
 modules/compute-providers/aws/ec2/versions.tf                 | 2 +-
 modules/orchestration-providers/scale-set/README.md           | 2 +-
 .../scale-set/tests/fixtures/computed-inputs/README.md        | 4 ++--
 modules/orchestration-providers/webhook/job-retry/versions.tf | 2 +-
 modules/orchestration-providers/webhook/pool/versions.tf      | 2 +-
 .../orchestration-providers/webhook/scale-runners/versions.tf | 2 +-
 modules/orchestration-providers/webhook/versions.tf           | 2 +-
 modules/runner-config/versions.tf                             | 2 +-
 11 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/examples/multi-runner-v2/versions.tf b/examples/multi-runner-v2/versions.tf
index 6af69ab915..1dfb3e5774 100644
--- a/examples/multi-runner-v2/versions.tf
+++ b/examples/multi-runner-v2/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 }
diff --git a/examples/multi-runner/versions.tf b/examples/multi-runner/versions.tf
index 6af69ab915..1dfb3e5774 100644
--- a/examples/multi-runner/versions.tf
+++ b/examples/multi-runner/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 }
diff --git a/modules/compute-providers/aws/ec2/trust-policy/versions.tf b/modules/compute-providers/aws/ec2/trust-policy/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/compute-providers/aws/ec2/trust-policy/versions.tf
+++ b/modules/compute-providers/aws/ec2/trust-policy/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/compute-providers/aws/ec2/versions.tf b/modules/compute-providers/aws/ec2/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/compute-providers/aws/ec2/versions.tf
+++ b/modules/compute-providers/aws/ec2/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index 13d0476599..2d7e07456e 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -149,7 +149,7 @@ Inner values such as scale-set IDs, SSM/KMS ARNs, provider configuration values,
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
 
 ## Providers
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
index 8ee616b61b..25516ecf3a 100644
--- a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
@@ -3,7 +3,7 @@
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
 
 ## Providers
@@ -35,4 +35,4 @@ No inputs.
 | <a name="output_cluster"></a> [cluster](#output\_cluster) | n/a |
 | <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | n/a |
 | <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | n/a |
-<!-- END_TF_DOCS -->
\ No newline at end of file
+<!-- END_TF_DOCS -->
diff --git a/modules/orchestration-providers/webhook/job-retry/versions.tf b/modules/orchestration-providers/webhook/job-retry/versions.tf
index 1238b79cc3..fcec7c620d 100644
--- a/modules/orchestration-providers/webhook/job-retry/versions.tf
+++ b/modules/orchestration-providers/webhook/job-retry/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/pool/versions.tf b/modules/orchestration-providers/webhook/pool/versions.tf
index 1238b79cc3..fcec7c620d 100644
--- a/modules/orchestration-providers/webhook/pool/versions.tf
+++ b/modules/orchestration-providers/webhook/pool/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/scale-runners/versions.tf b/modules/orchestration-providers/webhook/scale-runners/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/orchestration-providers/webhook/scale-runners/versions.tf
+++ b/modules/orchestration-providers/webhook/scale-runners/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/versions.tf b/modules/orchestration-providers/webhook/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/orchestration-providers/webhook/versions.tf
+++ b/modules/orchestration-providers/webhook/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/runner-config/versions.tf b/modules/runner-config/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/runner-config/versions.tf
+++ b/modules/runner-config/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {

From cc8f61fd38fc5c3a2fc7c7d83f53551b133795fc Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Fri, 11 Sep 2026 13:59:47 +0200
Subject: [PATCH 04/52] fix(scale-set): align GitHub and workspace
 configuration

---
 .../scale-set/README.md                       | 26 +++--
 .../scale-set/locals.tf                       | 30 +++---
 .../tests/fixtures/computed-inputs/main.tf    |  9 +-
 .../scale-set/tests/scale-set.tftest.hcl      | 96 +++++++------------
 .../scale-set/validations.tf                  | 44 +++------
 .../scale-set/variables.tf                    | 24 ++---
 6 files changed, 84 insertions(+), 145 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index 2d7e07456e..2a04930405 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -10,11 +10,11 @@ This internal module deploys long-running GitHub Actions runner scale-set contro
 1 ScaleSetController supervising N independent reconcilers
 ```
 
-Each reconciler still owns exactly one GitHub scale-set ID and one message session. Grouping only packs reconcilers into a shared task; it does not merge scale-set identity, session state, or compute-provider behavior. It does, however, intentionally union task IAM permissions and failure/deployment blast radius across all members of that controller group.
+Each reconciler still owns exactly one GitHub scale-set identity and one message session. Grouping only packs reconcilers into a shared task; it does not merge scale-set identity, session state, or compute-provider behavior. It does, however, intentionally union task IAM permissions and failure/deployment blast radius across all members of that controller group.
 
-This foundation adopts scale sets that were created elsewhere. It validates the supplied ID, expected name, and optional runner-group ID at runtime, but it does not create or delete the GitHub scale-set resource. The complete compute-provider contract must likewise come from its Terraform adapter; until that adapter and the public runner-config selection are wired, this internal module is not an end-to-end deployment interface.
+This foundation adopts scale sets that were created elsewhere. It passes the configured name to the controller, which captures the scale-set and runner-group identifiers dynamically from GitHub; it does not create or delete the GitHub scale-set resource. The complete compute-provider contract must likewise come from its Terraform adapter; until that adapter and the public runner-config selection are wired, this internal module is not an end-to-end deployment interface.
 
-The normalized `(github.config_url, scale_set.id)` ownership tuple must be globally unique across all groups. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Numeric scale-set IDs may repeat under different GitHub scopes.
+The normalized `(github.config_url, scale_set.name)` ownership tuple must be globally unique across all groups. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Scale-set names may repeat under different GitHub scopes.
 
 ## Grouping
 
@@ -76,9 +76,7 @@ Each leaf is the flat `ScaleSetReconcilerConfig` consumed by the service:
   "schemaVersion": 1,
   "runnerConfigName": "linux-small",
   "githubConfigUrl": "https://github.com/example",
-  "scaleSetId": 123,
   "expectedScaleSetName": "linux-small",
-  "expectedRunnerGroupId": null,
   "minRunners": 0,
   "maxRunners": 20,
   "bootTimeoutMinutes": 10,
@@ -96,7 +94,7 @@ Each leaf is the flat `ScaleSetReconcilerConfig` consumed by the service:
 
 The task receives only the group name, group path, and a SHA-256 revision. It loads the direct children with `GetParametersByPath`. Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes; Terraform validates every leaf against the selected tier and limits the decoded aggregate for one group to 4 MiB. The group revision changes the task definition whenever any reconciler configuration changes.
 
-Terraform always emits `sessionOwner`. An omitted value normally resolves to `<group>.<runner-config>`; if that would exceed the runtime's 256-character limit, the module truncates both readable components and appends a deterministic hash.
+Terraform derives `sessionOwner` locally as `<group>.<runner-config>`; if that would exceed the runtime's 256-character limit, the module truncates both readable components and appends a deterministic hash.
 
 GitHub credential **values** never enter Terraform configuration, task definitions, or controller-config parameters. Each leaf carries only three Parameter Store names. The task role can read the exact credential parameter ARNs for its group and decrypt only explicitly declared KMS keys.
 
@@ -142,21 +140,21 @@ The following values control `for_each`, dynamic IAM statements, or resource own
 - optional ECS ephemeral-storage wrapper presence;
 - managed versus external cluster mode.
 
-Inner values such as scale-set IDs, SSM/KMS ARNs, provider configuration values, IAM actions/resources, and an external cluster ARN may be computed. Nullable computed values should be placed inside a plan-known wrapper rather than used as the wrapper itself.
+Inner values such as scale-set names, SSM/KMS ARNs, provider configuration values, IAM actions/resources, and an external cluster ARN may be computed. Nullable computed values should be placed inside a plan-known wrapper rather than used as the wrapper itself.
 
 <!-- BEGIN_TF_DOCS -->
 ## Requirements
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
 
 ## Providers
 
 | Name | Version |
-|------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.33 |
+| ---- | ------- |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.64.0 |
 | <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
@@ -166,7 +164,7 @@ No modules.
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
 | [aws_cloudwatch_log_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
 | [aws_ecs_cluster.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource |
 | [aws_ecs_service.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
@@ -192,7 +190,7 @@ No modules.
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
+| ---- | ----------- | ---- | ------- | :------: |
 | <a name="input_compute_provider_contracts"></a> [compute\_provider\_contracts](#input\_compute\_provider\_contracts) | Provider-neutral, scale-set capability fragments keyed exactly like `runner_configs`.<br/><br/>`type` is the plan-known provider discriminator used by the default grouping implementation and the runtime adapter registry. `configuration_json` is provider-owned, valid JSON and must contain no secrets. `environment_variables` contains non-secret provider process settings shared by every reconciler in the same controller group; conflicting values are rejected. IAM statement map keys and optional condition shapes must be known during planning; their action, resource, and condition values may be computed. | <pre>map(object({<br/>    type = string<br/>    capabilities = object({<br/>      scale_set = object({<br/>        configuration_json    = optional(string, "{}")<br/>        environment_variables = optional(map(string), {})<br/>        iam_statements = optional(map(object({<br/>          actions   = set(string)<br/>          resources = set(string)<br/>          conditions = optional(list(object({<br/>            test     = string<br/>            variable = string<br/>            values   = set(string)<br/>          })), [])<br/>        })), {})<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_config_store"></a> [config\_store](#input\_config\_store) | Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.<br/><br/>Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`. | <pre>object({<br/>    path_prefix = optional(string, null)<br/>    tier        = optional(string, "Standard")<br/>    tags        = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_container"></a> [container](#input\_container) | Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health\_path is fixed at /healthz, the ECS liveness endpoint. | <pre>object({<br/>    image                             = optional(string, null)<br/>    user                              = optional(string, "10001:10001")<br/>    health_port                       = optional(number, 8080)<br/>    health_path                       = optional(string, "/healthz")<br/>    health_check_command              = optional(list(string), null)<br/>    health_check_interval             = optional(number, 30)<br/>    health_check_timeout              = optional(number, 5)<br/>    health_check_retries              = optional(number, 3)<br/>    health_check_start_period         = optional(number, 30)<br/>    health_stale_after_seconds        = optional(number, 180)<br/>    shutdown_timeout_seconds          = optional(number, 110)<br/>    session_close_timeout_seconds     = optional(number, 10)<br/>    reconnect_initial_backoff_seconds = optional(number, 1)<br/>    reconnect_max_backoff_seconds     = optional(number, 30)<br/>    stop_timeout_seconds              = optional(number, 120)<br/>    ecr_repository = optional(object({<br/>      arn = string<br/>    }), null)<br/>  })</pre> | `{}` | no |
@@ -201,13 +199,13 @@ No modules.
 | <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
-| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.ssl_verify` applies TLS verification per reconciler without changing process-global TLS behavior. Parameter and optional KMS ARNs, scale-set IDs, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      config_url = string<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      force_ghes = optional(bool, null)<br/>      ssl_verify = optional(bool, true)<br/>      user_agent = optional(string, null)<br/>    })<br/>    scale_set = object({<br/>      name                 = string<br/>      id                   = number<br/>      runner_group_id      = optional(number, null)<br/>      min_runners          = optional(number, 0)<br/>      max_runners          = optional(number, 10)<br/>      boot_time_in_minutes = optional(number, 10)<br/>      session_owner        = optional(string, null)<br/>    })<br/>    work_folder = optional(string, null)<br/>  }))</pre> | n/a | yes |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      config_url = string<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      user_agent = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
 
 ## Outputs
 
 | Name | Description |
-|------|-------------|
+| ---- | ----------- |
 | <a name="output_cluster"></a> [cluster](#output\_cluster) | Managed or external ECS cluster selected for all controller groups. |
 | <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | Controller-group resources keyed by stable resolved group name. |
 | <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | Non-secret SSM controller configuration parameters keyed by `<controller-group>/<runner-config>`. Values are intentionally not exposed. |
diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
index cd74e967a9..6a52092461 100644
--- a/modules/orchestration-providers/scale-set/locals.tf
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -18,7 +18,7 @@ locals {
   }
   scale_set_ownership_keys = [
     for runner_name, runner_config in var.runner_configs :
-    "${local.normalized_github_config_urls[runner_name]}#${runner_config.scale_set.id}"
+    "${local.normalized_github_config_urls[runner_name]}#${runner_config.scale_set.name}"
   ]
 
   declared_custom_groups = var.grouping.strategy == "custom" && var.grouping.custom != null ? {
@@ -81,20 +81,17 @@ locals {
         group_name  = group_name
         runner_name = runner_name
         value = merge({
-          schemaVersion         = 1
-          runnerConfigName      = runner_name
-          githubConfigUrl       = var.runner_configs[runner_name].github.config_url
-          scaleSetId            = var.runner_configs[runner_name].scale_set.id
-          expectedScaleSetName  = var.runner_configs[runner_name].scale_set.name
-          expectedRunnerGroupId = var.runner_configs[runner_name].scale_set.runner_group_id
-          minRunners            = var.runner_configs[runner_name].scale_set.min_runners
-          maxRunners            = var.runner_configs[runner_name].scale_set.max_runners
-          bootTimeoutMinutes    = var.runner_configs[runner_name].scale_set.boot_time_in_minutes
-          sslVerify             = var.runner_configs[runner_name].github.ssl_verify
+          schemaVersion        = 1
+          runnerConfigName     = runner_name
+          githubConfigUrl      = var.runner_configs[runner_name].github.config_url
+          expectedScaleSetName = var.runner_configs[runner_name].scale_set.name
+          minRunners           = var.runner_configs[runner_name].scale_set.runner.min_runners
+          maxRunners           = var.runner_configs[runner_name].scale_set.runner.max_runners
+          bootTimeoutMinutes   = var.runner_configs[runner_name].scale_set.runner.boot_time_in_minutes
+          sslVerify            = var.runner_configs[runner_name].github.enterprise_server.ssl_verify
+          forceGhes            = var.runner_configs[runner_name].github.enterprise_server.url != null
           sessionOwner = (
-            var.runner_configs[runner_name].scale_set.session_owner != null
-            ? var.runner_configs[runner_name].scale_set.session_owner
-            : length("${group_name}.${runner_name}") <= 256
+            length("${group_name}.${runner_name}") <= 256
             ? "${group_name}.${runner_name}"
             : "${substr(group_name, 0, 119)}.${substr(runner_name, 0, 119)}.${substr(sha256(format("%s.%s", group_name, runner_name)), 0, 16)}"
           )
@@ -107,11 +104,6 @@ locals {
             type          = var.compute_provider_contracts[runner_name].type
             configuration = jsondecode(var.compute_provider_contracts[runner_name].capabilities.scale_set.configuration_json)
           }
-          }, var.runner_configs[runner_name].work_folder == null ? {} : {
-          workFolder = var.runner_configs[runner_name].work_folder
-          }, var.runner_configs[runner_name].github.force_ghes == null ? {} : {
-          forceGhes = var.runner_configs[runner_name].github.force_ghes
-          }, var.runner_configs[runner_name].github.user_agent == null ? {} : {
           userAgent = var.runner_configs[runner_name].github.user_agent
         })
       }
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
index 1bbb74f924..8410005c3a 100644
--- a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
@@ -2,7 +2,6 @@ resource "terraform_data" "computed" {
   input = {
     external_cluster_arn = "arn:aws:ecs:eu-west-1:123456789012:cluster/external"
     github_config_url    = "https://github.com/example"
-    scale_set_id         = 901
     app_id_arn           = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/app-id"
     private_key_arn      = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/private-key"
     installation_id_arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/installation-id"
@@ -21,7 +20,8 @@ module "subject" {
   runner_configs = {
     computed = {
       github = {
-        config_url = terraform_data.computed.output.github_config_url
+        config_url        = terraform_data.computed.output.github_config_url
+        enterprise_server = {}
         app = {
           app_id = {
             name = "/github/computed/app-id"
@@ -37,11 +37,10 @@ module "subject" {
             arn  = terraform_data.computed.output.installation_id_arn
           }
         }
+        user_agent = "scale-set-test"
       }
       scale_set = {
-        id              = terraform_data.computed.output.scale_set_id
-        name            = "computed"
-        runner_group_id = null
+        name = "computed"
       }
     }
   }
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index f90142015f..4302a9a496 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -43,6 +43,9 @@ variables {
     linux-small = {
       github = {
         config_url = "https://github.com/example"
+        enterprise_server = {
+          ssl_verify = false
+        }
         app = {
           app_id = {
             name = "/github/linux-small/app-id"
@@ -59,19 +62,19 @@ variables {
           }
         }
         user_agent = "scale-set-test"
-        ssl_verify = false
       }
       scale_set = {
-        id              = 101
-        name            = "linux-small"
-        runner_group_id = 1
-        min_runners     = 1
-        max_runners     = 10
+        name = "linux-small"
+        runner = {
+          min_runners = 1
+          max_runners = 10
+        }
       }
     }
     linux-large = {
       github = {
         config_url = "https://github.com/example"
+        enterprise_server = {}
         app = {
           app_id = {
             name = "/github/linux-large/app-id"
@@ -86,18 +89,20 @@ variables {
             arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/installation-id"
           }
         }
+        user_agent = "scale-set-test"
       }
       scale_set = {
-        id          = 102
-        name        = "linux-large"
-        min_runners = 0
-        max_runners = 20
+        name = "linux-large"
+        runner = {
+          min_runners = 0
+          max_runners = 20
+        }
       }
-      work_folder = "_work/linux-large"
     }
     microvm = {
       github = {
         config_url = "https://github.com/example/repository"
+        enterprise_server = {}
         app = {
           app_id = {
             name = "/github/microvm/app-id"
@@ -112,14 +117,14 @@ variables {
             arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/installation-id"
           }
         }
-        force_ghes = false
+        user_agent = "scale-set-test"
       }
       scale_set = {
-        id            = 201
-        name          = "microvm"
-        min_runners   = 0
-        max_runners   = 5
-        session_owner = "test.microvm"
+        name = "microvm"
+        runner = {
+          min_runners = 0
+          max_runners = 5
+        }
       }
     }
   }
@@ -299,10 +304,12 @@ run "groups_by_compute_provider_and_hardens_each_task" {
     condition = (
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).schemaVersion == 1 &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).runnerConfigName == "linux-small" &&
-      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).scaleSetId == 101 &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com/example" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).expectedScaleSetName == "linux-small" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).bootTimeoutMinutes == 10 &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).sslVerify == false &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).forceGhes == false &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).userAgent == "scale-set-test" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubApp.privateKeyParameterName == "/github/linux-small/private-key" &&
       !contains(keys(jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value))), "runnerConfig")
     )
@@ -518,7 +525,7 @@ run "rejects_duplicate_scale_set_ownership_across_groups" {
           config_url = "https://GITHUB.COM:443/example/"
         })
         scale_set = merge(var.runner_configs.microvm.scale_set, {
-          id = 101
+          name = "linux-small"
         })
       })
     })
@@ -541,7 +548,7 @@ run "rejects_leading_zero_default_port_spelling" {
           config_url = "https://github.com:0443/example/"
         })
         scale_set = merge(var.runner_configs.microvm.scale_set, {
-          id = 101
+          name = "linux-small"
         })
       })
     })
@@ -608,46 +615,6 @@ run "rejects_invalid_compute_provider_type_identifier" {
   expect_failures = [terraform_data.validate_contract]
 }
 
-run "rejects_scale_set_id_above_runtime_integer_maximum" {
-  command = plan
-
-  plan_options {
-    target = [terraform_data.validate_contract]
-  }
-
-  variables {
-    runner_configs = merge(var.runner_configs, {
-      microvm = merge(var.runner_configs.microvm, {
-        scale_set = merge(var.runner_configs.microvm.scale_set, {
-          id = 2147483648
-        })
-      })
-    })
-  }
-
-  expect_failures = [terraform_data.validate_contract]
-}
-
-run "rejects_runner_group_id_above_runtime_integer_maximum" {
-  command = plan
-
-  plan_options {
-    target = [terraform_data.validate_contract]
-  }
-
-  variables {
-    runner_configs = merge(var.runner_configs, {
-      microvm = merge(var.runner_configs.microvm, {
-        scale_set = merge(var.runner_configs.microvm.scale_set, {
-          runner_group_id = 2147483648
-        })
-      })
-    })
-  }
-
-  expect_failures = [terraform_data.validate_contract]
-}
-
 run "rejects_credential_arn_name_mismatch" {
   command = plan
 
@@ -696,7 +663,7 @@ run "rejects_cross_account_credential_parameter" {
   expect_failures = [terraform_data.validate_contract]
 }
 
-run "allows_same_numeric_scale_set_id_in_another_github_scope" {
+run "allows_same_scale_set_name_in_another_github_scope" {
   command = plan
 
   plan_options {
@@ -707,7 +674,7 @@ run "allows_same_numeric_scale_set_id_in_another_github_scope" {
     runner_configs = merge(var.runner_configs, {
       microvm = merge(var.runner_configs.microvm, {
         scale_set = merge(var.runner_configs.microvm.scale_set, {
-          id = 101
+          name = "linux-small"
         })
       })
     })
@@ -715,7 +682,7 @@ run "allows_same_numeric_scale_set_id_in_another_github_scope" {
 
   assert {
     condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
-    error_message = "Scale-set IDs are scoped to their normalized GitHub configuration URL."
+    error_message = "Scale-set names are scoped to their normalized GitHub configuration URL."
   }
 }
 
@@ -730,6 +697,8 @@ run "bounds_default_session_owner_for_maximum_names" {
       (join("", [for index in range(128) : "a"])) = {
         github = {
           config_url = "https://github.com/example"
+          enterprise_server = {}
+          user_agent = "scale-set-test"
           app = {
             app_id = {
               name = "/github/max/app-id"
@@ -746,7 +715,6 @@ run "bounds_default_session_owner_for_maximum_names" {
           }
         }
         scale_set = {
-          id   = 301
           name = "maximum-name"
         }
       }
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index 0d29a31e5d..c5d5a80a36 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -57,7 +57,7 @@ resource "terraform_data" "validate_contract" {
 
     precondition {
       condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
-      error_message = "Each normalized github.config_url and scale_set.id tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
+      error_message = "Each normalized github.config_url and scale_set.name tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
     }
 
     precondition {
@@ -92,38 +92,20 @@ resource "terraform_data" "validate_contract" {
       condition = alltrue([
         for runner_config in values(var.runner_configs) : (
           can(regex("^[ -~]{1,128}$", runner_config.scale_set.name)) &&
-          runner_config.scale_set.id >= 1 &&
-          runner_config.scale_set.id <= 2147483647 &&
-          floor(runner_config.scale_set.id) == runner_config.scale_set.id &&
-          (runner_config.scale_set.runner_group_id == null ? true : (
-            runner_config.scale_set.runner_group_id >= 1 &&
-            runner_config.scale_set.runner_group_id <= 2147483647 &&
-            floor(runner_config.scale_set.runner_group_id) == runner_config.scale_set.runner_group_id
-          )) &&
-          runner_config.scale_set.min_runners >= 0 &&
-          floor(runner_config.scale_set.min_runners) == runner_config.scale_set.min_runners &&
-          runner_config.scale_set.max_runners >= 1 &&
-          runner_config.scale_set.max_runners <= 10000 &&
-          floor(runner_config.scale_set.max_runners) == runner_config.scale_set.max_runners &&
-          runner_config.scale_set.min_runners <= runner_config.scale_set.max_runners &&
-          runner_config.scale_set.boot_time_in_minutes >= 1 &&
-          runner_config.scale_set.boot_time_in_minutes <= 120 &&
-          floor(runner_config.scale_set.boot_time_in_minutes) == runner_config.scale_set.boot_time_in_minutes &&
-          (runner_config.scale_set.session_owner == null ? true : can(regex("^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$", runner_config.scale_set.session_owner))) &&
-          (runner_config.work_folder == null ? true : (
-            length(runner_config.work_folder) <= 128 &&
-            !startswith(runner_config.work_folder, "/") &&
-            !strcontains(runner_config.work_folder, "\\") &&
-            can(regex("^[A-Za-z0-9._/-]+$", runner_config.work_folder)) &&
-            alltrue([for part in split("/", runner_config.work_folder) : !contains(["", ".", ".."], part)])
-          )) &&
-          (runner_config.github.user_agent == null ? true : (
-            length(runner_config.github.user_agent) <= 256 &&
-            can(regex("^[ -~]+$", runner_config.github.user_agent))
-          ))
+          runner_config.scale_set.runner.min_runners >= 0 &&
+          floor(runner_config.scale_set.runner.min_runners) == runner_config.scale_set.runner.min_runners &&
+          runner_config.scale_set.runner.max_runners >= 1 &&
+          runner_config.scale_set.runner.max_runners <= 10000 &&
+          floor(runner_config.scale_set.runner.max_runners) == runner_config.scale_set.runner.max_runners &&
+          runner_config.scale_set.runner.min_runners <= runner_config.scale_set.runner.max_runners &&
+          runner_config.scale_set.runner.boot_time_in_minutes >= 1 &&
+          runner_config.scale_set.runner.boot_time_in_minutes <= 120 &&
+          floor(runner_config.scale_set.runner.boot_time_in_minutes) == runner_config.scale_set.runner.boot_time_in_minutes &&
+          length(runner_config.github.user_agent) <= 256 &&
+          can(regex("^[ -~]+$", runner_config.github.user_agent))
         )
       ])
-      error_message = "Scale-set names and IDs must be valid, boot_time_in_minutes must be an integer from 1 through 120, optional session/work-folder/user-agent values must match runtime constraints, and min_runners must be between zero and max_runners (maximum 10000)."
+      error_message = "Scale-set names must be valid, boot_time_in_minutes must be an integer from 1 through 120, and min_runners must be between zero and max_runners (maximum 10000)."
     }
 
     precondition {
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
index c1b854d5f2..bdf8c2b688 100644
--- a/modules/orchestration-providers/scale-set/variables.tf
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -9,11 +9,15 @@ variable "runner_configs" {
   description = <<-EOT
     Normalized scale-set runner configurations keyed by stable runner-config name.
 
-    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.ssl_verify` applies TLS verification per reconciler without changing process-global TLS behavior. Parameter and optional KMS ARNs, scale-set IDs, and other inner values may remain unknown until apply.
+    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply.
   EOT
   type = map(object({
     github = object({
       config_url = string
+      enterprise_server = object({
+        url        = optional(string, null)
+        ssl_verify = optional(bool, true)
+      })
       app = object({
         app_id = object({
           name        = string
@@ -31,20 +35,16 @@ variable "runner_configs" {
           kms_key_arn = optional(string, null)
         })
       })
-      force_ghes = optional(bool, null)
-      ssl_verify = optional(bool, true)
-      user_agent = optional(string, null)
+      user_agent = string
     })
     scale_set = object({
-      name                 = string
-      id                   = number
-      runner_group_id      = optional(number, null)
-      min_runners          = optional(number, 0)
-      max_runners          = optional(number, 10)
-      boot_time_in_minutes = optional(number, 10)
-      session_owner        = optional(string, null)
+      name = string
+      runner = optional(object({
+        min_runners          = optional(number, 0)
+        max_runners          = optional(number, 10)
+        boot_time_in_minutes = optional(number, 10)
+      }), {})
     })
-    work_folder = optional(string, null)
   }))
   nullable = false
 }

From 7e242adb8b11210a70bf6062ff45f6f0c3e40b75 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 11 Sep 2026 12:01:14 +0000
Subject: [PATCH 05/52] docs: auto update terraform docs

---
 modules/orchestration-providers/scale-set/README.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index 2a04930405..f485f18bfc 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -146,15 +146,15 @@ Inner values such as scale-set names, SSM/KMS ARNs, provider configuration value
 ## Requirements
 
 | Name | Version |
-| ---- | ------- |
+|------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
 
 ## Providers
 
 | Name | Version |
-| ---- | ------- |
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.64.0 |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.33 |
 | <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
@@ -164,7 +164,7 @@ No modules.
 ## Resources
 
 | Name | Type |
-| ---- | ---- |
+|------|------|
 | [aws_cloudwatch_log_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
 | [aws_ecs_cluster.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource |
 | [aws_ecs_service.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
@@ -190,7 +190,7 @@ No modules.
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-| ---- | ----------- | ---- | ------- | :------: |
+|------|-------------|------|---------|:--------:|
 | <a name="input_compute_provider_contracts"></a> [compute\_provider\_contracts](#input\_compute\_provider\_contracts) | Provider-neutral, scale-set capability fragments keyed exactly like `runner_configs`.<br/><br/>`type` is the plan-known provider discriminator used by the default grouping implementation and the runtime adapter registry. `configuration_json` is provider-owned, valid JSON and must contain no secrets. `environment_variables` contains non-secret provider process settings shared by every reconciler in the same controller group; conflicting values are rejected. IAM statement map keys and optional condition shapes must be known during planning; their action, resource, and condition values may be computed. | <pre>map(object({<br/>    type = string<br/>    capabilities = object({<br/>      scale_set = object({<br/>        configuration_json    = optional(string, "{}")<br/>        environment_variables = optional(map(string), {})<br/>        iam_statements = optional(map(object({<br/>          actions   = set(string)<br/>          resources = set(string)<br/>          conditions = optional(list(object({<br/>            test     = string<br/>            variable = string<br/>            values   = set(string)<br/>          })), [])<br/>        })), {})<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_config_store"></a> [config\_store](#input\_config\_store) | Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.<br/><br/>Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`. | <pre>object({<br/>    path_prefix = optional(string, null)<br/>    tier        = optional(string, "Standard")<br/>    tags        = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_container"></a> [container](#input\_container) | Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health\_path is fixed at /healthz, the ECS liveness endpoint. | <pre>object({<br/>    image                             = optional(string, null)<br/>    user                              = optional(string, "10001:10001")<br/>    health_port                       = optional(number, 8080)<br/>    health_path                       = optional(string, "/healthz")<br/>    health_check_command              = optional(list(string), null)<br/>    health_check_interval             = optional(number, 30)<br/>    health_check_timeout              = optional(number, 5)<br/>    health_check_retries              = optional(number, 3)<br/>    health_check_start_period         = optional(number, 30)<br/>    health_stale_after_seconds        = optional(number, 180)<br/>    shutdown_timeout_seconds          = optional(number, 110)<br/>    session_close_timeout_seconds     = optional(number, 10)<br/>    reconnect_initial_backoff_seconds = optional(number, 1)<br/>    reconnect_max_backoff_seconds     = optional(number, 30)<br/>    stop_timeout_seconds              = optional(number, 120)<br/>    ecr_repository = optional(object({<br/>      arn = string<br/>    }), null)<br/>  })</pre> | `{}` | no |
@@ -205,7 +205,7 @@ No modules.
 ## Outputs
 
 | Name | Description |
-| ---- | ----------- |
+|------|-------------|
 | <a name="output_cluster"></a> [cluster](#output\_cluster) | Managed or external ECS cluster selected for all controller groups. |
 | <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | Controller-group resources keyed by stable resolved group name. |
 | <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | Non-secret SSM controller configuration parameters keyed by `<controller-group>/<runner-config>`. Values are intentionally not exposed. |

From 7b43297f26ce4b7fc610aab1280adc3fb42307af Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Fri, 11 Sep 2026 14:17:49 +0200
Subject: [PATCH 06/52] fix(scale-set): derive GitHub URL from enterprise
 server

---
 .../scale-set/README.md                       |  6 +--
 .../scale-set/locals.tf                       | 18 ++++++---
 .../tests/fixtures/computed-inputs/main.tf    |  2 -
 .../scale-set/tests/scale-set.tftest.hcl      | 39 +++++++++++--------
 .../scale-set/validations.tf                  |  6 +--
 .../scale-set/variables.tf                    |  1 -
 6 files changed, 40 insertions(+), 32 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index f485f18bfc..1fb0b7ae1b 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -14,7 +14,7 @@ Each reconciler still owns exactly one GitHub scale-set identity and one message
 
 This foundation adopts scale sets that were created elsewhere. It passes the configured name to the controller, which captures the scale-set and runner-group identifiers dynamically from GitHub; it does not create or delete the GitHub scale-set resource. The complete compute-provider contract must likewise come from its Terraform adapter; until that adapter and the public runner-config selection are wired, this internal module is not an end-to-end deployment interface.
 
-The normalized `(github.config_url, scale_set.name)` ownership tuple must be globally unique across all groups. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Scale-set names may repeat under different GitHub scopes.
+The normalized `(github.enterprise_server.url, scale_set.name)` ownership tuple must be globally unique across all groups. A null enterprise-server URL resolves to GitHub.com. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Scale-set names may repeat under different GitHub scopes.
 
 ## Grouping
 
@@ -75,7 +75,7 @@ Each leaf is the flat `ScaleSetReconcilerConfig` consumed by the service:
 {
   "schemaVersion": 1,
   "runnerConfigName": "linux-small",
-  "githubConfigUrl": "https://github.com/example",
+  "githubConfigUrl": "https://github.com",
   "expectedScaleSetName": "linux-small",
   "minRunners": 0,
   "maxRunners": 20,
@@ -199,7 +199,7 @@ No modules.
 | <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
-| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      config_url = string<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      user_agent = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>  }))</pre> | n/a | yes |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      user_agent = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
 
 ## Outputs
diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
index 6a52092461..c0d5ef8ec1 100644
--- a/modules/orchestration-providers/scale-set/locals.tf
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -3,16 +3,22 @@ locals {
   contract_runner_names   = toset(keys(var.compute_provider_contracts))
   routable_runner_names   = sort(tolist(setintersection(local.configured_runner_names, local.contract_runner_names)))
 
+  github_config_urls = {
+    for runner_name, runner_config in var.runner_configs : runner_name => coalesce(
+      runner_config.github.enterprise_server.url,
+      "https://github.com",
+    )
+  }
   normalized_github_config_urls = {
     for runner_name, runner_config in var.runner_configs : runner_name => replace(
-      trimsuffix(lower(runner_config.github.config_url), "/"),
-      ":443/",
-      "/",
+      trimsuffix(lower(local.github_config_urls[runner_name]), "/"),
+      ":443",
+      "",
     )
   }
   github_config_url_ports = {
-    for runner_name, runner_config in var.runner_configs : runner_name => try(
-      tonumber(regex("^https://[A-Za-z0-9.-]+:([0-9]+)/", runner_config.github.config_url)[0]),
+    for runner_name in keys(var.runner_configs) : runner_name => try(
+      tonumber(regex("^https://[A-Za-z0-9.-]+:([0-9]+)", local.github_config_urls[runner_name])[0]),
       443,
     )
   }
@@ -83,7 +89,7 @@ locals {
         value = merge({
           schemaVersion        = 1
           runnerConfigName     = runner_name
-          githubConfigUrl      = var.runner_configs[runner_name].github.config_url
+          githubConfigUrl      = local.github_config_urls[runner_name]
           expectedScaleSetName = var.runner_configs[runner_name].scale_set.name
           minRunners           = var.runner_configs[runner_name].scale_set.runner.min_runners
           maxRunners           = var.runner_configs[runner_name].scale_set.runner.max_runners
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
index 8410005c3a..133622e8a7 100644
--- a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
@@ -1,7 +1,6 @@
 resource "terraform_data" "computed" {
   input = {
     external_cluster_arn = "arn:aws:ecs:eu-west-1:123456789012:cluster/external"
-    github_config_url    = "https://github.com/example"
     app_id_arn           = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/app-id"
     private_key_arn      = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/private-key"
     installation_id_arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/installation-id"
@@ -20,7 +19,6 @@ module "subject" {
   runner_configs = {
     computed = {
       github = {
-        config_url        = terraform_data.computed.output.github_config_url
         enterprise_server = {}
         app = {
           app_id = {
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index 4302a9a496..dcca54b24a 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -42,7 +42,6 @@ variables {
   runner_configs = {
     linux-small = {
       github = {
-        config_url = "https://github.com/example"
         enterprise_server = {
           ssl_verify = false
         }
@@ -73,8 +72,9 @@ variables {
     }
     linux-large = {
       github = {
-        config_url = "https://github.com/example"
-        enterprise_server = {}
+        enterprise_server = {
+          url = "https://github.example.test"
+        }
         app = {
           app_id = {
             name = "/github/linux-large/app-id"
@@ -101,7 +101,6 @@ variables {
     }
     microvm = {
       github = {
-        config_url = "https://github.com/example/repository"
         enterprise_server = {}
         app = {
           app_id = {
@@ -304,13 +303,15 @@ run "groups_by_compute_provider_and_hardens_each_task" {
     condition = (
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).schemaVersion == 1 &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).runnerConfigName == "linux-small" &&
-      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com/example" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).expectedScaleSetName == "linux-small" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).bootTimeoutMinutes == 10 &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).sslVerify == false &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).forceGhes == false &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).userAgent == "scale-set-test" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubApp.privateKeyParameterName == "/github/linux-small/private-key" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).githubConfigUrl == "https://github.example.test" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).forceGhes == true &&
       !contains(keys(jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value))), "runnerConfig")
     )
     error_message = "Each SSM leaf must use the frozen flat reconciler schema and contain references instead of GitHub credential values."
@@ -520,9 +521,9 @@ run "rejects_duplicate_scale_set_ownership_across_groups" {
 
   variables {
     runner_configs = merge(var.runner_configs, {
-      microvm = merge(var.runner_configs.microvm, {
-        github = merge(var.runner_configs.microvm.github, {
-          config_url = "https://GITHUB.COM:443/example/"
+        microvm = merge(var.runner_configs.microvm, {
+          github = merge(var.runner_configs.microvm.github, {
+          enterprise_server = { url = "https://GITHUB.COM:443/" }
         })
         scale_set = merge(var.runner_configs.microvm.scale_set, {
           name = "linux-small"
@@ -543,9 +544,9 @@ run "rejects_leading_zero_default_port_spelling" {
 
   variables {
     runner_configs = merge(var.runner_configs, {
-      microvm = merge(var.runner_configs.microvm, {
-        github = merge(var.runner_configs.microvm.github, {
-          config_url = "https://github.com:0443/example/"
+        microvm = merge(var.runner_configs.microvm, {
+          github = merge(var.runner_configs.microvm.github, {
+          enterprise_server = { url = "https://github.com:0443/" }
         })
         scale_set = merge(var.runner_configs.microvm.scale_set, {
           name = "linux-small"
@@ -566,9 +567,9 @@ run "rejects_port_above_url_maximum" {
 
   variables {
     runner_configs = merge(var.runner_configs, {
-      microvm = merge(var.runner_configs.microvm, {
-        github = merge(var.runner_configs.microvm.github, {
-          config_url = "https://github.com:65536/example"
+        microvm = merge(var.runner_configs.microvm, {
+          github = merge(var.runner_configs.microvm.github, {
+          enterprise_server = { url = "https://github.com:65536/" }
         })
       })
     })
@@ -673,6 +674,9 @@ run "allows_same_scale_set_name_in_another_github_scope" {
   variables {
     runner_configs = merge(var.runner_configs, {
       microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          enterprise_server = { url = "https://github.example.test" }
+        })
         scale_set = merge(var.runner_configs.microvm.scale_set, {
           name = "linux-small"
         })
@@ -682,7 +686,7 @@ run "allows_same_scale_set_name_in_another_github_scope" {
 
   assert {
     condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
-    error_message = "Scale-set names are scoped to their normalized GitHub configuration URL."
+    error_message = "Scale-set names are scoped to their normalized enterprise-server URL."
   }
 }
 
@@ -696,7 +700,6 @@ run "bounds_default_session_owner_for_maximum_names" {
     runner_configs = {
       (join("", [for index in range(128) : "a"])) = {
         github = {
-          config_url = "https://github.com/example"
           enterprise_server = {}
           user_agent = "scale-set-test"
           app = {
@@ -845,7 +848,9 @@ run "rejects_invalid_boot_timeout" {
     runner_configs = merge(var.runner_configs, {
       linux-small = merge(var.runner_configs.linux-small, {
         scale_set = merge(var.runner_configs.linux-small.scale_set, {
-          boot_time_in_minutes = 0
+          runner = merge(var.runner_configs.linux-small.scale_set.runner, {
+            boot_time_in_minutes = 0
+          })
         })
       })
     })
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index c5d5a80a36..0b012503f0 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -48,16 +48,16 @@ resource "terraform_data" "validate_contract" {
     precondition {
       condition = alltrue([
         for runner_name, runner_config in var.runner_configs : (
-          can(regex("^https://[A-Za-z0-9.-]+(:[1-9][0-9]{0,4})?/[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)?/?$", runner_config.github.config_url)) &&
+          can(regex("^https://[A-Za-z0-9.-]+(:[1-9][0-9]{0,4})?(/[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)?)?/?$", local.github_config_urls[runner_name])) &&
           local.github_config_url_ports[runner_name] <= 65535
         )
       ])
-      error_message = "Each github.config_url must be an HTTPS GitHub organization, repository, or enterprise URL without credentials, query, fragment, or whitespace."
+      error_message = "Each enterprise_server.url must be an HTTPS GitHub Enterprise Server URL without credentials, query, fragment, or whitespace."
     }
 
     precondition {
       condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
-      error_message = "Each normalized github.config_url and scale_set.name tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
+      error_message = "Each normalized enterprise_server.url and scale_set.name tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
     }
 
     precondition {
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
index bdf8c2b688..e3447660ca 100644
--- a/modules/orchestration-providers/scale-set/variables.tf
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -13,7 +13,6 @@ variable "runner_configs" {
   EOT
   type = map(object({
     github = object({
-      config_url = string
       enterprise_server = object({
         url        = optional(string, null)
         ssl_verify = optional(bool, true)

From 0475b27a987cb79110dc2618f0ca3a994db72c3c Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Fri, 11 Sep 2026 14:48:27 +0200
Subject: [PATCH 07/52] fix(scale-set): require runner registration scope

---
 .../scale-set/README.md                       |  4 +-
 .../scale-set/locals.tf                       | 13 ++-
 .../tests/fixtures/computed-inputs/main.tf    |  4 +-
 .../scale-set/tests/scale-set.tftest.hcl      | 86 ++++++++++++++++---
 .../scale-set/validations.tf                  | 31 ++++++-
 .../scale-set/variables.tf                    |  6 +-
 6 files changed, 123 insertions(+), 21 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index 1fb0b7ae1b..dcd9286b41 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -14,7 +14,7 @@ Each reconciler still owns exactly one GitHub scale-set identity and one message
 
 This foundation adopts scale sets that were created elsewhere. It passes the configured name to the controller, which captures the scale-set and runner-group identifiers dynamically from GitHub; it does not create or delete the GitHub scale-set resource. The complete compute-provider contract must likewise come from its Terraform adapter; until that adapter and the public runner-config selection are wired, this internal module is not an end-to-end deployment interface.
 
-The normalized `(github.enterprise_server.url, scale_set.name)` ownership tuple must be globally unique across all groups. A null enterprise-server URL resolves to GitHub.com. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Scale-set names may repeat under different GitHub scopes.
+The normalized `(githubConfigUrl, scale_set.name)` ownership tuple must be globally unique across all groups. `runner_registration_level` selects enterprise, organization, or repository scope; organization and repository scopes append `runner_owner` to the GitHub server URL. A null enterprise-server URL resolves to GitHub.com. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Scale-set names may repeat under different GitHub scopes.
 
 ## Grouping
 
@@ -199,7 +199,7 @@ No modules.
 | <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
-| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      user_agent = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>  }))</pre> | n/a | yes |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
 
 ## Outputs
diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
index c0d5ef8ec1..7199187a80 100644
--- a/modules/orchestration-providers/scale-set/locals.tf
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -3,10 +3,17 @@ locals {
   contract_runner_names   = toset(keys(var.compute_provider_contracts))
   routable_runner_names   = sort(tolist(setintersection(local.configured_runner_names, local.contract_runner_names)))
 
+  github_server_urls = {
+    for runner_name, runner_config in var.runner_configs : runner_name => trimsuffix(
+      coalesce(runner_config.github.enterprise_server.url, "https://github.com"),
+      "/",
+    )
+  }
   github_config_urls = {
-    for runner_name, runner_config in var.runner_configs : runner_name => coalesce(
-      runner_config.github.enterprise_server.url,
-      "https://github.com",
+    for runner_name, runner_config in var.runner_configs : runner_name => (
+      runner_config.github.runner_registration_level == "enterprise" || runner_config.github.runner_owner == null
+      ? local.github_server_urls[runner_name]
+      : format("%s/%s", local.github_server_urls[runner_name], runner_config.github.runner_owner)
     )
   }
   normalized_github_config_urls = {
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
index 133622e8a7..111d997afd 100644
--- a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
@@ -35,7 +35,9 @@ module "subject" {
             arn  = terraform_data.computed.output.installation_id_arn
           }
         }
-        user_agent = "scale-set-test"
+        runner_owner              = null
+        runner_registration_level = "enterprise"
+        user_agent                = "scale-set-test"
       }
       scale_set = {
         name = "computed"
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index dcca54b24a..c7498cba6a 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -60,7 +60,9 @@ variables {
             arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/installation-id"
           }
         }
-        user_agent = "scale-set-test"
+        runner_owner              = null
+        runner_registration_level = "enterprise"
+        user_agent                = "scale-set-test"
       }
       scale_set = {
         name = "linux-small"
@@ -89,7 +91,9 @@ variables {
             arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/installation-id"
           }
         }
-        user_agent = "scale-set-test"
+        runner_owner              = null
+        runner_registration_level = "enterprise"
+        user_agent                = "scale-set-test"
       }
       scale_set = {
         name = "linux-large"
@@ -116,7 +120,9 @@ variables {
             arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/installation-id"
           }
         }
-        user_agent = "scale-set-test"
+        runner_owner              = null
+        runner_registration_level = "enterprise"
+        user_agent                = "scale-set-test"
       }
       scale_set = {
         name = "microvm"
@@ -512,6 +518,42 @@ run "accepts_advanced_parameter_within_eight_kib" {
   }
 }
 
+run "assembles_github_config_url_from_registration_scope_and_owner" {
+  command = apply
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        github = merge(var.runner_configs.linux-small.github, {
+          runner_registration_level = "organization"
+          runner_owner              = "example"
+        })
+      })
+      linux-large = merge(var.runner_configs.linux-large, {
+        github = merge(var.runner_configs.linux-large.github, {
+          runner_registration_level = "organization"
+          runner_owner              = "example"
+        })
+      })
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          runner_registration_level = "repository"
+          runner_owner              = "example/repository"
+        })
+      })
+    })
+  }
+
+  assert {
+    condition = (
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com/example" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).githubConfigUrl == "https://github.example.test/example" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["microvm/microvm"].value)).githubConfigUrl == "https://github.com/example/repository"
+    )
+    error_message = "The reconciler config URL must combine the GitHub server with the configured organization or repository owner."
+  }
+}
+
 run "rejects_duplicate_scale_set_ownership_across_groups" {
   command = plan
 
@@ -521,8 +563,8 @@ run "rejects_duplicate_scale_set_ownership_across_groups" {
 
   variables {
     runner_configs = merge(var.runner_configs, {
-        microvm = merge(var.runner_configs.microvm, {
-          github = merge(var.runner_configs.microvm.github, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
           enterprise_server = { url = "https://GITHUB.COM:443/" }
         })
         scale_set = merge(var.runner_configs.microvm.scale_set, {
@@ -544,8 +586,8 @@ run "rejects_leading_zero_default_port_spelling" {
 
   variables {
     runner_configs = merge(var.runner_configs, {
-        microvm = merge(var.runner_configs.microvm, {
-          github = merge(var.runner_configs.microvm.github, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
           enterprise_server = { url = "https://github.com:0443/" }
         })
         scale_set = merge(var.runner_configs.microvm.scale_set, {
@@ -567,8 +609,8 @@ run "rejects_port_above_url_maximum" {
 
   variables {
     runner_configs = merge(var.runner_configs, {
-        microvm = merge(var.runner_configs.microvm, {
-          github = merge(var.runner_configs.microvm.github, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
           enterprise_server = { url = "https://github.com:65536/" }
         })
       })
@@ -700,8 +742,10 @@ run "bounds_default_session_owner_for_maximum_names" {
     runner_configs = {
       (join("", [for index in range(128) : "a"])) = {
         github = {
-          enterprise_server = {}
-          user_agent = "scale-set-test"
+          enterprise_server         = {}
+          runner_owner              = null
+          runner_registration_level = "enterprise"
+          user_agent                = "scale-set-test"
           app = {
             app_id = {
               name = "/github/max/app-id"
@@ -859,6 +903,26 @@ run "rejects_invalid_boot_timeout" {
   expect_failures = [terraform_data.validate_contract]
 }
 
+run "rejects_invalid_runner_registration_level" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        github = merge(var.runner_configs.linux-small.github, {
+          runner_registration_level = "invalid"
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
 run "rejects_controller_group_above_runtime_reconciler_limit" {
   command = plan
 
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index 0b012503f0..179e1b5e6c 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -45,6 +45,33 @@ resource "terraform_data" "validate_contract" {
       error_message = "runner-config keys must contain 1 to 128 ASCII letters, digits, dots, underscores, or hyphens and start with a letter or digit."
     }
 
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : contains([
+          "enterprise",
+          "organization",
+          "repository",
+        ], runner_config.github.runner_registration_level)
+      ])
+      error_message = "runner_registration_level must be enterprise, organization, or repository."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : (
+          runner_config.github.runner_registration_level == "enterprise"
+          ? runner_config.github.runner_owner == null
+          : runner_config.github.runner_owner != null && can(regex(
+            runner_config.github.runner_registration_level == "organization"
+            ? "^[A-Za-z0-9_.-]+$"
+            : "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+            runner_config.github.runner_owner,
+          ))
+        )
+      ])
+      error_message = "runner_owner must be null for enterprise registration and must be an organization or owner/repository path for the other registration levels."
+    }
+
     precondition {
       condition = alltrue([
         for runner_name, runner_config in var.runner_configs : (
@@ -52,12 +79,12 @@ resource "terraform_data" "validate_contract" {
           local.github_config_url_ports[runner_name] <= 65535
         )
       ])
-      error_message = "Each enterprise_server.url must be an HTTPS GitHub Enterprise Server URL without credentials, query, fragment, or whitespace."
+      error_message = "Each assembled GitHub config URL must be an HTTPS GitHub Enterprise Server URL without credentials, query, fragment, or whitespace."
     }
 
     precondition {
       condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
-      error_message = "Each normalized enterprise_server.url and scale_set.name tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
+      error_message = "Each normalized githubConfigUrl and scale_set.name tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
     }
 
     precondition {
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
index e3447660ca..b2316f28a0 100644
--- a/modules/orchestration-providers/scale-set/variables.tf
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -9,7 +9,7 @@ variable "runner_configs" {
   description = <<-EOT
     Normalized scale-set runner configurations keyed by stable runner-config name.
 
-    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply.
+    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply.
   EOT
   type = map(object({
     github = object({
@@ -34,7 +34,9 @@ variable "runner_configs" {
           kms_key_arn = optional(string, null)
         })
       })
-      user_agent = string
+      runner_owner              = string
+      runner_registration_level = string
+      user_agent                = string
     })
     scale_set = object({
       name = string

From 8fd9ea1cfe983f506a94f83e74b9a2400024be48 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 01:32:56 +0200
Subject: [PATCH 08/52] feat(scale-set): update orchestration provider module

---
 .../scale-set/README.md                       |  61 ++-
 .../orchestration-providers/scale-set/iam.tf  |  40 +-
 .../scale-set/locals.tf                       | 181 +++-----
 .../scale-set/service.tf                      |   1 -
 .../orchestration-providers/scale-set/task.tf |  13 +-
 .../tests/fixtures/computed-inputs/main.tf    |  53 ++-
 .../scale-set/tests/scale-set.tftest.hcl      | 413 +++++++++++-------
 .../scale-set/validations.tf                  |  64 ++-
 .../scale-set/variables.tf                    |  47 +-
 9 files changed, 462 insertions(+), 411 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index dcd9286b41..da247495b7 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -63,23 +63,65 @@ The symbolic locals above represent outputs from the selected compute-provider T
 
 ## Configuration delivery
 
-Large groups do not embed their full manifest in an ECS task definition. The module writes one non-secret SSM `String` parameter per reconciler:
+For the current ECS deployment, each task receives one bounded `SCALE_SET_CONTROLLER_MANIFEST` environment variable. Its value is JSON with this shape:
 
 ```text
-/<prefix>/scale-set-controller/<controller-group>/<runner-config>
+{
+  "version": 1,
+  "groupName": "ec2",
+  "revision": "<sha256>",
+  "reconcilers": [
+    {
+      "schemaVersion": 1,
+      "runnerConfigName": "linux-small",
+      "runnerGroupName": "Default",
+      "scaleSetName": "linux-small",
+      "githubConfigUrl": "https://github.com",
+      "githubApp": {
+        "appIdParameterName": "/github/app-id",
+        "privateKeyParameterName": "/github/private-key",
+        "installationIdParameterName": "/github/installation-id"
+      },
+      "computeProvider": {
+        "type": "ec2",
+        "configuration": {}
+      },
+      "minRunners": 0,
+      "maxRunners": 20,
+      "bootTimeoutMinutes": 10,
+      "sessionOwner": "ec2.linux-small",
+      "workFolder": "_work",
+      "forceGhes": false,
+      "sslVerify": true
+    }
+  ]
+}
 ```
 
-Each leaf is the flat `ScaleSetReconcilerConfig` consumed by the service:
+Each leaf is the flat `ScaleSetReconcilerConfig` consumed by the service. GitHub credential values never enter the manifest; it contains only the exact Parameter Store names used by the runtime. The manifest source is mutually exclusive with the service's SSM group-path source, so the task does not receive `SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH` or `SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION`.
+
+The module also keeps the per-reconciler SSM parameters available for the grouped configuration path while that delivery mode is being phased in. The task currently uses the manifest environment variable.
+
+Terraform derives `sessionOwner` locally as `<group>.<runner-config>`; if that would exceed the runtime's 256-character limit, the module truncates both readable components and appends a deterministic hash.
+
+The manifest must remain within the ECS task-definition size budget. Use the SSM group-path delivery mode for larger groups once it is enabled by the deployment configuration.
+
+The individual reconciler object has this shape:
 
 ```json
 {
   "schemaVersion": 1,
   "runnerConfigName": "linux-small",
+  "runnerGroupName": "Default",
   "githubConfigUrl": "https://github.com",
-  "expectedScaleSetName": "linux-small",
+  "scaleSetName": "linux-small",
   "minRunners": 0,
   "maxRunners": 20,
   "bootTimeoutMinutes": 10,
+  "sessionOwner": "ec2.linux-small",
+  "workFolder": "_work",
+  "forceGhes": false,
+  "sslVerify": true,
   "githubApp": {
     "appIdParameterName": "/github/app-id",
     "privateKeyParameterName": "/github/private-key",
@@ -92,10 +134,6 @@ Each leaf is the flat `ScaleSetReconcilerConfig` consumed by the service:
 }
 ```
 
-The task receives only the group name, group path, and a SHA-256 revision. It loads the direct children with `GetParametersByPath`. Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes; Terraform validates every leaf against the selected tier and limits the decoded aggregate for one group to 4 MiB. The group revision changes the task definition whenever any reconciler configuration changes.
-
-Terraform derives `sessionOwner` locally as `<group>.<runner-config>`; if that would exceed the runtime's 256-character limit, the module truncates both readable components and appends a deterministic hash.
-
 GitHub credential **values** never enter Terraform configuration, task definitions, or controller-config parameters. Each leaf carries only three Parameter Store names. The task role can read the exact credential parameter ARNs for its group and decrypt only explicitly declared KMS keys.
 
 ## Container image
@@ -114,7 +152,7 @@ container = {
 }
 ```
 
-Public registry images need no pull permission. For a private ECR override, set `container.ecr_repository.arn`; the execution role receives repository-scoped layer permissions plus the unavoidable resource-unscoped `ecr:GetAuthorizationToken` action.
+Public registry images need no pull permission. For a private ECR override, set `container.image` to the ECR image URI. The module grants the ECS task execution role wildcard ECR layer-pull permissions plus the unavoidable resource-unscoped `ecr:GetAuthorizationToken` action. The application task role is not used for image pulls. Repository-side access policy remains owned by the ECR module that owns the repository.
 
 For the official GHCR default, verify an anonymous pull after the first package publish. Package visibility may inherit repository or organization settings and must not be inferred only from a successful authenticated workflow push.
 
@@ -191,15 +229,14 @@ No modules.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_compute_provider_contracts"></a> [compute\_provider\_contracts](#input\_compute\_provider\_contracts) | Provider-neutral, scale-set capability fragments keyed exactly like `runner_configs`.<br/><br/>`type` is the plan-known provider discriminator used by the default grouping implementation and the runtime adapter registry. `configuration_json` is provider-owned, valid JSON and must contain no secrets. `environment_variables` contains non-secret provider process settings shared by every reconciler in the same controller group; conflicting values are rejected. IAM statement map keys and optional condition shapes must be known during planning; their action, resource, and condition values may be computed. | <pre>map(object({<br/>    type = string<br/>    capabilities = object({<br/>      scale_set = object({<br/>        configuration_json    = optional(string, "{}")<br/>        environment_variables = optional(map(string), {})<br/>        iam_statements = optional(map(object({<br/>          actions   = set(string)<br/>          resources = set(string)<br/>          conditions = optional(list(object({<br/>            test     = string<br/>            variable = string<br/>            values   = set(string)<br/>          })), [])<br/>        })), {})<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_config_store"></a> [config\_store](#input\_config\_store) | Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.<br/><br/>Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`. | <pre>object({<br/>    path_prefix = optional(string, null)<br/>    tier        = optional(string, "Standard")<br/>    tags        = optional(map(string), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_container"></a> [container](#input\_container) | Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health\_path is fixed at /healthz, the ECS liveness endpoint. | <pre>object({<br/>    image                             = optional(string, null)<br/>    user                              = optional(string, "10001:10001")<br/>    health_port                       = optional(number, 8080)<br/>    health_path                       = optional(string, "/healthz")<br/>    health_check_command              = optional(list(string), null)<br/>    health_check_interval             = optional(number, 30)<br/>    health_check_timeout              = optional(number, 5)<br/>    health_check_retries              = optional(number, 3)<br/>    health_check_start_period         = optional(number, 30)<br/>    health_stale_after_seconds        = optional(number, 180)<br/>    shutdown_timeout_seconds          = optional(number, 110)<br/>    session_close_timeout_seconds     = optional(number, 10)<br/>    reconnect_initial_backoff_seconds = optional(number, 1)<br/>    reconnect_max_backoff_seconds     = optional(number, 30)<br/>    stop_timeout_seconds              = optional(number, 120)<br/>    ecr_repository = optional(object({<br/>      arn = string<br/>    }), null)<br/>  })</pre> | `{}` | no |
+| <a name="input_container"></a> [container](#input\_container) | Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health\_path is fixed at /healthz, the ECS liveness endpoint. | <pre>object({<br/>    image                             = optional(string, null)<br/>    user                              = optional(string, "10001:10001")<br/>    health_port                       = optional(number, 8080)<br/>    health_path                       = optional(string, "/healthz")<br/>    health_check_command              = optional(list(string), null)<br/>    health_check_interval             = optional(number, 30)<br/>    health_check_timeout              = optional(number, 5)<br/>    health_check_retries              = optional(number, 3)<br/>    health_check_start_period         = optional(number, 30)<br/>    health_stale_after_seconds        = optional(number, 180)<br/>    shutdown_timeout_seconds          = optional(number, 110)<br/>    session_close_timeout_seconds     = optional(number, 10)<br/>    reconnect_initial_backoff_seconds = optional(number, 1)<br/>    reconnect_max_backoff_seconds     = optional(number, 30)<br/>    stop_timeout_seconds              = optional(number, 120)<br/>  })</pre> | `{}` | no |
 | <a name="input_ecs"></a> [ecs](#input\_ecs) | ECS substrate configuration. A managed cluster is created by default. For an external cluster, set `cluster.mode = "external"` and pass its ARN; the mode must be plan-known while the ARN may be computed. | <pre>object({<br/>    cluster = optional(object({<br/>      mode               = optional(string, "managed")<br/>      arn                = optional(string, null)<br/>      name               = optional(string, null)<br/>      container_insights = optional(bool, true)<br/>    }), {})<br/>    task = optional(object({<br/>      cpu              = optional(number, 512)<br/>      memory           = optional(number, 1024)<br/>      cpu_architecture = optional(string, "X86_64")<br/>      ephemeral_storage = optional(object({<br/>        size_in_gib = number<br/>      }), null)<br/>    }), {})<br/>    service = optional(object({<br/>      platform_version = optional(string, "LATEST")<br/>    }), {})<br/>    iam = optional(object({<br/>      path                 = optional(string, "/")<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_grouping"></a> [grouping](#input\_grouping) | Packing strategy for scale-set reconcilers. `compute_provider` creates one controller group per compute-provider type and is the default. `runner_config` creates one group per runner config. `custom` uses `custom.groups`; custom membership must cover every runner config exactly once.<br/><br/>The strategy, custom group keys, and memberships select Terraform `for_each` instances and must be known during planning. | <pre>object({<br/>    strategy = optional(string, "compute_provider")<br/>    custom = optional(object({<br/>      groups = map(object({<br/>        runner_configs = set(string)<br/>      }))<br/>    }), null)<br/>  })</pre> | `{}` | no |
 | <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
-| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>  }))</pre> | n/a | yes |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        group_name           = optional(string, "Default")<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>    compute_provider = object({<br/>      type = string<br/>      capabilities = object({<br/>        scale_set = object({<br/>          configuration_json    = optional(string, "{}")<br/>          environment_variables = optional(map(string), {})<br/>          iam_statements = optional(map(object({<br/>            actions   = set(string)<br/>            resources = set(string)<br/>            conditions = optional(list(object({<br/>              test     = string<br/>              variable = string<br/>              values   = set(string)<br/>            })), [])<br/>          })), {})<br/>        })<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
 
 ## Outputs
diff --git a/modules/orchestration-providers/scale-set/iam.tf b/modules/orchestration-providers/scale-set/iam.tf
index 1c23772f00..2f0b644180 100644
--- a/modules/orchestration-providers/scale-set/iam.tf
+++ b/modules/orchestration-providers/scale-set/iam.tf
@@ -63,7 +63,7 @@ data "aws_iam_policy_document" "task" {
       "ssm:GetParameter",
       "ssm:GetParameters",
     ]
-    resources = local.group_ssm_parameter_arns[each.key]
+    resources = [for parameter in local.group_github_parameters[each.key] : parameter.arn]
   }
 
   dynamic "statement" {
@@ -126,31 +126,23 @@ data "aws_iam_policy_document" "execution" {
     resources = ["${aws_cloudwatch_log_group.controller[each.key].arn}:*"]
   }
 
-  dynamic "statement" {
-    for_each = var.container.ecr_repository == null ? [] : [var.container.ecr_repository]
-
-    content {
-      sid    = "PullPrivateEcrImage"
-      effect = "Allow"
-      actions = [
-        "ecr:BatchCheckLayerAvailability",
-        "ecr:BatchGetImage",
-        "ecr:GetDownloadUrlForLayer",
-      ]
-      resources = [statement.value.arn]
-    }
+  statement {
+    sid    = "PullPrivateEcrImage"
+    effect = "Allow"
+    actions = [
+      "ecr:BatchCheckLayerAvailability",
+      "ecr:BatchGetImage",
+      "ecr:GetDownloadUrlForLayer",
+    ]
+    resources = ["*"]
   }
 
-  dynamic "statement" {
-    for_each = var.container.ecr_repository == null ? [] : [1]
-
-    content {
-      # ECR does not support resource-level permissions for authorization tokens.
-      sid       = "AuthorizePrivateEcrPull"
-      effect    = "Allow"
-      actions   = ["ecr:GetAuthorizationToken"]
-      resources = ["*"]
-    }
+  statement {
+    # ECR does not support resource-level permissions for authorization tokens.
+    sid       = "AuthorizePrivateEcrPull"
+    effect    = "Allow"
+    actions   = ["ecr:GetAuthorizationToken"]
+    resources = ["*"]
   }
 }
 
diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
index 7199187a80..e58e165ae4 100644
--- a/modules/orchestration-providers/scale-set/locals.tf
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -1,71 +1,33 @@
 locals {
-  configured_runner_names = toset(keys(var.runner_configs))
-  contract_runner_names   = toset(keys(var.compute_provider_contracts))
-  routable_runner_names   = sort(tolist(setintersection(local.configured_runner_names, local.contract_runner_names)))
-
-  github_server_urls = {
-    for runner_name, runner_config in var.runner_configs : runner_name => trimsuffix(
-      coalesce(runner_config.github.enterprise_server.url, "https://github.com"),
-      "/",
-    )
-  }
   github_config_urls = {
-    for runner_name, runner_config in var.runner_configs : runner_name => (
-      runner_config.github.runner_registration_level == "enterprise" || runner_config.github.runner_owner == null
-      ? local.github_server_urls[runner_name]
-      : format("%s/%s", local.github_server_urls[runner_name], runner_config.github.runner_owner)
-    )
-  }
-  normalized_github_config_urls = {
-    for runner_name, runner_config in var.runner_configs : runner_name => replace(
-      trimsuffix(lower(local.github_config_urls[runner_name]), "/"),
-      ":443",
-      "",
-    )
-  }
-  github_config_url_ports = {
-    for runner_name in keys(var.runner_configs) : runner_name => try(
-      tonumber(regex("^https://[A-Za-z0-9.-]+:([0-9]+)", local.github_config_urls[runner_name])[0]),
-      443,
+    for runner_name, runner_config in var.runner_configs : runner_name => format(
+      "%s%s",
+      trimsuffix(coalesce(runner_config.github.enterprise_server.url, "https://github.com"), "/"),
+      runner_config.github.runner_owner == null ? "" : "/${runner_config.github.runner_owner}",
     )
   }
-  scale_set_ownership_keys = [
-    for runner_name, runner_config in var.runner_configs :
-    "${local.normalized_github_config_urls[runner_name]}#${runner_config.scale_set.name}"
-  ]
-
   declared_custom_groups = var.grouping.strategy == "custom" && var.grouping.custom != null ? {
     for group_name, group in var.grouping.custom.groups : group_name => sort(tolist(group.runner_configs))
   } : {}
 
-  custom_members = flatten(values(local.declared_custom_groups))
-
-  compute_provider_types = distinct([
-    for runner_name in local.routable_runner_names : var.compute_provider_contracts[runner_name].type
-  ])
-
-  compute_provider_groups = {
-    for provider_type in local.compute_provider_types : provider_type => [
-      for runner_name in local.routable_runner_names : runner_name
-      if var.compute_provider_contracts[runner_name].type == provider_type
-    ]
-  }
-
-  runner_config_groups = {
-    for runner_name in local.routable_runner_names : runner_name => [runner_name]
-  }
-
-  custom_groups = {
-    for group_name, runner_names in local.declared_custom_groups : group_name => [
-      for runner_name in runner_names : runner_name
-      if contains(local.routable_runner_names, runner_name)
-    ]
-  }
-
   controller_groups = (
-    var.grouping.strategy == "compute_provider" ? local.compute_provider_groups :
-    var.grouping.strategy == "runner_config" ? local.runner_config_groups :
-    var.grouping.strategy == "custom" ? local.custom_groups :
+    var.grouping.strategy == "compute_provider" ? {
+      for provider_type in distinct([
+        for runner_name in keys(var.runner_configs) : var.runner_configs[runner_name].compute_provider.type
+        ]) : provider_type => [
+        for runner_name in keys(var.runner_configs) : runner_name
+        if var.runner_configs[runner_name].compute_provider.type == provider_type
+      ]
+    } :
+    var.grouping.strategy == "runner_config" ? {
+      for runner_name in keys(var.runner_configs) : runner_name => [runner_name]
+    } :
+    var.grouping.strategy == "custom" ? {
+      for group_name, runner_names in local.declared_custom_groups : group_name => [
+        for runner_name in runner_names : runner_name
+        if contains(keys(var.runner_configs), runner_name)
+      ]
+    } :
     {}
   )
 
@@ -94,15 +56,17 @@ locals {
         group_name  = group_name
         runner_name = runner_name
         value = merge({
-          schemaVersion        = 1
-          runnerConfigName     = runner_name
-          githubConfigUrl      = local.github_config_urls[runner_name]
-          expectedScaleSetName = var.runner_configs[runner_name].scale_set.name
-          minRunners           = var.runner_configs[runner_name].scale_set.runner.min_runners
-          maxRunners           = var.runner_configs[runner_name].scale_set.runner.max_runners
-          bootTimeoutMinutes   = var.runner_configs[runner_name].scale_set.runner.boot_time_in_minutes
-          sslVerify            = var.runner_configs[runner_name].github.enterprise_server.ssl_verify
-          forceGhes            = var.runner_configs[runner_name].github.enterprise_server.url != null
+          schemaVersion      = 1
+          runnerConfigName   = runner_name
+          runnerGroupName    = var.runner_configs[runner_name].scale_set.runner.group_name
+          githubConfigUrl    = local.github_config_urls[runner_name]
+          scaleSetName       = var.runner_configs[runner_name].scale_set.name
+          minRunners         = var.runner_configs[runner_name].scale_set.runner.min_runners
+          maxRunners         = var.runner_configs[runner_name].scale_set.runner.max_runners
+          bootTimeoutMinutes = var.runner_configs[runner_name].scale_set.runner.boot_time_in_minutes
+          workFolder         = "_work"
+          sslVerify          = var.runner_configs[runner_name].github.enterprise_server.ssl_verify
+          forceGhes          = var.runner_configs[runner_name].github.enterprise_server.url != null
           sessionOwner = (
             length("${group_name}.${runner_name}") <= 256
             ? "${group_name}.${runner_name}"
@@ -114,8 +78,8 @@ locals {
             installationIdParameterName = var.runner_configs[runner_name].github.app.installation_id.name
           }
           computeProvider = {
-            type          = var.compute_provider_contracts[runner_name].type
-            configuration = jsondecode(var.compute_provider_contracts[runner_name].capabilities.scale_set.configuration_json)
+            type          = var.runner_configs[runner_name].compute_provider.type
+            configuration = jsondecode(var.runner_configs[runner_name].compute_provider.capabilities.scale_set.configuration_json)
           }
           userAgent = var.runner_configs[runner_name].github.user_agent
         })
@@ -133,36 +97,43 @@ locals {
     }))
   }
 
-  group_ssm_parameter_arns = {
-    for group_name, runner_names in local.controller_groups : group_name => flatten([
-      for runner_name in runner_names : [
-        var.runner_configs[runner_name].github.app.app_id.arn,
-        var.runner_configs[runner_name].github.app.private_key.arn,
-        var.runner_configs[runner_name].github.app.installation_id.arn,
+  group_controller_manifests = {
+    for group_name, runner_names in local.controller_groups : group_name => jsonencode({
+      version   = 1
+      groupName = group_name
+      revision  = local.group_config_revisions[group_name]
+      reconcilers = [
+        for runner_name in runner_names : local.reconciler_configs["${group_name}/${runner_name}"].value
       ]
-    ])
+    })
   }
-
-  group_ssm_kms_key_arns = {
+  group_github_parameters = {
     for group_name, runner_names in local.controller_groups : group_name => flatten([
       for runner_name in runner_names : [
-        for parameter in [
-          var.runner_configs[runner_name].github.app.app_id,
-          var.runner_configs[runner_name].github.app.private_key,
-          var.runner_configs[runner_name].github.app.installation_id,
-        ] : parameter.kms_key_arn
+        {
+          arn         = var.runner_configs[runner_name].github.app.app_id.arn
+          kms_key_arn = var.runner_configs[runner_name].github.app.app_id.kms_key_arn
+        },
+        {
+          arn         = var.runner_configs[runner_name].github.app.private_key.arn
+          kms_key_arn = var.runner_configs[runner_name].github.app.private_key.kms_key_arn
+        },
+        {
+          arn         = var.runner_configs[runner_name].github.app.installation_id.arn
+          kms_key_arn = var.runner_configs[runner_name].github.app.installation_id.kms_key_arn
+        },
       ]
     ])
   }
 
   group_github_kms_policy_json = {
-    for group_name, kms_key_arns in local.group_ssm_kms_key_arns : group_name => jsonencode({
+    for group_name, parameters in local.group_github_parameters : group_name => jsonencode({
       Version = "2012-10-17"
-      Statement = length(compact(kms_key_arns)) == 0 ? [] : [{
+      Statement = length(compact([for parameter in parameters : parameter.kms_key_arn])) == 0 ? [] : [{
         Sid      = "DecryptGitHubAppParameters"
         Effect   = "Allow"
         Action   = ["kms:Decrypt"]
-        Resource = distinct(compact(kms_key_arns))
+        Resource = distinct(compact([for parameter in parameters : parameter.kms_key_arn]))
       }]
     })
   }
@@ -170,7 +141,7 @@ locals {
   group_compute_iam_statements = {
     for group_name, runner_names in local.controller_groups : group_name => merge([
       for runner_name in runner_names : {
-        for statement_name, statement in var.compute_provider_contracts[runner_name].capabilities.scale_set.iam_statements :
+        for statement_name, statement in var.runner_configs[runner_name].compute_provider.capabilities.scale_set.iam_statements :
         "${runner_name}/${statement_name}" => statement
       }
     ]...)
@@ -179,7 +150,7 @@ locals {
   group_compute_environment_entries = {
     for group_name, runner_names in local.controller_groups : group_name => flatten([
       for runner_name in runner_names : [
-        for name, value in var.compute_provider_contracts[runner_name].capabilities.scale_set.environment_variables : {
+        for name, value in var.runner_configs[runner_name].compute_provider.capabilities.scale_set.environment_variables : {
           runner_name = runner_name
           name        = name
           value       = value
@@ -194,41 +165,15 @@ locals {
     ]...)
   }
 
-  reserved_environment_variable_names = toset([
-    "PATH",
-    "HOME",
-    "HOSTNAME",
-    "PWD",
-    "SHLVL",
-  ])
-
   config_store_max_bytes = var.config_store.tier == "Advanced" ? 8192 : 4096
 
   reconciler_config_json = {
     for config_key, config in local.reconciler_configs : config_key => jsonencode(config.value)
   }
-  reconciler_config_base64 = {
-    for config_key, config_json in local.reconciler_config_json : config_key => base64encode(config_json)
-  }
   reconciler_config_bytes = {
-    for config_key, encoded in local.reconciler_config_base64 : config_key => (
-      floor(length(encoded) * 3 / 4) -
-      (endswith(encoded, "==") ? 2 : endswith(encoded, "=") ? 1 : 0)
-    )
-  }
-  group_reconciler_config_bytes = {
-    for group_name, runner_names in local.controller_groups : group_name => sum([
-      for runner_name in runner_names : local.reconciler_config_bytes["${group_name}/${runner_name}"]
-    ])
-  }
-
-  group_task_policy_base64 = {
-    for group_name, policy in data.aws_iam_policy_document.task : group_name => base64encode(policy.json)
-  }
-  group_task_policy_bytes = {
-    for group_name, encoded in local.group_task_policy_base64 : group_name => (
-      floor(length(encoded) * 3 / 4) -
-      (endswith(encoded, "==") ? 2 : endswith(encoded, "=") ? 1 : 0)
+    for config_key, config_json in local.reconciler_config_json : config_key => (
+      floor(length(base64encode(config_json)) * 3 / 4) -
+      (endswith(base64encode(config_json), "==") ? 2 : endswith(base64encode(config_json), "=") ? 1 : 0)
     )
   }
 
diff --git a/modules/orchestration-providers/scale-set/service.tf b/modules/orchestration-providers/scale-set/service.tf
index 964849f4e7..b8e48ecfbe 100644
--- a/modules/orchestration-providers/scale-set/service.tf
+++ b/modules/orchestration-providers/scale-set/service.tf
@@ -35,6 +35,5 @@ resource "aws_ecs_service" "controller" {
   depends_on = [
     aws_iam_role_policy.execution,
     aws_iam_role_policy.task,
-    aws_ssm_parameter.reconciler_config,
   ]
 }
diff --git a/modules/orchestration-providers/scale-set/task.tf b/modules/orchestration-providers/scale-set/task.tf
index a4d0b89392..9b00ca6dbf 100644
--- a/modules/orchestration-providers/scale-set/task.tf
+++ b/modules/orchestration-providers/scale-set/task.tf
@@ -41,16 +41,12 @@ resource "aws_ecs_task_definition" "controller" {
       environment = concat(
         [
           {
-            name  = "SCALE_SET_CONTROLLER_GROUP_NAME"
-            value = each.key
+            name  = "SCALE_SET_CONTROLLER_MANIFEST"
+            value = local.group_controller_manifests[each.key]
           },
           {
-            name  = "SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH"
-            value = local.group_config_paths[each.key]
-          },
-          {
-            name  = "SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION"
-            value = local.group_config_revisions[each.key]
+            name  = "AWS_XRAY_CONTEXT_MISSING"
+            value = "IGNORE_ERROR"
           },
           {
             name  = "SCALE_SET_HEALTH_PORT"
@@ -107,6 +103,5 @@ resource "aws_ecs_task_definition" "controller" {
   depends_on = [
     aws_iam_role_policy.execution,
     aws_iam_role_policy.task,
-    aws_ssm_parameter.reconciler_config,
   ]
 }
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
index 111d997afd..b0bab1554c 100644
--- a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
@@ -42,34 +42,31 @@ module "subject" {
       scale_set = {
         name = "computed"
       }
-    }
-  }
-
-  compute_provider_contracts = {
-    computed = {
-      type = "ec2"
-      capabilities = {
-        scale_set = {
-          configuration_json = jsonencode({
-            region                 = "eu-west-1"
-            environment            = "computed-test"
-            runnerOwner            = "example"
-            runnerType             = "Org"
-            runnerNamePrefix       = "computed-"
-            jitConfigParameterPath = "/computed-test/runners/tokens"
-            subnets                = ["subnet-12345678"]
-            launchTemplateName     = terraform_data.computed.output.launch_template_name
-            ec2instanceCriteria = {
-              instanceTypes              = ["m7i.large"]
-              targetCapacityType         = "on-demand"
-              instanceAllocationStrategy = "lowest-price"
-            }
-            scaleErrors = []
-          })
-          iam_statements = {
-            run_instances = {
-              actions   = [terraform_data.computed.output.action]
-              resources = [terraform_data.computed.output.resource]
+      compute_provider = {
+        type = "ec2"
+        capabilities = {
+          scale_set = {
+            configuration_json = jsonencode({
+              region                 = "eu-west-1"
+              environment            = "computed-test"
+              runnerOwner            = "example"
+              runnerType             = "Org"
+              runnerNamePrefix       = "computed-"
+              jitConfigParameterPath = "/computed-test/runners/tokens"
+              subnets                = ["subnet-12345678"]
+              launchTemplateName     = terraform_data.computed.output.launch_template_name
+              ec2instanceCriteria = {
+                instanceTypes              = ["m7i.large"]
+                targetCapacityType         = "on-demand"
+                instanceAllocationStrategy = "lowest-price"
+              }
+              scaleErrors = []
+            })
+            iam_statements = {
+              run_instances = {
+                actions   = [terraform_data.computed.output.action]
+                resources = [terraform_data.computed.output.resource]
+              }
             }
           }
         }
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index c7498cba6a..67de65948f 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -67,10 +67,43 @@ variables {
       scale_set = {
         name = "linux-small"
         runner = {
+          group_name  = "stable-group"
           min_runners = 1
           max_runners = 10
         }
       }
+      compute_provider = {
+        type = "ec2"
+        capabilities = {
+          scale_set = {
+            configuration_json = jsonencode({
+              region                 = "eu-west-1"
+              environment            = "scale-set-test"
+              runnerOwner            = "example"
+              runnerType             = "Org"
+              runnerNamePrefix       = "small-"
+              jitConfigParameterPath = "/scale-set-test/runners/tokens"
+              subnets                = ["subnet-11111111"]
+              launchTemplateName     = "lt-small"
+              ec2instanceCriteria = {
+                instanceTypes              = ["m7i.large"]
+                targetCapacityType         = "on-demand"
+                instanceAllocationStrategy = "lowest-price"
+              }
+              scaleErrors = []
+            })
+            environment_variables = {
+              EC2_CONTROLLER_MODE = "grouped"
+            }
+            iam_statements = {
+              run_instances = {
+                actions   = ["ec2:RunInstances"]
+                resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-small"]
+              }
+            }
+          }
+        }
+      }
     }
     linux-large = {
       github = {
@@ -102,6 +135,38 @@ variables {
           max_runners = 20
         }
       }
+      compute_provider = {
+        type = "ec2"
+        capabilities = {
+          scale_set = {
+            configuration_json = jsonencode({
+              region                 = "eu-west-1"
+              environment            = "scale-set-test"
+              runnerOwner            = "example"
+              runnerType             = "Org"
+              runnerNamePrefix       = "large-"
+              jitConfigParameterPath = "/scale-set-test/runners/tokens"
+              subnets                = ["subnet-22222222"]
+              launchTemplateName     = "lt-large"
+              ec2instanceCriteria = {
+                instanceTypes              = ["m7i.xlarge"]
+                targetCapacityType         = "on-demand"
+                instanceAllocationStrategy = "lowest-price"
+              }
+              scaleErrors = []
+            })
+            environment_variables = {
+              EC2_CONTROLLER_MODE = "grouped"
+            }
+            iam_statements = {
+              run_instances = {
+                actions   = ["ec2:RunInstances"]
+                resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-large"]
+              }
+            }
+          }
+        }
+      }
     }
     microvm = {
       github = {
@@ -131,84 +196,17 @@ variables {
           max_runners = 5
         }
       }
-    }
-  }
-
-  compute_provider_contracts = {
-    linux-small = {
-      type = "ec2"
-      capabilities = {
-        scale_set = {
-          configuration_json = jsonencode({
-            region                 = "eu-west-1"
-            environment            = "scale-set-test"
-            runnerOwner            = "example"
-            runnerType             = "Org"
-            runnerNamePrefix       = "small-"
-            jitConfigParameterPath = "/scale-set-test/runners/tokens"
-            subnets                = ["subnet-11111111"]
-            launchTemplateName     = "lt-small"
-            ec2instanceCriteria = {
-              instanceTypes              = ["m7i.large"]
-              targetCapacityType         = "on-demand"
-              instanceAllocationStrategy = "lowest-price"
-            }
-            scaleErrors = []
-          })
-          environment_variables = {
-            EC2_CONTROLLER_MODE = "grouped"
-          }
-          iam_statements = {
-            run_instances = {
-              actions   = ["ec2:RunInstances"]
-              resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-small"]
-            }
-          }
-        }
-      }
-    }
-    linux-large = {
-      type = "ec2"
-      capabilities = {
-        scale_set = {
-          configuration_json = jsonencode({
-            region                 = "eu-west-1"
-            environment            = "scale-set-test"
-            runnerOwner            = "example"
-            runnerType             = "Org"
-            runnerNamePrefix       = "large-"
-            jitConfigParameterPath = "/scale-set-test/runners/tokens"
-            subnets                = ["subnet-22222222"]
-            launchTemplateName     = "lt-large"
-            ec2instanceCriteria = {
-              instanceTypes              = ["m7i.xlarge"]
-              targetCapacityType         = "on-demand"
-              instanceAllocationStrategy = "lowest-price"
-            }
-            scaleErrors = []
-          })
-          environment_variables = {
-            EC2_CONTROLLER_MODE = "grouped"
-          }
-          iam_statements = {
-            run_instances = {
-              actions   = ["ec2:RunInstances"]
-              resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-large"]
-            }
-          }
-        }
-      }
-    }
-    microvm = {
-      # Future provider used only to prove grouping remains provider-neutral.
-      type = "microvm"
-      capabilities = {
-        scale_set = {
-          configuration_json = jsonencode({ image_arn = "arn:aws:lambda:eu-west-1:123456789012:runtime-management-config:microvm" })
-          iam_statements = {
-            run_microvm = {
-              actions   = ["lambda:InvokeFunction"]
-              resources = ["arn:aws:lambda:eu-west-1:123456789012:function:microvm"]
+      compute_provider = {
+        # Future provider used only to prove grouping remains provider-neutral.
+        type = "microvm"
+        capabilities = {
+          scale_set = {
+            configuration_json = jsonencode({ image_arn = "arn:aws:lambda:eu-west-1:123456789012:runtime-management-config:microvm" })
+            iam_statements = {
+              run_microvm = {
+                actions   = ["lambda:InvokeFunction"]
+                resources = ["arn:aws:lambda:eu-west-1:123456789012:function:microvm"]
+              }
             }
           }
         }
@@ -280,10 +278,59 @@ run "groups_by_compute_provider_and_hardens_each_task" {
         jsondecode(task.container_definitions)[0].user == "10001:10001" &&
         jsondecode(task.container_definitions)[0].linuxParameters.capabilities.drop == ["ALL"] &&
         jsondecode(task.container_definitions)[0].healthCheck.command[3] == "fetch('http://127.0.0.1:8080/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" &&
-        !contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_MANIFEST")
+        contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_MANIFEST") &&
+        one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "AWS_XRAY_CONTEXT_MISSING"]) == "IGNORE_ERROR" &&
+        !contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH") &&
+        !contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION")
       )
     ])
-    error_message = "Each task definition must contain one hardened controller container using group-path configuration and /healthz liveness."
+    error_message = "Each task definition must contain one hardened controller container using manifest configuration and /healthz liveness."
+  }
+
+  assert {
+    condition = (
+      contains(flatten([
+        for task in values(aws_ecs_task_definition.controller) : [
+          for entry in jsondecode(task.container_definitions)[0].environment : [
+            for reconciler in jsondecode(entry.value).reconcilers : reconciler.runnerGroupName
+          ]
+          if entry.name == "SCALE_SET_CONTROLLER_MANIFEST"
+        ]
+      ]), "stable-group") &&
+      alltrue([
+        for task in values(aws_ecs_task_definition.controller) : alltrue([
+          for entry in jsondecode(task.container_definitions)[0].environment : entry.name != "SCALE_SET_CONTROLLER_MANIFEST" || (
+            jsondecode(entry.value).version == 1 &&
+            jsondecode(entry.value).groupName == one([
+              for group_name in keys(local.controller_groups) : group_name
+              if local.group_controller_manifests[group_name] == entry.value
+            ]) &&
+            length(jsondecode(entry.value).reconcilers) > 0 &&
+            alltrue([
+              for reconciler in jsondecode(entry.value).reconcilers : (
+                reconciler.schemaVersion == 1 &&
+                reconciler.runnerConfigName != null &&
+                reconciler.runnerGroupName != null &&
+                reconciler.scaleSetName != null &&
+                reconciler.githubConfigUrl != null &&
+                reconciler.githubApp.appIdParameterName != null &&
+                reconciler.githubApp.privateKeyParameterName != null &&
+                reconciler.computeProvider.type != null &&
+                reconciler.computeProvider.configuration != null &&
+                reconciler.minRunners != null &&
+                reconciler.maxRunners != null &&
+                reconciler.bootTimeoutMinutes != null &&
+                reconciler.sessionOwner != null &&
+                reconciler.workFolder != null &&
+                reconciler.forceGhes != null &&
+                reconciler.sslVerify != null
+              )
+            ])
+          )
+        ])
+      ])
+    )
+    error_message = "Each ECS task must receive a versioned ScaleSetControllerManifest with complete reconciler configuration."
   }
 
   assert {
@@ -310,7 +357,7 @@ run "groups_by_compute_provider_and_hardens_each_task" {
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).schemaVersion == 1 &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).runnerConfigName == "linux-small" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com" &&
-      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).expectedScaleSetName == "linux-small" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).scaleSetName == "linux-small" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).bootTimeoutMinutes == 10 &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).sslVerify == false &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).forceGhes == false &&
@@ -357,6 +404,37 @@ run "supports_one_group_per_runner_config" {
   }
 }
 
+run "grants_execution_role_ecr_pull_permissions" {
+  command = plan
+
+  variables {
+    container = {
+      image = "999999999999.dkr.ecr.eu-west-1.amazonaws.com/scale-set-controller@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+  }
+
+  assert {
+    condition = (
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.resources
+      ]), "*") &&
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.actions
+      ]), "ecr:GetAuthorizationToken") &&
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.actions
+      ]), "ecr:BatchCheckLayerAvailability") &&
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.actions
+      ]), "ecr:BatchGetImage") &&
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.actions
+      ]), "ecr:GetDownloadUrlForLayer")
+    )
+    error_message = "The ECS execution role must have wildcard ECR pull permissions, including the authorization-token permission."
+  }
+}
+
 run "supports_exact_custom_groups" {
   command = plan
 
@@ -435,23 +513,6 @@ run "rejects_incomplete_custom_membership" {
   expect_failures = [terraform_data.validate_grouping]
 }
 
-run "rejects_contract_key_mismatch" {
-  command = plan
-
-  plan_options {
-    target = [terraform_data.validate_contract]
-  }
-
-  variables {
-    compute_provider_contracts = {
-      linux-small = var.compute_provider_contracts.linux-small
-      linux-large = var.compute_provider_contracts.linux-large
-    }
-  }
-
-  expect_failures = [terraform_data.validate_contract]
-}
-
 run "rejects_readiness_path_as_ecs_liveness" {
   command = plan
 
@@ -476,13 +537,15 @@ run "rejects_oversized_standard_parameter" {
   }
 
   variables {
-    compute_provider_contracts = merge(var.compute_provider_contracts, {
-      linux-small = merge(var.compute_provider_contracts.linux-small, {
-        capabilities = {
-          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
-            configuration_json = jsonencode({ payload = join("", [for index in range(1000) : "xxxxxx"]) })
-          })
-        }
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              configuration_json = jsonencode({ payload = join("", [for index in range(1000) : "xxxxxx"]) })
+            })
+          }
+        })
       })
     })
   }
@@ -501,13 +564,15 @@ run "accepts_advanced_parameter_within_eight_kib" {
     config_store = {
       tier = "Advanced"
     }
-    compute_provider_contracts = merge(var.compute_provider_contracts, {
-      linux-small = merge(var.compute_provider_contracts.linux-small, {
-        capabilities = {
-          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
-            configuration_json = jsonencode({ payload = join("", [for index in range(800) : "xxxxxx"]) })
-          })
-        }
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              configuration_json = jsonencode({ payload = join("", [for index in range(800) : "xxxxxx"]) })
+            })
+          }
+        })
       })
     })
   }
@@ -648,9 +713,11 @@ run "rejects_invalid_compute_provider_type_identifier" {
   }
 
   variables {
-    compute_provider_contracts = merge(var.compute_provider_contracts, {
-      microvm = merge(var.compute_provider_contracts.microvm, {
-        type = "AWS.MicroVM"
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        compute_provider = merge(var.runner_configs.microvm.compute_provider, {
+          type = "AWS.MicroVM"
+        })
       })
     })
   }
@@ -727,7 +794,19 @@ run "allows_same_scale_set_name_in_another_github_scope" {
   }
 
   assert {
-    condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
+    condition = length([
+      for runner_name, runner_config in var.runner_configs : format(
+        "%s#%s",
+        replace(trimsuffix(lower(local.github_config_urls[runner_name]), "/"), ":443", ""),
+        runner_config.scale_set.name,
+      )
+      ]) == length(distinct([
+        for runner_name, runner_config in var.runner_configs : format(
+          "%s#%s",
+          replace(trimsuffix(lower(local.github_config_urls[runner_name]), "/"), ":443", ""),
+          runner_config.scale_set.name,
+        )
+    ]))
     error_message = "Scale-set names are scoped to their normalized enterprise-server URL."
   }
 }
@@ -764,14 +843,12 @@ run "bounds_default_session_owner_for_maximum_names" {
         scale_set = {
           name = "maximum-name"
         }
-      }
-    }
-    compute_provider_contracts = {
-      (join("", [for index in range(128) : "a"])) = {
-        type = "ec2"
-        capabilities = {
-          scale_set = {
-            configuration_json = "{}"
+        compute_provider = {
+          type = "ec2"
+          capabilities = {
+            scale_set = {
+              configuration_json = "{}"
+            }
           }
         }
       }
@@ -814,15 +891,17 @@ run "rejects_conflicting_group_environment_variables" {
   }
 
   variables {
-    compute_provider_contracts = merge(var.compute_provider_contracts, {
-      linux-large = merge(var.compute_provider_contracts.linux-large, {
-        capabilities = {
-          scale_set = merge(var.compute_provider_contracts.linux-large.capabilities.scale_set, {
-            environment_variables = {
-              EC2_CONTROLLER_MODE = "isolated"
-            }
-          })
-        }
+    runner_configs = merge(var.runner_configs, {
+      linux-large = merge(var.runner_configs.linux-large, {
+        compute_provider = merge(var.runner_configs.linux-large.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-large.compute_provider.capabilities.scale_set, {
+              environment_variables = {
+                EC2_CONTROLLER_MODE = "isolated"
+              }
+            })
+          }
+        })
       })
     })
   }
@@ -838,18 +917,20 @@ run "rejects_controller_group_environment_above_task_definition_budget" {
   }
 
   variables {
-    compute_provider_contracts = merge(var.compute_provider_contracts, {
-      linux-small = merge(var.compute_provider_contracts.linux-small, {
-        capabilities = {
-          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
-            environment_variables = merge(
-              var.compute_provider_contracts.linux-small.capabilities.scale_set.environment_variables,
-              {
-                for index in range(16) : format("EC2_QUOTA_%02d", index) => join("", [for part in range(1024) : "xxxx"])
-              },
-            )
-          })
-        }
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              environment_variables = merge(
+                var.runner_configs.linux-small.compute_provider.capabilities.scale_set.environment_variables,
+                {
+                  for index in range(16) : format("EC2_QUOTA_%02d", index) => join("", [for part in range(1024) : "xxxx"])
+                },
+              )
+            })
+          }
+        })
       })
     })
   }
@@ -865,15 +946,17 @@ run "rejects_reserved_provider_environment_variables" {
   }
 
   variables {
-    compute_provider_contracts = merge(var.compute_provider_contracts, {
-      linux-small = merge(var.compute_provider_contracts.linux-small, {
-        capabilities = {
-          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
-            environment_variables = {
-              SCALE_SET_OVERRIDE = "unsafe"
-            }
-          })
-        }
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              environment_variables = {
+                SCALE_SET_OVERRIDE = "unsafe"
+              }
+            })
+          }
+        })
       })
     })
   }
@@ -934,9 +1017,6 @@ run "rejects_controller_group_above_runtime_reconciler_limit" {
     runner_configs = {
       for index in range(1001) : format("runner-%04d", index) => var.runner_configs.linux-small
     }
-    compute_provider_contracts = {
-      for index in range(1001) : format("runner-%04d", index) => var.compute_provider_contracts.linux-small
-    }
     grouping = {
       strategy = "custom"
       custom = {
@@ -964,17 +1044,16 @@ run "rejects_controller_group_above_runtime_config_bytes" {
       tier = "Advanced"
     }
     runner_configs = {
-      for index in range(900) : format("runner-%04d", index) => var.runner_configs.linux-small
-    }
-    compute_provider_contracts = {
-      for index in range(900) : format("runner-%04d", index) => merge(var.compute_provider_contracts.linux-small, {
-        capabilities = {
-          scale_set = merge(var.compute_provider_contracts.linux-small.capabilities.scale_set, {
-            configuration_json = jsonencode({
-              payload = join("", [for part in range(1000) : "xxxxx"])
+      for index in range(900) : format("runner-%04d", index) => merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              configuration_json = jsonencode({
+                payload = join("", [for part in range(1000) : "xxxxx"])
+              })
             })
-          })
-        }
+          }
+        })
       })
     }
     grouping = {
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index 179e1b5e6c..d395e195da 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -26,14 +26,6 @@ resource "terraform_data" "validate_contract" {
       error_message = "prefix must contain 1 to 20 lowercase ASCII letters, digits, or hyphens and start with a letter or digit."
     }
 
-    precondition {
-      condition = (
-        length(setsubtract(local.configured_runner_names, local.contract_runner_names)) == 0 &&
-        length(setsubtract(local.contract_runner_names, local.configured_runner_names)) == 0
-      )
-      error_message = "runner_configs and compute_provider_contracts must have exactly the same keys."
-    }
-
     precondition {
       condition = alltrue([
         for runner_name in keys(var.runner_configs) : (
@@ -76,14 +68,26 @@ resource "terraform_data" "validate_contract" {
       condition = alltrue([
         for runner_name, runner_config in var.runner_configs : (
           can(regex("^https://[A-Za-z0-9.-]+(:[1-9][0-9]{0,4})?(/[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)?)?/?$", local.github_config_urls[runner_name])) &&
-          local.github_config_url_ports[runner_name] <= 65535
+          try(tonumber(regex("^https://[A-Za-z0-9.-]+:([0-9]+)", local.github_config_urls[runner_name])[0]), 443) <= 65535
         )
       ])
       error_message = "Each assembled GitHub config URL must be an HTTPS GitHub Enterprise Server URL without credentials, query, fragment, or whitespace."
     }
 
     precondition {
-      condition     = length(local.scale_set_ownership_keys) == length(distinct(local.scale_set_ownership_keys))
+      condition = length([
+        for runner_name, runner_config in var.runner_configs : format(
+          "%s#%s",
+          replace(trimsuffix(lower(local.github_config_urls[runner_name]), "/"), ":443", ""),
+          runner_config.scale_set.name,
+        )
+        ]) == length(distinct([
+          for runner_name, runner_config in var.runner_configs : format(
+            "%s#%s",
+            replace(trimsuffix(lower(local.github_config_urls[runner_name]), "/"), ":443", ""),
+            runner_config.scale_set.name,
+          )
+      ]))
       error_message = "Each normalized githubConfigUrl and scale_set.name tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
     }
 
@@ -137,14 +141,14 @@ resource "terraform_data" "validate_contract" {
 
     precondition {
       condition = alltrue([
-        for contract in values(var.compute_provider_contracts) : (
-          can(regex("^[a-z][a-z0-9_-]{0,63}$", contract.type)) &&
-          can(keys(jsondecode(contract.capabilities.scale_set.configuration_json))) &&
-          length(contract.capabilities.scale_set.environment_variables) <= 64 &&
+        for runner_config in values(var.runner_configs) : (
+          can(regex("^[a-z][a-z0-9_-]{0,63}$", runner_config.compute_provider.type)) &&
+          can(keys(jsondecode(runner_config.compute_provider.capabilities.scale_set.configuration_json))) &&
+          length(runner_config.compute_provider.capabilities.scale_set.environment_variables) <= 64 &&
           alltrue([
-            for name, value in contract.capabilities.scale_set.environment_variables : (
+            for name, value in runner_config.compute_provider.capabilities.scale_set.environment_variables : (
               can(regex("^[A-Z][A-Z0-9_]{0,127}$", name)) &&
-              !contains(local.reserved_environment_variable_names, name) &&
+              !contains(["PATH", "HOME", "HOSTNAME", "PWD", "SHLVL"], name) &&
               alltrue([
                 for prefix in ["AWS_", "ECS_", "GITHUB_", "SCALE_SET_", "NODE_"] :
                 !startswith(name, prefix)
@@ -157,7 +161,7 @@ resource "terraform_data" "validate_contract" {
             )
           ]) &&
           alltrue([
-            for statement_name, statement in contract.capabilities.scale_set.iam_statements : (
+            for statement_name, statement in runner_config.compute_provider.capabilities.scale_set.iam_statements : (
               can(regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$", statement_name)) &&
               length(statement.actions) > 0 &&
               length(statement.resources) > 0 &&
@@ -216,9 +220,9 @@ resource "terraform_data" "validate_grouping" {
 
     precondition {
       condition = var.grouping.strategy != "custom" ? true : (
-        length(local.custom_members) == length(distinct(local.custom_members)) &&
-        length(setsubtract(toset(local.custom_members), local.configured_runner_names)) == 0 &&
-        length(setsubtract(local.configured_runner_names, toset(local.custom_members))) == 0
+        length(flatten(values(local.declared_custom_groups))) == length(distinct(flatten(values(local.declared_custom_groups)))) &&
+        length(setsubtract(toset(flatten(values(local.declared_custom_groups))), toset(keys(var.runner_configs)))) == 0 &&
+        length(setsubtract(toset(keys(var.runner_configs)), toset(flatten(values(local.declared_custom_groups))))) == 0
       )
       error_message = "Custom groups must contain every runner config exactly once and cannot contain unknown runner configs."
     }
@@ -236,7 +240,9 @@ resource "terraform_data" "validate_grouping" {
 
     precondition {
       condition = alltrue([
-        for group_name, decoded_bytes in local.group_reconciler_config_bytes : decoded_bytes <= 4 * 1024 * 1024
+        for group_name, runner_names in local.controller_groups : sum([
+          for runner_name in runner_names : local.reconciler_config_bytes["${group_name}/${runner_name}"]
+        ]) <= 4 * 1024 * 1024
       ])
       error_message = "A controller group's decoded reconciler configuration must not exceed the runtime's 4 MiB aggregate limit. Split the group or reduce provider configuration size."
     }
@@ -247,6 +253,15 @@ resource "terraform_data" "validate_grouping" {
       ])
       error_message = "A controller group's compute-provider environment JSON must not exceed 49152 bytes. This reserves 16 KiB of AWS's 64 KiB ECS task-definition quota for the fixed task definition; split the group or reduce provider environment settings."
     }
+
+    precondition {
+      condition = alltrue([
+        for group_name, manifest_bytes in local.group_controller_manifests : (
+          length(manifest_bytes) + local.group_compute_environment_bytes[group_name] <= 48 * 1024
+        )
+      ])
+      error_message = "A controller group's manifest and compute-provider environment JSON must fit the ECS task-definition budget; split the group or reduce provider configuration."
+    }
   }
 }
 
@@ -389,8 +404,11 @@ resource "terraform_data" "validate_group_task_policy" {
 
   lifecycle {
     precondition {
-      condition     = local.group_task_policy_bytes[each.key] <= 10240
-      error_message = "Controller group ${each.key} produces a ${local.group_task_policy_bytes[each.key]}-byte task-role policy, exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
+      condition = (
+        floor(length(base64encode(data.aws_iam_policy_document.task[each.key].json)) * 3 / 4) -
+        (endswith(base64encode(data.aws_iam_policy_document.task[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task[each.key].json), "=") ? 1 : 0)
+      ) <= 10240
+      error_message = "Controller group ${each.key} produces a task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
     }
   }
 }
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
index b2316f28a0..75d5bb611b 100644
--- a/modules/orchestration-providers/scale-set/variables.tf
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -9,7 +9,7 @@ variable "runner_configs" {
   description = <<-EOT
     Normalized scale-set runner configurations keyed by stable runner-config name.
 
-    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply.
+    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply.
   EOT
   type = map(object({
     github = object({
@@ -41,36 +41,28 @@ variable "runner_configs" {
     scale_set = object({
       name = string
       runner = optional(object({
+        group_name           = optional(string, "Default")
         min_runners          = optional(number, 0)
         max_runners          = optional(number, 10)
         boot_time_in_minutes = optional(number, 10)
       }), {})
     })
-  }))
-  nullable = false
-}
-
-variable "compute_provider_contracts" {
-  description = <<-EOT
-    Provider-neutral, scale-set capability fragments keyed exactly like `runner_configs`.
-
-    `type` is the plan-known provider discriminator used by the default grouping implementation and the runtime adapter registry. `configuration_json` is provider-owned, valid JSON and must contain no secrets. `environment_variables` contains non-secret provider process settings shared by every reconciler in the same controller group; conflicting values are rejected. IAM statement map keys and optional condition shapes must be known during planning; their action, resource, and condition values may be computed.
-  EOT
-  type = map(object({
-    type = string
-    capabilities = object({
-      scale_set = object({
-        configuration_json    = optional(string, "{}")
-        environment_variables = optional(map(string), {})
-        iam_statements = optional(map(object({
-          actions   = set(string)
-          resources = set(string)
-          conditions = optional(list(object({
-            test     = string
-            variable = string
-            values   = set(string)
-          })), [])
-        })), {})
+    compute_provider = object({
+      type = string
+      capabilities = object({
+        scale_set = object({
+          configuration_json    = optional(string, "{}")
+          environment_variables = optional(map(string), {})
+          iam_statements = optional(map(object({
+            actions   = set(string)
+            resources = set(string)
+            conditions = optional(list(object({
+              test     = string
+              variable = string
+              values   = set(string)
+            })), [])
+          })), {})
+        })
       })
     })
   }))
@@ -113,9 +105,6 @@ variable "container" {
     reconnect_initial_backoff_seconds = optional(number, 1)
     reconnect_max_backoff_seconds     = optional(number, 30)
     stop_timeout_seconds              = optional(number, 120)
-    ecr_repository = optional(object({
-      arn = string
-    }), null)
   })
   default  = {}
   nullable = false

From 7a62486f8378f7055dfcc65537aa6acc14759e67 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 01:54:45 +0200
Subject: [PATCH 09/52] fix(scale-set): isolate compute task policy

---
 .../orchestration-providers/scale-set/iam.tf  | 23 +++++++++++++++----
 .../scale-set/service.tf                      |  1 +
 .../orchestration-providers/scale-set/task.tf |  1 +
 .../scale-set/tests/scale-set.tftest.hcl      |  6 ++---
 .../scale-set/validations.tf                  | 14 +++++++++++
 5 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/iam.tf b/modules/orchestration-providers/scale-set/iam.tf
index 2f0b644180..8200c57b16 100644
--- a/modules/orchestration-providers/scale-set/iam.tf
+++ b/modules/orchestration-providers/scale-set/iam.tf
@@ -66,6 +66,21 @@ data "aws_iam_policy_document" "task" {
     resources = [for parameter in local.group_github_parameters[each.key] : parameter.arn]
   }
 
+}
+
+resource "aws_iam_role_policy" "task" {
+  for_each = local.controller_groups
+
+  name   = "scale-set-controller"
+  role   = aws_iam_role.task[each.key].name
+  policy = data.aws_iam_policy_document.task[each.key].json
+
+  depends_on = [terraform_data.validate_group_task_policy]
+}
+
+data "aws_iam_policy_document" "task_compute" {
+  for_each = local.controller_groups
+
   dynamic "statement" {
     for_each = local.group_compute_iam_statements[each.key]
 
@@ -87,14 +102,14 @@ data "aws_iam_policy_document" "task" {
   }
 }
 
-resource "aws_iam_role_policy" "task" {
+resource "aws_iam_role_policy" "task_compute" {
   for_each = local.controller_groups
 
-  name   = "scale-set-controller"
+  name   = "scale-set-controller-compute"
   role   = aws_iam_role.task[each.key].name
-  policy = data.aws_iam_policy_document.task[each.key].json
+  policy = data.aws_iam_policy_document.task_compute[each.key].json
 
-  depends_on = [terraform_data.validate_group_task_policy]
+  depends_on = [terraform_data.validate_group_compute_policy]
 }
 
 resource "aws_iam_role" "execution" {
diff --git a/modules/orchestration-providers/scale-set/service.tf b/modules/orchestration-providers/scale-set/service.tf
index b8e48ecfbe..5fad686419 100644
--- a/modules/orchestration-providers/scale-set/service.tf
+++ b/modules/orchestration-providers/scale-set/service.tf
@@ -35,5 +35,6 @@ resource "aws_ecs_service" "controller" {
   depends_on = [
     aws_iam_role_policy.execution,
     aws_iam_role_policy.task,
+    aws_iam_role_policy.task_compute,
   ]
 }
diff --git a/modules/orchestration-providers/scale-set/task.tf b/modules/orchestration-providers/scale-set/task.tf
index 9b00ca6dbf..874762223d 100644
--- a/modules/orchestration-providers/scale-set/task.tf
+++ b/modules/orchestration-providers/scale-set/task.tf
@@ -103,5 +103,6 @@ resource "aws_ecs_task_definition" "controller" {
   depends_on = [
     aws_iam_role_policy.execution,
     aws_iam_role_policy.task,
+    aws_iam_role_policy.task_compute,
   ]
 }
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index 67de65948f..f25114e04c 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -868,11 +868,11 @@ run "rejects_controller_group_policy_above_inline_quota" {
   command = plan
 
   plan_options {
-    target = [terraform_data.validate_group_task_policy["ec2"]]
+    target = [terraform_data.validate_group_compute_policy["ec2"]]
   }
 
   override_data {
-    target = data.aws_iam_policy_document.task["ec2"]
+    target = data.aws_iam_policy_document.task_compute["ec2"]
     values = {
       json = <<-JSON
         {"payload":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}
@@ -880,7 +880,7 @@ run "rejects_controller_group_policy_above_inline_quota" {
     }
   }
 
-  expect_failures = [terraform_data.validate_group_task_policy["ec2"]]
+  expect_failures = [terraform_data.validate_group_compute_policy["ec2"]]
 }
 
 run "rejects_conflicting_group_environment_variables" {
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index d395e195da..bf2d3a77b0 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -412,3 +412,17 @@ resource "terraform_data" "validate_group_task_policy" {
     }
   }
 }
+
+resource "terraform_data" "validate_group_compute_policy" {
+  for_each = local.controller_groups
+
+  lifecycle {
+    precondition {
+      condition = (
+        floor(length(base64encode(data.aws_iam_policy_document.task_compute[each.key].json)) * 3 / 4) -
+        (endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "=") ? 1 : 0)
+      ) <= 10240
+      error_message = "Controller group ${each.key} produces a compute-provider task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
+    }
+  }
+}

From 20ef101cf8334b120853c6e03bb5d93191efd98e Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 12:21:46 +0200
Subject: [PATCH 10/52] feat(scale-set): include runner labels in manifest

---
 modules/orchestration-providers/scale-set/locals.tf    | 1 +
 modules/orchestration-providers/scale-set/variables.tf | 1 +
 2 files changed, 2 insertions(+)

diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
index e58e165ae4..41685b5ca0 100644
--- a/modules/orchestration-providers/scale-set/locals.tf
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -59,6 +59,7 @@ locals {
           schemaVersion      = 1
           runnerConfigName   = runner_name
           runnerGroupName    = var.runner_configs[runner_name].scale_set.runner.group_name
+          runnerLabels       = var.runner_configs[runner_name].scale_set.runner.labels
           githubConfigUrl    = local.github_config_urls[runner_name]
           scaleSetName       = var.runner_configs[runner_name].scale_set.name
           minRunners         = var.runner_configs[runner_name].scale_set.runner.min_runners
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
index 75d5bb611b..3fe3288670 100644
--- a/modules/orchestration-providers/scale-set/variables.tf
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -41,6 +41,7 @@ variable "runner_configs" {
     scale_set = object({
       name = string
       runner = optional(object({
+        labels               = optional(list(string), [])
         group_name           = optional(string, "Default")
         min_runners          = optional(number, 0)
         max_runners          = optional(number, 10)

From 3cba8d703beb2c3a0bb918f20c058c2b0db15075 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 10:24:41 +0000
Subject: [PATCH 11/52] docs: auto update terraform docs

---
 modules/orchestration-providers/scale-set/README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index da247495b7..5e842d1bc2 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -211,10 +211,12 @@ No modules.
 | [aws_iam_role.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
 | [aws_iam_role_policy.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.task_compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_security_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
 | [aws_ssm_parameter.reconciler_config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [terraform_data.validate_config_store](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_contract](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_group_compute_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_group_task_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_grouping](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_runtime](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
@@ -222,6 +224,7 @@ No modules.
 | [aws_iam_policy_document.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.task_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.task_compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
 
@@ -236,7 +239,7 @@ No modules.
 | <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
-| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        group_name           = optional(string, "Default")<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>    compute_provider = object({<br/>      type = string<br/>      capabilities = object({<br/>        scale_set = object({<br/>          configuration_json    = optional(string, "{}")<br/>          environment_variables = optional(map(string), {})<br/>          iam_statements = optional(map(object({<br/>            actions   = set(string)<br/>            resources = set(string)<br/>            conditions = optional(list(object({<br/>              test     = string<br/>              variable = string<br/>              values   = set(string)<br/>            })), [])<br/>          })), {})<br/>        })<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        labels               = optional(list(string), [])<br/>        group_name           = optional(string, "Default")<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>    compute_provider = object({<br/>      type = string<br/>      capabilities = object({<br/>        scale_set = object({<br/>          configuration_json    = optional(string, "{}")<br/>          environment_variables = optional(map(string), {})<br/>          iam_statements = optional(map(object({<br/>            actions   = set(string)<br/>            resources = set(string)<br/>            conditions = optional(list(object({<br/>              test     = string<br/>              variable = string<br/>              values   = set(string)<br/>            })), [])<br/>          })), {})<br/>        })<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
 
 ## Outputs

From 2aedc6c94c50db642138eef15963ec94ef9c0e5e Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 15:20:14 +0200
Subject: [PATCH 12/52] feat(scale-set): sync orchestration module changes

---
 .../scale-set/README.md                       | 22 ++++---
 .../orchestration-providers/scale-set/iam.tf  | 65 ++++++++++++++++---
 .../scale-set/locals.tf                       | 49 ++++++++++++--
 .../scale-set/service.tf                      |  2 +-
 .../orchestration-providers/scale-set/task.tf | 14 +++-
 .../scale-set/tests/scale-set.tftest.hcl      | 11 +++-
 .../scale-set/validations.tf                  | 14 ----
 .../scale-set/variables.tf                    |  8 +++
 8 files changed, 139 insertions(+), 46 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index 5e842d1bc2..e893af726c 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -184,15 +184,15 @@ Inner values such as scale-set names, SSM/KMS ARNs, provider configuration value
 ## Requirements
 
 | Name | Version |
-|------|---------|
+| ---- | ------- |
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
 
 ## Providers
 
 | Name | Version |
-|------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.33 |
+| ---- | ------- |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.64.0 |
 | <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
@@ -202,50 +202,52 @@ No modules.
 ## Resources
 
 | Name | Type |
-|------|------|
+| ---- | ---- |
 | [aws_cloudwatch_log_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
 | [aws_ecs_cluster.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource |
 | [aws_ecs_service.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
 | [aws_ecs_task_definition.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource |
+| [aws_iam_role.compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
 | [aws_iam_role.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
 | [aws_iam_role.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy.compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
-| [aws_iam_role_policy.task_compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_security_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
 | [aws_ssm_parameter.reconciler_config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [terraform_data.validate_config_store](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_contract](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
-| [terraform_data.validate_group_compute_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_group_task_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_grouping](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_runtime](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.compute_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_policy_document.task_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
-| [aws_iam_policy_document.task_compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
 | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-|------|-------------|------|---------|:--------:|
+| ---- | ----------- | ---- | ------- | :------: |
 | <a name="input_config_store"></a> [config\_store](#input\_config\_store) | Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.<br/><br/>Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`. | <pre>object({<br/>    path_prefix = optional(string, null)<br/>    tier        = optional(string, "Standard")<br/>    tags        = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_container"></a> [container](#input\_container) | Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health\_path is fixed at /healthz, the ECS liveness endpoint. | <pre>object({<br/>    image                             = optional(string, null)<br/>    user                              = optional(string, "10001:10001")<br/>    health_port                       = optional(number, 8080)<br/>    health_path                       = optional(string, "/healthz")<br/>    health_check_command              = optional(list(string), null)<br/>    health_check_interval             = optional(number, 30)<br/>    health_check_timeout              = optional(number, 5)<br/>    health_check_retries              = optional(number, 3)<br/>    health_check_start_period         = optional(number, 30)<br/>    health_stale_after_seconds        = optional(number, 180)<br/>    shutdown_timeout_seconds          = optional(number, 110)<br/>    session_close_timeout_seconds     = optional(number, 10)<br/>    reconnect_initial_backoff_seconds = optional(number, 1)<br/>    reconnect_max_backoff_seconds     = optional(number, 30)<br/>    stop_timeout_seconds              = optional(number, 120)<br/>  })</pre> | `{}` | no |
 | <a name="input_ecs"></a> [ecs](#input\_ecs) | ECS substrate configuration. A managed cluster is created by default. For an external cluster, set `cluster.mode = "external"` and pass its ARN; the mode must be plan-known while the ARN may be computed. | <pre>object({<br/>    cluster = optional(object({<br/>      mode               = optional(string, "managed")<br/>      arn                = optional(string, null)<br/>      name               = optional(string, null)<br/>      container_insights = optional(bool, true)<br/>    }), {})<br/>    task = optional(object({<br/>      cpu              = optional(number, 512)<br/>      memory           = optional(number, 1024)<br/>      cpu_architecture = optional(string, "X86_64")<br/>      ephemeral_storage = optional(object({<br/>        size_in_gib = number<br/>      }), null)<br/>    }), {})<br/>    service = optional(object({<br/>      platform_version = optional(string, "LATEST")<br/>    }), {})<br/>    iam = optional(object({<br/>      path                 = optional(string, "/")<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_grouping"></a> [grouping](#input\_grouping) | Packing strategy for scale-set reconcilers. `compute_provider` creates one controller group per compute-provider type and is the default. `runner_config` creates one group per runner config. `custom` uses `custom.groups`; custom membership must cover every runner config exactly once.<br/><br/>The strategy, custom group keys, and memberships select Terraform `for_each` instances and must be known during planning. | <pre>object({<br/>    strategy = optional(string, "compute_provider")<br/>    custom = optional(object({<br/>      groups = map(object({<br/>        runner_configs = set(string)<br/>      }))<br/>    }), null)<br/>  })</pre> | `{}` | no |
+| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for the scale-set controller container. | `string` | `"info"` | no |
 | <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
-| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        labels               = optional(list(string), [])<br/>        group_name           = optional(string, "Default")<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>    compute_provider = object({<br/>      type = string<br/>      capabilities = object({<br/>        scale_set = object({<br/>          configuration_json    = optional(string, "{}")<br/>          environment_variables = optional(map(string), {})<br/>          iam_statements = optional(map(object({<br/>            actions   = set(string)<br/>            resources = set(string)<br/>            conditions = optional(list(object({<br/>              test     = string<br/>              variable = string<br/>              values   = set(string)<br/>            })), [])<br/>          })), {})<br/>        })<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        labels               = optional(list(string), [])<br/>        group_name           = optional(string, "Default")<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>    compute_provider = object({<br/>      type = string<br/>      capabilities = object({<br/>        scale_set = object({<br/>          role_arn              = optional(string, null)<br/>          configuration_json    = optional(string, "{}")<br/>          environment_variables = optional(map(string), {})<br/>          iam_statements = optional(map(object({<br/>            actions   = set(string)<br/>            resources = set(string)<br/>            conditions = optional(list(object({<br/>              test     = string<br/>              variable = string<br/>              values   = set(string)<br/>            })), [])<br/>          })), {})<br/>        })<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
 
 ## Outputs
 
 | Name | Description |
-|------|-------------|
+| ---- | ----------- |
 | <a name="output_cluster"></a> [cluster](#output\_cluster) | Managed or external ECS cluster selected for all controller groups. |
 | <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | Controller-group resources keyed by stable resolved group name. |
 | <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | Non-secret SSM controller configuration parameters keyed by `<controller-group>/<runner-config>`. Values are intentionally not exposed. |
diff --git a/modules/orchestration-providers/scale-set/iam.tf b/modules/orchestration-providers/scale-set/iam.tf
index 8200c57b16..e55ab0f6b9 100644
--- a/modules/orchestration-providers/scale-set/iam.tf
+++ b/modules/orchestration-providers/scale-set/iam.tf
@@ -66,6 +66,12 @@ data "aws_iam_policy_document" "task" {
     resources = [for parameter in local.group_github_parameters[each.key] : parameter.arn]
   }
 
+  statement {
+    sid       = "AssumeComputeProviderRoles"
+    effect    = "Allow"
+    actions   = ["sts:AssumeRole"]
+    resources = [for runner_name in local.controller_groups[each.key] : local.compute_role_arns["${each.key}/${runner_name}"]]
+  }
 }
 
 resource "aws_iam_role_policy" "task" {
@@ -78,11 +84,52 @@ resource "aws_iam_role_policy" "task" {
   depends_on = [terraform_data.validate_group_task_policy]
 }
 
-data "aws_iam_policy_document" "task_compute" {
-  for_each = local.controller_groups
+data "aws_iam_policy_document" "compute_assume_role" {
+  for_each = local.compute_role_configs
+
+  statement {
+    sid     = "AllowScaleSetTask"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type = "AWS"
+      identifiers = [format(
+        "arn:%s:iam::%s:root",
+        data.aws_partition.current.partition,
+        data.aws_caller_identity.current.account_id,
+      )]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:PrincipalArn"
+      values = [format(
+        "arn:%s:iam::%s:role%s%s-task",
+        data.aws_partition.current.partition,
+        data.aws_caller_identity.current.account_id,
+        var.ecs.iam.path,
+        local.group_resource_names[each.value.group_name],
+      )]
+    }
+  }
+}
+
+resource "aws_iam_role" "compute" {
+  for_each = local.compute_role_configs
+
+  name                 = "${local.group_resource_names[each.value.group_name]}-compute-${substr(sha256(each.key), 0, 8)}"
+  path                 = var.ecs.iam.path
+  permissions_boundary = var.ecs.iam.permissions_boundary
+  assume_role_policy   = data.aws_iam_policy_document.compute_assume_role[each.key].json
+  tags                 = local.group_tags[each.value.group_name]
+}
+
+data "aws_iam_policy_document" "compute" {
+  for_each = local.compute_role_configs
 
   dynamic "statement" {
-    for_each = local.group_compute_iam_statements[each.key]
+    for_each = local.reconciler_compute_iam_statements[each.key]
 
     content {
       effect    = "Allow"
@@ -102,14 +149,12 @@ data "aws_iam_policy_document" "task_compute" {
   }
 }
 
-resource "aws_iam_role_policy" "task_compute" {
-  for_each = local.controller_groups
-
-  name   = "scale-set-controller-compute"
-  role   = aws_iam_role.task[each.key].name
-  policy = data.aws_iam_policy_document.task_compute[each.key].json
+resource "aws_iam_role_policy" "compute" {
+  for_each = local.compute_role_configs
 
-  depends_on = [terraform_data.validate_group_compute_policy]
+  name   = "scale-set-compute"
+  role   = aws_iam_role.compute[each.key].name
+  policy = data.aws_iam_policy_document.compute[each.key].json
 }
 
 resource "aws_iam_role" "execution" {
diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
index 41685b5ca0..9df92c844e 100644
--- a/modules/orchestration-providers/scale-set/locals.tf
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -80,6 +80,7 @@ locals {
           }
           computeProvider = {
             type          = var.runner_configs[runner_name].compute_provider.type
+            roleArn       = local.compute_role_arns["${group_name}/${runner_name}"]
             configuration = jsondecode(var.runner_configs[runner_name].compute_provider.capabilities.scale_set.configuration_json)
           }
           userAgent = var.runner_configs[runner_name].github.user_agent
@@ -139,13 +140,47 @@ locals {
     })
   }
 
-  group_compute_iam_statements = {
-    for group_name, runner_names in local.controller_groups : group_name => merge([
-      for runner_name in runner_names : {
-        for statement_name, statement in var.runner_configs[runner_name].compute_provider.capabilities.scale_set.iam_statements :
-        "${runner_name}/${statement_name}" => statement
-      }
-    ]...)
+  compute_role_configs = {
+    for config_key in flatten([
+      for group_name, runner_names in local.controller_groups : [
+        for runner_name in runner_names : {
+          key         = "${group_name}/${runner_name}"
+          group_name  = group_name
+          runner_name = runner_name
+        }
+      ]
+    ]) : config_key.key => config_key
+    if var.runner_configs[config_key.runner_name].compute_provider.capabilities.scale_set.role_arn == null
+  }
+
+  compute_role_arns = {
+    for config in flatten([
+      for group_name, runner_names in local.controller_groups : [
+        for runner_name in runner_names : {
+          key         = "${group_name}/${runner_name}"
+          group_name  = group_name
+          runner_name = runner_name
+        }
+      ]
+      ]) : config.key => (
+      var.runner_configs[config.runner_name].compute_provider.capabilities.scale_set.role_arn != null
+      ? var.runner_configs[config.runner_name].compute_provider.capabilities.scale_set.role_arn
+      : format(
+        "arn:%s:iam::%s:role%s%s-compute-%s",
+        data.aws_partition.current.partition,
+        data.aws_caller_identity.current.account_id,
+        var.ecs.iam.path,
+        local.group_resource_names[config.group_name],
+        substr(sha256(config.key), 0, 8),
+      )
+    )
+  }
+
+  reconciler_compute_iam_statements = {
+    for config_key, config in local.compute_role_configs : config_key => {
+      for statement_name, statement in var.runner_configs[config.runner_name].compute_provider.capabilities.scale_set.iam_statements :
+      statement_name => statement
+    }
   }
 
   group_compute_environment_entries = {
diff --git a/modules/orchestration-providers/scale-set/service.tf b/modules/orchestration-providers/scale-set/service.tf
index 5fad686419..953ebe4058 100644
--- a/modules/orchestration-providers/scale-set/service.tf
+++ b/modules/orchestration-providers/scale-set/service.tf
@@ -35,6 +35,6 @@ resource "aws_ecs_service" "controller" {
   depends_on = [
     aws_iam_role_policy.execution,
     aws_iam_role_policy.task,
-    aws_iam_role_policy.task_compute,
+    aws_iam_role_policy.compute,
   ]
 }
diff --git a/modules/orchestration-providers/scale-set/task.tf b/modules/orchestration-providers/scale-set/task.tf
index 874762223d..c47902bfe0 100644
--- a/modules/orchestration-providers/scale-set/task.tf
+++ b/modules/orchestration-providers/scale-set/task.tf
@@ -40,6 +40,10 @@ resource "aws_ecs_task_definition" "controller" {
       }
       environment = concat(
         [
+          {
+            name  = "LOG_LEVEL"
+            value = var.log_level
+          },
           {
             name  = "SCALE_SET_CONTROLLER_MANIFEST"
             value = local.group_controller_manifests[each.key]
@@ -48,6 +52,14 @@ resource "aws_ecs_task_definition" "controller" {
             name  = "AWS_XRAY_CONTEXT_MISSING"
             value = "IGNORE_ERROR"
           },
+          {
+            name  = "AWS_REGION"
+            value = data.aws_region.current.region
+          },
+          {
+            name  = "AWS_DEFAULT_REGION"
+            value = data.aws_region.current.region
+          },
           {
             name  = "SCALE_SET_HEALTH_PORT"
             value = tostring(var.container.health_port)
@@ -103,6 +115,6 @@ resource "aws_ecs_task_definition" "controller" {
   depends_on = [
     aws_iam_role_policy.execution,
     aws_iam_role_policy.task,
-    aws_iam_role_policy.task_compute,
+    aws_iam_role_policy.compute,
   ]
 }
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index f25114e04c..304e0fee50 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -278,8 +278,11 @@ run "groups_by_compute_provider_and_hardens_each_task" {
         jsondecode(task.container_definitions)[0].user == "10001:10001" &&
         jsondecode(task.container_definitions)[0].linuxParameters.capabilities.drop == ["ALL"] &&
         jsondecode(task.container_definitions)[0].healthCheck.command[3] == "fetch('http://127.0.0.1:8080/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" &&
+        one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "LOG_LEVEL"]) == "info" &&
         contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_MANIFEST") &&
         one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "AWS_XRAY_CONTEXT_MISSING"]) == "IGNORE_ERROR" &&
+        one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "AWS_REGION"]) == "eu-west-1" &&
+        one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "AWS_DEFAULT_REGION"]) == "eu-west-1" &&
         !contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH") &&
         !contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION")
       )
@@ -316,6 +319,7 @@ run "groups_by_compute_provider_and_hardens_each_task" {
                 reconciler.githubApp.appIdParameterName != null &&
                 reconciler.githubApp.privateKeyParameterName != null &&
                 reconciler.computeProvider.type != null &&
+                reconciler.computeProvider.roleArn != null &&
                 reconciler.computeProvider.configuration != null &&
                 reconciler.minRunners != null &&
                 reconciler.maxRunners != null &&
@@ -377,6 +381,7 @@ run "groups_by_compute_provider_and_hardens_each_task" {
       contains(jsondecode(local.group_github_kms_policy_json["ec2"]).Statement[0].Resource, "arn:aws:kms:eu-west-1:123456789012:key/11111111-1111-1111-1111-111111111111") &&
       length(jsondecode(local.group_github_kms_policy_json["microvm"]).Statement) == 0 &&
       contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/scale-set-controller/ec2/*")
+      && contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.actions]), "sts:AssumeRole")
     )
     error_message = "Task IAM must be scoped to its group config prefix, credential parameters, KMS keys, and compute resources."
   }
@@ -868,11 +873,11 @@ run "rejects_controller_group_policy_above_inline_quota" {
   command = plan
 
   plan_options {
-    target = [terraform_data.validate_group_compute_policy["ec2"]]
+    target = [terraform_data.validate_group_task_policy["ec2"]]
   }
 
   override_data {
-    target = data.aws_iam_policy_document.task_compute["ec2"]
+    target = data.aws_iam_policy_document.task["ec2"]
     values = {
       json = <<-JSON
         {"payload":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}
@@ -880,7 +885,7 @@ run "rejects_controller_group_policy_above_inline_quota" {
     }
   }
 
-  expect_failures = [terraform_data.validate_group_compute_policy["ec2"]]
+  expect_failures = [terraform_data.validate_group_task_policy["ec2"]]
 }
 
 run "rejects_conflicting_group_environment_variables" {
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index bf2d3a77b0..d395e195da 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -412,17 +412,3 @@ resource "terraform_data" "validate_group_task_policy" {
     }
   }
 }
-
-resource "terraform_data" "validate_group_compute_policy" {
-  for_each = local.controller_groups
-
-  lifecycle {
-    precondition {
-      condition = (
-        floor(length(base64encode(data.aws_iam_policy_document.task_compute[each.key].json)) * 3 / 4) -
-        (endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "=") ? 1 : 0)
-      ) <= 10240
-      error_message = "Controller group ${each.key} produces a compute-provider task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
-    }
-  }
-}
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
index 3fe3288670..c7f8126c49 100644
--- a/modules/orchestration-providers/scale-set/variables.tf
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -5,6 +5,13 @@ variable "prefix" {
   nullable    = false
 }
 
+variable "log_level" {
+  description = "Logging level for the scale-set controller container."
+  type        = string
+  default     = "info"
+  nullable    = false
+}
+
 variable "runner_configs" {
   description = <<-EOT
     Normalized scale-set runner configurations keyed by stable runner-config name.
@@ -52,6 +59,7 @@ variable "runner_configs" {
       type = string
       capabilities = object({
         scale_set = object({
+          role_arn              = optional(string, null)
           configuration_json    = optional(string, "{}")
           environment_variables = optional(map(string), {})
           iam_statements = optional(map(object({

From a759a4e55931ef7a20b3909a764d823f069fd365 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 13:21:08 +0000
Subject: [PATCH 13/52] docs: auto update terraform docs

---
 modules/orchestration-providers/scale-set/README.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index e893af726c..d7632548f7 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -184,15 +184,15 @@ Inner values such as scale-set names, SSM/KMS ARNs, provider configuration value
 ## Requirements
 
 | Name | Version |
-| ---- | ------- |
+|------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
 
 ## Providers
 
 | Name | Version |
-| ---- | ------- |
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 6.64.0 |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.33 |
 | <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
 
 ## Modules
@@ -202,7 +202,7 @@ No modules.
 ## Resources
 
 | Name | Type |
-| ---- | ---- |
+|------|------|
 | [aws_cloudwatch_log_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
 | [aws_ecs_cluster.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource |
 | [aws_ecs_service.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
@@ -232,7 +232,7 @@ No modules.
 ## Inputs
 
 | Name | Description | Type | Default | Required |
-| ---- | ----------- | ---- | ------- | :------: |
+|------|-------------|------|---------|:--------:|
 | <a name="input_config_store"></a> [config\_store](#input\_config\_store) | Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.<br/><br/>Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`. | <pre>object({<br/>    path_prefix = optional(string, null)<br/>    tier        = optional(string, "Standard")<br/>    tags        = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_container"></a> [container](#input\_container) | Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health\_path is fixed at /healthz, the ECS liveness endpoint. | <pre>object({<br/>    image                             = optional(string, null)<br/>    user                              = optional(string, "10001:10001")<br/>    health_port                       = optional(number, 8080)<br/>    health_path                       = optional(string, "/healthz")<br/>    health_check_command              = optional(list(string), null)<br/>    health_check_interval             = optional(number, 30)<br/>    health_check_timeout              = optional(number, 5)<br/>    health_check_retries              = optional(number, 3)<br/>    health_check_start_period         = optional(number, 30)<br/>    health_stale_after_seconds        = optional(number, 180)<br/>    shutdown_timeout_seconds          = optional(number, 110)<br/>    session_close_timeout_seconds     = optional(number, 10)<br/>    reconnect_initial_backoff_seconds = optional(number, 1)<br/>    reconnect_max_backoff_seconds     = optional(number, 30)<br/>    stop_timeout_seconds              = optional(number, 120)<br/>  })</pre> | `{}` | no |
 | <a name="input_ecs"></a> [ecs](#input\_ecs) | ECS substrate configuration. A managed cluster is created by default. For an external cluster, set `cluster.mode = "external"` and pass its ARN; the mode must be plan-known while the ARN may be computed. | <pre>object({<br/>    cluster = optional(object({<br/>      mode               = optional(string, "managed")<br/>      arn                = optional(string, null)<br/>      name               = optional(string, null)<br/>      container_insights = optional(bool, true)<br/>    }), {})<br/>    task = optional(object({<br/>      cpu              = optional(number, 512)<br/>      memory           = optional(number, 1024)<br/>      cpu_architecture = optional(string, "X86_64")<br/>      ephemeral_storage = optional(object({<br/>        size_in_gib = number<br/>      }), null)<br/>    }), {})<br/>    service = optional(object({<br/>      platform_version = optional(string, "LATEST")<br/>    }), {})<br/>    iam = optional(object({<br/>      path                 = optional(string, "/")<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
@@ -247,7 +247,7 @@ No modules.
 ## Outputs
 
 | Name | Description |
-| ---- | ----------- |
+|------|-------------|
 | <a name="output_cluster"></a> [cluster](#output\_cluster) | Managed or external ECS cluster selected for all controller groups. |
 | <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | Controller-group resources keyed by stable resolved group name. |
 | <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | Non-secret SSM controller configuration parameters keyed by `<controller-group>/<runner-config>`. Values are intentionally not exposed. |

From 1e1bf287a0c9984048b70eb5f012de9017d7c272 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 17:33:54 +0200
Subject: [PATCH 14/52] fix(scale-set): identify controller logs

---
 modules/orchestration-providers/scale-set/task.tf | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/modules/orchestration-providers/scale-set/task.tf b/modules/orchestration-providers/scale-set/task.tf
index c47902bfe0..b1e6f44006 100644
--- a/modules/orchestration-providers/scale-set/task.tf
+++ b/modules/orchestration-providers/scale-set/task.tf
@@ -44,6 +44,14 @@ resource "aws_ecs_task_definition" "controller" {
             name  = "LOG_LEVEL"
             value = var.log_level
           },
+          {
+            name  = "POWERTOOLS_SERVICE_NAME"
+            value = "scale-set-controller"
+          },
+          {
+            name  = "POWERTOOLS_LOG_LEVEL"
+            value = upper(var.log_level)
+          },
           {
             name  = "SCALE_SET_CONTROLLER_MANIFEST"
             value = local.group_controller_manifests[each.key]

From 2359f24ec49fc0e5763499a4d9617c922e86caba Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 19:56:47 +0200
Subject: [PATCH 15/52] fix(scale-set): isolate provider permissions on compute
 roles

---
 .../orchestration-providers/scale-set/README.md  |  4 ++--
 modules/orchestration-providers/scale-set/iam.tf |  2 ++
 .../scale-set/tests/scale-set.tftest.hcl         | 11 +++++++++--
 .../scale-set/validations.tf                     | 16 +++++++++++++++-
 4 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index d7632548f7..9d1209fc3c 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -53,13 +53,13 @@ Group names and memberships become Terraform `for_each` identities and must be k
     scale_set = {
       configuration_json = local.provider_owned_runtime_configuration
       environment_variables = local.provider_owned_non_secret_environment
-      iam_statements     = local.provider_owned_task_role_statements
+      iam_statements     = local.provider_owned_compute_role_statements
     }
   }
 }
 ```
 
-The symbolic locals above represent outputs from the selected compute-provider Terraform adapter; callers should not recreate the provider payload by hand. The provider-specific adapter owns the runtime configuration schema and the complete IAM statement set. This orchestration module treats configuration JSON as an opaque, non-secret object and combines only the selected group's statements into that group's task role. Provider-owned process environment variables are also non-secret: duplicate names within a group must resolve to the same value, and reserved runtime names cannot be overridden. Runner-config-specific values stay in the SSM reconciler document, while credentials stay behind SSM references. Wildcard IAM actions are rejected. The rendered per-group policy is checked against AWS's 10,240-byte inline role-policy quota with an explicit split-the-group error; group splitting remains the escape hatch when the union is too large or too broad.
+The symbolic locals above represent outputs from the selected compute-provider Terraform adapter; callers should not recreate the provider payload by hand. The provider-specific adapter owns the runtime configuration schema and the complete IAM statement set. This orchestration module treats configuration JSON as an opaque, non-secret object and combines only the selected group's statements into the corresponding compute role. Provider-owned process environment variables are also non-secret: duplicate names within a group must resolve to the same value, and reserved runtime names cannot be overridden. Runner-config-specific values stay in the SSM reconciler document, while credentials stay behind SSM references. Wildcard IAM actions are rejected. The rendered controller and compute-role policies are each checked against AWS's 10,240-byte inline role-policy quota with an explicit split-the-group error; group splitting remains the escape hatch when the union is too large or too broad.
 
 ## Configuration delivery
 
diff --git a/modules/orchestration-providers/scale-set/iam.tf b/modules/orchestration-providers/scale-set/iam.tf
index e55ab0f6b9..6065fff396 100644
--- a/modules/orchestration-providers/scale-set/iam.tf
+++ b/modules/orchestration-providers/scale-set/iam.tf
@@ -155,6 +155,8 @@ resource "aws_iam_role_policy" "compute" {
   name   = "scale-set-compute"
   role   = aws_iam_role.compute[each.key].name
   policy = data.aws_iam_policy_document.compute[each.key].json
+
+  depends_on = [terraform_data.validate_compute_role_policy]
 }
 
 resource "aws_iam_role" "execution" {
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index 304e0fee50..d38ac6a04f 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -100,6 +100,10 @@ variables {
                 actions   = ["ec2:RunInstances"]
                 resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-small"]
               }
+              read_ami = {
+                actions   = ["ssm:GetParameters"]
+                resources = ["arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/runners/config/ami_id"]
+              }
             }
           }
         }
@@ -381,9 +385,12 @@ run "groups_by_compute_provider_and_hardens_each_task" {
       contains(jsondecode(local.group_github_kms_policy_json["ec2"]).Statement[0].Resource, "arn:aws:kms:eu-west-1:123456789012:key/11111111-1111-1111-1111-111111111111") &&
       length(jsondecode(local.group_github_kms_policy_json["microvm"]).Statement) == 0 &&
       contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/scale-set-controller/ec2/*")
-      && contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.actions]), "sts:AssumeRole")
+      && contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.actions]), "sts:AssumeRole") &&
+      !contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/runners/config/ami_id") &&
+      contains(flatten([for statement in data.aws_iam_policy_document.compute["ec2/linux-small"].statement : statement.actions]), "ssm:GetParameters") &&
+      contains(flatten([for statement in data.aws_iam_policy_document.compute["ec2/linux-small"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/runners/config/ami_id")
     )
-    error_message = "Task IAM must be scoped to its group config prefix, credential parameters, KMS keys, and compute resources."
+    error_message = "Controller IAM must contain only controller permissions, while provider permissions such as AMI SSM reads must be attached to the compute role."
   }
 }
 
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index d395e195da..2a9b9ade84 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -408,7 +408,21 @@ resource "terraform_data" "validate_group_task_policy" {
         floor(length(base64encode(data.aws_iam_policy_document.task[each.key].json)) * 3 / 4) -
         (endswith(base64encode(data.aws_iam_policy_document.task[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task[each.key].json), "=") ? 1 : 0)
       ) <= 10240
-      error_message = "Controller group ${each.key} produces a task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
+      error_message = "Controller group ${each.key} produces a task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce controller permissions."
+    }
+  }
+}
+
+resource "terraform_data" "validate_compute_role_policy" {
+  for_each = local.compute_role_configs
+
+  lifecycle {
+    precondition {
+      condition = (
+        floor(length(base64encode(data.aws_iam_policy_document.compute[each.key].json)) * 3 / 4) -
+        (endswith(base64encode(data.aws_iam_policy_document.compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.compute[each.key].json), "=") ? 1 : 0)
+      ) <= 10240
+      error_message = "Compute role ${each.key} produces an inline policy exceeding AWS's 10240-byte role-policy quota. Split the group or reduce provider IAM statements."
     }
   }
 }

From 4a551e789dc9dfa961bfdac8e2fe2b7056a80055 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 17:58:16 +0000
Subject: [PATCH 16/52] docs: auto update terraform docs

---
 modules/orchestration-providers/scale-set/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index 9d1209fc3c..2b91eb6629 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -215,6 +215,7 @@ No modules.
 | [aws_iam_role_policy.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_security_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
 | [aws_ssm_parameter.reconciler_config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [terraform_data.validate_compute_role_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_config_store](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_contract](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_group_task_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |

From 4dc9852fbd38722db5fba1e691ca063e8ed67644 Mon Sep 17 00:00:00 2001
From: Ederson Brilhante <contato@edersonbrilhante.com.br>
Date: Wed, 16 Sep 2026 15:28:19 +0200
Subject: [PATCH 17/52] Update
 modules/orchestration-providers/scale-set/locals.tf

Co-authored-by: Guilherme Caulada <guilherme.caulada@gmail.com>
---
 modules/orchestration-providers/scale-set/locals.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
index 9df92c844e..523b6b5a26 100644
--- a/modules/orchestration-providers/scale-set/locals.tf
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -35,7 +35,7 @@ locals {
     for group_name in keys(local.controller_groups) : group_name => format(
       "%s-ss-%s-%s",
       var.prefix,
-      substr(replace(lower(group_name), "/[^a-z0-9_-]/", "-"), 0, 20),
+      substr(replace(lower(group_name), "/[^a-z0-9_-]/", "-"), 0, 14),
       substr(sha256(group_name), 0, 8),
     )
   }

From dbe0ff02caf1ce660703b64f569650abf7a3a9b0 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Wed, 16 Sep 2026 15:40:16 +0200
Subject: [PATCH 18/52] fix(scale-set): remove enterprise registration support

---
 .../scale-set/README.md                       |  8 ++--
 .../tests/fixtures/computed-inputs/main.tf    |  4 +-
 .../scale-set/tests/scale-set.tftest.hcl      | 45 ++++++++++++++-----
 .../scale-set/validations.tf                  |  9 ++--
 .../scale-set/variables.tf                    |  2 +-
 5 files changed, 44 insertions(+), 24 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index 2b91eb6629..495a8cc314 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -14,7 +14,7 @@ Each reconciler still owns exactly one GitHub scale-set identity and one message
 
 This foundation adopts scale sets that were created elsewhere. It passes the configured name to the controller, which captures the scale-set and runner-group identifiers dynamically from GitHub; it does not create or delete the GitHub scale-set resource. The complete compute-provider contract must likewise come from its Terraform adapter; until that adapter and the public runner-config selection are wired, this internal module is not an end-to-end deployment interface.
 
-The normalized `(githubConfigUrl, scale_set.name)` ownership tuple must be globally unique across all groups. `runner_registration_level` selects enterprise, organization, or repository scope; organization and repository scopes append `runner_owner` to the GitHub server URL. A null enterprise-server URL resolves to GitHub.com. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Scale-set names may repeat under different GitHub scopes.
+The normalized `(githubConfigUrl, scale_set.name)` ownership tuple must be globally unique across all groups. `runner_registration_level` selects organization or repository scope; `runner_owner` supplies the corresponding path appended to the GitHub server URL. A null enterprise-server URL resolves to GitHub.com. Enterprise-level registration is not supported by this module. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Scale-set names may repeat under different GitHub scopes.
 
 ## Grouping
 
@@ -76,7 +76,7 @@ For the current ECS deployment, each task receives one bounded `SCALE_SET_CONTRO
       "runnerConfigName": "linux-small",
       "runnerGroupName": "Default",
       "scaleSetName": "linux-small",
-      "githubConfigUrl": "https://github.com",
+      "githubConfigUrl": "https://github.com/example",
       "githubApp": {
         "appIdParameterName": "/github/app-id",
         "privateKeyParameterName": "/github/private-key",
@@ -113,7 +113,7 @@ The individual reconciler object has this shape:
   "schemaVersion": 1,
   "runnerConfigName": "linux-small",
   "runnerGroupName": "Default",
-  "githubConfigUrl": "https://github.com",
+  "githubConfigUrl": "https://github.com/example",
   "scaleSetName": "linux-small",
   "minRunners": 0,
   "maxRunners": 20,
@@ -242,7 +242,7 @@ No modules.
 | <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
-| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        labels               = optional(list(string), [])<br/>        group_name           = optional(string, "Default")<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>    compute_provider = object({<br/>      type = string<br/>      capabilities = object({<br/>        scale_set = object({<br/>          role_arn              = optional(string, null)<br/>          configuration_json    = optional(string, "{}")<br/>          environment_variables = optional(map(string), {})<br/>          iam_statements = optional(map(object({<br/>            actions   = set(string)<br/>            resources = set(string)<br/>            conditions = optional(list(object({<br/>              test     = string<br/>              variable = string<br/>              values   = set(string)<br/>            })), [])<br/>          })), {})<br/>        })<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects organization or repository registration, and `runner_owner` supplies the corresponding organization or owner/repository path. Enterprise-level registration is not supported by this module. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        labels               = optional(list(string), [])<br/>        group_name           = optional(string, "Default")<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>    compute_provider = object({<br/>      type = string<br/>      capabilities = object({<br/>        scale_set = object({<br/>          role_arn              = optional(string, null)<br/>          configuration_json    = optional(string, "{}")<br/>          environment_variables = optional(map(string), {})<br/>          iam_statements = optional(map(object({<br/>            actions   = set(string)<br/>            resources = set(string)<br/>            conditions = optional(list(object({<br/>              test     = string<br/>              variable = string<br/>              values   = set(string)<br/>            })), [])<br/>          })), {})<br/>        })<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
 
 ## Outputs
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
index b0bab1554c..db8ae2b225 100644
--- a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
@@ -35,8 +35,8 @@ module "subject" {
             arn  = terraform_data.computed.output.installation_id_arn
           }
         }
-        runner_owner              = null
-        runner_registration_level = "enterprise"
+        runner_owner              = "example"
+        runner_registration_level = "organization"
         user_agent                = "scale-set-test"
       }
       scale_set = {
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index d38ac6a04f..e6f278516e 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -60,8 +60,8 @@ variables {
             arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/installation-id"
           }
         }
-        runner_owner              = null
-        runner_registration_level = "enterprise"
+        runner_owner              = "example"
+        runner_registration_level = "organization"
         user_agent                = "scale-set-test"
       }
       scale_set = {
@@ -128,8 +128,8 @@ variables {
             arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/installation-id"
           }
         }
-        runner_owner              = null
-        runner_registration_level = "enterprise"
+        runner_owner              = "example"
+        runner_registration_level = "organization"
         user_agent                = "scale-set-test"
       }
       scale_set = {
@@ -189,8 +189,8 @@ variables {
             arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/installation-id"
           }
         }
-        runner_owner              = null
-        runner_registration_level = "enterprise"
+        runner_owner              = "example/repository"
+        runner_registration_level = "repository"
         user_agent                = "scale-set-test"
       }
       scale_set = {
@@ -364,14 +364,14 @@ run "groups_by_compute_provider_and_hardens_each_task" {
     condition = (
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).schemaVersion == 1 &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).runnerConfigName == "linux-small" &&
-      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com/example" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).scaleSetName == "linux-small" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).bootTimeoutMinutes == 10 &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).sslVerify == false &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).forceGhes == false &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).userAgent == "scale-set-test" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubApp.privateKeyParameterName == "/github/linux-small/private-key" &&
-      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).githubConfigUrl == "https://github.example.test" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).githubConfigUrl == "https://github.example.test/example" &&
       jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).forceGhes == true &&
       !contains(keys(jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value))), "runnerConfig")
     )
@@ -642,7 +642,9 @@ run "rejects_duplicate_scale_set_ownership_across_groups" {
     runner_configs = merge(var.runner_configs, {
       microvm = merge(var.runner_configs.microvm, {
         github = merge(var.runner_configs.microvm.github, {
-          enterprise_server = { url = "https://GITHUB.COM:443/" }
+          enterprise_server         = { url = "https://GITHUB.COM:443/" }
+          runner_registration_level = "organization"
+          runner_owner              = "example"
         })
         scale_set = merge(var.runner_configs.microvm.scale_set, {
           name = "linux-small"
@@ -834,8 +836,8 @@ run "bounds_default_session_owner_for_maximum_names" {
       (join("", [for index in range(128) : "a"])) = {
         github = {
           enterprise_server         = {}
-          runner_owner              = null
-          runner_registration_level = "enterprise"
+          runner_owner              = "example"
+          runner_registration_level = "organization"
           user_agent                = "scale-set-test"
           app = {
             app_id = {
@@ -998,6 +1000,27 @@ run "rejects_invalid_boot_timeout" {
   expect_failures = [terraform_data.validate_contract]
 }
 
+run "rejects_enterprise_runner_registration_level" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        github = merge(var.runner_configs.linux-small.github, {
+          runner_registration_level = "enterprise"
+          runner_owner              = null
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
 run "rejects_invalid_runner_registration_level" {
   command = plan
 
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index 2a9b9ade84..9553581597 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -40,20 +40,17 @@ resource "terraform_data" "validate_contract" {
     precondition {
       condition = alltrue([
         for runner_config in values(var.runner_configs) : contains([
-          "enterprise",
           "organization",
           "repository",
         ], runner_config.github.runner_registration_level)
       ])
-      error_message = "runner_registration_level must be enterprise, organization, or repository."
+      error_message = "runner_registration_level must be organization or repository."
     }
 
     precondition {
       condition = alltrue([
         for runner_config in values(var.runner_configs) : (
-          runner_config.github.runner_registration_level == "enterprise"
-          ? runner_config.github.runner_owner == null
-          : runner_config.github.runner_owner != null && can(regex(
+          runner_config.github.runner_owner != null && can(regex(
             runner_config.github.runner_registration_level == "organization"
             ? "^[A-Za-z0-9_.-]+$"
             : "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
@@ -61,7 +58,7 @@ resource "terraform_data" "validate_contract" {
           ))
         )
       ])
-      error_message = "runner_owner must be null for enterprise registration and must be an organization or owner/repository path for the other registration levels."
+      error_message = "runner_owner must be an organization or owner/repository path for organization and repository registration levels."
     }
 
     precondition {
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
index c7f8126c49..236dfc8213 100644
--- a/modules/orchestration-providers/scale-set/variables.tf
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -16,7 +16,7 @@ variable "runner_configs" {
   description = <<-EOT
     Normalized scale-set runner configurations keyed by stable runner-config name.
 
-    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects the GitHub scale-set scope, and `runner_owner` supplies the organization or repository path for organization- and repository-level registration. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply.
+    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects organization or repository registration, and `runner_owner` supplies the corresponding organization or owner/repository path. Enterprise-level registration is not supported by this module. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply.
   EOT
   type = map(object({
     github = object({

From d426efec00a399b22bc31b188390f0fbc3dce6bb Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Wed, 16 Sep 2026 15:55:18 +0200
Subject: [PATCH 19/52] test(scale-set): use custom GitHub host in ownership
 test

---
 .../scale-set/tests/scale-set.tftest.hcl                   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index e6f278516e..870a73b9b2 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -640,9 +640,14 @@ run "rejects_duplicate_scale_set_ownership_across_groups" {
 
   variables {
     runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        github = merge(var.runner_configs.linux-small.github, {
+          enterprise_server = { url = "https://mygithub.com" }
+        })
+      })
       microvm = merge(var.runner_configs.microvm, {
         github = merge(var.runner_configs.microvm.github, {
-          enterprise_server         = { url = "https://GITHUB.COM:443/" }
+          enterprise_server         = { url = "https://mygithub.com:443/" }
           runner_registration_level = "organization"
           runner_owner              = "example"
         })

From 88fec7c89ed610843b0cc67600b5639024aa8621 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 16:08:10 +0200
Subject: [PATCH 20/52] feat(scale-set): wire orchestration through runner
 config

---
 modules/compute-providers/aws/ec2/outputs.tf  |   2 +
 .../compute-providers/aws/ec2/scale-set.tf    | 254 +++++++++++++
 .../config.experimental.effective.tf          |   7 +-
 .../config.experimental.resolved.tf           |   1 +
 .../config.experimental.translation.tf        |   6 +-
 modules/multi-runner/main.tf                  |   5 +-
 .../orchestration-provider.scale-set.tf       |  62 ++++
 modules/multi-runner/outputs.tf               |  11 +-
 modules/multi-runner/queues.tf                |  15 +-
 modules/multi-runner/runners.experimental.tf  |   1 +
 .../tests/config-resolution.tftest.hcl        | 333 +++++++++++++++++-
 modules/multi-runner/validations.tf           |  34 +-
 .../variables.experimental.github.tf          |  15 +-
 ...les.experimental.orchestration-provider.tf |  72 ++++
 modules/multi-runner/variables.tf             |  13 +
 .../runner-config/orchestration-provider.tf   |   7 +-
 modules/runner-config/outputs.tf              |  25 +-
 modules/runner-config/validations.tf          |   7 +-
 .../variables.orchestration-provider.tf       |  11 +-
 modules/ssm/outputs.tf                        |   4 +
 modules/ssm/ssm.tf                            |   9 +
 modules/ssm/variables.tf                      |   5 +
 22 files changed, 874 insertions(+), 25 deletions(-)
 create mode 100644 modules/compute-providers/aws/ec2/scale-set.tf
 create mode 100644 modules/multi-runner/orchestration-provider.scale-set.tf

diff --git a/modules/compute-providers/aws/ec2/outputs.tf b/modules/compute-providers/aws/ec2/outputs.tf
index 422383df0f..83b2647fca 100644
--- a/modules/compute-providers/aws/ec2/outputs.tf
+++ b/modules/compute-providers/aws/ec2/outputs.tf
@@ -16,6 +16,8 @@ output "resources" {
 output "provider" {
   description = "Nested EC2 compute-provider contract consumed by runner-config."
   value = {
+    type                  = "ec2"
+    capabilities          = { scale_set = local.scale_set_capability }
     environment_variables = local.provider_environment_variables
     policies              = local.provider_policies
     resources             = local.provider_resources
diff --git a/modules/compute-providers/aws/ec2/scale-set.tf b/modules/compute-providers/aws/ec2/scale-set.tf
new file mode 100644
index 0000000000..439652db58
--- /dev/null
+++ b/modules/compute-providers/aws/ec2/scale-set.tf
@@ -0,0 +1,254 @@
+# Provider-owned runtime and IAM fragments for the additive scale-set
+# orchestration capability. GitHub credentials, GitHub scope, desired capacity,
+# and boot timeout remain orchestration-owned and are not serialized here.
+locals {
+  scale_set_ec2_instance_criteria = merge(
+    {
+      instanceTypes              = var.config.instance_types
+      targetCapacityType         = var.config.instance_target_capacity_type
+      instanceAllocationStrategy = var.config.instance_allocation_strategy
+    },
+    var.config.instance_type_priorities == null ? {} : {
+      instanceTypePriorities = var.config.instance_type_priorities
+    },
+    var.config.instance_max_spot_price == null ? {} : {
+      maxSpotPrice = var.config.instance_max_spot_price
+    },
+  )
+
+  scale_set_runtime_configuration = merge(
+    {
+      region                  = var.aws_region
+      environment             = var.prefix
+      runnerNamePrefix        = var.runner.name_prefix
+      jitConfigParameterPath  = "${var.ssm.paths.root}/${var.ssm.paths.tokens}"
+      subnets                 = var.config.subnet_ids
+      launchTemplateName      = aws_launch_template.runner.name
+      ec2instanceCriteria     = local.scale_set_ec2_instance_criteria
+      onDemandFailoverOnError = var.config.on_demand_failover_for_errors
+      useDedicatedHost        = var.config.use_dedicated_host
+      ssmParameterTags = [
+        for key in sort(keys(local.ssm_parameter_tags)) : {
+          Key   = key
+          Value = local.ssm_parameter_tags[key]
+        }
+      ]
+    },
+    local.ami_id_ssm_external ? {
+      amiIdSsmParameterName = local.ami_id_ssm_parameter_name
+    } : {},
+  )
+
+  scale_set_owned_instance_conditions = [
+    {
+      test     = "StringEquals"
+      variable = "ec2:ResourceTag/ghr:Application"
+      values   = toset(["github-action-runner"])
+    },
+    {
+      test     = "StringEquals"
+      variable = "ec2:ResourceTag/ghr:created_by"
+      values   = toset(["scale-set-service"])
+    },
+    {
+      test     = "StringEquals"
+      variable = "ec2:ResourceTag/ghr:environment"
+      values   = toset([var.prefix])
+    },
+  ]
+
+  scale_set_owned_request_conditions = [
+    {
+      test     = "StringEquals"
+      variable = "aws:RequestTag/ghr:Application"
+      values   = toset(["github-action-runner"])
+    },
+    {
+      test     = "StringEquals"
+      variable = "aws:RequestTag/ghr:created_by"
+      values   = toset(["scale-set-service"])
+    },
+    {
+      test     = "StringEquals"
+      variable = "aws:RequestTag/ghr:environment"
+      values   = toset([var.prefix])
+    },
+  ]
+
+  scale_set_launch_dependency_resources = toset(concat(
+    [
+      "arn:${var.aws_partition}:ec2:${var.aws_region}::image/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:*:snapshot/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:dedicated-host/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:network-interface/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:placement-group/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:security-group/*",
+      aws_launch_template.runner.arn,
+    ],
+    [
+      for subnet_id in var.config.subnet_ids :
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:subnet/${subnet_id}"
+    ],
+    var.config.key_name == null ? [] : [
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:key-pair/${var.config.key_name}",
+    ],
+  ))
+
+  scale_set_create_fleet_dependency_resources = toset(concat(
+    [
+      "arn:${var.aws_partition}:ec2:${var.aws_region}::image/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:placement-group/*",
+      aws_launch_template.runner.arn,
+    ],
+    [
+      for subnet_id in var.config.subnet_ids :
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:subnet/${subnet_id}"
+    ],
+  ))
+
+  scale_set_iam_statements = merge(
+    {
+      describe_ec2 = {
+        actions = toset([
+          "ec2:DescribeInstances",
+          "ec2:DescribeLaunchTemplateVersions",
+          "ec2:DescribeTags",
+        ])
+        # These EC2 Describe APIs do not support resource-level permissions.
+        resources  = toset(["*"])
+        conditions = []
+      }
+      create_fleet_dependencies = {
+        actions    = toset(["ec2:CreateFleet"])
+        resources  = local.scale_set_create_fleet_dependency_resources
+        conditions = []
+      }
+      create_owned_fleet_capacity = {
+        actions = toset(["ec2:CreateFleet"])
+        resources = toset([
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:fleet/*",
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:instance/*",
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:volume/*",
+        ])
+        conditions = local.scale_set_owned_request_conditions
+      }
+      run_instances_dependencies = {
+        actions    = toset(["ec2:RunInstances"])
+        resources  = local.scale_set_launch_dependency_resources
+        conditions = []
+      }
+      run_owned_instances = {
+        actions = toset(["ec2:RunInstances"])
+        resources = toset([
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:instance/*",
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:volume/*",
+        ])
+        conditions = local.scale_set_owned_request_conditions
+      }
+      tag_runners_on_create = {
+        actions   = toset(["ec2:CreateTags"])
+        resources = toset(["arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:*/*"])
+        conditions = [
+          {
+            test     = "StringEquals"
+            variable = "ec2:CreateAction"
+            values   = toset(["CreateFleet", "RunInstances"])
+          },
+        ]
+      }
+      update_owned_runner_tags = {
+        actions   = toset(["ec2:CreateTags"])
+        resources = toset(["arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:instance/*"])
+        conditions = concat(local.scale_set_owned_instance_conditions, [
+          {
+            test     = "ForAllValues:StringEquals"
+            variable = "aws:TagKeys"
+            values = toset([
+              "ghr:github_runner_id",
+              "ghr:runner_name",
+              "ghr:scale_set_state",
+            ])
+          },
+        ])
+      }
+      terminate_owned_runners = {
+        actions    = toset(["ec2:TerminateInstances"])
+        resources  = toset(["arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:instance/*"])
+        conditions = local.scale_set_owned_instance_conditions
+      }
+      pass_runner_role = {
+        actions   = toset(["iam:PassRole"])
+        resources = toset([var.runner.iam.role.arn])
+        conditions = [
+          {
+            test     = "StringEquals"
+            variable = "iam:PassedToService"
+            values   = toset(["ec2.amazonaws.com"])
+          },
+        ]
+      }
+      publish_runner_jit_configuration = {
+        actions = toset([
+          "ssm:AddTagsToResource",
+          "ssm:DeleteParameter",
+          "ssm:PutParameter",
+        ])
+        resources = toset([
+          "${local.ssm_parameter_arn_prefix}${var.ssm.paths.root}/${var.ssm.paths.tokens}/*",
+        ])
+        conditions = []
+      }
+    },
+    local.ami_id_ssm_external ? {
+      read_external_ami_parameter = {
+        actions    = toset(["ssm:GetParameter"])
+        resources  = toset([local.ami_id_ssm_parameter_arn])
+        conditions = []
+      }
+    } : {},
+    local.ami_kms_key_enabled ? {
+      use_ami_kms_key = {
+        actions = toset([
+          "kms:Decrypt",
+          "kms:DescribeKey",
+          "kms:ReEncryptFrom",
+          "kms:ReEncryptTo",
+        ])
+        resources  = toset([local.ami_kms_key_arn])
+        conditions = []
+      }
+      create_ami_kms_grant = {
+        actions   = toset(["kms:CreateGrant"])
+        resources = toset([local.ami_kms_key_arn])
+        conditions = [
+          {
+            test     = "Bool"
+            variable = "kms:GrantIsForAWSResource"
+            values   = toset(["true"])
+          },
+        ]
+      }
+    } : {},
+    var.config.create_service_linked_role_spot ? {
+      create_spot_service_linked_role = {
+        actions = toset(["iam:CreateServiceLinkedRole"])
+        resources = toset([
+          "arn:${var.aws_partition}:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot",
+        ])
+        conditions = [
+          {
+            test     = "StringEquals"
+            variable = "iam:AWSServiceName"
+            values   = toset(["spot.amazonaws.com"])
+          },
+        ]
+      }
+    } : {},
+  )
+
+  scale_set_capability = {
+    configuration_json    = jsonencode(local.scale_set_runtime_configuration)
+    environment_variables = {}
+    iam_statements        = local.scale_set_iam_statements
+  }
+}
diff --git a/modules/multi-runner/config.experimental.effective.tf b/modules/multi-runner/config.experimental.effective.tf
index 1a53a16520..4e54b5070b 100644
--- a/modules/multi-runner/config.experimental.effective.tf
+++ b/modules/multi-runner/config.experimental.effective.tf
@@ -16,8 +16,10 @@ locals {
         })
 
         github = {
-          enterprise_server = local.normalized_config.github.enterprise_server
-          user_agent        = local.normalized_config.github.user_agent
+          enterprise_server         = local.normalized_config.github.enterprise_server
+          runner_owner              = local.normalized_config.github.runner_owner
+          runner_registration_level = local.normalized_config.github.runner_registration_level
+          user_agent                = local.normalized_config.github.user_agent
         }
 
         lambda = merge(v.lambda, {
@@ -35,6 +37,7 @@ locals {
               artifact = local.normalized_config.orchestration_provider.webhook.lambda.artifact
             })
           })
+          scale_set = v.orchestration_provider.scale_set
         }
 
         ssm = merge(v.ssm, {
diff --git a/modules/multi-runner/config.experimental.resolved.tf b/modules/multi-runner/config.experimental.resolved.tf
index 2b44bfe797..5753b19c8b 100644
--- a/modules/multi-runner/config.experimental.resolved.tf
+++ b/modules/multi-runner/config.experimental.resolved.tf
@@ -295,6 +295,7 @@ locals {
               tags = merge(local.normalized_config.orchestration_provider.webhook.queue.tags, v.orchestration_provider.webhook.queue.tags)
             })
           })
+          scale_set = v.orchestration_provider.scale_set
         }
 
         ssm = merge(v.ssm, {
diff --git a/modules/multi-runner/config.experimental.translation.tf b/modules/multi-runner/config.experimental.translation.tf
index 301d37ec4d..4d7b7d8257 100644
--- a/modules/multi-runner/config.experimental.translation.tf
+++ b/modules/multi-runner/config.experimental.translation.tf
@@ -38,7 +38,9 @@ locals {
       url        = var.ghes_url
       ssl_verify = var.ghes_ssl_verify
     }
-    user_agent = var.user_agent
+    runner_owner              = null
+    runner_registration_level = "enterprise"
+    user_agent                = var.user_agent
   }
 
   stable_to_v2_lambda = {
@@ -141,6 +143,7 @@ locals {
         encryption = var.queue_encryption
       }
     }
+    scale_set = null
   }
 
   stable_to_v2_ssm = {
@@ -427,6 +430,7 @@ locals {
             }
           }
         }
+        scale_set = null
       }
 
       ssm = {
diff --git a/modules/multi-runner/main.tf b/modules/multi-runner/main.tf
index 23d51b7f65..99a41d5207 100644
--- a/modules/multi-runner/main.tf
+++ b/modules/multi-runner/main.tf
@@ -3,8 +3,9 @@ locals {
     "ghr:environment" = var.prefix
   })
 
-  primary_app_id         = coalesce(local.effective_config.github.app.id_ssm, module.ssm.parameters.github_app_id)
-  primary_app_key_base64 = coalesce(local.effective_config.github.app.key_base64_ssm, module.ssm.parameters.github_app_key_base64)
+  primary_app_id              = coalesce(local.effective_config.github.app.id_ssm, module.ssm.parameters.github_app_id)
+  primary_app_key_base64      = coalesce(local.effective_config.github.app.key_base64_ssm, module.ssm.parameters.github_app_key_base64)
+  primary_app_installation_id = local.effective_config.github.app.installation_id_ssm != null ? local.effective_config.github.app.installation_id_ssm : module.ssm.parameters.github_app_installation_id
 
   github_app_parameters = {
     id             = local.primary_app_id
diff --git a/modules/multi-runner/orchestration-provider.scale-set.tf b/modules/multi-runner/orchestration-provider.scale-set.tf
new file mode 100644
index 0000000000..137c7c15b6
--- /dev/null
+++ b/modules/multi-runner/orchestration-provider.scale-set.tf
@@ -0,0 +1,62 @@
+locals {
+  scale_set_runner_configs = {
+    for runner_name, runner_config in local.effective_config.multi_runner_config : runner_name => {
+      github = {
+        enterprise_server = local.effective_config.github.enterprise_server
+        app = {
+          app_id = {
+            name        = local.primary_app_id.name
+            arn         = local.primary_app_id.arn
+            kms_key_arn = local.effective_config.ssm.kms_key_id
+          }
+          private_key = {
+            name        = local.primary_app_key_base64.name
+            arn         = local.primary_app_key_base64.arn
+            kms_key_arn = local.effective_config.ssm.kms_key_id
+          }
+          installation_id = {
+            name        = local.primary_app_installation_id.name
+            arn         = local.primary_app_installation_id.arn
+            kms_key_arn = local.effective_config.ssm.kms_key_id
+          }
+        }
+        runner_owner              = local.effective_config.github.runner_owner
+        runner_registration_level = local.effective_config.github.runner_registration_level
+        user_agent                = local.effective_config.github.user_agent
+      }
+      scale_set = {
+        name = runner_config.orchestration_provider.scale_set.name
+        runner = {
+          labels               = runner_config.runner.labels
+          group_name           = runner_config.runner.group_name
+          min_runners          = runner_config.orchestration_provider.scale_set.runner.min_runners
+          max_runners          = runner_config.orchestration_provider.scale_set.runner.max_runners
+          boot_time_in_minutes = runner_config.orchestration_provider.scale_set.runner.boot_time_in_minutes
+        }
+      }
+      compute_provider = module.runner_configs[runner_name].compute_provider_contract
+    }
+    if runner_config.orchestration_provider.scale_set != null
+  }
+}
+
+module "orchestration_scale_set" {
+  source = "../orchestration-providers/scale-set"
+  count  = length(local.scale_set_runner_configs) > 0 ? 1 : 0
+
+  prefix         = var.prefix
+  log_level      = var.global_config_observability.logs.level
+  runner_configs = local.scale_set_runner_configs
+
+  grouping     = try(local.effective_config.orchestration_provider.scale_set.grouping, {})
+  container    = try(local.effective_config.orchestration_provider.scale_set.container, {})
+  config_store = try(local.effective_config.orchestration_provider.scale_set.config_store, {})
+  ecs          = try(local.effective_config.orchestration_provider.scale_set.ecs, {})
+  network      = try(local.effective_config.orchestration_provider.scale_set.network, {})
+  logging      = try(local.effective_config.orchestration_provider.scale_set.logging, {})
+  tags = merge(
+    local.effective_config.tags,
+    try(local.effective_config.orchestration_provider.scale_set.tags, {}),
+    { "ghr:environment" = var.prefix },
+  )
+}
diff --git a/modules/multi-runner/outputs.tf b/modules/multi-runner/outputs.tf
index 6b7632ffc6..2ec43c8c56 100644
--- a/modules/multi-runner/outputs.tf
+++ b/modules/multi-runner/outputs.tf
@@ -20,7 +20,6 @@ output "runners_map" {
     }
   }
 }
-
 output "runners_map_v2" {
   value = { for runner_key, runner in module.runner_configs : runner_key => {
     runner                 = runner.runner
@@ -33,6 +32,16 @@ output "runners_map_v2" {
   }
 }
 
+output "scale_set" {
+  description = "Shared scale-set orchestration resources, or null when no runner configuration selects scale_set."
+  value = length(module.orchestration_scale_set) == 0 ? null : {
+    cluster                      = module.orchestration_scale_set[0].cluster
+    controller_groups            = module.orchestration_scale_set[0].controller_groups
+    reconciler_config_parameters = module.orchestration_scale_set[0].reconciler_config_parameters
+    resolved_container_image     = module.orchestration_scale_set[0].resolved_container_image
+  }
+}
+
 output "binaries_syncer_map" {
   value = { for runner_binary_key, runner_binary in module.runner_binaries : runner_binary_key => {
     lambda           = runner_binary.lambda
diff --git a/modules/multi-runner/queues.tf b/modules/multi-runner/queues.tf
index 0f57020571..c969bc6881 100644
--- a/modules/multi-runner/queues.tf
+++ b/modules/multi-runner/queues.tf
@@ -26,8 +26,15 @@ data "aws_iam_policy_document" "deny_insecure_transport" {
   }
 }
 
+locals {
+  webhook_queue_configs = {
+    for config, values in local.effective_config.multi_runner_config : config => values
+    if values.orchestration_provider.webhook != null
+  }
+}
+
 resource "aws_sqs_queue" "queued_builds" {
-  for_each                   = local.effective_config.multi_runner_config
+  for_each                   = local.webhook_queue_configs
   name                       = "${var.prefix}-${each.key}-queued-builds"
   delay_seconds              = each.value.orchestration_provider.webhook.queue.delay_webhook_event
   visibility_timeout_seconds = each.value.orchestration_provider.webhook.queue.visibility_timeout_seconds
@@ -50,14 +57,14 @@ resource "aws_sqs_queue" "queued_builds" {
 }
 
 resource "aws_sqs_queue_policy" "build_queue_policy" {
-  for_each  = local.effective_config.multi_runner_config
+  for_each  = local.webhook_queue_configs
   queue_url = aws_sqs_queue.queued_builds[each.key].id
   policy    = data.aws_iam_policy_document.deny_insecure_transport.json
 }
 
 resource "aws_sqs_queue" "queued_builds_dlq" {
   for_each = {
-    for config, values in local.effective_config.multi_runner_config : config => values
+    for config, values in local.webhook_queue_configs : config => values
     if values.orchestration_provider.webhook.queue.redrive_build_queue.enabled
   }
   name = "${var.prefix}-${each.key}-queued-builds_dead_letter"
@@ -74,7 +81,7 @@ resource "aws_sqs_queue" "queued_builds_dlq" {
 
 resource "aws_sqs_queue_policy" "build_queue_dlq_policy" {
   for_each = {
-    for config, values in local.effective_config.multi_runner_config : config => values
+    for config, values in local.webhook_queue_configs : config => values
     if values.orchestration_provider.webhook.queue.redrive_build_queue.enabled
   }
   queue_url = aws_sqs_queue.queued_builds_dlq[each.key].id
diff --git a/modules/multi-runner/runners.experimental.tf b/modules/multi-runner/runners.experimental.tf
index 3c20ca250b..78349b733b 100644
--- a/modules/multi-runner/runners.experimental.tf
+++ b/modules/multi-runner/runners.experimental.tf
@@ -44,6 +44,7 @@ module "runner_configs" {
       lambda    = each.value.orchestration_provider.webhook.lambda
       job_retry = each.value.orchestration_provider.webhook.job_retry
     }
+    scale_set = each.value.orchestration_provider.scale_set
   }
   ssm              = each.value.ssm
   observability    = each.value.observability
diff --git a/modules/multi-runner/tests/config-resolution.tftest.hcl b/modules/multi-runner/tests/config-resolution.tftest.hcl
index a3f795856c..ea2ab2c614 100644
--- a/modules/multi-runner/tests/config-resolution.tftest.hcl
+++ b/modules/multi-runner/tests/config-resolution.tftest.hcl
@@ -65,9 +65,10 @@ variables {
 
   global_config_github = {
     app = {
-      key_base64     = "experimental-app-key"
-      id             = "experimental-app-id"
-      webhook_secret = "experimental-webhook-secret"
+      key_base64      = "experimental-app-key"
+      id              = "experimental-app-id"
+      installation_id = "experimental-app-installation"
+      webhook_secret  = "experimental-webhook-secret"
     }
   }
 
@@ -392,6 +393,8 @@ run "v2_inputs_resolve_lane_over_global" {
       && keys(module.runner_configs) == ["lane"]
       && length(output.runners_map) == 0
       && keys(output.runners_map_v2) == ["lane"]
+      && keys(aws_sqs_queue.queued_builds) == ["lane"]
+      && keys(aws_sqs_queue_policy.build_queue_policy) == ["lane"]
     )
     error_message = "Experimental v2 configurations must route through module.runner_configs and skip the legacy runners module."
   }
@@ -447,3 +450,327 @@ run "v2_inputs_do_not_require_legacy_arguments" {
     error_message = "The v2 interface must work without the stable v1 GitHub App, VPC, subnet, or runner configuration inputs."
   }
 }
+
+run "scale_set_only_lane_omits_webhook_queues" {
+  command = plan
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_orchestration_provider = {
+      webhook = {
+        eventbridge = {
+          enabled = false
+        }
+        lambda = {
+          artifact = {
+            s3 = {
+              key = "scale-runners.zip"
+            }
+          }
+          webhook = {
+            artifact = {
+              s3 = {
+                key = "scale-webhook.zip"
+              }
+            }
+          }
+        }
+      }
+      scale_set = {
+        network = {
+          vpc_id     = "vpc-scale-set"
+          subnet_ids = ["subnet-scale-set"]
+        }
+      }
+    }
+
+    multi_runner_config = {
+      scale = {
+        runner = {
+          os           = "linux"
+          architecture = "x64"
+        }
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-only"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+              binaries_syncer = {
+                enabled = false
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      local.resolved_config.multi_runner_config["scale"].orchestration_provider.webhook == null
+      && local.resolved_config.multi_runner_config["scale"].orchestration_provider.scale_set.name == "scale-only"
+      && keys(aws_sqs_queue.queued_builds) == []
+      && keys(aws_sqs_queue_policy.build_queue_policy) == []
+      && keys(aws_sqs_queue.queued_builds_dlq) == []
+      && keys(aws_sqs_queue_policy.build_queue_dlq_policy) == []
+      && length(module.orchestration_scale_set) == 1
+    )
+    error_message = "A scale-set-only lane must not create or access webhook SQS resources."
+  }
+}
+
+run "mixed_webhook_and_scale_set_lanes_create_webhook_queues_only_for_webhook" {
+  command = plan
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_orchestration_provider = {
+      webhook = {
+        eventbridge = {
+          enabled = false
+        }
+        lambda = {
+          artifact = {
+            s3 = {
+              key = "mixed-runners.zip"
+            }
+          }
+          webhook = {
+            artifact = {
+              s3 = {
+                key = "mixed-webhook.zip"
+              }
+            }
+          }
+        }
+      }
+      scale_set = {
+        network = {
+          vpc_id     = "vpc-scale-set"
+          subnet_ids = ["subnet-scale-set"]
+        }
+      }
+    }
+
+    multi_runner_config = {
+      webhook = {
+        orchestration_provider = {
+          webhook = {
+            matcherConfig = {
+              labelMatchers = [["self-hosted", "linux", "x64"]]
+            }
+          }
+          scale_set = null
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-webhook"
+              subnet_ids     = ["subnet-webhook"]
+              binaries_syncer = {
+                enabled = false
+              }
+            }
+          }
+        }
+      }
+      scale = {
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-mixed"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+              binaries_syncer = {
+                enabled = false
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      keys(aws_sqs_queue.queued_builds) == ["webhook"]
+      && keys(aws_sqs_queue_policy.build_queue_policy) == ["webhook"]
+      && keys(module.runner_configs) == ["scale", "webhook"]
+    )
+    error_message = "Mixed provider lanes must create webhook queues only for the webhook lane while routing both lanes through v2 runner configs."
+  }
+}
+
+run "scale_set_lane_requires_owner_for_non_enterprise_registration" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_v2]
+  }
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_github = {
+      app = {
+        key_base64     = "experimental-app-key"
+        id             = "experimental-app-id"
+        webhook_secret = "experimental-webhook-secret"
+      }
+      runner_registration_level = "organization"
+    }
+
+    multi_runner_config = {
+      scale = {
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-missing-owner"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_v2]
+}
+
+run "scale_set_queue_for_each_keys_are_plan_known" {
+  command = plan
+
+  plan_options {
+    target = [aws_sqs_queue.queued_builds, aws_sqs_queue.queued_builds_dlq]
+  }
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_orchestration_provider = {
+      scale_set = {
+        network = {
+          vpc_id     = "vpc-scale-set"
+          subnet_ids = ["subnet-scale-set"]
+        }
+      }
+    }
+
+    multi_runner_config = {
+      scale = {
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-plan-known"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+              binaries_syncer = {
+                enabled = false
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      keys(aws_sqs_queue.queued_builds) == []
+      && keys(aws_sqs_queue.queued_builds_dlq) == []
+    )
+    error_message = "Webhook queue for_each keys must be known and empty for a scale-set-only plan."
+  }
+}
+
+run "v2_lane_requires_exactly_one_orchestration_provider" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_v2]
+  }
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    multi_runner_config = {
+      missing = {
+        orchestration_provider = {}
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-missing-provider"
+              subnet_ids     = ["subnet-missing-provider"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_v2]
+}
+
+run "v2_lane_rejects_multiple_orchestration_providers" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_v2]
+  }
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    multi_runner_config = {
+      multiple = {
+        orchestration_provider = {
+          webhook = {}
+          scale_set = {
+            name = "multiple-providers"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-multiple-providers"
+              subnet_ids     = ["subnet-multiple-providers"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_v2]
+}
diff --git a/modules/multi-runner/validations.tf b/modules/multi-runner/validations.tf
index f55e20395d..63c6959757 100644
--- a/modules/multi-runner/validations.tf
+++ b/modules/multi-runner/validations.tf
@@ -68,14 +68,44 @@ resource "terraform_data" "validate_v2" {
     precondition {
       condition = alltrue([
         for config in local.resolved_config.multi_runner_config : (
-          try(config.orchestration_provider.webhook != null, false) &&
           try(config.compute_provider.aws.ec2 != null, false) &&
           try(length(config.compute_provider.aws.ec2.instance_types) > 0, false) &&
           try(config.compute_provider.aws.ec2.vpc_id != null, false) &&
           try(length(config.compute_provider.aws.ec2.subnet_ids) > 0, false)
         )
       ])
-      error_message = "Each experimental v2 runner lane requires a webhook provider, EC2 instance_types, vpc_id, and at least one subnet."
+      error_message = "Each experimental v2 runner lane requires the supported aws.ec2 compute provider with instance_types, vpc_id, and at least one subnet."
     }
+
+    precondition {
+      condition = alltrue([
+        for config in local.resolved_config.multi_runner_config : (
+          try(config.orchestration_provider.webhook != null, false) !=
+          try(config.orchestration_provider.scale_set != null, false)
+        )
+      ])
+      error_message = "Each experimental v2 runner lane requires exactly one orchestration provider: webhook or scale_set."
+    }
+
+    precondition {
+      condition = alltrue([
+        for config in local.resolved_config.multi_runner_config : (
+          try(config.orchestration_provider.scale_set, null) == null ? true : (
+            contains([
+              "enterprise",
+              "organization",
+              "repository",
+            ], try(var.global_config_github.runner_registration_level, null)) &&
+            (
+              var.global_config_github.runner_registration_level == "enterprise"
+              ? try(var.global_config_github.runner_owner, null) == null
+              : try(var.global_config_github.runner_owner, null) != null
+            )
+          )
+        )
+      ])
+      error_message = "Scale-set lanes require global_config_github.runner_registration_level to be enterprise, organization, or repository; runner_owner must be null for enterprise or set for organization and repository registration."
+    }
+
   }
 }
diff --git a/modules/multi-runner/variables.experimental.github.tf b/modules/multi-runner/variables.experimental.github.tf
index 6a783f7d59..79e993cf18 100644
--- a/modules/multi-runner/variables.experimental.github.tf
+++ b/modules/multi-runner/variables.experimental.github.tf
@@ -13,6 +13,10 @@ variable "global_config_github" {
         id_ssm: "SSM parameter containing the GitHub App ID."
         id_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."
         id_ssm.name: "Name of the SSM parameter containing the GitHub App ID."
+        installation_id: "GitHub App installation ID for the primary scale-set installation."
+        installation_id_ssm: "SSM parameter containing the primary GitHub App installation ID."
+        installation_id_ssm.arn: "ARN of the SSM parameter containing the primary GitHub App installation ID."
+        installation_id_ssm.name: "Name of the SSM parameter containing the primary GitHub App installation ID."
         webhook_secret: "GitHub App webhook secret."
         webhook_secret_ssm: "SSM parameter containing the GitHub App webhook secret."
         webhook_secret_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."
@@ -33,6 +37,8 @@ variable "global_config_github" {
       additional_apps.installation_id_ssm.name: "Name of the SSM parameter containing an additional App installation ID."
       enterprise_server.url: "GitHub Enterprise Server URL."
       enterprise_server.ssl_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."
+      runner_owner: "GitHub organization or owner/repository path for organization- or repository-level scale-set registration."
+      runner_registration_level: "GitHub scale-set registration scope: enterprise, organization, or repository."
       user_agent: "User-Agent value sent with GitHub API requests."
     }
   EOT
@@ -48,6 +54,11 @@ variable "global_config_github" {
         arn  = string
         name = string
       }))
+      installation_id = optional(string)
+      installation_id_ssm = optional(object({
+        arn  = string
+        name = string
+      }))
       webhook_secret = optional(string)
       webhook_secret_ssm = optional(object({
         arn  = string
@@ -66,7 +77,9 @@ variable "global_config_github" {
       url        = optional(string, null)
       ssl_verify = optional(bool, true)
     }), {})
-    user_agent = optional(string, "github-aws-runners")
+    runner_owner              = optional(string, null)
+    runner_registration_level = optional(string, "enterprise")
+    user_agent                = optional(string, "github-aws-runners")
   })
   default = {}
 }
diff --git a/modules/multi-runner/variables.experimental.orchestration-provider.tf b/modules/multi-runner/variables.experimental.orchestration-provider.tf
index 9919d3645e..41a51d6204 100644
--- a/modules/multi-runner/variables.experimental.orchestration-provider.tf
+++ b/modules/multi-runner/variables.experimental.orchestration-provider.tf
@@ -173,6 +173,78 @@ variable "global_config_orchestration_provider" {
           sqs_managed_sse_enabled           = true
         })
       }), {})
+
+    }), {})
+
+    scale_set = optional(object({
+      grouping = optional(object({
+        strategy = optional(string, "compute_provider")
+        custom = optional(object({
+          groups = map(object({
+            runner_configs = set(string)
+          }))
+        }), null)
+      }), {})
+      container = optional(object({
+        image                             = optional(string, null)
+        user                              = optional(string, "10001:10001")
+        health_port                       = optional(number, 8080)
+        health_path                       = optional(string, "/healthz")
+        health_check_command              = optional(list(string), null)
+        health_check_interval             = optional(number, 30)
+        health_check_timeout              = optional(number, 5)
+        health_check_retries              = optional(number, 3)
+        health_check_start_period         = optional(number, 30)
+        health_stale_after_seconds        = optional(number, 180)
+        shutdown_timeout_seconds          = optional(number, 110)
+        session_close_timeout_seconds     = optional(number, 10)
+        reconnect_initial_backoff_seconds = optional(number, 1)
+        reconnect_max_backoff_seconds     = optional(number, 30)
+        stop_timeout_seconds              = optional(number, 120)
+      }), {})
+      config_store = optional(object({
+        path_prefix = optional(string, null)
+        tier        = optional(string, "Standard")
+        tags        = optional(map(string), {})
+      }), {})
+      ecs = optional(object({
+        cluster = optional(object({
+          mode               = optional(string, "managed")
+          arn                = optional(string, null)
+          name               = optional(string, null)
+          container_insights = optional(bool, true)
+        }), {})
+        task = optional(object({
+          cpu              = optional(number, 512)
+          memory           = optional(number, 1024)
+          cpu_architecture = optional(string, "X86_64")
+          ephemeral_storage = optional(object({
+            size_in_gib = number
+          }), null)
+        }), {})
+        service = optional(object({
+          platform_version = optional(string, "LATEST")
+        }), {})
+        iam = optional(object({
+          path                 = optional(string, "/")
+          permissions_boundary = optional(string, null)
+        }), {})
+      }), {})
+      network = optional(object({
+        vpc_id     = optional(string, null)
+        subnet_ids = optional(set(string), null)
+        https_egress = optional(object({
+          ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])
+          ipv6_cidrs = optional(set(string), [])
+        }), {})
+      }), {})
+      logging = optional(object({
+        retention_in_days = optional(number, 30)
+        kms_key_arn       = optional(string, null)
+        log_group_class   = optional(string, "STANDARD")
+        tags              = optional(map(string), {})
+      }), {})
+      tags = optional(map(string), {})
     }), {})
   })
   default = {}
diff --git a/modules/multi-runner/variables.tf b/modules/multi-runner/variables.tf
index 793e126e4e..bf47576d67 100644
--- a/modules/multi-runner/variables.tf
+++ b/modules/multi-runner/variables.tf
@@ -19,6 +19,11 @@ variable "github_app" {
       arn  = string
       name = string
     }))
+    installation_id = optional(string)
+    installation_id_ssm = optional(object({
+      arn  = string
+      name = string
+    }))
     webhook_secret = optional(string)
     webhook_secret_ssm = optional(object({
       arn  = string
@@ -386,6 +391,14 @@ variable "multi_runner_config" {
           }), {})
         }), {})
       }), null)
+      scale_set = optional(object({
+        name = string
+        runner = optional(object({
+          min_runners          = optional(number, 0)
+          max_runners          = optional(number, 10)
+          boot_time_in_minutes = optional(number, 10)
+        }), {})
+      }), null)
     }), {})
 
     ssm = optional(object({
diff --git a/modules/runner-config/orchestration-provider.tf b/modules/runner-config/orchestration-provider.tf
index 25994beaba..4d6c4c4444 100644
--- a/modules/runner-config/orchestration-provider.tf
+++ b/modules/runner-config/orchestration-provider.tf
@@ -7,11 +7,16 @@ locals {
   orchestration_provider_type = one(keys(local.orchestration_providers))
 
   orchestration_provider_enabled = {
-    webhook = local.orchestration_provider_type == "webhook"
+    webhook   = local.orchestration_provider_type == "webhook"
+    scale_set = local.orchestration_provider_type == "scale_set"
   }
 
   orchestration_provider_runner_lifecycle = {
     webhook = one(module.orchestration_webhook[*].runner_lifecycle)
+    scale_set = {
+      ephemeral          = true
+      jit_config_enabled = true
+    }
   }[local.orchestration_provider_type]
 }
 
diff --git a/modules/runner-config/outputs.tf b/modules/runner-config/outputs.tf
index 486e3261eb..d52230ba5f 100644
--- a/modules/runner-config/outputs.tf
+++ b/modules/runner-config/outputs.tf
@@ -22,13 +22,26 @@ output "pool" {
 
 output "orchestration_provider" {
   description = "Resources grouped under the selected runner orchestration provider."
+  value = merge(
+    {
+      webhook = local.orchestration_provider_enabled.webhook ? {
+        scale_up   = one(module.orchestration_webhook[*].scale_up)
+        scale_down = one(module.orchestration_webhook[*].scale_down)
+        pool       = one(module.orchestration_webhook[*].pool)
+        job_retry  = one(module.orchestration_webhook[*].job_retry)
+      } : null
+    },
+    local.orchestration_provider_enabled.scale_set ? {
+      scale_set = {}
+    } : {},
+  )
+}
+
+output "compute_provider_contract" {
+  description = "Provider-neutral compute-provider capabilities consumed by topology-level orchestration."
   value = {
-    webhook = local.orchestration_provider_enabled.webhook ? {
-      scale_up   = one(module.orchestration_webhook[*].scale_up)
-      scale_down = one(module.orchestration_webhook[*].scale_down)
-      pool       = one(module.orchestration_webhook[*].pool)
-      job_retry  = one(module.orchestration_webhook[*].job_retry)
-    } : null
+    type         = local.provider_contract.type
+    capabilities = local.provider_contract.capabilities
   }
 }
 
diff --git a/modules/runner-config/validations.tf b/modules/runner-config/validations.tf
index f510bf0422..0c4ff5bcf0 100644
--- a/modules/runner-config/validations.tf
+++ b/modules/runner-config/validations.tf
@@ -90,7 +90,12 @@ resource "terraform_data" "validate_config" {
         for provider_name, provider_config in var.orchestration_provider : provider_name
         if provider_config != null
       ]) == 1
-      error_message = "Exactly one orchestration provider must be configured. Supported providers: webhook."
+      error_message = "Exactly one orchestration provider must be configured. Supported providers: webhook and scale_set."
+    }
+
+    precondition {
+      condition     = var.orchestration_provider.scale_set == null ? true : local.provider_contract.capabilities.scale_set != null
+      error_message = "The selected compute provider must expose a scale_set capability when scale_set orchestration is selected."
     }
 
     precondition {
diff --git a/modules/runner-config/variables.orchestration-provider.tf b/modules/runner-config/variables.orchestration-provider.tf
index 6d176ad6d7..4077dc29f7 100644
--- a/modules/runner-config/variables.orchestration-provider.tf
+++ b/modules/runner-config/variables.orchestration-provider.tf
@@ -3,7 +3,8 @@ variable "orchestration_provider" {
   description = <<-EOT
     Runner demand-orchestration provider configuration. Exactly one provider block must be non-null. Wrapper presence selects the provider and must therefore be known during planning; values inside the selected provider may remain unknown until apply.
 
-    - `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls. Future providers can be added as sibling blocks without moving this contract.
+    - `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls.
+    - `scale_set`: Selects scale-set orchestration for this runner config. The multi-runner topology owns the shared controller service and passes this plan-known selection marker to runner-config. Scale-set runners always use ephemeral JIT registration.
     - `webhook.runner`: Runner lifecycle, boot timeout, and capacity settings owned by webhook orchestration.
     - `webhook.runner.boot_time_in_minutes`: Expected runner boot duration used by scale-down and pool controls. The default is `5`.
     - `webhook.runner.ephemeral`: Registers runners in ephemeral mode. The default is `false`.
@@ -135,6 +136,14 @@ variable "orchestration_provider" {
         }), {})
       }), {})
     }), null)
+    scale_set = optional(object({
+      name = string
+      runner = optional(object({
+        min_runners          = optional(number, 0)
+        max_runners          = optional(number, 10)
+        boot_time_in_minutes = optional(number, 10)
+      }), {})
+    }), null)
   })
   nullable = false
 
diff --git a/modules/ssm/outputs.tf b/modules/ssm/outputs.tf
index e1afaf990e..f37b28d939 100644
--- a/modules/ssm/outputs.tf
+++ b/modules/ssm/outputs.tf
@@ -8,6 +8,10 @@ output "parameters" {
       name = var.github_app.key_base64_ssm != null ? var.github_app.key_base64_ssm.name : aws_ssm_parameter.github_app_key_base64[0].name
       arn  = var.github_app.key_base64_ssm != null ? var.github_app.key_base64_ssm.arn : aws_ssm_parameter.github_app_key_base64[0].arn
     }
+    github_app_installation_id = var.github_app.installation_id_ssm != null || var.github_app.installation_id != null ? {
+      name = var.github_app.installation_id_ssm != null ? var.github_app.installation_id_ssm.name : aws_ssm_parameter.github_app_installation_id[0].name
+      arn  = var.github_app.installation_id_ssm != null ? var.github_app.installation_id_ssm.arn : aws_ssm_parameter.github_app_installation_id[0].arn
+    } : null
     github_app_webhook_secret = {
       name = var.github_app.webhook_secret_ssm != null ? var.github_app.webhook_secret_ssm.name : aws_ssm_parameter.github_app_webhook_secret[0].name
       arn  = var.github_app.webhook_secret_ssm != null ? var.github_app.webhook_secret_ssm.arn : aws_ssm_parameter.github_app_webhook_secret[0].arn
diff --git a/modules/ssm/ssm.tf b/modules/ssm/ssm.tf
index 9467a136e5..ab8a406f2d 100644
--- a/modules/ssm/ssm.tf
+++ b/modules/ssm/ssm.tf
@@ -16,6 +16,15 @@ resource "aws_ssm_parameter" "github_app_key_base64" {
   tags   = var.tags
 }
 
+resource "aws_ssm_parameter" "github_app_installation_id" {
+  count  = var.github_app.installation_id_ssm != null || var.github_app.installation_id == null ? 0 : 1
+  name   = "${var.path_prefix}/github_app_installation_id"
+  type   = "SecureString"
+  value  = var.github_app.installation_id
+  key_id = local.kms_key_arn
+  tags   = var.tags
+}
+
 resource "aws_ssm_parameter" "github_app_webhook_secret" {
   count  = var.github_app.webhook_secret_ssm != null ? 0 : 1
   name   = "${var.path_prefix}/github_app_webhook_secret"
diff --git a/modules/ssm/variables.tf b/modules/ssm/variables.tf
index d7387ecc30..d1c0f41f36 100644
--- a/modules/ssm/variables.tf
+++ b/modules/ssm/variables.tf
@@ -17,6 +17,11 @@ variable "github_app" {
       arn  = string
       name = string
     }))
+    installation_id = optional(string)
+    installation_id_ssm = optional(object({
+      arn  = string
+      name = string
+    }))
     webhook_secret = optional(string)
     webhook_secret_ssm = optional(object({
       arn  = string

From fc62799b430a90459bd8e3177ff7bead996f7809 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 14:13:09 +0000
Subject: [PATCH 21/52] docs: auto update terraform docs

---
 modules/multi-runner/README.md  | 10 ++++++----
 modules/runner-config/README.md |  3 ++-
 modules/ssm/README.md           |  3 ++-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/modules/multi-runner/README.md b/modules/multi-runner/README.md
index 9935f47def..c9bd103a5d 100644
--- a/modules/multi-runner/README.md
+++ b/modules/multi-runner/README.md
@@ -119,6 +119,7 @@ module "multi-runner" {
 |------|--------|---------|
 | <a name="module_ami_housekeeper"></a> [ami\_housekeeper](#module\_ami\_housekeeper) | ../ami-housekeeper | n/a |
 | <a name="module_instance_termination_watcher"></a> [instance\_termination\_watcher](#module\_instance\_termination\_watcher) | ../termination-watcher | n/a |
+| <a name="module_orchestration_scale_set"></a> [orchestration\_scale\_set](#module\_orchestration\_scale\_set) | ../orchestration-providers/scale-set | n/a |
 | <a name="module_runner_binaries"></a> [runner\_binaries](#module\_runner\_binaries) | ../runner-binaries-syncer | n/a |
 | <a name="module_runner_configs"></a> [runner\_configs](#module\_runner\_configs) | ../runner-config | n/a |
 | <a name="module_runners"></a> [runners](#module\_runners) | ../runners | n/a |
@@ -160,13 +161,13 @@ module "multi-runner" {
 | <a name="input_experimental_features"></a> [experimental\_features](#input\_experimental\_features) | Explicit acknowledgement for opt-in features whose schemas may change<br/>while experimental. Set to ["multi-runner-v2"] when using the v2<br/>provider-boundary configuration. This flag will become a deprecated no-op<br/>for one release when the feature graduates. | `set(string)` | `[]` | no |
 | <a name="input_ghes_ssl_verify"></a> [ghes\_ssl\_verify](#input\_ghes\_ssl\_verify) | GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). | `bool` | `true` | no |
 | <a name="input_ghes_url"></a> [ghes\_url](#input\_ghes\_url) | GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB. .However if you are using GitHub Enterprise Cloud with data-residency (ghe.com), set the endpoint here. Example - https://companyname.ghe.com\| | `string` | `null` | no |
-| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters for the stable v1 interface, see your github app.<br/>  Omit this value when using the experimental v2 interface and provide the<br/>  app through `global_config_github` instead.<br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here,<br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | `{}` | no |
+| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters for the stable v1 interface, see your github app.<br/>  Omit this value when using the experimental v2 interface and provide the<br/>  app through `global_config_github` instead.<br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here,<br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    installation_id = optional(string)<br/>    installation_id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config"></a> [global\_config](#input\_global\_config) | Global defaults shared by all runner lanes.<br/><br/>global\_config = {<br/>  tags: "Tags applied to resources created for all runner lanes."<br/>  roles: {<br/>    path: "IAM path used for roles created for runner resources."<br/>    permissions\_boundary: "Optional IAM permissions boundary ARN applied to created roles."<br/>  }<br/>  runner: {<br/>    os: "Default operating system for runners."<br/>    architecture: "Default runner architecture."<br/>    disable\_default\_labels: "Whether to omit the default operating-system, architecture, and self-hosted labels."<br/>    extra\_labels: "Additional labels applied to all runners."<br/>    group\_name: "Default GitHub runner group."<br/>    name\_prefix: "Prefix for runner names."<br/>    run\_as\_root: "Whether the GitHub Actions runner executes as root."<br/>    run\_as: "User that runs the GitHub Actions agent when it is not running as root."<br/>    auto\_update\_disabled: "Whether automatic GitHub Actions runner updates are disabled."<br/>    tags: "Tags applied to runner resources."<br/>    hooks: {<br/>      job\_started: "Script executed when a job starts on a runner."<br/>      job\_completed: "Script executed when a job completes on a runner."<br/>    }<br/>    iam: {<br/>      role.arn: "Existing IAM role ARN to use for runners."<br/>      managed\_policy\_arns: "Managed policy ARNs attached to the runner IAM role."<br/>      additional\_trust\_policy\_json: "Additional trust policy JSON merged into the runner role trust policy."<br/>      path: "IAM path used for the runner role."<br/>      permissions\_boundary: "Optional IAM permissions boundary ARN for the runner role."<br/>    }<br/>  }<br/>} | <pre>object({<br/>    tags = optional(map(string), {})<br/><br/>    roles = optional(object({<br/>      path                 = optional(string, null)<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/><br/>    runner = optional(object({<br/>      os                     = optional(string, null)<br/>      architecture           = optional(string, null)<br/>      disable_default_labels = optional(bool, false)<br/>      extra_labels           = optional(list(string), [])<br/>      group_name             = optional(string, "Default")<br/>      name_prefix            = optional(string, "")<br/>      run_as_root            = optional(bool, false)<br/>      run_as                 = optional(string, "ec2-user")<br/>      auto_update_disabled   = optional(bool, false)<br/>      tags                   = optional(map(string), {})<br/>      hooks = optional(object({<br/>        job_started   = optional(string, "")<br/>        job_completed = optional(string, "")<br/>      }), {})<br/>      iam = optional(object({<br/>        role = optional(object({<br/>          arn = string<br/>        }), null)<br/>        managed_policy_arns          = optional(map(string), {})<br/>        additional_trust_policy_json = optional(string, null)<br/>        path                         = optional(string, null)<br/>        permissions_boundary         = optional(string, null)<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_compute_provider"></a> [global\_config\_compute\_provider](#input\_global\_config\_compute\_provider) | Global compute-provider configuration shared by all runner lanes.<br/><br/>global\_config\_compute\_provider = {<br/>  selections: "Compute-provider selections keyed by namespace."<br/>  selections.namespace: "Provider namespace used to resolve a compute implementation."<br/>  selections.type: "Compute-provider type selected for the namespace."<br/>  aws.ec2.vpc\_id: "Default VPC for EC2 runners."<br/>  aws.ec2.subnet\_ids: "Default subnets for EC2 runners."<br/>  aws.ec2.managed\_security\_group\_enabled: "Whether the module manages the default runner security group."<br/>  aws.ec2.egress\_rules: "Egress rules for the managed runner security group."<br/>  aws.ec2.egress\_rules.cidr\_blocks: "IPv4 CIDR blocks allowed by an egress rule."<br/>  aws.ec2.egress\_rules.ipv6\_cidr\_blocks: "IPv6 CIDR blocks allowed by an egress rule."<br/>  aws.ec2.egress\_rules.prefix\_list\_ids: "AWS prefix lists allowed by an egress rule."<br/>  aws.ec2.egress\_rules.from\_port: "Start of the egress port range."<br/>  aws.ec2.egress\_rules.protocol: "Protocol for the egress rule."<br/>  aws.ec2.egress\_rules.security\_groups: "Referenced security groups allowed by an egress rule."<br/>  aws.ec2.egress\_rules.self: "Whether the security group itself is allowed by an egress rule."<br/>  aws.ec2.egress\_rules.to\_port: "End of the egress port range."<br/>  aws.ec2.egress\_rules.description: "Description of the egress rule."<br/>  aws.ec2.additional\_security\_group\_ids: "Additional security groups attached to EC2 runners."<br/>  aws.ec2.cloudwatch\_agent.config: "CloudWatch Agent configuration for EC2 runners."<br/>  aws.ec2.instance\_profile\_path: "IAM path used for the EC2 instance profile."<br/>  aws.ec2.key\_name: "EC2 key pair name assigned to runner instances."<br/>  aws.ec2.associate\_public\_ipv4\_address: "Whether runner instances receive a public IPv4 address."<br/>  aws.ec2.tags: "Tags applied to EC2 runner resources."<br/>  aws.ec2.ami.housekeeper.enabled: "Whether AMI cleanup is enabled."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.maxItems: "Maximum number of AMIs retained by cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.minimumDaysOld: "Minimum AMI age in days before cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters: "AMI filters used to select AMIs for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters.Name: "AMI filter name."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters.Values: "Values matched by the AMI filter."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.launchTemplateNames: "Launch template names associated with AMIs eligible for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.ssmParameterNames: "SSM parameter names associated with AMIs eligible for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.dryRun: "Whether AMI cleanup reports changes without deleting AMIs."<br/>  aws.ec2.ami.housekeeper.artifact.zip: "Local ZIP artifact used for the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.artifact.s3.key: "S3 object key for the AMI housekeeper Lambda artifact."<br/>  aws.ec2.ami.housekeeper.artifact.s3.object\_version: "Optional S3 object version for the AMI housekeeper artifact."<br/>  aws.ec2.ami.housekeeper.lambda.memory\_size: "Memory allocated to the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.lambda.timeout: "Timeout in seconds for the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.schedule.expression: "Schedule expression for AMI cleanup."<br/>  aws.ec2.instance\_termination\_watcher.enabled: "Whether the instance termination watcher is enabled."<br/>  aws.ec2.instance\_termination\_watcher.features.runner\_deregistration.enabled: "Whether terminated runners are deregistered."<br/>  aws.ec2.instance\_termination\_watcher.features.spot\_termination\_handler.enabled: "Whether spot termination events trigger runner handling."<br/>  aws.ec2.instance\_termination\_watcher.features.spot\_termination\_notification\_watcher.enabled: "Whether spot termination notification monitoring is enabled."<br/>  aws.ec2.instance\_termination\_watcher.environment\_variables: "Environment variables passed to the termination watcher."<br/>  aws.ec2.instance\_termination\_watcher.artifact.zip: "Local ZIP artifact used for the termination watcher Lambda."<br/>  aws.ec2.instance\_termination\_watcher.artifact.s3.key: "S3 object key for the termination watcher Lambda artifact."<br/>  aws.ec2.instance\_termination\_watcher.artifact.s3.object\_version: "Optional S3 object version for the termination watcher artifact."<br/>  aws.ec2.instance\_termination\_watcher.lambda.memory\_size: "Memory allocated to the termination watcher Lambda."<br/>  aws.ec2.instance\_termination\_watcher.lambda.timeout: "Timeout in seconds for the termination watcher Lambda."<br/>  aws.ec2.runner\_binaries.enabled: "Whether runner binary synchronization is enabled."<br/>  aws.ec2.runner\_binaries.s3.encryption.enabled: "Whether runner-binary S3 encryption is enabled."<br/>  aws.ec2.runner\_binaries.s3.encryption.bucket\_key\_enabled: "Whether an S3 bucket key is used for KMS encryption."<br/>  aws.ec2.runner\_binaries.s3.encryption.sse\_algorithm: "S3 server-side encryption algorithm."<br/>  aws.ec2.runner\_binaries.s3.encryption.kms\_master\_key\_id: "KMS key ID used for runner-binary S3 encryption."<br/>  aws.ec2.runner\_binaries.s3.tags: "Tags applied to the runner-binary S3 bucket."<br/>  aws.ec2.runner\_binaries.s3.versioning: "S3 versioning state for the runner-binary bucket."<br/>  aws.ec2.runner\_binaries.s3.logging.bucket: "S3 bucket receiving runner-binary access logs."<br/>  aws.ec2.runner\_binaries.s3.logging.prefix: "Prefix for runner-binary S3 access logs."<br/>  aws.ec2.runner\_binaries.syncer.artifact.zip: "Local ZIP artifact used for the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.artifact.s3.key: "S3 object key for the runner-binary syncer artifact."<br/>  aws.ec2.runner\_binaries.syncer.artifact.s3.object\_version: "Optional S3 object version for the runner-binary syncer artifact."<br/>  aws.ec2.runner\_binaries.syncer.lambda.memory\_size: "Memory allocated to the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.lambda.timeout: "Timeout in seconds for the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.schedule.expression: "Schedule expression for runner-binary synchronization."<br/>  aws.ec2.runner\_binaries.syncer.schedule.state: "EventBridge rule state for runner-binary synchronization."<br/>} | <pre>object({<br/>    selections = optional(map(object({<br/>      namespace = string<br/>      type      = string<br/>    })), null)<br/>    aws = optional(object({<br/>      ec2 = optional(object({<br/>        vpc_id                         = optional(string, null)<br/>        subnet_ids                     = optional(list(string), null)<br/>        managed_security_group_enabled = optional(bool, true)<br/>        egress_rules = optional(list(object({<br/>          cidr_blocks      = list(string)<br/>          ipv6_cidr_blocks = list(string)<br/>          prefix_list_ids  = list(string)<br/>          from_port        = number<br/>          protocol         = string<br/>          security_groups  = list(string)<br/>          self             = bool<br/>          to_port          = number<br/>          description      = string<br/>          })), [{<br/>          cidr_blocks      = ["0.0.0.0/0"]<br/>          ipv6_cidr_blocks = ["::/0"]<br/>          prefix_list_ids  = null<br/>          from_port        = 0<br/>          protocol         = "-1"<br/>          security_groups  = null<br/>          self             = null<br/>          to_port          = 0<br/>          description      = null<br/>        }])<br/>        additional_security_group_ids = optional(list(string), [])<br/>        cloudwatch_agent = optional(object({<br/>          config = optional(string, null)<br/>        }), {})<br/>        instance_profile_path         = optional(string, null)<br/>        key_name                      = optional(string, null)<br/>        associate_public_ipv4_address = optional(bool, false)<br/>        tags                          = optional(map(string), {})<br/>        ami = optional(object({<br/>          housekeeper = optional(object({<br/>            enabled = optional(bool, false)<br/>            cleanup_config = optional(object({<br/>              maxItems       = optional(number)<br/>              minimumDaysOld = optional(number)<br/>              amiFilters = optional(list(object({<br/>                Name   = string<br/>                Values = list(string)<br/>              })))<br/>              launchTemplateNames = optional(list(string))<br/>              ssmParameterNames   = optional(list(string))<br/>              dryRun              = optional(bool)<br/>            }), {})<br/>            artifact = optional(object({<br/>              zip = optional(string, null)<br/>              s3 = optional(object({<br/>                key            = string<br/>                object_version = optional(string, null)<br/>              }), null)<br/>            }), {})<br/>            lambda = optional(object({<br/>              memory_size = optional(number, 256)<br/>              timeout     = optional(number, 300)<br/>            }), {})<br/>            schedule = optional(object({<br/>              expression = optional(string, "cron(11 7 * * ? *)")<br/>            }), {})<br/>          }), {})<br/>        }), {})<br/>        instance_termination_watcher = optional(object({<br/>          enabled = optional(bool, false)<br/>          features = optional(object({<br/>            runner_deregistration = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>            spot_termination_handler = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>            spot_termination_notification_watcher = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>          }), {})<br/>          environment_variables = optional(map(string), {})<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          lambda = optional(object({<br/>            memory_size = optional(number, null)<br/>            timeout     = optional(number, null)<br/>          }), {})<br/>        }), {})<br/>        runner_binaries = optional(object({<br/>          enabled = optional(bool, true)<br/>          s3 = optional(object({<br/>            encryption = optional(object({<br/>              enabled            = optional(bool, true)<br/>              bucket_key_enabled = optional(bool, null)<br/>              sse_algorithm      = optional(string, "AES256")<br/>              kms_master_key_id  = optional(string, null)<br/>            }), {})<br/>            tags       = optional(map(string), {})<br/>            versioning = optional(string, "Disabled")<br/>            logging = optional(object({<br/>              bucket = optional(string, null)<br/>              prefix = optional(string, null)<br/>            }), {})<br/>          }), {})<br/>          syncer = optional(object({<br/>            artifact = optional(object({<br/>              zip = optional(string, null)<br/>              s3 = optional(object({<br/>                key            = string<br/>                object_version = optional(string, null)<br/>              }), null)<br/>            }), {})<br/>            lambda = optional(object({<br/>              memory_size = optional(number, 256)<br/>              timeout     = optional(number, 300)<br/>            }), {})<br/>            schedule = optional(object({<br/>              expression = optional(string, "cron(27 * * * ? *)")<br/>              state      = optional(string, "ENABLED")<br/>            }), {})<br/>          }), {})<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_global_config_github"></a> [global\_config\_github](#input\_global\_config\_github) | Global GitHub configuration shared by all runner lanes.<br/><br/>global\_config\_github = {<br/>  app: {<br/>    key\_base64: "Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm: "SSM parameter containing the Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm.arn: "ARN of the SSM parameter containing the GitHub App private key."<br/>    key\_base64\_ssm.name: "Name of the SSM parameter containing the GitHub App private key."<br/>    id: "GitHub App ID."<br/>    id\_ssm: "SSM parameter containing the GitHub App ID."<br/>    id\_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."<br/>    id\_ssm.name: "Name of the SSM parameter containing the GitHub App ID."<br/>    webhook\_secret: "GitHub App webhook secret."<br/>    webhook\_secret\_ssm: "SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.name: "Name of the SSM parameter containing the GitHub App webhook secret."<br/>  }<br/>  additional\_apps: "Additional GitHub Apps used to distribute GitHub API requests."<br/>  additional\_apps.key\_base64: "Base64-encoded private key for an additional GitHub App."<br/>  additional\_apps.key\_base64\_ssm: "SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.arn: "ARN of the SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.name: "Name of the SSM parameter containing an additional App private key."<br/>  additional\_apps.id: "ID of an additional GitHub App."<br/>  additional\_apps.id\_ssm: "SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.arn: "ARN of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.name: "Name of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.installation\_id: "Optional installation ID for an additional GitHub App."<br/>  additional\_apps.installation\_id\_ssm: "SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.arn: "ARN of the SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.name: "Name of the SSM parameter containing an additional App installation ID."<br/>  enterprise\_server.url: "GitHub Enterprise Server URL."<br/>  enterprise\_server.ssl\_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."<br/>  user\_agent: "User-Agent value sent with GitHub API requests."<br/>} | <pre>object({<br/>    app = optional(object({<br/>      key_base64 = optional(string)<br/>      key_base64_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      id = optional(string)<br/>      id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      webhook_secret = optional(string)<br/>      webhook_secret_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>    }), null)<br/>    additional_apps = optional(list(object({<br/>      key_base64          = optional(string)<br/>      key_base64_ssm      = optional(object({ arn = string, name = string }))<br/>      id                  = optional(string)<br/>      id_ssm              = optional(object({ arn = string, name = string }))<br/>      installation_id     = optional(string)<br/>      installation_id_ssm = optional(object({ arn = string, name = string }))<br/>    })), [])<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>    user_agent = optional(string, "github-aws-runners")<br/>  })</pre> | `{}` | no |
+| <a name="input_global_config_github"></a> [global\_config\_github](#input\_global\_config\_github) | Global GitHub configuration shared by all runner lanes.<br/><br/>global\_config\_github = {<br/>  app: {<br/>    key\_base64: "Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm: "SSM parameter containing the Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm.arn: "ARN of the SSM parameter containing the GitHub App private key."<br/>    key\_base64\_ssm.name: "Name of the SSM parameter containing the GitHub App private key."<br/>    id: "GitHub App ID."<br/>    id\_ssm: "SSM parameter containing the GitHub App ID."<br/>    id\_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."<br/>    id\_ssm.name: "Name of the SSM parameter containing the GitHub App ID."<br/>    installation\_id: "GitHub App installation ID for the primary scale-set installation."<br/>    installation\_id\_ssm: "SSM parameter containing the primary GitHub App installation ID."<br/>    installation\_id\_ssm.arn: "ARN of the SSM parameter containing the primary GitHub App installation ID."<br/>    installation\_id\_ssm.name: "Name of the SSM parameter containing the primary GitHub App installation ID."<br/>    webhook\_secret: "GitHub App webhook secret."<br/>    webhook\_secret\_ssm: "SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.name: "Name of the SSM parameter containing the GitHub App webhook secret."<br/>  }<br/>  additional\_apps: "Additional GitHub Apps used to distribute GitHub API requests."<br/>  additional\_apps.key\_base64: "Base64-encoded private key for an additional GitHub App."<br/>  additional\_apps.key\_base64\_ssm: "SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.arn: "ARN of the SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.name: "Name of the SSM parameter containing an additional App private key."<br/>  additional\_apps.id: "ID of an additional GitHub App."<br/>  additional\_apps.id\_ssm: "SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.arn: "ARN of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.name: "Name of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.installation\_id: "Optional installation ID for an additional GitHub App."<br/>  additional\_apps.installation\_id\_ssm: "SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.arn: "ARN of the SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.name: "Name of the SSM parameter containing an additional App installation ID."<br/>  enterprise\_server.url: "GitHub Enterprise Server URL."<br/>  enterprise\_server.ssl\_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."<br/>  runner\_owner: "GitHub organization or owner/repository path for organization- or repository-level scale-set registration."<br/>  runner\_registration\_level: "GitHub scale-set registration scope: enterprise, organization, or repository."<br/>  user\_agent: "User-Agent value sent with GitHub API requests."<br/>} | <pre>object({<br/>    app = optional(object({<br/>      key_base64 = optional(string)<br/>      key_base64_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      id = optional(string)<br/>      id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      installation_id = optional(string)<br/>      installation_id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      webhook_secret = optional(string)<br/>      webhook_secret_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>    }), null)<br/>    additional_apps = optional(list(object({<br/>      key_base64          = optional(string)<br/>      key_base64_ssm      = optional(object({ arn = string, name = string }))<br/>      id                  = optional(string)<br/>      id_ssm              = optional(object({ arn = string, name = string }))<br/>      installation_id     = optional(string)<br/>      installation_id_ssm = optional(object({ arn = string, name = string }))<br/>    })), [])<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>    runner_owner              = optional(string, null)<br/>    runner_registration_level = optional(string, "enterprise")<br/>    user_agent                = optional(string, "github-aws-runners")<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_lambda"></a> [global\_config\_lambda](#input\_global\_config\_lambda) | Global Lambda configuration shared by all runner lanes.<br/><br/>global\_config\_lambda = {<br/>  artifact.s3.bucket: "S3 bucket containing Lambda deployment artifacts."<br/>  runtime: "Default Lambda runtime."<br/>  architecture: "Default Lambda instruction-set architecture."<br/>  principals: "Additional AWS principals allowed to invoke the Lambda functions."<br/>  principals.type: "Principal type, such as AWS account, service, or organization."<br/>  principals.identifiers: "Identifiers allowed for the principal type."<br/>  subnet\_ids: "Subnets used by Lambda functions."<br/>  security\_group\_ids: "Security groups attached to Lambda functions."<br/>  tags: "Tags applied to Lambda functions and related resources."<br/>  role.path: "IAM path used for Lambda execution roles."<br/>  role.permissions\_boundary: "Optional IAM permissions boundary ARN for Lambda execution roles."<br/>} | <pre>object({<br/>    artifact = optional(object({<br/>      s3 = optional(object({<br/>        bucket = optional(string, null)<br/>      }), {})<br/>    }), {})<br/>    runtime      = optional(string, "nodejs24.x")<br/>    architecture = optional(string, "arm64")<br/>    principals = optional(list(object({<br/>      type        = string<br/>      identifiers = list(string)<br/>    })), [])<br/>    subnet_ids         = optional(list(string), [])<br/>    security_group_ids = optional(list(string), [])<br/>    tags               = optional(map(string), {})<br/>    role = optional(object({<br/>      path                 = optional(string, null)<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_observability"></a> [global\_config\_observability](#input\_global\_config\_observability) | Global observability configuration shared by all runner lanes.<br/><br/>global\_config\_observability = {<br/>  logs.level: "Log level for module resources."<br/>  logs.retention\_in\_days: "CloudWatch log retention period in days."<br/>  logs.kms\_key\_id: "KMS key ID used to encrypt CloudWatch log groups."<br/>  logs.class: "CloudWatch log group class."<br/>  logs.tags: "Tags applied to CloudWatch log groups."<br/>  tracing.mode: "Tracing mode used by instrumented resources."<br/>  tracing.capture\_http\_requests: "Whether HTTP requests are captured by tracing."<br/>  tracing.capture\_error: "Whether errors are captured by tracing."<br/>  metrics.enabled: "Whether module metrics are enabled."<br/>  metrics.namespace: "CloudWatch namespace used for module metrics."<br/>  metrics.metric.github\_app\_rate\_limit.enabled: "Whether GitHub App rate-limit metrics are emitted."<br/>  metrics.metric.job\_retry.enabled: "Whether job-retry metrics are emitted."<br/>  metrics.metric.spot\_termination\_warning.enabled: "Whether spot-termination warning metrics are emitted."<br/>} | <pre>object({<br/>    logs = optional(object({<br/>      level             = optional(string, "info")<br/>      retention_in_days = optional(number, 180)<br/>      kms_key_id        = optional(string, null)<br/>      class             = optional(string, "STANDARD")<br/>      tags              = optional(map(string), {})<br/>    }), {})<br/>    tracing = optional(object({<br/>      mode                  = optional(string, null)<br/>      capture_http_requests = optional(bool, false)<br/>      capture_error         = optional(bool, false)<br/>    }), {})<br/>    metrics = optional(object({<br/>      enabled   = optional(bool, false)<br/>      namespace = optional(string, "GitHub Runners")<br/>      metric = optional(object({<br/>        github_app_rate_limit = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        spot_termination_warning = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_global_config_orchestration_provider"></a> [global\_config\_orchestration\_provider](#input\_global\_config\_orchestration\_provider) | Global orchestration-provider configuration shared by all runner lanes.<br/><br/>global\_config\_orchestration\_provider = {<br/>  webhook: {<br/>    queue\_selection\_strategy: "Strategy used to select the build queue for a webhook event."<br/>    eventbridge.enabled: "Whether EventBridge integration is enabled for webhook events."<br/>    eventbridge.accept\_events: "Event types accepted by the EventBridge integration."<br/>    matcher\_config\_parameter\_store\_tier: "SSM Parameter Store tier used for matcher configuration."<br/>    runner.boot\_time\_in\_minutes: "Expected runner boot time used by orchestration."<br/>    runner.ephemeral: "Whether runners created by the orchestration provider are ephemeral."<br/>    runner.jit\_config\_enabled: "Whether JIT runner configuration is enabled."<br/>    runner.maximum\_count: "Maximum number of runners that orchestration may create."<br/>    github.repository\_white\_list: "Repositories allowed to use the webhook configuration."<br/>    lambda.artifact.zip: "Local ZIP artifact used for orchestration Lambda functions."<br/>    lambda.artifact.s3.key: "S3 object key for the orchestration Lambda artifact."<br/>    lambda.artifact.s3.object\_version: "Optional S3 object version for the orchestration Lambda artifact."<br/>    lambda.scale.up.memory\_size: "Memory allocated to the scale-up Lambda."<br/>    lambda.scale.up.timeout: "Timeout in seconds for the scale-up Lambda."<br/>    lambda.scale.up.reserved\_concurrent\_executions: "Reserved concurrent executions for the scale-up Lambda."<br/>    lambda.scale.up.job\_queued\_check\_enabled: "Whether the scale-up Lambda checks queued jobs."<br/>    lambda.scale.up.event\_source\_mapping.batch\_size: "Maximum records passed to one scale-up Lambda invocation."<br/>    lambda.scale.up.event\_source\_mapping.maximum\_batching\_window\_in\_seconds: "Maximum time to batch records before invoking the scale-up Lambda."<br/>    lambda.scale.up.tags: "Tags applied to the scale-up Lambda."<br/>    lambda.scale.down.memory\_size: "Memory allocated to the scale-down Lambda."<br/>    lambda.scale.down.timeout: "Timeout in seconds for the scale-down Lambda."<br/>    lambda.scale.down.schedule\_expression: "Schedule expression for scale-down processing."<br/>    lambda.scale.down.minimum\_running\_time\_in\_minutes: "Minimum runner lifetime before scale-down."<br/>    lambda.scale.down.idle\_confirmation\_seconds: "Seconds a runner must consistently report not-busy before scale-down terminates it; 0 disables the confirmation window."<br/>    lambda.scale.down.idle\_config: "Scheduled minimum idle-runner pool settings."<br/>    lambda.scale.down.idle\_config.cron: "Cron expression defining when the idle-runner count applies."<br/>    lambda.scale.down.idle\_config.timeZone: "Time zone used to evaluate the idle-runner schedule."<br/>    lambda.scale.down.idle\_config.idleCount: "Minimum number of idle runners maintained during the schedule."<br/>    lambda.scale.down.idle\_config.evictionStrategy: "Strategy used when evicting idle runners."<br/>    lambda.scale.down.tags: "Tags applied to the scale-down Lambda."<br/>    lambda.webhook.artifact.zip: "Local ZIP artifact used for the webhook Lambda."<br/>    lambda.webhook.artifact.s3.key: "S3 object key for the webhook Lambda artifact."<br/>    lambda.webhook.artifact.s3.object\_version: "Optional S3 object version for the webhook Lambda artifact."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings: "API Gateway access-log destination and format."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.destination\_arn: "ARN of the API Gateway access-log destination."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.format: "API Gateway access-log format."<br/>    lambda.webhook.memory\_size: "Memory allocated to the webhook Lambda."<br/>    lambda.webhook.timeout: "Timeout in seconds for the webhook Lambda."<br/>    lambda.webhook.tags: "Tags applied to the webhook Lambda."<br/>    lambda.pool.memory\_size: "Memory allocated to the pool Lambda."<br/>    lambda.pool.timeout: "Timeout in seconds for the pool Lambda."<br/>    lambda.pool.reserved\_concurrent\_executions: "Reserved concurrent executions for the pool Lambda."<br/>    lambda.pool.config: "Scheduled runner-pool size configuration."<br/>    lambda.pool.config.schedule\_expression: "Schedule expression for the pool size."<br/>    lambda.pool.config.schedule\_expression\_timezone: "Time zone used to evaluate the pool schedule."<br/>    lambda.pool.config.size: "Runner pool size applied by the schedule."<br/>    lambda.pool.include\_busy\_runners: "Whether busy runners are included in pool sizing."<br/>    lambda.pool.runner\_owner: "GitHub organization that owns the runner pool."<br/>    lambda.pool.tags: "Tags applied to the pool Lambda."<br/>    queue.delay\_webhook\_event: "Seconds a webhook event remains invisible in the build queue before processing."<br/>    queue.job\_queue\_retention\_in\_seconds: "Seconds a queued job is retained before it is purged."<br/>    queue.visibility\_timeout\_seconds: "Build queue visibility timeout in seconds."<br/>    queue.redrive\_build\_queue.enabled: "Whether the build queue dead-letter queue is enabled."<br/>    queue.redrive\_build\_queue.maxReceiveCount: "Maximum receives before a message is moved to the dead-letter queue."<br/>    queue.tags: "Tags applied to build queues."<br/>    queue.encryption.kms\_data\_key\_reuse\_period\_seconds: "KMS data-key reuse period for queue encryption."<br/>    queue.encryption.kms\_master\_key\_id: "KMS key ID used for queue encryption."<br/>    queue.encryption.sqs\_managed\_sse\_enabled: "Whether SQS-managed server-side encryption is enabled."<br/>  }<br/>} | <pre>object({<br/>    webhook = optional(object({<br/>      queue_selection_strategy = optional(string, "first")<br/>      eventbridge = optional(object({<br/>        enabled       = optional(bool, true)<br/>        accept_events = optional(list(string), [])<br/>      }), {})<br/>      matcher_config_parameter_store_tier = optional(string, "Standard")<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, null)<br/>      }), {})<br/><br/>      github = optional(object({<br/>        repository_white_list = optional(list(string), [])<br/>      }), {})<br/><br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 30)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_confirmation_seconds       = optional(number, 0)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        webhook = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          api_gateway_access_log_settings = optional(object({<br/>            destination_arn = string<br/>            format          = string<br/>          }), null)<br/>          memory_size = optional(number, 256)<br/>          timeout     = optional(number, 10)<br/>          tags        = optional(map(string), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/><br/>      queue = optional(object({<br/>        delay_webhook_event            = optional(number, 30)<br/>        job_queue_retention_in_seconds = optional(number, 86400)<br/>        visibility_timeout_seconds     = optional(number, 180)<br/>        redrive_build_queue = optional(object({<br/>          enabled         = optional(bool, false)<br/>          maxReceiveCount = optional(number, null)<br/>          }), {<br/>          enabled         = false<br/>          maxReceiveCount = null<br/>        })<br/>        tags = optional(map(string), {})<br/>        encryption = optional(object({<br/>          kms_data_key_reuse_period_seconds = number<br/>          kms_master_key_id                 = string<br/>          sqs_managed_sse_enabled           = bool<br/>          }), {<br/>          kms_data_key_reuse_period_seconds = null<br/>          kms_master_key_id                 = null<br/>          sqs_managed_sse_enabled           = true<br/>        })<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
+| <a name="input_global_config_orchestration_provider"></a> [global\_config\_orchestration\_provider](#input\_global\_config\_orchestration\_provider) | Global orchestration-provider configuration shared by all runner lanes.<br/><br/>global\_config\_orchestration\_provider = {<br/>  webhook: {<br/>    queue\_selection\_strategy: "Strategy used to select the build queue for a webhook event."<br/>    eventbridge.enabled: "Whether EventBridge integration is enabled for webhook events."<br/>    eventbridge.accept\_events: "Event types accepted by the EventBridge integration."<br/>    matcher\_config\_parameter\_store\_tier: "SSM Parameter Store tier used for matcher configuration."<br/>    runner.boot\_time\_in\_minutes: "Expected runner boot time used by orchestration."<br/>    runner.ephemeral: "Whether runners created by the orchestration provider are ephemeral."<br/>    runner.jit\_config\_enabled: "Whether JIT runner configuration is enabled."<br/>    runner.maximum\_count: "Maximum number of runners that orchestration may create."<br/>    github.repository\_white\_list: "Repositories allowed to use the webhook configuration."<br/>    lambda.artifact.zip: "Local ZIP artifact used for orchestration Lambda functions."<br/>    lambda.artifact.s3.key: "S3 object key for the orchestration Lambda artifact."<br/>    lambda.artifact.s3.object\_version: "Optional S3 object version for the orchestration Lambda artifact."<br/>    lambda.scale.up.memory\_size: "Memory allocated to the scale-up Lambda."<br/>    lambda.scale.up.timeout: "Timeout in seconds for the scale-up Lambda."<br/>    lambda.scale.up.reserved\_concurrent\_executions: "Reserved concurrent executions for the scale-up Lambda."<br/>    lambda.scale.up.job\_queued\_check\_enabled: "Whether the scale-up Lambda checks queued jobs."<br/>    lambda.scale.up.event\_source\_mapping.batch\_size: "Maximum records passed to one scale-up Lambda invocation."<br/>    lambda.scale.up.event\_source\_mapping.maximum\_batching\_window\_in\_seconds: "Maximum time to batch records before invoking the scale-up Lambda."<br/>    lambda.scale.up.tags: "Tags applied to the scale-up Lambda."<br/>    lambda.scale.down.memory\_size: "Memory allocated to the scale-down Lambda."<br/>    lambda.scale.down.timeout: "Timeout in seconds for the scale-down Lambda."<br/>    lambda.scale.down.schedule\_expression: "Schedule expression for scale-down processing."<br/>    lambda.scale.down.minimum\_running\_time\_in\_minutes: "Minimum runner lifetime before scale-down."<br/>    lambda.scale.down.idle\_confirmation\_seconds: "Seconds a runner must consistently report not-busy before scale-down terminates it; 0 disables the confirmation window."<br/>    lambda.scale.down.idle\_config: "Scheduled minimum idle-runner pool settings."<br/>    lambda.scale.down.idle\_config.cron: "Cron expression defining when the idle-runner count applies."<br/>    lambda.scale.down.idle\_config.timeZone: "Time zone used to evaluate the idle-runner schedule."<br/>    lambda.scale.down.idle\_config.idleCount: "Minimum number of idle runners maintained during the schedule."<br/>    lambda.scale.down.idle\_config.evictionStrategy: "Strategy used when evicting idle runners."<br/>    lambda.scale.down.tags: "Tags applied to the scale-down Lambda."<br/>    lambda.webhook.artifact.zip: "Local ZIP artifact used for the webhook Lambda."<br/>    lambda.webhook.artifact.s3.key: "S3 object key for the webhook Lambda artifact."<br/>    lambda.webhook.artifact.s3.object\_version: "Optional S3 object version for the webhook Lambda artifact."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings: "API Gateway access-log destination and format."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.destination\_arn: "ARN of the API Gateway access-log destination."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.format: "API Gateway access-log format."<br/>    lambda.webhook.memory\_size: "Memory allocated to the webhook Lambda."<br/>    lambda.webhook.timeout: "Timeout in seconds for the webhook Lambda."<br/>    lambda.webhook.tags: "Tags applied to the webhook Lambda."<br/>    lambda.pool.memory\_size: "Memory allocated to the pool Lambda."<br/>    lambda.pool.timeout: "Timeout in seconds for the pool Lambda."<br/>    lambda.pool.reserved\_concurrent\_executions: "Reserved concurrent executions for the pool Lambda."<br/>    lambda.pool.config: "Scheduled runner-pool size configuration."<br/>    lambda.pool.config.schedule\_expression: "Schedule expression for the pool size."<br/>    lambda.pool.config.schedule\_expression\_timezone: "Time zone used to evaluate the pool schedule."<br/>    lambda.pool.config.size: "Runner pool size applied by the schedule."<br/>    lambda.pool.include\_busy\_runners: "Whether busy runners are included in pool sizing."<br/>    lambda.pool.runner\_owner: "GitHub organization that owns the runner pool."<br/>    lambda.pool.tags: "Tags applied to the pool Lambda."<br/>    queue.delay\_webhook\_event: "Seconds a webhook event remains invisible in the build queue before processing."<br/>    queue.job\_queue\_retention\_in\_seconds: "Seconds a queued job is retained before it is purged."<br/>    queue.visibility\_timeout\_seconds: "Build queue visibility timeout in seconds."<br/>    queue.redrive\_build\_queue.enabled: "Whether the build queue dead-letter queue is enabled."<br/>    queue.redrive\_build\_queue.maxReceiveCount: "Maximum receives before a message is moved to the dead-letter queue."<br/>    queue.tags: "Tags applied to build queues."<br/>    queue.encryption.kms\_data\_key\_reuse\_period\_seconds: "KMS data-key reuse period for queue encryption."<br/>    queue.encryption.kms\_master\_key\_id: "KMS key ID used for queue encryption."<br/>    queue.encryption.sqs\_managed\_sse\_enabled: "Whether SQS-managed server-side encryption is enabled."<br/>  }<br/>} | <pre>object({<br/>    webhook = optional(object({<br/>      queue_selection_strategy = optional(string, "first")<br/>      eventbridge = optional(object({<br/>        enabled       = optional(bool, true)<br/>        accept_events = optional(list(string), [])<br/>      }), {})<br/>      matcher_config_parameter_store_tier = optional(string, "Standard")<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, null)<br/>      }), {})<br/><br/>      github = optional(object({<br/>        repository_white_list = optional(list(string), [])<br/>      }), {})<br/><br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 30)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_confirmation_seconds       = optional(number, 0)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        webhook = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          api_gateway_access_log_settings = optional(object({<br/>            destination_arn = string<br/>            format          = string<br/>          }), null)<br/>          memory_size = optional(number, 256)<br/>          timeout     = optional(number, 10)<br/>          tags        = optional(map(string), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/><br/>      queue = optional(object({<br/>        delay_webhook_event            = optional(number, 30)<br/>        job_queue_retention_in_seconds = optional(number, 86400)<br/>        visibility_timeout_seconds     = optional(number, 180)<br/>        redrive_build_queue = optional(object({<br/>          enabled         = optional(bool, false)<br/>          maxReceiveCount = optional(number, null)<br/>          }), {<br/>          enabled         = false<br/>          maxReceiveCount = null<br/>        })<br/>        tags = optional(map(string), {})<br/>        encryption = optional(object({<br/>          kms_data_key_reuse_period_seconds = number<br/>          kms_master_key_id                 = string<br/>          sqs_managed_sse_enabled           = bool<br/>          }), {<br/>          kms_data_key_reuse_period_seconds = null<br/>          kms_master_key_id                 = null<br/>          sqs_managed_sse_enabled           = true<br/>        })<br/>      }), {})<br/><br/>    }), {})<br/><br/>    scale_set = optional(object({<br/>      grouping = optional(object({<br/>        strategy = optional(string, "compute_provider")<br/>        custom = optional(object({<br/>          groups = map(object({<br/>            runner_configs = set(string)<br/>          }))<br/>        }), null)<br/>      }), {})<br/>      container = optional(object({<br/>        image                             = optional(string, null)<br/>        user                              = optional(string, "10001:10001")<br/>        health_port                       = optional(number, 8080)<br/>        health_path                       = optional(string, "/healthz")<br/>        health_check_command              = optional(list(string), null)<br/>        health_check_interval             = optional(number, 30)<br/>        health_check_timeout              = optional(number, 5)<br/>        health_check_retries              = optional(number, 3)<br/>        health_check_start_period         = optional(number, 30)<br/>        health_stale_after_seconds        = optional(number, 180)<br/>        shutdown_timeout_seconds          = optional(number, 110)<br/>        session_close_timeout_seconds     = optional(number, 10)<br/>        reconnect_initial_backoff_seconds = optional(number, 1)<br/>        reconnect_max_backoff_seconds     = optional(number, 30)<br/>        stop_timeout_seconds              = optional(number, 120)<br/>      }), {})<br/>      config_store = optional(object({<br/>        path_prefix = optional(string, null)<br/>        tier        = optional(string, "Standard")<br/>        tags        = optional(map(string), {})<br/>      }), {})<br/>      ecs = optional(object({<br/>        cluster = optional(object({<br/>          mode               = optional(string, "managed")<br/>          arn                = optional(string, null)<br/>          name               = optional(string, null)<br/>          container_insights = optional(bool, true)<br/>        }), {})<br/>        task = optional(object({<br/>          cpu              = optional(number, 512)<br/>          memory           = optional(number, 1024)<br/>          cpu_architecture = optional(string, "X86_64")<br/>          ephemeral_storage = optional(object({<br/>            size_in_gib = number<br/>          }), null)<br/>        }), {})<br/>        service = optional(object({<br/>          platform_version = optional(string, "LATEST")<br/>        }), {})<br/>        iam = optional(object({<br/>          path                 = optional(string, "/")<br/>          permissions_boundary = optional(string, null)<br/>        }), {})<br/>      }), {})<br/>      network = optional(object({<br/>        vpc_id     = optional(string, null)<br/>        subnet_ids = optional(set(string), null)<br/>        https_egress = optional(object({<br/>          ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>          ipv6_cidrs = optional(set(string), [])<br/>        }), {})<br/>      }), {})<br/>      logging = optional(object({<br/>        retention_in_days = optional(number, 30)<br/>        kms_key_arn       = optional(string, null)<br/>        log_group_class   = optional(string, "STANDARD")<br/>        tags              = optional(map(string), {})<br/>      }), {})<br/>      tags = optional(map(string), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_ssm"></a> [global\_config\_ssm](#input\_global\_config\_ssm) | Global SSM configuration shared by all runner lanes.<br/><br/>global\_config\_ssm = {<br/>  paths.root: "Root path for SSM parameters."<br/>  paths.app: "Path segment for application parameters."<br/>  paths.webhook: "Path segment for webhook parameters."<br/>  paths.tokens: "Path segment for runner token parameters."<br/>  paths.config: "Path segment for runner configuration parameters."<br/>  kms\_key\_id: "KMS key ID used to encrypt SSM parameters."<br/>  tags: "Tags applied to SSM resources."<br/>  parameters.tags: "Tags applied to runner configuration parameters."<br/>  housekeeper.schedule\_expression: "Schedule for the SSM parameter housekeeper."<br/>  housekeeper.state: "EventBridge rule state for the SSM parameter housekeeper."<br/>  housekeeper.tags: "Tags applied to the SSM housekeeper resources."<br/>  housekeeper.lambda.artifact.zip: "Local ZIP artifact used for the SSM housekeeper Lambda."<br/>  housekeeper.lambda.artifact.s3.key: "S3 object key for the SSM housekeeper Lambda artifact."<br/>  housekeeper.lambda.artifact.s3.object\_version: "Optional S3 object version for the SSM housekeeper artifact."<br/>  housekeeper.lambda.memory\_size: "Memory allocated to the SSM housekeeper Lambda."<br/>  housekeeper.lambda.timeout: "Timeout in seconds for the SSM housekeeper Lambda."<br/>  housekeeper.config.tokenPath: "Parameter path containing runner tokens to clean up."<br/>  housekeeper.config.minimumDaysOld: "Minimum age in days before an old token is eligible for cleanup."<br/>  housekeeper.config.dryRun: "Whether the SSM housekeeper reports cleanup without deleting parameters."<br/>} | <pre>object({<br/>    paths = optional(object({<br/>      root    = optional(string, null)<br/>      app     = optional(string, "app")<br/>      webhook = optional(string, "webhook")<br/>      tokens  = optional(string, "runners/tokens")<br/>      config  = optional(string, "runners/config")<br/>    }), {})<br/>    kms_key_id = optional(string, null)<br/>    tags       = optional(map(string), {})<br/>    parameters = optional(object({<br/>      tags = optional(map(string), {})<br/>    }), {})<br/>    housekeeper = optional(object({<br/>      schedule_expression = optional(string, "rate(1 day)")<br/>      state               = optional(string, "ENABLED")<br/>      tags                = optional(map(string), {})<br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        memory_size = optional(number, 512)<br/>        timeout     = optional(number, 60)<br/>      }), {})<br/>      config = optional(object({<br/>        tokenPath      = optional(string, null)<br/>        minimumDaysOld = optional(number, 1)<br/>        dryRun         = optional(bool, false)<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_iam_overrides"></a> [iam\_overrides](#input\_iam\_overrides) | This map provides the possibility to override some IAM defaults. The following attributes are supported: `instance_profile_name` overrides the instance profile name used in the launch template. `runner_role_arn` overrides the IAM role ARN used for the runner instances. | <pre>object({<br/>    override_instance_profile = optional(bool, null)<br/>    instance_profile_name     = optional(string, null)<br/>    override_runner_role      = optional(bool, null)<br/>    runner_role_arn           = optional(string, null)<br/>  })</pre> | <pre>{<br/>  "instance_profile_name": null,<br/>  "override_instance_profile": false,<br/>  "override_runner_role": false,<br/>  "runner_role_arn": null<br/>}</pre> | no |
 | <a name="input_instance_profile_path"></a> [instance\_profile\_path](#input\_instance\_profile\_path) | The path that will be added to the instance\_profile, if not set the environment name will be used. | `string` | `null` | no |
@@ -188,7 +189,7 @@ module "multi-runner" {
 | <a name="input_logging_retention_in_days"></a> [logging\_retention\_in\_days](#input\_logging\_retention\_in\_days) | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `180` | no |
 | <a name="input_matcher_config_parameter_store_tier"></a> [matcher\_config\_parameter\_store\_tier](#input\_matcher\_config\_parameter\_store\_tier) | The tier of the parameter store for the matcher configuration. Valid values are `Standard`, and `Advanced`. | `string` | `"Standard"` | no |
 | <a name="input_metrics"></a> [metrics](#input\_metrics) | Configuration for metrics created by the module, by default metrics are disabled to avoid additional costs. When metrics are enable all metrics are created unless explicit configured otherwise. | <pre>object({<br/>    enable    = optional(bool, false)<br/>    namespace = optional(string, "GitHub Runners")<br/>    metric = optional(object({<br/>      enable_github_app_rate_limit    = optional(bool, true)<br/>      enable_job_retry                = optional(bool, true)<br/>      enable_spot_termination_warning = optional(bool, true)<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_multi_runner_config"></a> [multi\_runner\_config](#input\_multi\_runner\_config) | Accepts either the stable v1 runner configuration shape or the provider-boundary v2 shape. Entries with `runner_config` use the v1 shape; entries without `runner_config` use the v2 shape. A v2 entry does not need matcher configuration. A v2 entry must be acknowledged with `experimental_features = ["multi-runner-v2"]`; the v2 shape is experimental and may change before graduation.<br/><br/>    multi\_runner\_config = {<br/>      runner\_config: {<br/>        runner\_os: "The EC2 Operating System type to use for action runner instances (linux, osx, windows)."<br/>        runner\_architecture: "The platform architecture of the runner instance\_type."<br/>        runner\_metadata\_options: "(Optional) Metadata options for the ec2 runner instances."<br/>        ami: "(Optional) AMI configuration for the action runner instances. This object allows you to specify all AMI-related settings in one place."<br/>        create\_service\_linked\_role\_spot: (Optional) create the serviced linked role for spot instances that is required by the scale-up lambda.<br/>        credit\_specification: "(Optional) The credit specification of the runner instance\_type. Can be unset, `standard` or `unlimited`.<br/>        delay\_webhook\_event: "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."<br/>        disable\_runner\_autoupdate: "Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"<br/>        ebs\_optimized: "The EC2 EBS optimized configuration."<br/>        enable\_ephemeral\_runners: "Enable ephemeral runners, runners will only be used once."<br/>        enable\_job\_queued\_check: Enables JIT configuration for creating runners instead of registration token based registraton. JIT configuration will only be applied for ephemeral runners. By default JIT configuration is enabled for ephemeral runners an can be disabled via this override. When running on GHES without support for JIT configuration this variable should be set to true for ephemeral runners."<br/>        enable\_on\_demand\_failover\_for\_errors: "Enable on-demand failover. For example to fall back to on demand when no spot capacity is available the variable can be set to `InsufficientInstanceCapacity`. When not defined the default behavior is to retry later."<br/>        scale\_errors: "List of AWS error codes that should trigger retry during scale up. This list replaces the module default scale-up retry errors"<br/>        enable\_organization\_runners: "Register runners to organization, instead of repo level"<br/>        enable\_runner\_binaries\_syncer: "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."<br/>        enable\_ssm\_on\_runners: "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."<br/>        enable\_userdata: "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."<br/>        instance\_allocation\_strategy: "The allocation strategy for creating instances. For spot, AWS recommends `price-capacity-optimized`; for on-demand, use `lowest-price` or `prioritized`. The AWS default is `lowest-price`."<br/>        instance\_type\_priorities: "A map of instance type to priority for the `prioritized` and `capacity-optimized-prioritized` allocation strategies. Lower numbers mean higher priority. If not provided, priorities are assigned based on the order of `instance_types`."<br/>        instance\_max\_spot\_price: "Max price price for spot instances per hour. This variable will be passed to the create fleet as max spot price for the fleet."<br/>        instance\_target\_capacity\_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."<br/>        instance\_types: "List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux, macOS Sequoia for osx, Windows Server Core for win)."<br/>        job\_queue\_retention\_in\_seconds: "The number of seconds the job is held in the queue before it is purged"<br/>        minimum\_running\_time\_in\_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy."<br/>        pool\_runner\_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."<br/>        runner\_additional\_security\_group\_ids: "List of additional security groups IDs to apply to the runner. If added outside the multi\_runner\_config block, the additional security group(s) will be applied to all runner configs. If added inside the multi\_runner\_config, the additional security group(s) will be applied to the individual runner."<br/>        runner\_as\_root: "Run the action runner under the root user. Variable `runner_run_as` will be ignored."<br/>        runner\_boot\_time\_in\_minutes: "The minimum time for an EC2 runner to boot and register as a runner."<br/>        scale\_down\_idle\_confirmation\_seconds: "Number of seconds a runner must consistently report not-busy before scale-down terminates it. GitHub's busy flag can be stale, so a single not-busy reading is not sufficient evidence a runner is idle. 0 keeps the previous single-reading behaviour."<br/>        runner\_disable\_default\_labels: "Disable default labels for the runners (os, architecture and `self-hosted`). If enabled, the runner will only have the extra labels provided in `runner_extra_labels`. In case you on own start script is used, this configuration parameter needs to be parsed via SSM."<br/>        runner\_extra\_labels: "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `multi_runner_config.matcherConfig.exactMatch`. GitHub read-only labels should not be provided."<br/>        runner\_group\_name: "Name of the runner group."<br/>        runner\_name\_prefix: "Prefix for the GitHub runner name."<br/>        runner\_run\_as: "Run the GitHub actions agent as user."<br/>        runners\_maximum\_count: "The maximum number of runners that will be created. Setting the variable to `-1` disables the maximum check."<br/>        scale\_down\_schedule\_expression: "Scheduler expression to check every x for scale down."<br/>        scale\_up\_reserved\_concurrent\_executions: "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."<br/>        lambda\_event\_source\_mapping\_batch\_size: "(Optional) Maximum number of records per Lambda invocation for this runner flavor. Overrides the module-level `lambda_event_source_mapping_batch_size` when set."<br/>        lambda\_event\_source\_mapping\_maximum\_batching\_window\_in\_seconds: "(Optional) Maximum seconds to gather records before invoking Lambda for this runner flavor. Overrides the module-level `lambda_event_source_mapping_maximum_batching_window_in_seconds` when set."<br/>        userdata\_template: "Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored."<br/>        enable\_jit\_config: "Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is available. In case you are upgrading from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI."<br/>        enable\_runner\_detailed\_monitoring: "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."<br/>        enable\_cloudwatch\_agent: "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."<br/>        cloudwatch\_config: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."<br/>        userdata\_pre\_install: "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"<br/>        userdata\_post\_install: "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"<br/>        runner\_hook\_job\_started: "Script to be ran in the runner environment at the beginning of every job"<br/>        runner\_hook\_job\_completed: "Script to be ran in the runner environment at the end of every job"<br/>        runner\_ec2\_tags: "Map of tags that will be added to the launch template instance tag specifications."<br/>        runner\_iam\_role\_managed\_policy\_arns: "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"<br/>        vpc\_id: "The VPC for security groups of the action runners. If not set uses the value of `var.vpc_id`."<br/>        subnet\_ids: "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. If not set, uses the value of `var.subnet_ids`."<br/>        idle\_config: "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."<br/>        license\_specifications: "Optional EC2 License Manager license configuration ARNs for the runner launch template. Required for macOS dedicated-host runners when the host resource group uses a Mac dedicated host license configuration."<br/>        use\_dedicated\_host: "Experimental! Can be removed / changed without trigger a major release. Whether to use EC2 dedicated hosts for the runners. Needed for macos runners Note that using dedicated hosts can increase cost significantly."<br/>        runner\_log\_files: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."<br/>        block\_device\_mappings: "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`, `volume_initialization_rate`."<br/>        job\_retry: "Experimental! Can be removed / changed without trigger a major release. Configure job retries. The configuration enables job retries (for ephemeral runners). After creating the instances a message will be published to a job retry queue. The job retry check lambda is checking after a delay if the job is queued. If not the message will be published again on the scale-up (build queue). Using this feature can impact the rate limit of the GitHub app."<br/>        pool\_config: "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1. Use `schedule_expression_timezone` to override the schedule time zone (defaults to UTC)."<br/>        iam\_overrides: "Allows to (optionally) override the instance profile and runner role created by the module. Set `override_instance_profile` to true and provide the `instance_profile_name` to use an existing instance profile. Set `override_runner_role` to true and provide the `runner_role_arn` to use an existing role for the runner instances."<br/>      }<br/>      # V2 contract<br/>      tags: "Tags applied to resources created for this runner configuration."<br/>      runner: "Runner settings such as the operating system, architecture, labels, hooks, runner group, name prefix, and IAM role configuration."<br/>      lambda: "Lambda settings such as runtime, architecture, networking, tags, and execution-role options for this runner configuration."<br/>      # Webhook, queue, and scale-up/scale-down orchestration settings.<br/>      orchestration\_provider: {<br/>        webhook: {<br/>          matcherConfig: "Label matching and dynamic-label policy used to route workflow jobs to this runner configuration."<br/>          runner: "Runner lifecycle settings including boot time, ephemeral mode, JIT configuration, and maximum runner count."<br/>          queue: "Build queue delay, retention, visibility timeout, redrive, and tags."<br/>        }<br/>      }<br/>      ssm: "SSM parameter paths, tags, and housekeeper settings for runner configuration storage."<br/>      observability: "Logging, tracing, and metric settings for the resources in this runner configuration."<br/>      # Compute settings for the runner provider.<br/>      compute\_provider: {<br/>        aws: {<br/>          ec2: "AWS EC2 runner settings, including AMI selection, instance types, capacity strategy, VPC and subnet placement, storage, user data, and runner access."<br/>        }<br/>      }<br/>      matcherConfig: {<br/>        labelMatchers: "The list of list of labels supported by the runner configuration. `[[self-hosted, linux, x64, example]]`"<br/>        exactMatch: "DEPRECATED: Use `bidirectionalLabelMatch` instead. If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ workflow label matches it will trigger the webhook. Note: this only checks that workflow labels are a subset of runner labels, not the reverse."<br/>        bidirectionalLabelMatch: "If set to true, the runner labels and workflow job labels must be an exact two-way match (same set, any order, no extras or missing labels). This is stricter than `exactMatch` which only checks that workflow labels are a subset of runner labels. When false, if __any__ workflow label matches it will trigger the webhook."<br/>        priority: "If set it defines the priority of the matcher, the matcher with the lowest priority will be evaluated first. Default is 999, allowed values 0-999."<br/>        enableDynamicLabels: "Experimental! When true the dispatcher allows `ghr-*` dynamic labels for jobs routed to this runner. Default false."<br/>        awsDynamicLabelsPolicy: "Optional AWS dynamic label policy evaluated by the dispatcher. Only effective when `enableDynamicLabels = true`. Jobs whose provider dynamic labels violate every matching runner's policy are rejected with a 202 (a warning is logged). Evaluation: keys in `blocked_keys` are always rejected; keys in `restricted_keys` are allowed only when their value passes the rule; unlisted keys are allowed. Schema: `{ blocked_keys = [<key>], restricted_keys = { <key> = { allowed = [globs], denied = [globs], max = number|string } } }`. Keys use the dynamic label suffix, e.g. `instance-type` for `ghr-ec2-instance-type`."<br/>      }<br/>      redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."<br/>    } | <pre>map(object({<br/>    # V1 contract<br/>    runner_config = optional(object({<br/>      runner_os           = string<br/>      runner_architecture = string<br/>      runner_metadata_options = optional(map(any), {<br/>        instance_metadata_tags      = "enabled"<br/>        http_endpoint               = "enabled"<br/>        http_tokens                 = "required"<br/>        http_put_response_hop_limit = 1<br/>      })<br/>      ami = optional(object({<br/>        filter               = optional(map(list(string)), { state = ["available"] })<br/>        owners               = optional(list(string), ["amazon"])<br/>        id_ssm_parameter_arn = optional(string, null)<br/>        kms_key_arn          = optional(string, null)<br/>      }), null)<br/>      create_service_linked_role_spot      = optional(bool, false)<br/>      credit_specification                 = optional(string, null)<br/>      delay_webhook_event                  = optional(number, 30)<br/>      disable_runner_autoupdate            = optional(bool, false)<br/>      ebs_optimized                        = optional(bool, false)<br/>      enable_ephemeral_runners             = optional(bool, false)<br/>      enable_job_queued_check              = optional(bool, null)<br/>      enable_on_demand_failover_for_errors = optional(list(string), [])<br/>      scale_errors = optional(list(string), [<br/>        "UnfulfillableCapacity",<br/>        "MaxSpotInstanceCountExceeded",<br/>        "TargetCapacityLimitExceededException",<br/>        "RequestLimitExceeded",<br/>        "ResourceLimitExceeded",<br/>        "MaxSpotInstanceCountExceeded",<br/>        "MaxSpotFleetRequestCountExceeded",<br/>        "InsufficientInstanceCapacity",<br/>        "InsufficientCapacityOnHost",<br/>      ])<br/>      enable_organization_runners                                    = optional(bool, false)<br/>      enable_runner_binaries_syncer                                  = optional(bool, true)<br/>      enable_ssm_on_runners                                          = optional(bool, false)<br/>      enable_userdata                                                = optional(bool, true)<br/>      instance_allocation_strategy                                   = optional(string, "lowest-price")<br/>      instance_type_priorities                                       = optional(map(number), null)<br/>      instance_max_spot_price                                        = optional(string, null)<br/>      instance_target_capacity_type                                  = optional(string, "spot")<br/>      instance_types                                                 = list(string)<br/>      job_queue_retention_in_seconds                                 = optional(number, 86400)<br/>      minimum_running_time_in_minutes                                = optional(number, null)<br/>      pool_runner_owner                                              = optional(string, null)<br/>      runner_as_root                                                 = optional(bool, false)<br/>      runner_boot_time_in_minutes                                    = optional(number, 5)<br/>      scale_down_idle_confirmation_seconds                           = optional(number, 0)<br/>      runner_disable_default_labels                                  = optional(bool, false)<br/>      runner_extra_labels                                            = optional(list(string), [])<br/>      runner_group_name                                              = optional(string, "Default")<br/>      runner_name_prefix                                             = optional(string, "")<br/>      runner_run_as                                                  = optional(string, "ec2-user")<br/>      runners_maximum_count                                          = number<br/>      runner_additional_security_group_ids                           = optional(list(string), [])<br/>      scale_down_schedule_expression                                 = optional(string, "cron(*/5 * * * ? *)")<br/>      scale_up_reserved_concurrent_executions                        = optional(number, 1)<br/>      lambda_event_source_mapping_batch_size                         = optional(number, null)<br/>      lambda_event_source_mapping_maximum_batching_window_in_seconds = optional(number, null)<br/>      userdata_template                                              = optional(string, null)<br/>      userdata_content                                               = optional(string, null)<br/>      enable_jit_config                                              = optional(bool, null)<br/>      enable_runner_detailed_monitoring                              = optional(bool, false)<br/>      enable_cloudwatch_agent                                        = optional(bool, true)<br/>      cloudwatch_config                                              = optional(string, null)<br/>      userdata_pre_install                                           = optional(string, "")<br/>      userdata_post_install                                          = optional(string, "")<br/>      runner_hook_job_started                                        = optional(string, "")<br/>      runner_hook_job_completed                                      = optional(string, "")<br/>      runner_ec2_tags                                                = optional(map(string), {})<br/>      runner_iam_role_managed_policy_arns                            = optional(list(string), [])<br/>      vpc_id                                                         = optional(string, null)<br/>      subnet_ids                                                     = optional(list(string), null)<br/>      idle_config = optional(list(object({<br/>        cron             = string<br/>        timeZone         = string<br/>        idleCount        = number<br/>        evictionStrategy = optional(string, "oldest_first")<br/>      })), [])<br/>      cpu_options = optional(object({<br/>        core_count            = optional(number)<br/>        threads_per_core      = optional(number)<br/>        amd_sev_snp           = optional(string)<br/>        nested_virtualization = optional(string)<br/>      }), null)<br/>      placement = optional(object({<br/>        affinity                = optional(string)<br/>        availability_zone       = optional(string)<br/>        group_id                = optional(string)<br/>        group_name              = optional(string)<br/>        host_id                 = optional(string)<br/>        host_resource_group_arn = optional(string)<br/>        spread_domain           = optional(string)<br/>        tenancy                 = optional(string)<br/>        partition_number        = optional(number)<br/>      }), null)<br/>      license_specifications = optional(list(object({<br/>        license_configuration_arn = string<br/>      })), [])<br/>      use_dedicated_host = optional(bool, false)<br/>      runner_log_files = optional(list(object({<br/>        log_group_name   = string<br/>        prefix_log_group = bool<br/>        file_path        = string<br/>        log_stream_name  = string<br/>        log_class        = optional(string, "STANDARD")<br/>      })), null)<br/>      block_device_mappings = optional(list(object({<br/>        delete_on_termination      = optional(bool, true)<br/>        device_name                = optional(string, "/dev/xvda")<br/>        encrypted                  = optional(bool, true)<br/>        iops                       = optional(number)<br/>        kms_key_id                 = optional(string)<br/>        snapshot_id                = optional(string)<br/>        throughput                 = optional(number)<br/>        volume_initialization_rate = optional(number)<br/>        volume_size                = number<br/>        volume_type                = optional(string, "gp3")<br/>        })), [{<br/>        volume_size = 30<br/>      }])<br/>      pool_config = optional(list(object({<br/>        schedule_expression          = string<br/>        schedule_expression_timezone = optional(string)<br/>        size                         = number<br/>      })), [])<br/>      job_retry = optional(object({<br/>        enable             = optional(bool, false)<br/>        delay_in_seconds   = optional(number, 300)<br/>        delay_backoff      = optional(number, 2)<br/>        lambda_memory_size = optional(number, 256)<br/>        lambda_timeout     = optional(number, 30)<br/>        max_attempts       = optional(number, 1)<br/>      }), {})<br/>      iam_overrides = optional(object({<br/>        override_instance_profile = optional(bool, null)<br/>        instance_profile_name     = optional(string, null)<br/>        override_runner_role      = optional(bool, null)<br/>        runner_role_arn           = optional(string, null)<br/>        }), {<br/>        override_instance_profile = false<br/>        instance_profile_name     = null<br/>        override_runner_role      = false<br/>        runner_role_arn           = null<br/>      })<br/>    }), null)<br/>    matcherConfig = optional(object({<br/>      labelMatchers           = list(list(string))<br/>      exactMatch              = optional(bool, false)<br/>      bidirectionalLabelMatch = optional(bool, false)<br/>      priority                = optional(number, 999)<br/>      enableDynamicLabels     = optional(bool, false)<br/>      awsDynamicLabelsPolicy  = optional(any, null)<br/>    }), null)<br/>    redrive_build_queue = optional(object({<br/>      enabled         = bool<br/>      maxReceiveCount = number<br/>      }), {<br/>      enabled         = false<br/>      maxReceiveCount = null<br/>    })<br/><br/>    # V2 Contract<br/>    tags = optional(map(string), {})<br/><br/>    runner = optional(object({<br/>      os                     = optional(string, null)<br/>      architecture           = optional(string, null)<br/>      disable_default_labels = optional(bool, null)<br/>      extra_labels           = optional(list(string), null)<br/>      group_name             = optional(string, null)<br/>      name_prefix            = optional(string, null)<br/>      run_as_root            = optional(bool, null)<br/>      run_as                 = optional(string, null)<br/>      auto_update_disabled   = optional(bool, null)<br/>      tags                   = optional(map(string), {})<br/>      hooks = optional(object({<br/>        job_started   = optional(string, null)<br/>        job_completed = optional(string, null)<br/>      }), {})<br/>      iam = optional(object({<br/>        role = optional(object({<br/>          arn = string<br/>        }), null)<br/>        managed_policy_arns          = optional(map(string), null)<br/>        additional_trust_policy_json = optional(string, null)<br/>        path                         = optional(string, null)<br/>        permissions_boundary         = optional(string, null)<br/>      }), {})<br/>    }), {})<br/><br/>    lambda = optional(object({<br/>      runtime            = optional(string, null)<br/>      architecture       = optional(string, null)<br/>      subnet_ids         = optional(list(string), null)<br/>      security_group_ids = optional(list(string), null)<br/>      tags               = optional(map(string), {})<br/>      role = optional(object({<br/>        path                 = optional(string, null)<br/>        permissions_boundary = optional(string, null)<br/>      }), {})<br/>    }), {})<br/><br/>    orchestration_provider = optional(object({<br/>      webhook = optional(object({<br/>        runner = optional(object({<br/>          boot_time_in_minutes = optional(number, null)<br/>          ephemeral            = optional(bool, null)<br/>          jit_config_enabled   = optional(bool, null)<br/>          maximum_count        = optional(number, null)<br/>        }), {})<br/>        github = optional(object({<br/>          organization_runners = optional(bool, false)<br/>        }), {})<br/>        matcherConfig = optional(object({<br/>          labelMatchers           = list(list(string))<br/>          exactMatch              = optional(bool, false)<br/>          bidirectionalLabelMatch = optional(bool, false)<br/>          priority                = optional(number, 999)<br/>          dynamic_labels_enabled  = optional(bool, false)<br/>          awsDynamicLabelsPolicy = optional(object({<br/>            blocked_keys = optional(list(string), [])<br/>            restricted_keys = optional(map(object({<br/>              allowed = optional(list(string), [])<br/>              denied  = optional(list(string), [])<br/>              max     = optional(string, null)<br/>            })), {})<br/>          }), null)<br/>        }), null)<br/>        queue = optional(object({<br/>          delay_webhook_event            = optional(number, null)<br/>          job_queue_retention_in_seconds = optional(number, null)<br/>          visibility_timeout_seconds     = optional(number, null)<br/>          redrive_build_queue = optional(object({<br/>            enabled         = optional(bool, null)<br/>            maxReceiveCount = optional(number, null)<br/>          }), null)<br/>          tags = optional(map(string), {})<br/>        }), {})<br/>        lambda = optional(object({<br/>          scale = optional(object({<br/>            up = optional(object({<br/>              memory_size                    = optional(number, null)<br/>              timeout                        = optional(number, null)<br/>              reserved_concurrent_executions = optional(number, null)<br/>              job_queued_check_enabled       = optional(bool, null)<br/>              event_source_mapping = optional(object({<br/>                batch_size                         = optional(number, null)<br/>                maximum_batching_window_in_seconds = optional(number, null)<br/>              }), {})<br/>              tags = optional(map(string), {})<br/>            }), {})<br/>            down = optional(object({<br/>              memory_size                     = optional(number, null)<br/>              timeout                         = optional(number, null)<br/>              schedule_expression             = optional(string, null)<br/>              minimum_running_time_in_minutes = optional(number, null)<br/>              idle_confirmation_seconds       = optional(number, null)<br/>              idle_config = optional(list(object({<br/>                cron             = string<br/>                timeZone         = string<br/>                idleCount        = number<br/>                evictionStrategy = optional(string, "oldest_first")<br/>              })), null)<br/>              tags = optional(map(string), {})<br/>            }), {})<br/>          }), {})<br/>          pool = optional(object({<br/>            memory_size                    = optional(number, null)<br/>            timeout                        = optional(number, null)<br/>            reserved_concurrent_executions = optional(number, null)<br/>            config = optional(list(object({<br/>              schedule_expression          = string<br/>              schedule_expression_timezone = optional(string)<br/>              size                         = number<br/>            })), null)<br/>            include_busy_runners = optional(bool, null)<br/>            runner_owner         = optional(string, null)<br/>            tags                 = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled          = optional(bool, false)<br/>          delay_in_seconds = optional(number, 300)<br/>          delay_backoff    = optional(number, 2)<br/>          max_attempts     = optional(number, 1)<br/>          tags             = optional(map(string), {})<br/>          lambda = optional(object({<br/>            memory_size                    = optional(number, 256)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            timeout                        = optional(number, 30)<br/>          }), {})<br/>        }), {})<br/>      }), null)<br/>    }), {})<br/><br/>    ssm = optional(object({<br/>      paths = optional(object({<br/>        root   = optional(string, null)<br/>        tokens = optional(string, null)<br/>        config = optional(string, null)<br/>      }), {})<br/>      tags = optional(map(string), {})<br/>      parameters = optional(object({<br/>        tags = optional(map(string), {})<br/>      }), {})<br/>      housekeeper = optional(object({<br/>        schedule_expression = optional(string, null)<br/>        state               = optional(string, null)<br/>        tags                = optional(map(string), {})<br/>        lambda = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          memory_size = optional(number, null)<br/>          timeout     = optional(number, null)<br/>        }), {})<br/>        config = optional(object({<br/>          tokenPath      = optional(string, null)<br/>          minimumDaysOld = optional(number, null)<br/>          dryRun         = optional(bool, null)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/><br/>    observability = optional(object({<br/>      logs = optional(object({<br/>        level             = optional(string, null)<br/>        retention_in_days = optional(number, null)<br/>        kms_key_id        = optional(string, null)<br/>        class             = optional(string, null)<br/>        tags              = optional(map(string), {})<br/>      }), {})<br/>      tracing = optional(object({<br/>        mode                  = optional(string, null)<br/>        capture_http_requests = optional(bool, null)<br/>        capture_error         = optional(bool, null)<br/>      }), {})<br/>      metrics = optional(object({<br/>        enabled   = optional(bool, null)<br/>        namespace = optional(string, null)<br/>        metric = optional(object({<br/>          github_app_rate_limit = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          job_retry = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          spot_termination_warning = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/><br/>    compute_provider = optional(object({<br/>      aws = optional(object({<br/>        ec2 = optional(object({<br/>          metadata_options = optional(object({<br/>            instance_metadata_tags      = optional(string, "enabled")<br/>            http_endpoint               = optional(string, "enabled")<br/>            http_tokens                 = optional(string, "required")<br/>            http_put_response_hop_limit = optional(number, 1)<br/>          }), {})<br/>          ami = optional(object({<br/>            filter = optional(map(list(string)), { state = ["available"] })<br/>            owners = optional(list(string), ["amazon"])<br/>            id_ssm_parameter = optional(object({<br/>              arn = string<br/>            }), null)<br/>            kms_key = optional(object({<br/>              arn = string<br/>            }), null)<br/>          }), null)<br/>          block_device_mappings = optional(list(object({<br/>            delete_on_termination      = optional(bool, true)<br/>            device_name                = optional(string, "/dev/xvda")<br/>            encrypted                  = optional(bool, true)<br/>            iops                       = optional(number)<br/>            kms_key_id                 = optional(string)<br/>            snapshot_id                = optional(string)<br/>            throughput                 = optional(number)<br/>            volume_initialization_rate = optional(number)<br/>            volume_size                = number<br/>            volume_type                = optional(string, "gp3")<br/>          })), [{ volume_size = 30 }])<br/>          create_service_linked_role_spot = optional(bool, false)<br/>          credit_specification            = optional(string, null)<br/>          ebs_optimized                   = optional(bool, false)<br/>          cloudwatch_agent = optional(object({<br/>            enabled = optional(bool, true)<br/>            config  = optional(string, null)<br/>          }), {})<br/>          binaries_syncer = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          detailed_monitoring_enabled = optional(bool, false)<br/>          ssm_enabled                 = optional(bool, false)<br/>          user_data = optional(object({<br/>            enabled               = optional(bool, true)<br/>            template              = optional(string, null)<br/>            content               = optional(string, null)<br/>            pre_install           = optional(string, "")<br/>            post_install          = optional(string, "")<br/>            debug_logging_enabled = optional(bool, false)<br/>          }), {})<br/>          instance_allocation_strategy   = optional(string, "lowest-price")<br/>          instance_max_spot_price        = optional(string, null)<br/>          instance_target_capacity_type  = optional(string, "spot")<br/>          instance_type_priorities       = optional(map(number), null)<br/>          instance_types                 = optional(list(string), [])<br/>          additional_security_group_ids  = optional(list(string), null)<br/>          managed_security_group_enabled = optional(bool, null)<br/>          egress_rules = optional(list(object({<br/>            cidr_blocks      = list(string)<br/>            ipv6_cidr_blocks = list(string)<br/>            prefix_list_ids  = list(string)<br/>            from_port        = number<br/>            protocol         = string<br/>            security_groups  = list(string)<br/>            self             = bool<br/>            to_port          = number<br/>            description      = string<br/>          })), null)<br/>          instance_profile_path         = optional(string, null)<br/>          key_name                      = optional(string, null)<br/>          associate_public_ipv4_address = optional(bool, null)<br/>          instance_profile = optional(object({<br/>            name = string<br/>          }), null)<br/>          on_demand_failover_for_errors = optional(list(string), [])<br/>          scale_errors = optional(list(string), [<br/>            "UnfulfillableCapacity",<br/>            "MaxSpotInstanceCountExceeded",<br/>            "TargetCapacityLimitExceededException",<br/>            "RequestLimitExceeded",<br/>            "ResourceLimitExceeded",<br/>            "MaxSpotInstanceCountExceeded",<br/>            "MaxSpotFleetRequestCountExceeded",<br/>            "InsufficientInstanceCapacity",<br/>            "InsufficientCapacityOnHost",<br/>          ])<br/>          subnet_ids = optional(list(string), null)<br/>          vpc_id     = optional(string, null)<br/>          cpu_options = optional(object({<br/>            core_count            = optional(number)<br/>            threads_per_core      = optional(number)<br/>            amd_sev_snp           = optional(string)<br/>            nested_virtualization = optional(string)<br/>          }), null)<br/>          placement = optional(object({<br/>            affinity                = optional(string)<br/>            availability_zone       = optional(string)<br/>            group_id                = optional(string)<br/>            group_name              = optional(string)<br/>            host_id                 = optional(string)<br/>            host_resource_group_arn = optional(string)<br/>            spread_domain           = optional(string)<br/>            tenancy                 = optional(string)<br/>            partition_number        = optional(number)<br/>          }), null)<br/>          license_specifications = optional(list(object({<br/>            license_configuration_arn = string<br/>          })), [])<br/>          use_dedicated_host = optional(bool, false)<br/>          log_files = optional(list(object({<br/>            log_group_name   = string<br/>            prefix_log_group = bool<br/>            file_path        = string<br/>            log_stream_name  = string<br/>            log_class        = optional(string, "STANDARD")<br/>          })), null)<br/>          tags = optional(map(string), {})<br/>        }), null)<br/>      }), {})<br/>    }), {})<br/>  }))</pre> | `{}` | no |
+| <a name="input_multi_runner_config"></a> [multi\_runner\_config](#input\_multi\_runner\_config) | Accepts either the stable v1 runner configuration shape or the provider-boundary v2 shape. Entries with `runner_config` use the v1 shape; entries without `runner_config` use the v2 shape. A v2 entry does not need matcher configuration. A v2 entry must be acknowledged with `experimental_features = ["multi-runner-v2"]`; the v2 shape is experimental and may change before graduation.<br/><br/>    multi\_runner\_config = {<br/>      runner\_config: {<br/>        runner\_os: "The EC2 Operating System type to use for action runner instances (linux, osx, windows)."<br/>        runner\_architecture: "The platform architecture of the runner instance\_type."<br/>        runner\_metadata\_options: "(Optional) Metadata options for the ec2 runner instances."<br/>        ami: "(Optional) AMI configuration for the action runner instances. This object allows you to specify all AMI-related settings in one place."<br/>        create\_service\_linked\_role\_spot: (Optional) create the serviced linked role for spot instances that is required by the scale-up lambda.<br/>        credit\_specification: "(Optional) The credit specification of the runner instance\_type. Can be unset, `standard` or `unlimited`.<br/>        delay\_webhook\_event: "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."<br/>        disable\_runner\_autoupdate: "Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"<br/>        ebs\_optimized: "The EC2 EBS optimized configuration."<br/>        enable\_ephemeral\_runners: "Enable ephemeral runners, runners will only be used once."<br/>        enable\_job\_queued\_check: Enables JIT configuration for creating runners instead of registration token based registraton. JIT configuration will only be applied for ephemeral runners. By default JIT configuration is enabled for ephemeral runners an can be disabled via this override. When running on GHES without support for JIT configuration this variable should be set to true for ephemeral runners."<br/>        enable\_on\_demand\_failover\_for\_errors: "Enable on-demand failover. For example to fall back to on demand when no spot capacity is available the variable can be set to `InsufficientInstanceCapacity`. When not defined the default behavior is to retry later."<br/>        scale\_errors: "List of AWS error codes that should trigger retry during scale up. This list replaces the module default scale-up retry errors"<br/>        enable\_organization\_runners: "Register runners to organization, instead of repo level"<br/>        enable\_runner\_binaries\_syncer: "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."<br/>        enable\_ssm\_on\_runners: "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."<br/>        enable\_userdata: "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."<br/>        instance\_allocation\_strategy: "The allocation strategy for creating instances. For spot, AWS recommends `price-capacity-optimized`; for on-demand, use `lowest-price` or `prioritized`. The AWS default is `lowest-price`."<br/>        instance\_type\_priorities: "A map of instance type to priority for the `prioritized` and `capacity-optimized-prioritized` allocation strategies. Lower numbers mean higher priority. If not provided, priorities are assigned based on the order of `instance_types`."<br/>        instance\_max\_spot\_price: "Max price price for spot instances per hour. This variable will be passed to the create fleet as max spot price for the fleet."<br/>        instance\_target\_capacity\_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."<br/>        instance\_types: "List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux, macOS Sequoia for osx, Windows Server Core for win)."<br/>        job\_queue\_retention\_in\_seconds: "The number of seconds the job is held in the queue before it is purged"<br/>        minimum\_running\_time\_in\_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy."<br/>        pool\_runner\_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."<br/>        runner\_additional\_security\_group\_ids: "List of additional security groups IDs to apply to the runner. If added outside the multi\_runner\_config block, the additional security group(s) will be applied to all runner configs. If added inside the multi\_runner\_config, the additional security group(s) will be applied to the individual runner."<br/>        runner\_as\_root: "Run the action runner under the root user. Variable `runner_run_as` will be ignored."<br/>        runner\_boot\_time\_in\_minutes: "The minimum time for an EC2 runner to boot and register as a runner."<br/>        scale\_down\_idle\_confirmation\_seconds: "Number of seconds a runner must consistently report not-busy before scale-down terminates it. GitHub's busy flag can be stale, so a single not-busy reading is not sufficient evidence a runner is idle. 0 keeps the previous single-reading behaviour."<br/>        runner\_disable\_default\_labels: "Disable default labels for the runners (os, architecture and `self-hosted`). If enabled, the runner will only have the extra labels provided in `runner_extra_labels`. In case you on own start script is used, this configuration parameter needs to be parsed via SSM."<br/>        runner\_extra\_labels: "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `multi_runner_config.matcherConfig.exactMatch`. GitHub read-only labels should not be provided."<br/>        runner\_group\_name: "Name of the runner group."<br/>        runner\_name\_prefix: "Prefix for the GitHub runner name."<br/>        runner\_run\_as: "Run the GitHub actions agent as user."<br/>        runners\_maximum\_count: "The maximum number of runners that will be created. Setting the variable to `-1` disables the maximum check."<br/>        scale\_down\_schedule\_expression: "Scheduler expression to check every x for scale down."<br/>        scale\_up\_reserved\_concurrent\_executions: "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."<br/>        lambda\_event\_source\_mapping\_batch\_size: "(Optional) Maximum number of records per Lambda invocation for this runner flavor. Overrides the module-level `lambda_event_source_mapping_batch_size` when set."<br/>        lambda\_event\_source\_mapping\_maximum\_batching\_window\_in\_seconds: "(Optional) Maximum seconds to gather records before invoking Lambda for this runner flavor. Overrides the module-level `lambda_event_source_mapping_maximum_batching_window_in_seconds` when set."<br/>        userdata\_template: "Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored."<br/>        enable\_jit\_config: "Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is available. In case you are upgrading from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI."<br/>        enable\_runner\_detailed\_monitoring: "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."<br/>        enable\_cloudwatch\_agent: "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."<br/>        cloudwatch\_config: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."<br/>        userdata\_pre\_install: "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"<br/>        userdata\_post\_install: "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"<br/>        runner\_hook\_job\_started: "Script to be ran in the runner environment at the beginning of every job"<br/>        runner\_hook\_job\_completed: "Script to be ran in the runner environment at the end of every job"<br/>        runner\_ec2\_tags: "Map of tags that will be added to the launch template instance tag specifications."<br/>        runner\_iam\_role\_managed\_policy\_arns: "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"<br/>        vpc\_id: "The VPC for security groups of the action runners. If not set uses the value of `var.vpc_id`."<br/>        subnet\_ids: "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. If not set, uses the value of `var.subnet_ids`."<br/>        idle\_config: "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."<br/>        license\_specifications: "Optional EC2 License Manager license configuration ARNs for the runner launch template. Required for macOS dedicated-host runners when the host resource group uses a Mac dedicated host license configuration."<br/>        use\_dedicated\_host: "Experimental! Can be removed / changed without trigger a major release. Whether to use EC2 dedicated hosts for the runners. Needed for macos runners Note that using dedicated hosts can increase cost significantly."<br/>        runner\_log\_files: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."<br/>        block\_device\_mappings: "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`, `volume_initialization_rate`."<br/>        job\_retry: "Experimental! Can be removed / changed without trigger a major release. Configure job retries. The configuration enables job retries (for ephemeral runners). After creating the instances a message will be published to a job retry queue. The job retry check lambda is checking after a delay if the job is queued. If not the message will be published again on the scale-up (build queue). Using this feature can impact the rate limit of the GitHub app."<br/>        pool\_config: "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1. Use `schedule_expression_timezone` to override the schedule time zone (defaults to UTC)."<br/>        iam\_overrides: "Allows to (optionally) override the instance profile and runner role created by the module. Set `override_instance_profile` to true and provide the `instance_profile_name` to use an existing instance profile. Set `override_runner_role` to true and provide the `runner_role_arn` to use an existing role for the runner instances."<br/>      }<br/>      # V2 contract<br/>      tags: "Tags applied to resources created for this runner configuration."<br/>      runner: "Runner settings such as the operating system, architecture, labels, hooks, runner group, name prefix, and IAM role configuration."<br/>      lambda: "Lambda settings such as runtime, architecture, networking, tags, and execution-role options for this runner configuration."<br/>      # Webhook, queue, and scale-up/scale-down orchestration settings.<br/>      orchestration\_provider: {<br/>        webhook: {<br/>          matcherConfig: "Label matching and dynamic-label policy used to route workflow jobs to this runner configuration."<br/>          runner: "Runner lifecycle settings including boot time, ephemeral mode, JIT configuration, and maximum runner count."<br/>          queue: "Build queue delay, retention, visibility timeout, redrive, and tags."<br/>        }<br/>      }<br/>      ssm: "SSM parameter paths, tags, and housekeeper settings for runner configuration storage."<br/>      observability: "Logging, tracing, and metric settings for the resources in this runner configuration."<br/>      # Compute settings for the runner provider.<br/>      compute\_provider: {<br/>        aws: {<br/>          ec2: "AWS EC2 runner settings, including AMI selection, instance types, capacity strategy, VPC and subnet placement, storage, user data, and runner access."<br/>        }<br/>      }<br/>      matcherConfig: {<br/>        labelMatchers: "The list of list of labels supported by the runner configuration. `[[self-hosted, linux, x64, example]]`"<br/>        exactMatch: "DEPRECATED: Use `bidirectionalLabelMatch` instead. If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ workflow label matches it will trigger the webhook. Note: this only checks that workflow labels are a subset of runner labels, not the reverse."<br/>        bidirectionalLabelMatch: "If set to true, the runner labels and workflow job labels must be an exact two-way match (same set, any order, no extras or missing labels). This is stricter than `exactMatch` which only checks that workflow labels are a subset of runner labels. When false, if __any__ workflow label matches it will trigger the webhook."<br/>        priority: "If set it defines the priority of the matcher, the matcher with the lowest priority will be evaluated first. Default is 999, allowed values 0-999."<br/>        enableDynamicLabels: "Experimental! When true the dispatcher allows `ghr-*` dynamic labels for jobs routed to this runner. Default false."<br/>        awsDynamicLabelsPolicy: "Optional AWS dynamic label policy evaluated by the dispatcher. Only effective when `enableDynamicLabels = true`. Jobs whose provider dynamic labels violate every matching runner's policy are rejected with a 202 (a warning is logged). Evaluation: keys in `blocked_keys` are always rejected; keys in `restricted_keys` are allowed only when their value passes the rule; unlisted keys are allowed. Schema: `{ blocked_keys = [<key>], restricted_keys = { <key> = { allowed = [globs], denied = [globs], max = number|string } } }`. Keys use the dynamic label suffix, e.g. `instance-type` for `ghr-ec2-instance-type`."<br/>      }<br/>      redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."<br/>    } | <pre>map(object({<br/>    # V1 contract<br/>    runner_config = optional(object({<br/>      runner_os           = string<br/>      runner_architecture = string<br/>      runner_metadata_options = optional(map(any), {<br/>        instance_metadata_tags      = "enabled"<br/>        http_endpoint               = "enabled"<br/>        http_tokens                 = "required"<br/>        http_put_response_hop_limit = 1<br/>      })<br/>      ami = optional(object({<br/>        filter               = optional(map(list(string)), { state = ["available"] })<br/>        owners               = optional(list(string), ["amazon"])<br/>        id_ssm_parameter_arn = optional(string, null)<br/>        kms_key_arn          = optional(string, null)<br/>      }), null)<br/>      create_service_linked_role_spot      = optional(bool, false)<br/>      credit_specification                 = optional(string, null)<br/>      delay_webhook_event                  = optional(number, 30)<br/>      disable_runner_autoupdate            = optional(bool, false)<br/>      ebs_optimized                        = optional(bool, false)<br/>      enable_ephemeral_runners             = optional(bool, false)<br/>      enable_job_queued_check              = optional(bool, null)<br/>      enable_on_demand_failover_for_errors = optional(list(string), [])<br/>      scale_errors = optional(list(string), [<br/>        "UnfulfillableCapacity",<br/>        "MaxSpotInstanceCountExceeded",<br/>        "TargetCapacityLimitExceededException",<br/>        "RequestLimitExceeded",<br/>        "ResourceLimitExceeded",<br/>        "MaxSpotInstanceCountExceeded",<br/>        "MaxSpotFleetRequestCountExceeded",<br/>        "InsufficientInstanceCapacity",<br/>        "InsufficientCapacityOnHost",<br/>      ])<br/>      enable_organization_runners                                    = optional(bool, false)<br/>      enable_runner_binaries_syncer                                  = optional(bool, true)<br/>      enable_ssm_on_runners                                          = optional(bool, false)<br/>      enable_userdata                                                = optional(bool, true)<br/>      instance_allocation_strategy                                   = optional(string, "lowest-price")<br/>      instance_type_priorities                                       = optional(map(number), null)<br/>      instance_max_spot_price                                        = optional(string, null)<br/>      instance_target_capacity_type                                  = optional(string, "spot")<br/>      instance_types                                                 = list(string)<br/>      job_queue_retention_in_seconds                                 = optional(number, 86400)<br/>      minimum_running_time_in_minutes                                = optional(number, null)<br/>      pool_runner_owner                                              = optional(string, null)<br/>      runner_as_root                                                 = optional(bool, false)<br/>      runner_boot_time_in_minutes                                    = optional(number, 5)<br/>      scale_down_idle_confirmation_seconds                           = optional(number, 0)<br/>      runner_disable_default_labels                                  = optional(bool, false)<br/>      runner_extra_labels                                            = optional(list(string), [])<br/>      runner_group_name                                              = optional(string, "Default")<br/>      runner_name_prefix                                             = optional(string, "")<br/>      runner_run_as                                                  = optional(string, "ec2-user")<br/>      runners_maximum_count                                          = number<br/>      runner_additional_security_group_ids                           = optional(list(string), [])<br/>      scale_down_schedule_expression                                 = optional(string, "cron(*/5 * * * ? *)")<br/>      scale_up_reserved_concurrent_executions                        = optional(number, 1)<br/>      lambda_event_source_mapping_batch_size                         = optional(number, null)<br/>      lambda_event_source_mapping_maximum_batching_window_in_seconds = optional(number, null)<br/>      userdata_template                                              = optional(string, null)<br/>      userdata_content                                               = optional(string, null)<br/>      enable_jit_config                                              = optional(bool, null)<br/>      enable_runner_detailed_monitoring                              = optional(bool, false)<br/>      enable_cloudwatch_agent                                        = optional(bool, true)<br/>      cloudwatch_config                                              = optional(string, null)<br/>      userdata_pre_install                                           = optional(string, "")<br/>      userdata_post_install                                          = optional(string, "")<br/>      runner_hook_job_started                                        = optional(string, "")<br/>      runner_hook_job_completed                                      = optional(string, "")<br/>      runner_ec2_tags                                                = optional(map(string), {})<br/>      runner_iam_role_managed_policy_arns                            = optional(list(string), [])<br/>      vpc_id                                                         = optional(string, null)<br/>      subnet_ids                                                     = optional(list(string), null)<br/>      idle_config = optional(list(object({<br/>        cron             = string<br/>        timeZone         = string<br/>        idleCount        = number<br/>        evictionStrategy = optional(string, "oldest_first")<br/>      })), [])<br/>      cpu_options = optional(object({<br/>        core_count            = optional(number)<br/>        threads_per_core      = optional(number)<br/>        amd_sev_snp           = optional(string)<br/>        nested_virtualization = optional(string)<br/>      }), null)<br/>      placement = optional(object({<br/>        affinity                = optional(string)<br/>        availability_zone       = optional(string)<br/>        group_id                = optional(string)<br/>        group_name              = optional(string)<br/>        host_id                 = optional(string)<br/>        host_resource_group_arn = optional(string)<br/>        spread_domain           = optional(string)<br/>        tenancy                 = optional(string)<br/>        partition_number        = optional(number)<br/>      }), null)<br/>      license_specifications = optional(list(object({<br/>        license_configuration_arn = string<br/>      })), [])<br/>      use_dedicated_host = optional(bool, false)<br/>      runner_log_files = optional(list(object({<br/>        log_group_name   = string<br/>        prefix_log_group = bool<br/>        file_path        = string<br/>        log_stream_name  = string<br/>        log_class        = optional(string, "STANDARD")<br/>      })), null)<br/>      block_device_mappings = optional(list(object({<br/>        delete_on_termination      = optional(bool, true)<br/>        device_name                = optional(string, "/dev/xvda")<br/>        encrypted                  = optional(bool, true)<br/>        iops                       = optional(number)<br/>        kms_key_id                 = optional(string)<br/>        snapshot_id                = optional(string)<br/>        throughput                 = optional(number)<br/>        volume_initialization_rate = optional(number)<br/>        volume_size                = number<br/>        volume_type                = optional(string, "gp3")<br/>        })), [{<br/>        volume_size = 30<br/>      }])<br/>      pool_config = optional(list(object({<br/>        schedule_expression          = string<br/>        schedule_expression_timezone = optional(string)<br/>        size                         = number<br/>      })), [])<br/>      job_retry = optional(object({<br/>        enable             = optional(bool, false)<br/>        delay_in_seconds   = optional(number, 300)<br/>        delay_backoff      = optional(number, 2)<br/>        lambda_memory_size = optional(number, 256)<br/>        lambda_timeout     = optional(number, 30)<br/>        max_attempts       = optional(number, 1)<br/>      }), {})<br/>      iam_overrides = optional(object({<br/>        override_instance_profile = optional(bool, null)<br/>        instance_profile_name     = optional(string, null)<br/>        override_runner_role      = optional(bool, null)<br/>        runner_role_arn           = optional(string, null)<br/>        }), {<br/>        override_instance_profile = false<br/>        instance_profile_name     = null<br/>        override_runner_role      = false<br/>        runner_role_arn           = null<br/>      })<br/>    }), null)<br/>    matcherConfig = optional(object({<br/>      labelMatchers           = list(list(string))<br/>      exactMatch              = optional(bool, false)<br/>      bidirectionalLabelMatch = optional(bool, false)<br/>      priority                = optional(number, 999)<br/>      enableDynamicLabels     = optional(bool, false)<br/>      awsDynamicLabelsPolicy  = optional(any, null)<br/>    }), null)<br/>    redrive_build_queue = optional(object({<br/>      enabled         = bool<br/>      maxReceiveCount = number<br/>      }), {<br/>      enabled         = false<br/>      maxReceiveCount = null<br/>    })<br/><br/>    # V2 Contract<br/>    tags = optional(map(string), {})<br/><br/>    runner = optional(object({<br/>      os                     = optional(string, null)<br/>      architecture           = optional(string, null)<br/>      disable_default_labels = optional(bool, null)<br/>      extra_labels           = optional(list(string), null)<br/>      group_name             = optional(string, null)<br/>      name_prefix            = optional(string, null)<br/>      run_as_root            = optional(bool, null)<br/>      run_as                 = optional(string, null)<br/>      auto_update_disabled   = optional(bool, null)<br/>      tags                   = optional(map(string), {})<br/>      hooks = optional(object({<br/>        job_started   = optional(string, null)<br/>        job_completed = optional(string, null)<br/>      }), {})<br/>      iam = optional(object({<br/>        role = optional(object({<br/>          arn = string<br/>        }), null)<br/>        managed_policy_arns          = optional(map(string), null)<br/>        additional_trust_policy_json = optional(string, null)<br/>        path                         = optional(string, null)<br/>        permissions_boundary         = optional(string, null)<br/>      }), {})<br/>    }), {})<br/><br/>    lambda = optional(object({<br/>      runtime            = optional(string, null)<br/>      architecture       = optional(string, null)<br/>      subnet_ids         = optional(list(string), null)<br/>      security_group_ids = optional(list(string), null)<br/>      tags               = optional(map(string), {})<br/>      role = optional(object({<br/>        path                 = optional(string, null)<br/>        permissions_boundary = optional(string, null)<br/>      }), {})<br/>    }), {})<br/><br/>    orchestration_provider = optional(object({<br/>      webhook = optional(object({<br/>        runner = optional(object({<br/>          boot_time_in_minutes = optional(number, null)<br/>          ephemeral            = optional(bool, null)<br/>          jit_config_enabled   = optional(bool, null)<br/>          maximum_count        = optional(number, null)<br/>        }), {})<br/>        github = optional(object({<br/>          organization_runners = optional(bool, false)<br/>        }), {})<br/>        matcherConfig = optional(object({<br/>          labelMatchers           = list(list(string))<br/>          exactMatch              = optional(bool, false)<br/>          bidirectionalLabelMatch = optional(bool, false)<br/>          priority                = optional(number, 999)<br/>          dynamic_labels_enabled  = optional(bool, false)<br/>          awsDynamicLabelsPolicy = optional(object({<br/>            blocked_keys = optional(list(string), [])<br/>            restricted_keys = optional(map(object({<br/>              allowed = optional(list(string), [])<br/>              denied  = optional(list(string), [])<br/>              max     = optional(string, null)<br/>            })), {})<br/>          }), null)<br/>        }), null)<br/>        queue = optional(object({<br/>          delay_webhook_event            = optional(number, null)<br/>          job_queue_retention_in_seconds = optional(number, null)<br/>          visibility_timeout_seconds     = optional(number, null)<br/>          redrive_build_queue = optional(object({<br/>            enabled         = optional(bool, null)<br/>            maxReceiveCount = optional(number, null)<br/>          }), null)<br/>          tags = optional(map(string), {})<br/>        }), {})<br/>        lambda = optional(object({<br/>          scale = optional(object({<br/>            up = optional(object({<br/>              memory_size                    = optional(number, null)<br/>              timeout                        = optional(number, null)<br/>              reserved_concurrent_executions = optional(number, null)<br/>              job_queued_check_enabled       = optional(bool, null)<br/>              event_source_mapping = optional(object({<br/>                batch_size                         = optional(number, null)<br/>                maximum_batching_window_in_seconds = optional(number, null)<br/>              }), {})<br/>              tags = optional(map(string), {})<br/>            }), {})<br/>            down = optional(object({<br/>              memory_size                     = optional(number, null)<br/>              timeout                         = optional(number, null)<br/>              schedule_expression             = optional(string, null)<br/>              minimum_running_time_in_minutes = optional(number, null)<br/>              idle_confirmation_seconds       = optional(number, null)<br/>              idle_config = optional(list(object({<br/>                cron             = string<br/>                timeZone         = string<br/>                idleCount        = number<br/>                evictionStrategy = optional(string, "oldest_first")<br/>              })), null)<br/>              tags = optional(map(string), {})<br/>            }), {})<br/>          }), {})<br/>          pool = optional(object({<br/>            memory_size                    = optional(number, null)<br/>            timeout                        = optional(number, null)<br/>            reserved_concurrent_executions = optional(number, null)<br/>            config = optional(list(object({<br/>              schedule_expression          = string<br/>              schedule_expression_timezone = optional(string)<br/>              size                         = number<br/>            })), null)<br/>            include_busy_runners = optional(bool, null)<br/>            runner_owner         = optional(string, null)<br/>            tags                 = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled          = optional(bool, false)<br/>          delay_in_seconds = optional(number, 300)<br/>          delay_backoff    = optional(number, 2)<br/>          max_attempts     = optional(number, 1)<br/>          tags             = optional(map(string), {})<br/>          lambda = optional(object({<br/>            memory_size                    = optional(number, 256)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            timeout                        = optional(number, 30)<br/>          }), {})<br/>        }), {})<br/>      }), null)<br/>      scale_set = optional(object({<br/>        name = string<br/>        runner = optional(object({<br/>          min_runners          = optional(number, 0)<br/>          max_runners          = optional(number, 10)<br/>          boot_time_in_minutes = optional(number, 10)<br/>        }), {})<br/>      }), null)<br/>    }), {})<br/><br/>    ssm = optional(object({<br/>      paths = optional(object({<br/>        root   = optional(string, null)<br/>        tokens = optional(string, null)<br/>        config = optional(string, null)<br/>      }), {})<br/>      tags = optional(map(string), {})<br/>      parameters = optional(object({<br/>        tags = optional(map(string), {})<br/>      }), {})<br/>      housekeeper = optional(object({<br/>        schedule_expression = optional(string, null)<br/>        state               = optional(string, null)<br/>        tags                = optional(map(string), {})<br/>        lambda = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          memory_size = optional(number, null)<br/>          timeout     = optional(number, null)<br/>        }), {})<br/>        config = optional(object({<br/>          tokenPath      = optional(string, null)<br/>          minimumDaysOld = optional(number, null)<br/>          dryRun         = optional(bool, null)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/><br/>    observability = optional(object({<br/>      logs = optional(object({<br/>        level             = optional(string, null)<br/>        retention_in_days = optional(number, null)<br/>        kms_key_id        = optional(string, null)<br/>        class             = optional(string, null)<br/>        tags              = optional(map(string), {})<br/>      }), {})<br/>      tracing = optional(object({<br/>        mode                  = optional(string, null)<br/>        capture_http_requests = optional(bool, null)<br/>        capture_error         = optional(bool, null)<br/>      }), {})<br/>      metrics = optional(object({<br/>        enabled   = optional(bool, null)<br/>        namespace = optional(string, null)<br/>        metric = optional(object({<br/>          github_app_rate_limit = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          job_retry = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          spot_termination_warning = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/><br/>    compute_provider = optional(object({<br/>      aws = optional(object({<br/>        ec2 = optional(object({<br/>          metadata_options = optional(object({<br/>            instance_metadata_tags      = optional(string, "enabled")<br/>            http_endpoint               = optional(string, "enabled")<br/>            http_tokens                 = optional(string, "required")<br/>            http_put_response_hop_limit = optional(number, 1)<br/>          }), {})<br/>          ami = optional(object({<br/>            filter = optional(map(list(string)), { state = ["available"] })<br/>            owners = optional(list(string), ["amazon"])<br/>            id_ssm_parameter = optional(object({<br/>              arn = string<br/>            }), null)<br/>            kms_key = optional(object({<br/>              arn = string<br/>            }), null)<br/>          }), null)<br/>          block_device_mappings = optional(list(object({<br/>            delete_on_termination      = optional(bool, true)<br/>            device_name                = optional(string, "/dev/xvda")<br/>            encrypted                  = optional(bool, true)<br/>            iops                       = optional(number)<br/>            kms_key_id                 = optional(string)<br/>            snapshot_id                = optional(string)<br/>            throughput                 = optional(number)<br/>            volume_initialization_rate = optional(number)<br/>            volume_size                = number<br/>            volume_type                = optional(string, "gp3")<br/>          })), [{ volume_size = 30 }])<br/>          create_service_linked_role_spot = optional(bool, false)<br/>          credit_specification            = optional(string, null)<br/>          ebs_optimized                   = optional(bool, false)<br/>          cloudwatch_agent = optional(object({<br/>            enabled = optional(bool, true)<br/>            config  = optional(string, null)<br/>          }), {})<br/>          binaries_syncer = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          detailed_monitoring_enabled = optional(bool, false)<br/>          ssm_enabled                 = optional(bool, false)<br/>          user_data = optional(object({<br/>            enabled               = optional(bool, true)<br/>            template              = optional(string, null)<br/>            content               = optional(string, null)<br/>            pre_install           = optional(string, "")<br/>            post_install          = optional(string, "")<br/>            debug_logging_enabled = optional(bool, false)<br/>          }), {})<br/>          instance_allocation_strategy   = optional(string, "lowest-price")<br/>          instance_max_spot_price        = optional(string, null)<br/>          instance_target_capacity_type  = optional(string, "spot")<br/>          instance_type_priorities       = optional(map(number), null)<br/>          instance_types                 = optional(list(string), [])<br/>          additional_security_group_ids  = optional(list(string), null)<br/>          managed_security_group_enabled = optional(bool, null)<br/>          egress_rules = optional(list(object({<br/>            cidr_blocks      = list(string)<br/>            ipv6_cidr_blocks = list(string)<br/>            prefix_list_ids  = list(string)<br/>            from_port        = number<br/>            protocol         = string<br/>            security_groups  = list(string)<br/>            self             = bool<br/>            to_port          = number<br/>            description      = string<br/>          })), null)<br/>          instance_profile_path         = optional(string, null)<br/>          key_name                      = optional(string, null)<br/>          associate_public_ipv4_address = optional(bool, null)<br/>          instance_profile = optional(object({<br/>            name = string<br/>          }), null)<br/>          on_demand_failover_for_errors = optional(list(string), [])<br/>          scale_errors = optional(list(string), [<br/>            "UnfulfillableCapacity",<br/>            "MaxSpotInstanceCountExceeded",<br/>            "TargetCapacityLimitExceededException",<br/>            "RequestLimitExceeded",<br/>            "ResourceLimitExceeded",<br/>            "MaxSpotInstanceCountExceeded",<br/>            "MaxSpotFleetRequestCountExceeded",<br/>            "InsufficientInstanceCapacity",<br/>            "InsufficientCapacityOnHost",<br/>          ])<br/>          subnet_ids = optional(list(string), null)<br/>          vpc_id     = optional(string, null)<br/>          cpu_options = optional(object({<br/>            core_count            = optional(number)<br/>            threads_per_core      = optional(number)<br/>            amd_sev_snp           = optional(string)<br/>            nested_virtualization = optional(string)<br/>          }), null)<br/>          placement = optional(object({<br/>            affinity                = optional(string)<br/>            availability_zone       = optional(string)<br/>            group_id                = optional(string)<br/>            group_name              = optional(string)<br/>            host_id                 = optional(string)<br/>            host_resource_group_arn = optional(string)<br/>            spread_domain           = optional(string)<br/>            tenancy                 = optional(string)<br/>            partition_number        = optional(number)<br/>          }), null)<br/>          license_specifications = optional(list(object({<br/>            license_configuration_arn = string<br/>          })), [])<br/>          use_dedicated_host = optional(bool, false)<br/>          log_files = optional(list(object({<br/>            log_group_name   = string<br/>            prefix_log_group = bool<br/>            file_path        = string<br/>            log_stream_name  = string<br/>            log_class        = optional(string, "STANDARD")<br/>          })), null)<br/>          tags = optional(map(string), {})<br/>        }), null)<br/>      }), {})<br/>    }), {})<br/>  }))</pre> | `{}` | no |
 | <a name="input_parameter_store_tags"></a> [parameter\_store\_tags](#input\_parameter\_store\_tags) | Map of tags that will be added to all the SSM Parameter Store parameters created by the Lambda function. | `map(string)` | `{}` | no |
 | <a name="input_pool_lambda_reserved_concurrent_executions"></a> [pool\_lambda\_reserved\_concurrent\_executions](#input\_pool\_lambda\_reserved\_concurrent\_executions) | Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. | `number` | `1` | no |
 | <a name="input_pool_lambda_timeout"></a> [pool\_lambda\_timeout](#input\_pool\_lambda\_timeout) | Time out for the pool lambda in seconds. | `number` | `60` | no |
@@ -239,6 +240,7 @@ module "multi-runner" {
 | <a name="output_instance_termination_watcher"></a> [instance\_termination\_watcher](#output\_instance\_termination\_watcher) | n/a |
 | <a name="output_runners_map"></a> [runners\_map](#output\_runners\_map) | n/a |
 | <a name="output_runners_map_v2"></a> [runners\_map\_v2](#output\_runners\_map\_v2) | n/a |
+| <a name="output_scale_set"></a> [scale\_set](#output\_scale\_set) | Shared scale-set orchestration resources, or null when no runner configuration selects scale\_set. |
 | <a name="output_ssm_parameters"></a> [ssm\_parameters](#output\_ssm\_parameters) | n/a |
 | <a name="output_webhook"></a> [webhook](#output\_webhook) | n/a |
 <!-- END_TF_DOCS -->
diff --git a/modules/runner-config/README.md b/modules/runner-config/README.md
index c918a79fa0..eace9fe184 100644
--- a/modules/runner-config/README.md
+++ b/modules/runner-config/README.md
@@ -114,7 +114,7 @@ yarn run dist
 | <a name="input_github"></a> [github](#input\_github) | GitHub API and runner-registration configuration.<br/><br/>- `app_parameters.key_base64`: Ordered Parameter Store references for GitHub App private keys.<br/>- `app_parameters.id`: Ordered Parameter Store references for GitHub App IDs.<br/>- `app_parameters.installation_id`: Ordered optional Parameter Store references for GitHub App installation IDs.<br/>- `enterprise_server.url`: Optional GitHub Enterprise Server base URL. Null selects GitHub.com.<br/>- `enterprise_server.ssl_verify`: Enables TLS certificate verification for GitHub Enterprise Server requests.<br/>- `user_agent`: Optional User-Agent value added to GitHub API requests. | <pre>object({<br/>    app_parameters = object({<br/>      key_base64      = list(map(string))<br/>      id              = list(map(string))<br/>      installation_id = list(object({ name = string, arn = string }))<br/>    })<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>    user_agent = optional(string, null)<br/>  })</pre> | n/a | yes |
 | <a name="input_lambda"></a> [lambda](#input\_lambda) | Common Lambda substrate independent of the selected runner orchestration provider.<br/><br/>- `artifact.s3.bucket`: Optional shared S3 bucket containing component-owned Lambda artifacts. An orchestration provider selects its own object key and version; the bucket alone selects no artifact.<br/>- `runtime`: Runtime used by the control-plane Lambda functions.<br/>- `architecture`: Instruction-set architecture used by the control-plane Lambda functions. Supported values are `arm64` and `x86_64`.<br/>- `subnet_ids`: Subnets used for Lambda VPC configuration.<br/>- `security_group_ids`: Security groups used for Lambda VPC configuration.<br/>- `tags`: Shared tags applied to Lambda function resources only. These override module-level `tags`; component `tags` override this map when keys conflict.<br/>- `principals`: Additional principals allowed to assume the control-plane Lambda roles.<br/>- `role.path`: IAM path for module-managed Lambda execution roles. Defaults to a path derived from `prefix`.<br/>- `role.permissions_boundary`: Permissions-boundary ARN applied to module-managed Lambda execution roles. | <pre>object({<br/>    artifact = optional(object({<br/>      s3 = optional(object({<br/>        bucket = optional(string, null)<br/>      }), {})<br/>    }), {})<br/>    runtime            = optional(string, "nodejs24.x")<br/>    architecture       = optional(string, "arm64")<br/>    subnet_ids         = optional(list(string), [])<br/>    security_group_ids = optional(list(string), [])<br/>    tags               = optional(map(string), {})<br/>    principals = optional(list(object({<br/>      type        = string<br/>      identifiers = list(string)<br/>    })), [])<br/>    role = optional(object({<br/>      path                 = optional(string, null)<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_observability"></a> [observability](#input\_observability) | Logging, tracing, and metrics configuration for control-plane and provider resources.<br/><br/>- `logs.level`: Application log level supplied to the control-plane functions.<br/>- `logs.retention_in_days`: CloudWatch Logs retention period.<br/>- `logs.kms_key_id`: Optional KMS key ID or ARN used to encrypt CloudWatch log groups.<br/>- `logs.class`: CloudWatch log-group class. Supported values are `STANDARD` and `INFREQUENT_ACCESS`.<br/>- `logs.tags`: Shared tags for CloudWatch log groups. These override module-level `tags`; component `tags` override this map when keys conflict.<br/>- `tracing.mode`: Optional Lambda active-tracing mode. Null disables X-Ray tracing configuration.<br/>- `tracing.capture_http_requests`: Enables HTTP request capture in the tracing helper.<br/>- `tracing.capture_error`: Enables error capture in the tracing helper.<br/>- `metrics.enabled`: Enables module-emitted metrics.<br/>- `metrics.namespace`: CloudWatch namespace used for emitted metrics.<br/>- `metrics.metric.github_app_rate_limit.enabled`: Emits GitHub App rate-limit metrics.<br/>- `metrics.metric.job_retry.enabled`: Emits job-retry metrics.<br/>- `metrics.metric.spot_termination_warning.enabled`: Emits spot-termination warning metrics where supported. | <pre>object({<br/>    logs = optional(object({<br/>      level             = optional(string, "info")<br/>      retention_in_days = optional(number, 180)<br/>      kms_key_id        = optional(string, null)<br/>      class             = optional(string, "STANDARD")<br/>      tags              = optional(map(string), {})<br/>    }), {})<br/>    tracing = optional(object({<br/>      mode                  = optional(string, null)<br/>      capture_http_requests = optional(bool, false)<br/>      capture_error         = optional(bool, false)<br/>    }), {})<br/>    metrics = optional(object({<br/>      enabled   = optional(bool, false)<br/>      namespace = optional(string, "GitHub Runners")<br/>      metric = optional(object({<br/>        github_app_rate_limit = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        spot_termination_warning = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_orchestration_provider"></a> [orchestration\_provider](#input\_orchestration\_provider) | Runner demand-orchestration provider configuration. Exactly one provider block must be non-null. Wrapper presence selects the provider and must therefore be known during planning; values inside the selected provider may remain unknown until apply.<br/><br/>- `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls. Future providers can be added as sibling blocks without moving this contract.<br/>- `webhook.runner`: Runner lifecycle, boot timeout, and capacity settings owned by webhook orchestration.<br/>- `webhook.runner.boot_time_in_minutes`: Expected runner boot duration used by scale-down and pool controls. The default is `5`.<br/>- `webhook.runner.ephemeral`: Registers runners in ephemeral mode. The default is `false`.<br/>- `webhook.runner.jit_config_enabled`: Explicitly enables or disables just-in-time configuration. The default is null, which follows `runner.ephemeral`.<br/>- `webhook.runner.maximum_count`: Maximum number of runners managed for this runner configuration. The default is `3`.<br/>- `webhook.github.organization_runners`: Registers runners at organization scope when true; otherwise registration is repository-scoped.<br/>- `webhook.queue.build.arn`: ARN of the runner configuration's build queue.<br/>- `webhook.queue.build.url`: URL of the runner configuration's build queue.<br/>- `webhook.queue.kms_key_id`: Optional KMS key ARN encrypting the build queue. The default is null and is independent from the Parameter Store KMS key.<br/>- `webhook.queue.tags`: Tags inherited by queue-related provider resources before component-specific overrides. The default is `{}`.<br/>- `webhook.lambda.artifact`: Runner-control artifact shared by scale, pool, and job-retry components. Set at most one of `zip` or `s3`; no selection uses the packaged runner archive.<br/>- `webhook.lambda.artifact.zip`: Optional local path to the runner-control Lambda archive. The default is null.<br/>- `webhook.lambda.artifact.s3`: Optional S3 object selector in the common `lambda.artifact.s3.bucket`. Wrapper presence must be known during planning, selecting it requires a non-null common bucket, and the default is null.<br/>- `webhook.lambda.artifact.s3.key`: Object key of the runner-control Lambda archive.<br/>- `webhook.lambda.artifact.s3.object_version`: Optional object version of the runner-control Lambda archive. The default is null.<br/>- `webhook.lambda.scale.up.memory_size`: Memory allocated to the scale-up Lambda in MB. The default is `512`.<br/>- `webhook.lambda.scale.up.timeout`: Scale-up Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.scale.up.reserved_concurrent_executions`: Reserved concurrency for scale-up. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.lambda.scale.up.job_queued_check_enabled`: Enables queued-job verification before scaling. The default is null, which follows the resolved runner mode.<br/>- `webhook.lambda.scale.up.event_source_mapping.batch_size`: Maximum build-queue records delivered per scale-up invocation. The default is `10`.<br/>- `webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds`: Maximum batching window for build-queue records. The default is `0`.<br/>- `webhook.lambda.scale.up.tags`: Tags applied within scale-up resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.lambda.scale.down.memory_size`: Memory allocated to the scale-down Lambda in MB. The default is `512`.<br/>- `webhook.lambda.scale.down.timeout`: Scale-down Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.scale.down.schedule_expression`: EventBridge schedule expression that invokes scale-down. The default is `cron(*/5 * * * ? *)`.<br/>- `webhook.lambda.scale.down.minimum_running_time_in_minutes`: Optional minimum runner age before scale-down may terminate it. The default is null, which selects the operating-system default.<br/>- `webhook.lambda.scale.down.idle_config`: Time-based desired idle-runner configurations. The default is `[]`.<br/>- `webhook.lambda.scale.down.idle_config[].cron`: Cron expression identifying when the idle configuration applies.<br/>- `webhook.lambda.scale.down.idle_config[].timeZone`: IANA time zone used to evaluate the cron expression.<br/>- `webhook.lambda.scale.down.idle_config[].idleCount`: Number of idle runners retained during the matching period.<br/>- `webhook.lambda.scale.down.idle_config[].evictionStrategy`: Selection strategy used when excess idle runners are removed. The default is `oldest_first`.<br/>- `webhook.lambda.scale.down.tags`: Tags applied within scale-down resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.lambda.pool.memory_size`: Memory allocated to the pool Lambda in MB. The default is `512`.<br/>- `webhook.lambda.pool.timeout`: Pool Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.pool.reserved_concurrent_executions`: Reserved concurrency for the pool Lambda. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.lambda.pool.config`: Scheduled target pool sizes. The default is `[]`, which disables the pool component.<br/>- `webhook.lambda.pool.config[].schedule_expression`: Scheduler expression that activates the target size.<br/>- `webhook.lambda.pool.config[].schedule_expression_timezone`: Optional IANA time zone used to evaluate the schedule.<br/>- `webhook.lambda.pool.config[].size`: Desired number of runners for the schedule.<br/>- `webhook.lambda.pool.include_busy_runners`: Includes busy runners when reconciling scheduled pool capacity. The default is `false`.<br/>- `webhook.lambda.pool.runner_owner`: Optional GitHub organization or repository owner used for pooled runners. The default is null.<br/>- `webhook.lambda.pool.tags`: Tags applied within pool resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.job_retry.enabled`: Creates the retry queue, Lambda function, event-source mapping, and related IAM resources. The default is `false`.<br/>- `webhook.job_retry.delay_in_seconds`: Initial delay before a queued-job retry check. The default is `300`.<br/>- `webhook.job_retry.delay_backoff`: Multiplier applied to the delay after each unsuccessful check. The default is `2`.<br/>- `webhook.job_retry.max_attempts`: Maximum retry-check attempts before the message is no longer republished. The default is `1`.<br/>- `webhook.job_retry.tags`: Tags applied within job-retry resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.job_retry.lambda.memory_size`: Memory allocated to the job-retry Lambda in MB. The default is `256`.<br/>- `webhook.job_retry.lambda.reserved_concurrent_executions`: Reserved concurrency for job retry. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.job_retry.lambda.timeout`: Job-retry Lambda timeout in seconds and visibility timeout for its retry queue. The default is `30`. | <pre>object({<br/>    webhook = optional(object({<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, 3)<br/>      }), {})<br/>      github = object({<br/>        organization_runners = bool<br/>      })<br/>      queue = object({<br/>        build = object({<br/>          arn = string<br/>          url = string<br/>        })<br/>        kms_key_id = optional(string, null)<br/>        tags       = optional(map(string), {})<br/>      })<br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 60)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/>      job_retry = optional(object({<br/>        enabled          = optional(bool, false)<br/>        delay_in_seconds = optional(number, 300)<br/>        delay_backoff    = optional(number, 2)<br/>        max_attempts     = optional(number, 1)<br/>        tags             = optional(map(string), {})<br/>        lambda = optional(object({<br/>          memory_size                    = optional(number, 256)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          timeout                        = optional(number, 30)<br/>        }), {})<br/>      }), {})<br/>    }), null)<br/>  })</pre> | n/a | yes |
+| <a name="input_orchestration_provider"></a> [orchestration\_provider](#input\_orchestration\_provider) | Runner demand-orchestration provider configuration. Exactly one provider block must be non-null. Wrapper presence selects the provider and must therefore be known during planning; values inside the selected provider may remain unknown until apply.<br/><br/>- `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls.<br/>- `scale_set`: Selects scale-set orchestration for this runner config. The multi-runner topology owns the shared controller service and passes this plan-known selection marker to runner-config. Scale-set runners always use ephemeral JIT registration.<br/>- `webhook.runner`: Runner lifecycle, boot timeout, and capacity settings owned by webhook orchestration.<br/>- `webhook.runner.boot_time_in_minutes`: Expected runner boot duration used by scale-down and pool controls. The default is `5`.<br/>- `webhook.runner.ephemeral`: Registers runners in ephemeral mode. The default is `false`.<br/>- `webhook.runner.jit_config_enabled`: Explicitly enables or disables just-in-time configuration. The default is null, which follows `runner.ephemeral`.<br/>- `webhook.runner.maximum_count`: Maximum number of runners managed for this runner configuration. The default is `3`.<br/>- `webhook.github.organization_runners`: Registers runners at organization scope when true; otherwise registration is repository-scoped.<br/>- `webhook.queue.build.arn`: ARN of the runner configuration's build queue.<br/>- `webhook.queue.build.url`: URL of the runner configuration's build queue.<br/>- `webhook.queue.kms_key_id`: Optional KMS key ARN encrypting the build queue. The default is null and is independent from the Parameter Store KMS key.<br/>- `webhook.queue.tags`: Tags inherited by queue-related provider resources before component-specific overrides. The default is `{}`.<br/>- `webhook.lambda.artifact`: Runner-control artifact shared by scale, pool, and job-retry components. Set at most one of `zip` or `s3`; no selection uses the packaged runner archive.<br/>- `webhook.lambda.artifact.zip`: Optional local path to the runner-control Lambda archive. The default is null.<br/>- `webhook.lambda.artifact.s3`: Optional S3 object selector in the common `lambda.artifact.s3.bucket`. Wrapper presence must be known during planning, selecting it requires a non-null common bucket, and the default is null.<br/>- `webhook.lambda.artifact.s3.key`: Object key of the runner-control Lambda archive.<br/>- `webhook.lambda.artifact.s3.object_version`: Optional object version of the runner-control Lambda archive. The default is null.<br/>- `webhook.lambda.scale.up.memory_size`: Memory allocated to the scale-up Lambda in MB. The default is `512`.<br/>- `webhook.lambda.scale.up.timeout`: Scale-up Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.scale.up.reserved_concurrent_executions`: Reserved concurrency for scale-up. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.lambda.scale.up.job_queued_check_enabled`: Enables queued-job verification before scaling. The default is null, which follows the resolved runner mode.<br/>- `webhook.lambda.scale.up.event_source_mapping.batch_size`: Maximum build-queue records delivered per scale-up invocation. The default is `10`.<br/>- `webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds`: Maximum batching window for build-queue records. The default is `0`.<br/>- `webhook.lambda.scale.up.tags`: Tags applied within scale-up resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.lambda.scale.down.memory_size`: Memory allocated to the scale-down Lambda in MB. The default is `512`.<br/>- `webhook.lambda.scale.down.timeout`: Scale-down Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.scale.down.schedule_expression`: EventBridge schedule expression that invokes scale-down. The default is `cron(*/5 * * * ? *)`.<br/>- `webhook.lambda.scale.down.minimum_running_time_in_minutes`: Optional minimum runner age before scale-down may terminate it. The default is null, which selects the operating-system default.<br/>- `webhook.lambda.scale.down.idle_config`: Time-based desired idle-runner configurations. The default is `[]`.<br/>- `webhook.lambda.scale.down.idle_config[].cron`: Cron expression identifying when the idle configuration applies.<br/>- `webhook.lambda.scale.down.idle_config[].timeZone`: IANA time zone used to evaluate the cron expression.<br/>- `webhook.lambda.scale.down.idle_config[].idleCount`: Number of idle runners retained during the matching period.<br/>- `webhook.lambda.scale.down.idle_config[].evictionStrategy`: Selection strategy used when excess idle runners are removed. The default is `oldest_first`.<br/>- `webhook.lambda.scale.down.tags`: Tags applied within scale-down resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.lambda.pool.memory_size`: Memory allocated to the pool Lambda in MB. The default is `512`.<br/>- `webhook.lambda.pool.timeout`: Pool Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.pool.reserved_concurrent_executions`: Reserved concurrency for the pool Lambda. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.lambda.pool.config`: Scheduled target pool sizes. The default is `[]`, which disables the pool component.<br/>- `webhook.lambda.pool.config[].schedule_expression`: Scheduler expression that activates the target size.<br/>- `webhook.lambda.pool.config[].schedule_expression_timezone`: Optional IANA time zone used to evaluate the schedule.<br/>- `webhook.lambda.pool.config[].size`: Desired number of runners for the schedule.<br/>- `webhook.lambda.pool.include_busy_runners`: Includes busy runners when reconciling scheduled pool capacity. The default is `false`.<br/>- `webhook.lambda.pool.runner_owner`: Optional GitHub organization or repository owner used for pooled runners. The default is null.<br/>- `webhook.lambda.pool.tags`: Tags applied within pool resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.job_retry.enabled`: Creates the retry queue, Lambda function, event-source mapping, and related IAM resources. The default is `false`.<br/>- `webhook.job_retry.delay_in_seconds`: Initial delay before a queued-job retry check. The default is `300`.<br/>- `webhook.job_retry.delay_backoff`: Multiplier applied to the delay after each unsuccessful check. The default is `2`.<br/>- `webhook.job_retry.max_attempts`: Maximum retry-check attempts before the message is no longer republished. The default is `1`.<br/>- `webhook.job_retry.tags`: Tags applied within job-retry resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.job_retry.lambda.memory_size`: Memory allocated to the job-retry Lambda in MB. The default is `256`.<br/>- `webhook.job_retry.lambda.reserved_concurrent_executions`: Reserved concurrency for job retry. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.job_retry.lambda.timeout`: Job-retry Lambda timeout in seconds and visibility timeout for its retry queue. The default is `30`. | <pre>object({<br/>    webhook = optional(object({<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, 3)<br/>      }), {})<br/>      github = object({<br/>        organization_runners = bool<br/>      })<br/>      queue = object({<br/>        build = object({<br/>          arn = string<br/>          url = string<br/>        })<br/>        kms_key_id = optional(string, null)<br/>        tags       = optional(map(string), {})<br/>      })<br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 60)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/>      job_retry = optional(object({<br/>        enabled          = optional(bool, false)<br/>        delay_in_seconds = optional(number, 300)<br/>        delay_backoff    = optional(number, 2)<br/>        max_attempts     = optional(number, 1)<br/>        tags             = optional(map(string), {})<br/>        lambda = optional(object({<br/>          memory_size                    = optional(number, 256)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          timeout                        = optional(number, 30)<br/>        }), {})<br/>      }), {})<br/>    }), null)<br/>    scale_set = optional(object({<br/>      name = string<br/>      runner = optional(object({<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    }), null)<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix used for naming resources. | `string` | `"github-actions"` | no |
 | <a name="input_runner"></a> [runner](#input\_runner) | Provider-neutral GitHub runner configuration.<br/><br/>- `os`: Runner operating system. Supported values are `linux`, `osx`, and `windows`.<br/>- `architecture`: Runner distribution architecture, such as `x64` or `arm64`.<br/>- `disable_default_labels`: Prevents GitHub's default self-hosted, operating-system, and architecture labels from being registered.<br/>- `labels`: Complete set of labels supplied to the control-plane functions.<br/>- `group_name`: GitHub runner group used during registration.<br/>- `name_prefix`: Prefix added to registered runner names.<br/>- `run_as_root`: Runs the runner service as root when supported by the compute provider.<br/>- `run_as`: Operating-system user used when `run_as_root` is false.<br/>- `auto_update_disabled`: Disables the GitHub runner application's built-in updater.<br/>- `tags`: Additional tags for common runner resources, currently the managed runner IAM role. These override module-level `tags` with the same key.<br/>- `hooks.job_started`: Script content installed as the runner job-started hook.<br/>- `hooks.job_completed`: Script content installed as the runner job-completed hook.<br/>- `iam.role.arn`: ARN of an externally managed runner role. When set, this module does not create or modify that role.<br/>- `iam.managed_policy_arns`: Named managed-policy ARNs attached to the module-managed runner role.<br/>- `iam.additional_trust_policy_json`: Optional IAM policy document merged with the selected compute provider's default runner-role trust policy.<br/>- `iam.path`: IAM path for the module-managed runner role. Defaults to a path derived from `prefix`.<br/>- `iam.permissions_boundary`: Permissions-boundary ARN for the module-managed runner role. | <pre>object({<br/>    os                     = optional(string, "linux")<br/>    architecture           = optional(string, "x64")<br/>    disable_default_labels = optional(bool, false)<br/>    labels                 = list(string)<br/>    group_name             = optional(string, "Default")<br/>    name_prefix            = optional(string, "")<br/>    run_as_root            = optional(bool, false)<br/>    run_as                 = optional(string, "ec2-user")<br/>    auto_update_disabled   = optional(bool, false)<br/>    tags                   = optional(map(string), {})<br/>    hooks = optional(object({<br/>      job_started   = optional(string, "")<br/>      job_completed = optional(string, "")<br/>    }), {})<br/>    iam = optional(object({<br/>      role = optional(object({<br/>        arn = string<br/>      }), null)<br/>      managed_policy_arns          = optional(map(string), {})<br/>      additional_trust_policy_json = optional(string, null)<br/>      path                         = optional(string, null)<br/>      permissions_boundary         = optional(string, null)<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_ssm"></a> [ssm](#input\_ssm) | Parameter Store paths, encryption, tag scopes, and housekeeper configuration.<br/><br/>- `paths.root`: Root Parameter Store path for this runner configuration.<br/>- `paths.tokens`: Path segment under `paths.root` used for registration tokens and just-in-time configuration.<br/>- `paths.config`: Path segment under `paths.root` used for persistent runner configuration.<br/>- `kms_key_id`: Optional customer-managed KMS key ARN used by control-plane IAM policies to decrypt shared GitHub App parameters. The ARN may be unknown until apply; null omits the provider-owned KMS statements. It does not select encryption for runtime-created runner parameters.<br/>- `tags`: Shared tags for SSM-related resources. These override module-level `tags` and are inherited by parameter and housekeeper resources.<br/>- `parameters.tags`: Tags for Terraform-managed runner configuration parameters and temporary parameters created by the scale-up and pool Lambdas. These override module-level and `ssm.tags` values with the same key.<br/>- `housekeeper.schedule_expression`: EventBridge schedule expression that invokes the SSM housekeeper.<br/>- `housekeeper.state`: EventBridge rule state, such as `ENABLED` or `DISABLED`.<br/>- `housekeeper.tags`: Tags for housekeeper resources, including the Lambda function, log group, EventBridge rule, and IAM role. These override module-level, `ssm.tags`, shared Lambda, and shared log tags when keys conflict.<br/>- `housekeeper.lambda.artifact`: Component-owned SSM-housekeeper artifact selection. Set at most one of `zip` or `s3`; when neither is selected, the module uses its packaged runner control-plane archive. This selector does not inherit an orchestration-provider artifact.<br/>- `housekeeper.lambda.artifact.zip`: Optional local path to the SSM-housekeeper Lambda archive.<br/>- `housekeeper.lambda.artifact.s3`: Optional object key and version in the shared `lambda.artifact.s3.bucket`. Selecting S3 requires that common bucket.<br/>- `housekeeper.lambda.artifact.s3.key`: Object key of the SSM-housekeeper Lambda archive.<br/>- `housekeeper.lambda.artifact.s3.object_version`: Optional object version of the SSM-housekeeper Lambda archive.<br/>- `housekeeper.lambda.memory_size`: Memory allocated to the SSM housekeeper Lambda in MB.<br/>- `housekeeper.lambda.timeout`: SSM housekeeper Lambda timeout in seconds.<br/>- `housekeeper.config.tokenPath`: Parameter Store token path cleaned by the housekeeper. When omitted, the configured runner token path is used.<br/>- `housekeeper.config.minimumDaysOld`: Minimum parameter age in days before deletion is allowed.<br/>- `housekeeper.config.dryRun`: Reports eligible parameters without deleting them when true. | <pre>object({<br/>    paths = object({<br/>      root   = string<br/>      tokens = string<br/>      config = string<br/>    })<br/>    kms_key_id = optional(string, null)<br/>    tags       = optional(map(string), {})<br/>    parameters = optional(object({<br/>      tags = optional(map(string), {})<br/>    }), {})<br/>    housekeeper = optional(object({<br/>      schedule_expression = optional(string, "rate(1 day)")<br/>      state               = optional(string, "ENABLED")<br/>      tags                = optional(map(string), {})<br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        memory_size = optional(number, 512)<br/>        timeout     = optional(number, 60)<br/>      }), {})<br/>      config = optional(object({<br/>        tokenPath      = optional(string)<br/>        minimumDaysOld = optional(number, 1)<br/>        dryRun         = optional(bool, false)<br/>      }), {})<br/>    }), {})<br/>  })</pre> | n/a | yes |
@@ -124,6 +124,7 @@ yarn run dist
 
 | Name | Description |
 |------|-------------|
+| <a name="output_compute_provider_contract"></a> [compute\_provider\_contract](#output\_compute\_provider\_contract) | Provider-neutral compute-provider capabilities consumed by topology-level orchestration. |
 | <a name="output_orchestration_provider"></a> [orchestration\_provider](#output\_orchestration\_provider) | Resources grouped under the selected runner orchestration provider. |
 | <a name="output_pool"></a> [pool](#output\_pool) | Scheduled pool resources. Null when no pool configuration is supplied. |
 | <a name="output_provider"></a> [provider](#output\_provider) | Provider-specific resources grouped under the selected provider namespace and type. |
diff --git a/modules/ssm/README.md b/modules/ssm/README.md
index 66bce354e2..2750e04f0e 100644
--- a/modules/ssm/README.md
+++ b/modules/ssm/README.md
@@ -31,6 +31,7 @@ No modules.
 | [aws_ssm_parameter.additional_github_app_key_base64](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [aws_ssm_parameter.additional_github_apps_manifest](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [aws_ssm_parameter.github_app_id](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [aws_ssm_parameter.github_app_installation_id](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [aws_ssm_parameter.github_app_key_base64](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [aws_ssm_parameter.github_app_webhook_secret](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 
@@ -39,7 +40,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_additional_github_apps"></a> [additional\_github\_apps](#input\_additional\_github\_apps) | Additional GitHub Apps for distributing API rate limit usage. | <pre>list(object({<br/>    key_base64          = optional(string)<br/>    key_base64_ssm      = optional(object({ arn = string, name = string }))<br/>    id                  = optional(string)<br/>    id_ssm              = optional(object({ arn = string, name = string }))<br/>    installation_id     = optional(string)<br/>    installation_id_ssm = optional(object({ arn = string, name = string }))<br/>  }))</pre> | `[]` | no |
-| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters, see your github app. <br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here, <br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | n/a | yes |
+| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters, see your github app. <br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here, <br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    installation_id = optional(string)<br/>    installation_id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | n/a | yes |
 | <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | Optional CMK Key ARN to be used for Parameter Store. | `string` | `null` | no |
 | <a name="input_path_prefix"></a> [path\_prefix](#input\_path\_prefix) | The path prefix used for naming resources | `string` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Map of tags that will be added to created resources. By default resources will be tagged with name and environment. | `map(string)` | `{}` | no |

From a7b2c0f7575a30f36efe015fd097494314d23635 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 20:25:05 +0200
Subject: [PATCH 22/52] fix(ec2): grant scale-set AMI SSM read access

---
 .../compute-providers/aws/ec2/scale-set.tf    | 15 ++++++----
 .../aws/ec2/tests/provider.tftest.hcl         | 29 +++++++++++++++++++
 2 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/modules/compute-providers/aws/ec2/scale-set.tf b/modules/compute-providers/aws/ec2/scale-set.tf
index 439652db58..dcbefd55f4 100644
--- a/modules/compute-providers/aws/ec2/scale-set.tf
+++ b/modules/compute-providers/aws/ec2/scale-set.tf
@@ -198,14 +198,17 @@ locals {
         ])
         conditions = []
       }
-    },
-    local.ami_id_ssm_external ? {
-      read_external_ami_parameter = {
-        actions    = toset(["ssm:GetParameter"])
-        resources  = toset([local.ami_id_ssm_parameter_arn])
+      read_ami_parameter = {
+        actions = toset([
+          "ssm:GetParameter",
+          "ssm:GetParameters",
+        ])
+        resources = toset([
+          local.ami_id_ssm_module_managed ? aws_ssm_parameter.runner_ami_id[0].arn : local.ami_id_ssm_parameter_arn,
+        ])
         conditions = []
       }
-    } : {},
+    },
     local.ami_kms_key_enabled ? {
       use_ami_kms_key = {
         actions = toset([
diff --git a/modules/compute-providers/aws/ec2/tests/provider.tftest.hcl b/modules/compute-providers/aws/ec2/tests/provider.tftest.hcl
index bc92537279..99feb7ef8e 100644
--- a/modules/compute-providers/aws/ec2/tests/provider.tftest.hcl
+++ b/modules/compute-providers/aws/ec2/tests/provider.tftest.hcl
@@ -138,6 +138,15 @@ run "separates_control_plane_contract_from_ec2_resources" {
     error_message = "An external AMI SSM parameter must enable the pool managed policy attachment at plan time."
   }
 
+  assert {
+    condition = (
+      contains(output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.actions, "ssm:GetParameter")
+      && contains(output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.actions, "ssm:GetParameters")
+      && contains(output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.resources, "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/ami-id")
+    )
+    error_message = "The scale-set compute role must read an external AMI parameter with both single and batched SSM actions."
+  }
+
   assert {
     condition = (
       contains(flatten([
@@ -199,6 +208,26 @@ run "separates_control_plane_contract_from_ec2_resources" {
 
 }
 
+run "includes_managed_ami_read_in_scale_set_contract" {
+  command = plan
+
+  variables {
+    config = merge(var.config, {
+      ami = merge(var.config.ami, {
+        id_ssm_parameter = null
+      })
+    })
+  }
+
+  assert {
+    condition = (
+      contains(output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.actions, "ssm:GetParameters")
+      && output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.resources != toset([])
+    )
+    error_message = "The scale-set compute role must read the module-managed AMI parameter."
+  }
+}
+
 run "accepts_partial_typed_compute_options" {
   command = plan
 

From 06181ce7d267052b647f30949921c52276bfac07 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Wed, 16 Sep 2026 16:05:45 +0200
Subject: [PATCH 23/52] fix(multi-runner): validate scale-set installation ID

---
 .../orchestration-provider.scale-set.tf       |  4 +-
 .../tests/config-resolution.tftest.hcl        | 42 +++++++++++++++++++
 modules/multi-runner/validations.tf           | 12 ++++++
 3 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/modules/multi-runner/orchestration-provider.scale-set.tf b/modules/multi-runner/orchestration-provider.scale-set.tf
index 137c7c15b6..f18a7c1230 100644
--- a/modules/multi-runner/orchestration-provider.scale-set.tf
+++ b/modules/multi-runner/orchestration-provider.scale-set.tf
@@ -14,7 +14,7 @@ locals {
             arn         = local.primary_app_key_base64.arn
             kms_key_arn = local.effective_config.ssm.kms_key_id
           }
-          installation_id = {
+          installation_id = local.primary_app_installation_id == null ? null : {
             name        = local.primary_app_installation_id.name
             arn         = local.primary_app_installation_id.arn
             kms_key_arn = local.effective_config.ssm.kms_key_id
@@ -42,7 +42,7 @@ locals {
 
 module "orchestration_scale_set" {
   source = "../orchestration-providers/scale-set"
-  count  = length(local.scale_set_runner_configs) > 0 ? 1 : 0
+  count  = length(local.scale_set_runner_configs) > 0 && local.primary_app_installation_id != null ? 1 : 0
 
   prefix         = var.prefix
   log_level      = var.global_config_observability.logs.level
diff --git a/modules/multi-runner/tests/config-resolution.tftest.hcl b/modules/multi-runner/tests/config-resolution.tftest.hcl
index ea2ab2c614..ad5deede3e 100644
--- a/modules/multi-runner/tests/config-resolution.tftest.hcl
+++ b/modules/multi-runner/tests/config-resolution.tftest.hcl
@@ -660,6 +660,48 @@ run "scale_set_lane_requires_owner_for_non_enterprise_registration" {
   expect_failures = [terraform_data.validate_v2]
 }
 
+run "scale_set_lane_requires_installation_id" {
+  command = plan
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_github = {
+      app = {
+        key_base64     = "experimental-app-key"
+        id             = "experimental-app-id"
+        webhook_secret = "experimental-webhook-secret"
+      }
+    }
+
+    multi_runner_config = {
+      scale = {
+        runner = {
+          os           = "linux"
+          architecture = "x64"
+        }
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-missing-installation"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_v2]
+}
+
 run "scale_set_queue_for_each_keys_are_plan_known" {
   command = plan
 
diff --git a/modules/multi-runner/validations.tf b/modules/multi-runner/validations.tf
index 63c6959757..41f09bfd3b 100644
--- a/modules/multi-runner/validations.tf
+++ b/modules/multi-runner/validations.tf
@@ -107,5 +107,17 @@ resource "terraform_data" "validate_v2" {
       error_message = "Scale-set lanes require global_config_github.runner_registration_level to be enterprise, organization, or repository; runner_owner must be null for enterprise or set for organization and repository registration."
     }
 
+    precondition {
+      condition = alltrue([
+        for config in local.resolved_config.multi_runner_config : (
+          try(config.orchestration_provider.scale_set, null) == null ? true : (
+            try(var.global_config_github.app.installation_id, null) != null ||
+            try(var.global_config_github.app.installation_id_ssm, null) != null
+          )
+        )
+      ])
+      error_message = "Scale-set lanes require global_config_github.app.installation_id or global_config_github.app.installation_id_ssm."
+    }
+
   }
 }

From 8757a5bee25b4fb90dd0c7165ddde8cf59462d80 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Wed, 16 Sep 2026 17:20:30 +0200
Subject: [PATCH 24/52] fix(multi-runner): use supported scale-set registration
 in fixtures

---
 .../tests/config-resolution.tftest.hcl        | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/modules/multi-runner/tests/config-resolution.tftest.hcl b/modules/multi-runner/tests/config-resolution.tftest.hcl
index ad5deede3e..7886f2139d 100644
--- a/modules/multi-runner/tests/config-resolution.tftest.hcl
+++ b/modules/multi-runner/tests/config-resolution.tftest.hcl
@@ -457,6 +457,17 @@ run "scale_set_only_lane_omits_webhook_queues" {
   variables {
     experimental_features = ["multi-runner-v2"]
 
+    global_config_github = {
+      app = {
+        key_base64      = "experimental-app-key"
+        id              = "experimental-app-id"
+        installation_id = "experimental-app-installation"
+        webhook_secret  = "experimental-webhook-secret"
+      }
+      runner_owner              = "example"
+      runner_registration_level = "organization"
+    }
+
     global_config_orchestration_provider = {
       webhook = {
         eventbridge = {
@@ -533,6 +544,17 @@ run "mixed_webhook_and_scale_set_lanes_create_webhook_queues_only_for_webhook" {
   variables {
     experimental_features = ["multi-runner-v2"]
 
+    global_config_github = {
+      app = {
+        key_base64      = "experimental-app-key"
+        id              = "experimental-app-id"
+        installation_id = "experimental-app-installation"
+        webhook_secret  = "experimental-webhook-secret"
+      }
+      runner_owner              = "example"
+      runner_registration_level = "organization"
+    }
+
     global_config_orchestration_provider = {
       webhook = {
         eventbridge = {
@@ -672,6 +694,8 @@ run "scale_set_lane_requires_installation_id" {
         id             = "experimental-app-id"
         webhook_secret = "experimental-webhook-secret"
       }
+      runner_owner              = "example"
+      runner_registration_level = "organization"
     }
 
     multi_runner_config = {

From 89a7bb73bf17c3fa3c2238093e205bc80869e0d1 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Thu, 17 Sep 2026 00:03:52 +0200
Subject: [PATCH 25/52] fix(multi-runner): remove enterprise scale-set
 registration

---
 modules/multi-runner/validations.tf                   | 9 ++-------
 modules/multi-runner/variables.experimental.github.tf | 4 ++--
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/modules/multi-runner/validations.tf b/modules/multi-runner/validations.tf
index 41f09bfd3b..49dea05b2b 100644
--- a/modules/multi-runner/validations.tf
+++ b/modules/multi-runner/validations.tf
@@ -92,19 +92,14 @@ resource "terraform_data" "validate_v2" {
         for config in local.resolved_config.multi_runner_config : (
           try(config.orchestration_provider.scale_set, null) == null ? true : (
             contains([
-              "enterprise",
               "organization",
               "repository",
             ], try(var.global_config_github.runner_registration_level, null)) &&
-            (
-              var.global_config_github.runner_registration_level == "enterprise"
-              ? try(var.global_config_github.runner_owner, null) == null
-              : try(var.global_config_github.runner_owner, null) != null
-            )
+            try(var.global_config_github.runner_owner, null) != null
           )
         )
       ])
-      error_message = "Scale-set lanes require global_config_github.runner_registration_level to be enterprise, organization, or repository; runner_owner must be null for enterprise or set for organization and repository registration."
+      error_message = "Scale-set lanes require global_config_github.runner_registration_level to be organization or repository; runner_owner must be set for organization and repository registration."
     }
 
     precondition {
diff --git a/modules/multi-runner/variables.experimental.github.tf b/modules/multi-runner/variables.experimental.github.tf
index 79e993cf18..79ea3a65cf 100644
--- a/modules/multi-runner/variables.experimental.github.tf
+++ b/modules/multi-runner/variables.experimental.github.tf
@@ -38,7 +38,7 @@ variable "global_config_github" {
       enterprise_server.url: "GitHub Enterprise Server URL."
       enterprise_server.ssl_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."
       runner_owner: "GitHub organization or owner/repository path for organization- or repository-level scale-set registration."
-      runner_registration_level: "GitHub scale-set registration scope: enterprise, organization, or repository."
+      runner_registration_level: "GitHub scale-set registration scope: organization or repository."
       user_agent: "User-Agent value sent with GitHub API requests."
     }
   EOT
@@ -78,7 +78,7 @@ variable "global_config_github" {
       ssl_verify = optional(bool, true)
     }), {})
     runner_owner              = optional(string, null)
-    runner_registration_level = optional(string, "enterprise")
+    runner_registration_level = optional(string, "organization")
     user_agent                = optional(string, "github-aws-runners")
   })
   default = {}

From d34ba91c1083d65a7aaf81a2b22c557cf760686c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 22:08:32 +0000
Subject: [PATCH 26/52] docs: auto update terraform docs

---
 modules/multi-runner/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/multi-runner/README.md b/modules/multi-runner/README.md
index c9bd103a5d..d5a8e9c8ee 100644
--- a/modules/multi-runner/README.md
+++ b/modules/multi-runner/README.md
@@ -164,7 +164,7 @@ module "multi-runner" {
 | <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters for the stable v1 interface, see your github app.<br/>  Omit this value when using the experimental v2 interface and provide the<br/>  app through `global_config_github` instead.<br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here,<br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    installation_id = optional(string)<br/>    installation_id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config"></a> [global\_config](#input\_global\_config) | Global defaults shared by all runner lanes.<br/><br/>global\_config = {<br/>  tags: "Tags applied to resources created for all runner lanes."<br/>  roles: {<br/>    path: "IAM path used for roles created for runner resources."<br/>    permissions\_boundary: "Optional IAM permissions boundary ARN applied to created roles."<br/>  }<br/>  runner: {<br/>    os: "Default operating system for runners."<br/>    architecture: "Default runner architecture."<br/>    disable\_default\_labels: "Whether to omit the default operating-system, architecture, and self-hosted labels."<br/>    extra\_labels: "Additional labels applied to all runners."<br/>    group\_name: "Default GitHub runner group."<br/>    name\_prefix: "Prefix for runner names."<br/>    run\_as\_root: "Whether the GitHub Actions runner executes as root."<br/>    run\_as: "User that runs the GitHub Actions agent when it is not running as root."<br/>    auto\_update\_disabled: "Whether automatic GitHub Actions runner updates are disabled."<br/>    tags: "Tags applied to runner resources."<br/>    hooks: {<br/>      job\_started: "Script executed when a job starts on a runner."<br/>      job\_completed: "Script executed when a job completes on a runner."<br/>    }<br/>    iam: {<br/>      role.arn: "Existing IAM role ARN to use for runners."<br/>      managed\_policy\_arns: "Managed policy ARNs attached to the runner IAM role."<br/>      additional\_trust\_policy\_json: "Additional trust policy JSON merged into the runner role trust policy."<br/>      path: "IAM path used for the runner role."<br/>      permissions\_boundary: "Optional IAM permissions boundary ARN for the runner role."<br/>    }<br/>  }<br/>} | <pre>object({<br/>    tags = optional(map(string), {})<br/><br/>    roles = optional(object({<br/>      path                 = optional(string, null)<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/><br/>    runner = optional(object({<br/>      os                     = optional(string, null)<br/>      architecture           = optional(string, null)<br/>      disable_default_labels = optional(bool, false)<br/>      extra_labels           = optional(list(string), [])<br/>      group_name             = optional(string, "Default")<br/>      name_prefix            = optional(string, "")<br/>      run_as_root            = optional(bool, false)<br/>      run_as                 = optional(string, "ec2-user")<br/>      auto_update_disabled   = optional(bool, false)<br/>      tags                   = optional(map(string), {})<br/>      hooks = optional(object({<br/>        job_started   = optional(string, "")<br/>        job_completed = optional(string, "")<br/>      }), {})<br/>      iam = optional(object({<br/>        role = optional(object({<br/>          arn = string<br/>        }), null)<br/>        managed_policy_arns          = optional(map(string), {})<br/>        additional_trust_policy_json = optional(string, null)<br/>        path                         = optional(string, null)<br/>        permissions_boundary         = optional(string, null)<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_compute_provider"></a> [global\_config\_compute\_provider](#input\_global\_config\_compute\_provider) | Global compute-provider configuration shared by all runner lanes.<br/><br/>global\_config\_compute\_provider = {<br/>  selections: "Compute-provider selections keyed by namespace."<br/>  selections.namespace: "Provider namespace used to resolve a compute implementation."<br/>  selections.type: "Compute-provider type selected for the namespace."<br/>  aws.ec2.vpc\_id: "Default VPC for EC2 runners."<br/>  aws.ec2.subnet\_ids: "Default subnets for EC2 runners."<br/>  aws.ec2.managed\_security\_group\_enabled: "Whether the module manages the default runner security group."<br/>  aws.ec2.egress\_rules: "Egress rules for the managed runner security group."<br/>  aws.ec2.egress\_rules.cidr\_blocks: "IPv4 CIDR blocks allowed by an egress rule."<br/>  aws.ec2.egress\_rules.ipv6\_cidr\_blocks: "IPv6 CIDR blocks allowed by an egress rule."<br/>  aws.ec2.egress\_rules.prefix\_list\_ids: "AWS prefix lists allowed by an egress rule."<br/>  aws.ec2.egress\_rules.from\_port: "Start of the egress port range."<br/>  aws.ec2.egress\_rules.protocol: "Protocol for the egress rule."<br/>  aws.ec2.egress\_rules.security\_groups: "Referenced security groups allowed by an egress rule."<br/>  aws.ec2.egress\_rules.self: "Whether the security group itself is allowed by an egress rule."<br/>  aws.ec2.egress\_rules.to\_port: "End of the egress port range."<br/>  aws.ec2.egress\_rules.description: "Description of the egress rule."<br/>  aws.ec2.additional\_security\_group\_ids: "Additional security groups attached to EC2 runners."<br/>  aws.ec2.cloudwatch\_agent.config: "CloudWatch Agent configuration for EC2 runners."<br/>  aws.ec2.instance\_profile\_path: "IAM path used for the EC2 instance profile."<br/>  aws.ec2.key\_name: "EC2 key pair name assigned to runner instances."<br/>  aws.ec2.associate\_public\_ipv4\_address: "Whether runner instances receive a public IPv4 address."<br/>  aws.ec2.tags: "Tags applied to EC2 runner resources."<br/>  aws.ec2.ami.housekeeper.enabled: "Whether AMI cleanup is enabled."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.maxItems: "Maximum number of AMIs retained by cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.minimumDaysOld: "Minimum AMI age in days before cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters: "AMI filters used to select AMIs for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters.Name: "AMI filter name."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters.Values: "Values matched by the AMI filter."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.launchTemplateNames: "Launch template names associated with AMIs eligible for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.ssmParameterNames: "SSM parameter names associated with AMIs eligible for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.dryRun: "Whether AMI cleanup reports changes without deleting AMIs."<br/>  aws.ec2.ami.housekeeper.artifact.zip: "Local ZIP artifact used for the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.artifact.s3.key: "S3 object key for the AMI housekeeper Lambda artifact."<br/>  aws.ec2.ami.housekeeper.artifact.s3.object\_version: "Optional S3 object version for the AMI housekeeper artifact."<br/>  aws.ec2.ami.housekeeper.lambda.memory\_size: "Memory allocated to the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.lambda.timeout: "Timeout in seconds for the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.schedule.expression: "Schedule expression for AMI cleanup."<br/>  aws.ec2.instance\_termination\_watcher.enabled: "Whether the instance termination watcher is enabled."<br/>  aws.ec2.instance\_termination\_watcher.features.runner\_deregistration.enabled: "Whether terminated runners are deregistered."<br/>  aws.ec2.instance\_termination\_watcher.features.spot\_termination\_handler.enabled: "Whether spot termination events trigger runner handling."<br/>  aws.ec2.instance\_termination\_watcher.features.spot\_termination\_notification\_watcher.enabled: "Whether spot termination notification monitoring is enabled."<br/>  aws.ec2.instance\_termination\_watcher.environment\_variables: "Environment variables passed to the termination watcher."<br/>  aws.ec2.instance\_termination\_watcher.artifact.zip: "Local ZIP artifact used for the termination watcher Lambda."<br/>  aws.ec2.instance\_termination\_watcher.artifact.s3.key: "S3 object key for the termination watcher Lambda artifact."<br/>  aws.ec2.instance\_termination\_watcher.artifact.s3.object\_version: "Optional S3 object version for the termination watcher artifact."<br/>  aws.ec2.instance\_termination\_watcher.lambda.memory\_size: "Memory allocated to the termination watcher Lambda."<br/>  aws.ec2.instance\_termination\_watcher.lambda.timeout: "Timeout in seconds for the termination watcher Lambda."<br/>  aws.ec2.runner\_binaries.enabled: "Whether runner binary synchronization is enabled."<br/>  aws.ec2.runner\_binaries.s3.encryption.enabled: "Whether runner-binary S3 encryption is enabled."<br/>  aws.ec2.runner\_binaries.s3.encryption.bucket\_key\_enabled: "Whether an S3 bucket key is used for KMS encryption."<br/>  aws.ec2.runner\_binaries.s3.encryption.sse\_algorithm: "S3 server-side encryption algorithm."<br/>  aws.ec2.runner\_binaries.s3.encryption.kms\_master\_key\_id: "KMS key ID used for runner-binary S3 encryption."<br/>  aws.ec2.runner\_binaries.s3.tags: "Tags applied to the runner-binary S3 bucket."<br/>  aws.ec2.runner\_binaries.s3.versioning: "S3 versioning state for the runner-binary bucket."<br/>  aws.ec2.runner\_binaries.s3.logging.bucket: "S3 bucket receiving runner-binary access logs."<br/>  aws.ec2.runner\_binaries.s3.logging.prefix: "Prefix for runner-binary S3 access logs."<br/>  aws.ec2.runner\_binaries.syncer.artifact.zip: "Local ZIP artifact used for the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.artifact.s3.key: "S3 object key for the runner-binary syncer artifact."<br/>  aws.ec2.runner\_binaries.syncer.artifact.s3.object\_version: "Optional S3 object version for the runner-binary syncer artifact."<br/>  aws.ec2.runner\_binaries.syncer.lambda.memory\_size: "Memory allocated to the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.lambda.timeout: "Timeout in seconds for the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.schedule.expression: "Schedule expression for runner-binary synchronization."<br/>  aws.ec2.runner\_binaries.syncer.schedule.state: "EventBridge rule state for runner-binary synchronization."<br/>} | <pre>object({<br/>    selections = optional(map(object({<br/>      namespace = string<br/>      type      = string<br/>    })), null)<br/>    aws = optional(object({<br/>      ec2 = optional(object({<br/>        vpc_id                         = optional(string, null)<br/>        subnet_ids                     = optional(list(string), null)<br/>        managed_security_group_enabled = optional(bool, true)<br/>        egress_rules = optional(list(object({<br/>          cidr_blocks      = list(string)<br/>          ipv6_cidr_blocks = list(string)<br/>          prefix_list_ids  = list(string)<br/>          from_port        = number<br/>          protocol         = string<br/>          security_groups  = list(string)<br/>          self             = bool<br/>          to_port          = number<br/>          description      = string<br/>          })), [{<br/>          cidr_blocks      = ["0.0.0.0/0"]<br/>          ipv6_cidr_blocks = ["::/0"]<br/>          prefix_list_ids  = null<br/>          from_port        = 0<br/>          protocol         = "-1"<br/>          security_groups  = null<br/>          self             = null<br/>          to_port          = 0<br/>          description      = null<br/>        }])<br/>        additional_security_group_ids = optional(list(string), [])<br/>        cloudwatch_agent = optional(object({<br/>          config = optional(string, null)<br/>        }), {})<br/>        instance_profile_path         = optional(string, null)<br/>        key_name                      = optional(string, null)<br/>        associate_public_ipv4_address = optional(bool, false)<br/>        tags                          = optional(map(string), {})<br/>        ami = optional(object({<br/>          housekeeper = optional(object({<br/>            enabled = optional(bool, false)<br/>            cleanup_config = optional(object({<br/>              maxItems       = optional(number)<br/>              minimumDaysOld = optional(number)<br/>              amiFilters = optional(list(object({<br/>                Name   = string<br/>                Values = list(string)<br/>              })))<br/>              launchTemplateNames = optional(list(string))<br/>              ssmParameterNames   = optional(list(string))<br/>              dryRun              = optional(bool)<br/>            }), {})<br/>            artifact = optional(object({<br/>              zip = optional(string, null)<br/>              s3 = optional(object({<br/>                key            = string<br/>                object_version = optional(string, null)<br/>              }), null)<br/>            }), {})<br/>            lambda = optional(object({<br/>              memory_size = optional(number, 256)<br/>              timeout     = optional(number, 300)<br/>            }), {})<br/>            schedule = optional(object({<br/>              expression = optional(string, "cron(11 7 * * ? *)")<br/>            }), {})<br/>          }), {})<br/>        }), {})<br/>        instance_termination_watcher = optional(object({<br/>          enabled = optional(bool, false)<br/>          features = optional(object({<br/>            runner_deregistration = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>            spot_termination_handler = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>            spot_termination_notification_watcher = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>          }), {})<br/>          environment_variables = optional(map(string), {})<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          lambda = optional(object({<br/>            memory_size = optional(number, null)<br/>            timeout     = optional(number, null)<br/>          }), {})<br/>        }), {})<br/>        runner_binaries = optional(object({<br/>          enabled = optional(bool, true)<br/>          s3 = optional(object({<br/>            encryption = optional(object({<br/>              enabled            = optional(bool, true)<br/>              bucket_key_enabled = optional(bool, null)<br/>              sse_algorithm      = optional(string, "AES256")<br/>              kms_master_key_id  = optional(string, null)<br/>            }), {})<br/>            tags       = optional(map(string), {})<br/>            versioning = optional(string, "Disabled")<br/>            logging = optional(object({<br/>              bucket = optional(string, null)<br/>              prefix = optional(string, null)<br/>            }), {})<br/>          }), {})<br/>          syncer = optional(object({<br/>            artifact = optional(object({<br/>              zip = optional(string, null)<br/>              s3 = optional(object({<br/>                key            = string<br/>                object_version = optional(string, null)<br/>              }), null)<br/>            }), {})<br/>            lambda = optional(object({<br/>              memory_size = optional(number, 256)<br/>              timeout     = optional(number, 300)<br/>            }), {})<br/>            schedule = optional(object({<br/>              expression = optional(string, "cron(27 * * * ? *)")<br/>              state      = optional(string, "ENABLED")<br/>            }), {})<br/>          }), {})<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_global_config_github"></a> [global\_config\_github](#input\_global\_config\_github) | Global GitHub configuration shared by all runner lanes.<br/><br/>global\_config\_github = {<br/>  app: {<br/>    key\_base64: "Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm: "SSM parameter containing the Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm.arn: "ARN of the SSM parameter containing the GitHub App private key."<br/>    key\_base64\_ssm.name: "Name of the SSM parameter containing the GitHub App private key."<br/>    id: "GitHub App ID."<br/>    id\_ssm: "SSM parameter containing the GitHub App ID."<br/>    id\_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."<br/>    id\_ssm.name: "Name of the SSM parameter containing the GitHub App ID."<br/>    installation\_id: "GitHub App installation ID for the primary scale-set installation."<br/>    installation\_id\_ssm: "SSM parameter containing the primary GitHub App installation ID."<br/>    installation\_id\_ssm.arn: "ARN of the SSM parameter containing the primary GitHub App installation ID."<br/>    installation\_id\_ssm.name: "Name of the SSM parameter containing the primary GitHub App installation ID."<br/>    webhook\_secret: "GitHub App webhook secret."<br/>    webhook\_secret\_ssm: "SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.name: "Name of the SSM parameter containing the GitHub App webhook secret."<br/>  }<br/>  additional\_apps: "Additional GitHub Apps used to distribute GitHub API requests."<br/>  additional\_apps.key\_base64: "Base64-encoded private key for an additional GitHub App."<br/>  additional\_apps.key\_base64\_ssm: "SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.arn: "ARN of the SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.name: "Name of the SSM parameter containing an additional App private key."<br/>  additional\_apps.id: "ID of an additional GitHub App."<br/>  additional\_apps.id\_ssm: "SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.arn: "ARN of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.name: "Name of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.installation\_id: "Optional installation ID for an additional GitHub App."<br/>  additional\_apps.installation\_id\_ssm: "SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.arn: "ARN of the SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.name: "Name of the SSM parameter containing an additional App installation ID."<br/>  enterprise\_server.url: "GitHub Enterprise Server URL."<br/>  enterprise\_server.ssl\_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."<br/>  runner\_owner: "GitHub organization or owner/repository path for organization- or repository-level scale-set registration."<br/>  runner\_registration\_level: "GitHub scale-set registration scope: enterprise, organization, or repository."<br/>  user\_agent: "User-Agent value sent with GitHub API requests."<br/>} | <pre>object({<br/>    app = optional(object({<br/>      key_base64 = optional(string)<br/>      key_base64_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      id = optional(string)<br/>      id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      installation_id = optional(string)<br/>      installation_id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      webhook_secret = optional(string)<br/>      webhook_secret_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>    }), null)<br/>    additional_apps = optional(list(object({<br/>      key_base64          = optional(string)<br/>      key_base64_ssm      = optional(object({ arn = string, name = string }))<br/>      id                  = optional(string)<br/>      id_ssm              = optional(object({ arn = string, name = string }))<br/>      installation_id     = optional(string)<br/>      installation_id_ssm = optional(object({ arn = string, name = string }))<br/>    })), [])<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>    runner_owner              = optional(string, null)<br/>    runner_registration_level = optional(string, "enterprise")<br/>    user_agent                = optional(string, "github-aws-runners")<br/>  })</pre> | `{}` | no |
+| <a name="input_global_config_github"></a> [global\_config\_github](#input\_global\_config\_github) | Global GitHub configuration shared by all runner lanes.<br/><br/>global\_config\_github = {<br/>  app: {<br/>    key\_base64: "Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm: "SSM parameter containing the Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm.arn: "ARN of the SSM parameter containing the GitHub App private key."<br/>    key\_base64\_ssm.name: "Name of the SSM parameter containing the GitHub App private key."<br/>    id: "GitHub App ID."<br/>    id\_ssm: "SSM parameter containing the GitHub App ID."<br/>    id\_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."<br/>    id\_ssm.name: "Name of the SSM parameter containing the GitHub App ID."<br/>    installation\_id: "GitHub App installation ID for the primary scale-set installation."<br/>    installation\_id\_ssm: "SSM parameter containing the primary GitHub App installation ID."<br/>    installation\_id\_ssm.arn: "ARN of the SSM parameter containing the primary GitHub App installation ID."<br/>    installation\_id\_ssm.name: "Name of the SSM parameter containing the primary GitHub App installation ID."<br/>    webhook\_secret: "GitHub App webhook secret."<br/>    webhook\_secret\_ssm: "SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.name: "Name of the SSM parameter containing the GitHub App webhook secret."<br/>  }<br/>  additional\_apps: "Additional GitHub Apps used to distribute GitHub API requests."<br/>  additional\_apps.key\_base64: "Base64-encoded private key for an additional GitHub App."<br/>  additional\_apps.key\_base64\_ssm: "SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.arn: "ARN of the SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.name: "Name of the SSM parameter containing an additional App private key."<br/>  additional\_apps.id: "ID of an additional GitHub App."<br/>  additional\_apps.id\_ssm: "SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.arn: "ARN of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.name: "Name of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.installation\_id: "Optional installation ID for an additional GitHub App."<br/>  additional\_apps.installation\_id\_ssm: "SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.arn: "ARN of the SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.name: "Name of the SSM parameter containing an additional App installation ID."<br/>  enterprise\_server.url: "GitHub Enterprise Server URL."<br/>  enterprise\_server.ssl\_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."<br/>  runner\_owner: "GitHub organization or owner/repository path for organization- or repository-level scale-set registration."<br/>  runner\_registration\_level: "GitHub scale-set registration scope: organization or repository."<br/>  user\_agent: "User-Agent value sent with GitHub API requests."<br/>} | <pre>object({<br/>    app = optional(object({<br/>      key_base64 = optional(string)<br/>      key_base64_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      id = optional(string)<br/>      id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      installation_id = optional(string)<br/>      installation_id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      webhook_secret = optional(string)<br/>      webhook_secret_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>    }), null)<br/>    additional_apps = optional(list(object({<br/>      key_base64          = optional(string)<br/>      key_base64_ssm      = optional(object({ arn = string, name = string }))<br/>      id                  = optional(string)<br/>      id_ssm              = optional(object({ arn = string, name = string }))<br/>      installation_id     = optional(string)<br/>      installation_id_ssm = optional(object({ arn = string, name = string }))<br/>    })), [])<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>    runner_owner              = optional(string, null)<br/>    runner_registration_level = optional(string, "organization")<br/>    user_agent                = optional(string, "github-aws-runners")<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_lambda"></a> [global\_config\_lambda](#input\_global\_config\_lambda) | Global Lambda configuration shared by all runner lanes.<br/><br/>global\_config\_lambda = {<br/>  artifact.s3.bucket: "S3 bucket containing Lambda deployment artifacts."<br/>  runtime: "Default Lambda runtime."<br/>  architecture: "Default Lambda instruction-set architecture."<br/>  principals: "Additional AWS principals allowed to invoke the Lambda functions."<br/>  principals.type: "Principal type, such as AWS account, service, or organization."<br/>  principals.identifiers: "Identifiers allowed for the principal type."<br/>  subnet\_ids: "Subnets used by Lambda functions."<br/>  security\_group\_ids: "Security groups attached to Lambda functions."<br/>  tags: "Tags applied to Lambda functions and related resources."<br/>  role.path: "IAM path used for Lambda execution roles."<br/>  role.permissions\_boundary: "Optional IAM permissions boundary ARN for Lambda execution roles."<br/>} | <pre>object({<br/>    artifact = optional(object({<br/>      s3 = optional(object({<br/>        bucket = optional(string, null)<br/>      }), {})<br/>    }), {})<br/>    runtime      = optional(string, "nodejs24.x")<br/>    architecture = optional(string, "arm64")<br/>    principals = optional(list(object({<br/>      type        = string<br/>      identifiers = list(string)<br/>    })), [])<br/>    subnet_ids         = optional(list(string), [])<br/>    security_group_ids = optional(list(string), [])<br/>    tags               = optional(map(string), {})<br/>    role = optional(object({<br/>      path                 = optional(string, null)<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_observability"></a> [global\_config\_observability](#input\_global\_config\_observability) | Global observability configuration shared by all runner lanes.<br/><br/>global\_config\_observability = {<br/>  logs.level: "Log level for module resources."<br/>  logs.retention\_in\_days: "CloudWatch log retention period in days."<br/>  logs.kms\_key\_id: "KMS key ID used to encrypt CloudWatch log groups."<br/>  logs.class: "CloudWatch log group class."<br/>  logs.tags: "Tags applied to CloudWatch log groups."<br/>  tracing.mode: "Tracing mode used by instrumented resources."<br/>  tracing.capture\_http\_requests: "Whether HTTP requests are captured by tracing."<br/>  tracing.capture\_error: "Whether errors are captured by tracing."<br/>  metrics.enabled: "Whether module metrics are enabled."<br/>  metrics.namespace: "CloudWatch namespace used for module metrics."<br/>  metrics.metric.github\_app\_rate\_limit.enabled: "Whether GitHub App rate-limit metrics are emitted."<br/>  metrics.metric.job\_retry.enabled: "Whether job-retry metrics are emitted."<br/>  metrics.metric.spot\_termination\_warning.enabled: "Whether spot-termination warning metrics are emitted."<br/>} | <pre>object({<br/>    logs = optional(object({<br/>      level             = optional(string, "info")<br/>      retention_in_days = optional(number, 180)<br/>      kms_key_id        = optional(string, null)<br/>      class             = optional(string, "STANDARD")<br/>      tags              = optional(map(string), {})<br/>    }), {})<br/>    tracing = optional(object({<br/>      mode                  = optional(string, null)<br/>      capture_http_requests = optional(bool, false)<br/>      capture_error         = optional(bool, false)<br/>    }), {})<br/>    metrics = optional(object({<br/>      enabled   = optional(bool, false)<br/>      namespace = optional(string, "GitHub Runners")<br/>      metric = optional(object({<br/>        github_app_rate_limit = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        spot_termination_warning = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_orchestration_provider"></a> [global\_config\_orchestration\_provider](#input\_global\_config\_orchestration\_provider) | Global orchestration-provider configuration shared by all runner lanes.<br/><br/>global\_config\_orchestration\_provider = {<br/>  webhook: {<br/>    queue\_selection\_strategy: "Strategy used to select the build queue for a webhook event."<br/>    eventbridge.enabled: "Whether EventBridge integration is enabled for webhook events."<br/>    eventbridge.accept\_events: "Event types accepted by the EventBridge integration."<br/>    matcher\_config\_parameter\_store\_tier: "SSM Parameter Store tier used for matcher configuration."<br/>    runner.boot\_time\_in\_minutes: "Expected runner boot time used by orchestration."<br/>    runner.ephemeral: "Whether runners created by the orchestration provider are ephemeral."<br/>    runner.jit\_config\_enabled: "Whether JIT runner configuration is enabled."<br/>    runner.maximum\_count: "Maximum number of runners that orchestration may create."<br/>    github.repository\_white\_list: "Repositories allowed to use the webhook configuration."<br/>    lambda.artifact.zip: "Local ZIP artifact used for orchestration Lambda functions."<br/>    lambda.artifact.s3.key: "S3 object key for the orchestration Lambda artifact."<br/>    lambda.artifact.s3.object\_version: "Optional S3 object version for the orchestration Lambda artifact."<br/>    lambda.scale.up.memory\_size: "Memory allocated to the scale-up Lambda."<br/>    lambda.scale.up.timeout: "Timeout in seconds for the scale-up Lambda."<br/>    lambda.scale.up.reserved\_concurrent\_executions: "Reserved concurrent executions for the scale-up Lambda."<br/>    lambda.scale.up.job\_queued\_check\_enabled: "Whether the scale-up Lambda checks queued jobs."<br/>    lambda.scale.up.event\_source\_mapping.batch\_size: "Maximum records passed to one scale-up Lambda invocation."<br/>    lambda.scale.up.event\_source\_mapping.maximum\_batching\_window\_in\_seconds: "Maximum time to batch records before invoking the scale-up Lambda."<br/>    lambda.scale.up.tags: "Tags applied to the scale-up Lambda."<br/>    lambda.scale.down.memory\_size: "Memory allocated to the scale-down Lambda."<br/>    lambda.scale.down.timeout: "Timeout in seconds for the scale-down Lambda."<br/>    lambda.scale.down.schedule\_expression: "Schedule expression for scale-down processing."<br/>    lambda.scale.down.minimum\_running\_time\_in\_minutes: "Minimum runner lifetime before scale-down."<br/>    lambda.scale.down.idle\_confirmation\_seconds: "Seconds a runner must consistently report not-busy before scale-down terminates it; 0 disables the confirmation window."<br/>    lambda.scale.down.idle\_config: "Scheduled minimum idle-runner pool settings."<br/>    lambda.scale.down.idle\_config.cron: "Cron expression defining when the idle-runner count applies."<br/>    lambda.scale.down.idle\_config.timeZone: "Time zone used to evaluate the idle-runner schedule."<br/>    lambda.scale.down.idle\_config.idleCount: "Minimum number of idle runners maintained during the schedule."<br/>    lambda.scale.down.idle\_config.evictionStrategy: "Strategy used when evicting idle runners."<br/>    lambda.scale.down.tags: "Tags applied to the scale-down Lambda."<br/>    lambda.webhook.artifact.zip: "Local ZIP artifact used for the webhook Lambda."<br/>    lambda.webhook.artifact.s3.key: "S3 object key for the webhook Lambda artifact."<br/>    lambda.webhook.artifact.s3.object\_version: "Optional S3 object version for the webhook Lambda artifact."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings: "API Gateway access-log destination and format."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.destination\_arn: "ARN of the API Gateway access-log destination."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.format: "API Gateway access-log format."<br/>    lambda.webhook.memory\_size: "Memory allocated to the webhook Lambda."<br/>    lambda.webhook.timeout: "Timeout in seconds for the webhook Lambda."<br/>    lambda.webhook.tags: "Tags applied to the webhook Lambda."<br/>    lambda.pool.memory\_size: "Memory allocated to the pool Lambda."<br/>    lambda.pool.timeout: "Timeout in seconds for the pool Lambda."<br/>    lambda.pool.reserved\_concurrent\_executions: "Reserved concurrent executions for the pool Lambda."<br/>    lambda.pool.config: "Scheduled runner-pool size configuration."<br/>    lambda.pool.config.schedule\_expression: "Schedule expression for the pool size."<br/>    lambda.pool.config.schedule\_expression\_timezone: "Time zone used to evaluate the pool schedule."<br/>    lambda.pool.config.size: "Runner pool size applied by the schedule."<br/>    lambda.pool.include\_busy\_runners: "Whether busy runners are included in pool sizing."<br/>    lambda.pool.runner\_owner: "GitHub organization that owns the runner pool."<br/>    lambda.pool.tags: "Tags applied to the pool Lambda."<br/>    queue.delay\_webhook\_event: "Seconds a webhook event remains invisible in the build queue before processing."<br/>    queue.job\_queue\_retention\_in\_seconds: "Seconds a queued job is retained before it is purged."<br/>    queue.visibility\_timeout\_seconds: "Build queue visibility timeout in seconds."<br/>    queue.redrive\_build\_queue.enabled: "Whether the build queue dead-letter queue is enabled."<br/>    queue.redrive\_build\_queue.maxReceiveCount: "Maximum receives before a message is moved to the dead-letter queue."<br/>    queue.tags: "Tags applied to build queues."<br/>    queue.encryption.kms\_data\_key\_reuse\_period\_seconds: "KMS data-key reuse period for queue encryption."<br/>    queue.encryption.kms\_master\_key\_id: "KMS key ID used for queue encryption."<br/>    queue.encryption.sqs\_managed\_sse\_enabled: "Whether SQS-managed server-side encryption is enabled."<br/>  }<br/>} | <pre>object({<br/>    webhook = optional(object({<br/>      queue_selection_strategy = optional(string, "first")<br/>      eventbridge = optional(object({<br/>        enabled       = optional(bool, true)<br/>        accept_events = optional(list(string), [])<br/>      }), {})<br/>      matcher_config_parameter_store_tier = optional(string, "Standard")<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, null)<br/>      }), {})<br/><br/>      github = optional(object({<br/>        repository_white_list = optional(list(string), [])<br/>      }), {})<br/><br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 30)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_confirmation_seconds       = optional(number, 0)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        webhook = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          api_gateway_access_log_settings = optional(object({<br/>            destination_arn = string<br/>            format          = string<br/>          }), null)<br/>          memory_size = optional(number, 256)<br/>          timeout     = optional(number, 10)<br/>          tags        = optional(map(string), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/><br/>      queue = optional(object({<br/>        delay_webhook_event            = optional(number, 30)<br/>        job_queue_retention_in_seconds = optional(number, 86400)<br/>        visibility_timeout_seconds     = optional(number, 180)<br/>        redrive_build_queue = optional(object({<br/>          enabled         = optional(bool, false)<br/>          maxReceiveCount = optional(number, null)<br/>          }), {<br/>          enabled         = false<br/>          maxReceiveCount = null<br/>        })<br/>        tags = optional(map(string), {})<br/>        encryption = optional(object({<br/>          kms_data_key_reuse_period_seconds = number<br/>          kms_master_key_id                 = string<br/>          sqs_managed_sse_enabled           = bool<br/>          }), {<br/>          kms_data_key_reuse_period_seconds = null<br/>          kms_master_key_id                 = null<br/>          sqs_managed_sse_enabled           = true<br/>        })<br/>      }), {})<br/><br/>    }), {})<br/><br/>    scale_set = optional(object({<br/>      grouping = optional(object({<br/>        strategy = optional(string, "compute_provider")<br/>        custom = optional(object({<br/>          groups = map(object({<br/>            runner_configs = set(string)<br/>          }))<br/>        }), null)<br/>      }), {})<br/>      container = optional(object({<br/>        image                             = optional(string, null)<br/>        user                              = optional(string, "10001:10001")<br/>        health_port                       = optional(number, 8080)<br/>        health_path                       = optional(string, "/healthz")<br/>        health_check_command              = optional(list(string), null)<br/>        health_check_interval             = optional(number, 30)<br/>        health_check_timeout              = optional(number, 5)<br/>        health_check_retries              = optional(number, 3)<br/>        health_check_start_period         = optional(number, 30)<br/>        health_stale_after_seconds        = optional(number, 180)<br/>        shutdown_timeout_seconds          = optional(number, 110)<br/>        session_close_timeout_seconds     = optional(number, 10)<br/>        reconnect_initial_backoff_seconds = optional(number, 1)<br/>        reconnect_max_backoff_seconds     = optional(number, 30)<br/>        stop_timeout_seconds              = optional(number, 120)<br/>      }), {})<br/>      config_store = optional(object({<br/>        path_prefix = optional(string, null)<br/>        tier        = optional(string, "Standard")<br/>        tags        = optional(map(string), {})<br/>      }), {})<br/>      ecs = optional(object({<br/>        cluster = optional(object({<br/>          mode               = optional(string, "managed")<br/>          arn                = optional(string, null)<br/>          name               = optional(string, null)<br/>          container_insights = optional(bool, true)<br/>        }), {})<br/>        task = optional(object({<br/>          cpu              = optional(number, 512)<br/>          memory           = optional(number, 1024)<br/>          cpu_architecture = optional(string, "X86_64")<br/>          ephemeral_storage = optional(object({<br/>            size_in_gib = number<br/>          }), null)<br/>        }), {})<br/>        service = optional(object({<br/>          platform_version = optional(string, "LATEST")<br/>        }), {})<br/>        iam = optional(object({<br/>          path                 = optional(string, "/")<br/>          permissions_boundary = optional(string, null)<br/>        }), {})<br/>      }), {})<br/>      network = optional(object({<br/>        vpc_id     = optional(string, null)<br/>        subnet_ids = optional(set(string), null)<br/>        https_egress = optional(object({<br/>          ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>          ipv6_cidrs = optional(set(string), [])<br/>        }), {})<br/>      }), {})<br/>      logging = optional(object({<br/>        retention_in_days = optional(number, 30)<br/>        kms_key_arn       = optional(string, null)<br/>        log_group_class   = optional(string, "STANDARD")<br/>        tags              = optional(map(string), {})<br/>      }), {})<br/>      tags = optional(map(string), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |

From 03233bcb7cbed715431fa0fa2b9db01a0e32bbb0 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Thu, 17 Sep 2026 00:09:55 +0200
Subject: [PATCH 27/52] fix(multi-runner): align translated registration scope

---
 modules/multi-runner/config.experimental.translation.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/multi-runner/config.experimental.translation.tf b/modules/multi-runner/config.experimental.translation.tf
index 4d7b7d8257..fb8f09b96e 100644
--- a/modules/multi-runner/config.experimental.translation.tf
+++ b/modules/multi-runner/config.experimental.translation.tf
@@ -39,7 +39,7 @@ locals {
       ssl_verify = var.ghes_ssl_verify
     }
     runner_owner              = null
-    runner_registration_level = "enterprise"
+    runner_registration_level = "organization"
     user_agent                = var.user_agent
   }
 

From e640bb4f5b05ebb10b8024d17a40267feee7d4d7 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 16:09:35 +0200
Subject: [PATCH 28/52] test(examples): add scale-set orchestration example

---
 .../.terraform.lock.hcl                       |  93 ++++++++
 .../.terraform.lock.hcl.tofu                  | 150 +++++++++++++
 examples/multi-runner-scale-set/README.md     |  84 +++++++
 examples/multi-runner-scale-set/main.tf       | 208 ++++++++++++++++++
 examples/multi-runner-scale-set/outputs.tf    |   8 +
 examples/multi-runner-scale-set/providers.tf  |   9 +
 examples/multi-runner-scale-set/variables.tf  |  58 +++++
 examples/multi-runner-scale-set/versions.tf   |  17 ++
 8 files changed, 627 insertions(+)
 create mode 100644 examples/multi-runner-scale-set/.terraform.lock.hcl
 create mode 100644 examples/multi-runner-scale-set/.terraform.lock.hcl.tofu
 create mode 100644 examples/multi-runner-scale-set/README.md
 create mode 100644 examples/multi-runner-scale-set/main.tf
 create mode 100644 examples/multi-runner-scale-set/outputs.tf
 create mode 100644 examples/multi-runner-scale-set/providers.tf
 create mode 100644 examples/multi-runner-scale-set/variables.tf
 create mode 100644 examples/multi-runner-scale-set/versions.tf

diff --git a/examples/multi-runner-scale-set/.terraform.lock.hcl b/examples/multi-runner-scale-set/.terraform.lock.hcl
new file mode 100644
index 0000000000..c96d2b19bf
--- /dev/null
+++ b/examples/multi-runner-scale-set/.terraform.lock.hcl
@@ -0,0 +1,93 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "6.63.0"
+  constraints = ">= 5.0.0, >= 6.21.0, >= 6.33.0"
+  hashes = [
+    "h1:9cre7jh1lSs/9igpgAcENMUAUlYW3HCtkav3up4oit0=",
+    "h1:dRlYHkc+r6fgzF57WC7Zjcmb6sF/6TTGDEgwGK+LAZY=",
+    "zh:005d56736afd17d963998c405cee6f434dbc23a415109f9435ff1542879ae611",
+    "zh:026ef126321a86ad7080b5d858e2527f96f5289678cbcd8856296e229c43339d",
+    "zh:06e0b58b2d1eddb5137fc86bee7ad2d07953c0bc3f57cccfc5ae0d2456068a3a",
+    "zh:07221735d61ababed84734e5ffcfc5bd59d01f29f029166ba5f2175895dceed1",
+    "zh:1a72db00583112bdb8c19b213a78a3f5de754fffc08f07e061f4e326289fab7d",
+    "zh:32968e74a53b03e97a084dc7050c22ef661fb5b3ea8a44f5a63e47bc45ad0e7c",
+    "zh:4b357dfe4b820e3e4acd2881cff8288b2186491e63416751f0d12692ba478ceb",
+    "zh:81e30884d7de686265e7d87bb92527e802878c65a378470ede2a1e9f4e40ccc9",
+    "zh:82e137297f6a5a08b9ce2138f7aabea245ad99495d9d9eff502f752d6ca90dbd",
+    "zh:8eb83b67099f0ea9df238a979dff933ff50ce06a2e3ff05a48556a10f10dd204",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:d0ba30886cbe41850fee689f51ef9088578f323cfd21817bb409951d43c465eb",
+    "zh:dd48e7089784454bc03d713e9057f5ca0ea1613bd402125054a51894957b7925",
+    "zh:f250fa81e54cf60fcb0e9c0fc4ac043f1ecc2ac24967f628b3609364fcab3d04",
+    "zh:f38fc09fc25a8d2cf89a4d4cd6a5ef7cb1aad72798dbdcad58b8876b6a551a54",
+    "zh:f7c7380fdf126e1901f2084588dbfd724c76cb131ccfa795a541219111103c06",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/local" {
+  version     = "2.9.0"
+  constraints = "~> 2.0"
+  hashes = [
+    "h1:9rBZCMNpxKwMlRbWH2QpwD3kqUCAejdOZQ/aiiDObXQ=",
+    "h1:m24fjcInWvTVZ1XSo2MaNuKPe+X/gfG8SIi09rA7a7M=",
+    "zh:0baa4566cf77f1ff52f4293d1c8536202dd23edc197c3196413a28343c3ac3a0",
+    "zh:16b5559c3c07088ddad11a9bb9e9c0799999363c2958e9a5be2bcbbf2cd9ca64",
+    "zh:197c79015a10d1cce904a8ea722cbc750c42aeae2da53f44a6a0751d9fd1aa90",
+    "zh:29d0b03e5343a80677ebfeb2e2c31cbe4b1f65e736e53417454a4277fec2544c",
+    "zh:4896bfa6cf1d2fd562b47ef2e87f47862ae92a04f8ad5d764380f0c6653473b8",
+    "zh:531f8529cbca49f681883e57761a05a8398afaef6d1ab0d205d26bf12f4428e8",
+    "zh:6aaf5011d83161c86d2bfb80c0923ec934e578288758da2f37acb7aec129004b",
+    "zh:7430275253d3d3c40aa6179e0ec0d63212874dbbc06c5a51b9d07ec590f9756c",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:be17dc611e95e26cdf6cad79dfccf1064f0e32032a2efeb939a9bbe7fb1cbfe9",
+    "zh:f0e3b0aa644202e1d79d2000dca91f6019425da71e9800fa23f27e51c034f195",
+    "zh:f62bae4519e4ead49182ddc8afe8cf61e2a4c3ba3973b0fbba967736a2696aa3",
+    "zh:fcafa360a5b0b96244f26f4e3a6d642b716a376557142c2442ff2fb12d11da18",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/null" {
+  version     = "3.3.1"
+  constraints = "~> 3.0, ~> 3.2"
+  hashes = [
+    "h1:TuxJq10DVnRP7c5HBZPyyvQGcckNVfijyU1eXEu5e4M=",
+    "h1:m5FqidbIgh+E9OigiZh8/xbkvpUQFSj3hZo/jqNLCLQ=",
+    "zh:08c59776542ea16e5a8545752787b17ff412922182b4cfabe16139197be8ac44",
+    "zh:123109cc7e5ed6d515787fbc212f2a3fd5e75647bb24ab7c801ccd4d4ed42451",
+    "zh:14b3fa4372754b54844b41d5dbd4671a292d8d6828b90169061feb4d7b15dd05",
+    "zh:56a4daaa3212f57b764bf3d1f333141c6610c5f21abb240e0111221f7c7fa4d4",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7e888a026dbacd2474a42264227ae35f639780f0f0c613529d10a95cd61988b3",
+    "zh:85a53646267e87d600df7124e4767ffde9bba3b6356d45d961618bdd68131cc7",
+    "zh:8ffa0e9c7c39b2ab0905b472465d6e35ef0b776b3f6273bb34c150340b61bff1",
+    "zh:9846510a1841530d4403f4818e233f91e3b3bade7441047599fbf800742f65be",
+    "zh:afa98d44860875f037c6def0a7e6ff208e042712ba771f620482b143cd336891",
+    "zh:bdca130d9ef27488ae0b13bc8fd8019e8bbdd4f2ceff29da066bd333165d68c5",
+    "zh:cb3b94cbca88210dd0d1f11e2b8a89333f48c3857faf8f70f589072ce7c28610",
+    "zh:f0c0ba87925fe32f84b80f7513b1efb1b0866f51f899ba825e95ad59ff09b018",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/random" {
+  version     = "3.9.0"
+  constraints = "~> 3.0"
+  hashes = [
+    "h1:OO+IuvQJSPmWdN8AyyIEvPJbLvDQpgX/zbktoa9KsJE=",
+    "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=",
+    "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1",
+    "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea",
+    "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f",
+    "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0",
+    "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61",
+    "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc",
+    "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e",
+    "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef",
+    "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b",
+    "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257",
+    "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04",
+  ]
+}
diff --git a/examples/multi-runner-scale-set/.terraform.lock.hcl.tofu b/examples/multi-runner-scale-set/.terraform.lock.hcl.tofu
new file mode 100644
index 0000000000..577519c08d
--- /dev/null
+++ b/examples/multi-runner-scale-set/.terraform.lock.hcl.tofu
@@ -0,0 +1,150 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hashicorp/aws" {
+  version     = "6.63.0"
+  constraints = ">= 5.0.0, >= 6.21.0, >= 6.33.0"
+  hashes = [
+    "h1:1jhQJPHOPu2mzDG/ke3tK8PNcEqQHA4vhF05WWlM/yg=",
+    "h1:3+pvT0KN/bkJ6TBuExj+gxptEozhnpo80Ztblwq85eo=",
+    "h1:5aTequ87wZS7Mh4dEIayDGKcFdaFgHtw74NtqY5Idi0=",
+    "h1:AMRlrrM3z1SmrslOtotqKq02zapxLKtXaSN9Jbs0Oho=",
+    "h1:OTjECFWTDxsjcUfOKCNBp75Z5lGrW/KplRDsjTZYT2g=",
+    "h1:b8LORLOKMOOl+nK1M2UhCjELSjjziClJuAv6hYuySHs=",
+    "h1:bUfTX1giRLOyfDbBvsDbwR3tJmsTFRWcOTQdj2npDWA=",
+    "h1:dzs4kwx+itVGAH7yEOyeoWcE3LNRMnWtlt4ROgyAa0M=",
+    "h1:lnjou+SiwpYJ+j9PXWozXPHSPlhxIZb0RqpsSEBzfGw=",
+    "h1:pqzUeHAQj9NctgkwaynaF2aB+3QiZXcoslzMGjT743w=",
+    "h1:qTXEWOWxA6sfUpC29UXrsbHnNzWH7+j1RTUVG4YCm+U=",
+    "h1:qdHKOKt/ISn9RLjUe22OZBpN3F7H2DFeHJL/CSc2x8E=",
+    "h1:tpNzIZBzzUW7/kLU3BhYf3jhdO5uNwYfNmgC9B8kvMM=",
+    "h1:uVVlFgjg6GyxJLbCsTO1+R5fTNbZ73mLpVpSd0mMrFk=",
+    "h1:xGJsV5IFf7c11cXzJrsY40hiJCghp4odT0eJyTyAUYY=",
+    "zh:039a03e920e55f14a691feb67216a2d142bfee603128e15f9c5138f9ecd85016",
+    "zh:14e060b7f46ca7b0fa009b91aef419c58cbdff854de96e9a1d853166f8d902fd",
+    "zh:18803e8fe2c291c8db5526c71b3287ff7c81453f10ca6d8e69cdf9c535b00783",
+    "zh:1b83fce6e31a6095e932d80a7c3f47ac04252653a2de2b98ec6204563310fcba",
+    "zh:2add7bc976ceebb1a94d84598762c9b9cf281ca52ec83deeb4e95e90aa200a12",
+    "zh:2f22cd5372408f11937fa5513a7b960d3cebc334c5ec65fc5322c3bac1c1f664",
+    "zh:41c5e857dacfd83b7ca12a435204957ff6ca8830b9efefd0d381ad4d63b19779",
+    "zh:4eace6246e46999782d219bc4f50f83d19ef9156bacf5ca1528da12da4918015",
+    "zh:5e1c1281c3f929399e2ed3dbdce03426fd57a9ec55cd36e04acf1712aa5954ba",
+    "zh:608272b1f5d75ead123c9d933aa1fed7dc832cedd1506019046b4c8fdcc91dce",
+    "zh:6b3680f8a2f7be2c171953aba89d639fb2624b9cf52ec304e16434874566601d",
+    "zh:99aa1006f2141f3341a02020e1c91abfb02280e57c77e0415c98b8d900353d88",
+    "zh:9ad235bef34a89a8dd9943f9fa9f05cc729bb52a4e0dc926a31bb13cb0ae2418",
+    "zh:e0e3ac361e04748a4ca0c1cdbb6abab2aa817f4ad67e1692817d16e370161d59",
+    "zh:f60962c982a41fde956e796425e7194b4311741c179c060c1c8b5e16a557d635",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/local" {
+  version     = "2.9.0"
+  constraints = "~> 2.0"
+  hashes = [
+    "h1:1dtKYW/5a1qob3yneL6WzOlnSGfYtJ6a2XeejCk9yb4=",
+    "h1:5NseXq5wU8O20ersTtV4ocrLYFFtgFr7n0pRLO1W2Rw=",
+    "h1:5d22ZPPK4iiygPbwRz/PJF5Es/0axVpMlPRpCR0Padw=",
+    "h1:AnwyolirmIlBMjH6+tV8bKkvT+5axJNYxi2y2IguiX4=",
+    "h1:PBp+HeseY021Fw3sLznCG27idgwPoff4cBuNmKgPL2w=",
+    "h1:VDxIhe4GbzdOCdmt7mQaqdwERQW6GSI7Roonts42Gr0=",
+    "h1:ZO6eWWnf8LjjV1q/JNeL9WLtZ6fwIttOnyN5LjCNSEo=",
+    "h1:dPIAf8oUAz+vW2E0iZunMvpuPddRZIztRsPSY1u+VnY=",
+    "h1:fwTDVG9AhFVKQZIb1EXkHv4FqzsZNlLWgkyPGDmZZEE=",
+    "h1:kDc465XPC7/6XFCjrMC4mTqhA9ef0FHKuJ3ZgfGNfeg=",
+    "h1:kGbjxrI2P8MHeyVtE1U3Q1TbyF71ExnHxtkrE+Aj6UU=",
+    "h1:kcoK6Afbsj54u9zaEqpecWAFKytqjBijtguCNwV3d4M=",
+    "h1:rxomJjDwOo+YZ+WIPc25FqEgsz9orh/2MCyUcZmFjvw=",
+    "h1:t0CMn/Rkwquw8l2yQ+O4ApzbMZfY2UazbsDnZygzACA=",
+    "h1:tJwgm2BS4xCGlElCDQEFXQoefY9Y4t0JdSKTtsPBbBo=",
+    "zh:13ef7ecd1e397ec5b20ea588508dd3e3b8d6c50d809ae76b079abf9dd8d02e4b",
+    "zh:2190c9325980076489ce02b0f5dd2c0b91fc8711cefa99e714d8619a32827ad1",
+    "zh:2a0cfc5600730093705071707e4a4e4e953e7d9091859e0f66b46daa1060dd5d",
+    "zh:2ff53eac1af43ab9a2248a0e53c963d46e19cf04bc4c3f323591cfcebb218252",
+    "zh:4ebc3dee700f60af9da29970052fd02fa947813162b224716862dc9d7f1f7542",
+    "zh:5fe6dab84ceeaa8eb3f1567c5f05578333370c472240ca5c5bfc25e92d4d5586",
+    "zh:66bbec16367bbf440045502c9779b11f4ac5b022c8d8d17afe12d431950838b5",
+    "zh:7641e5c2e4b529e869cde29ab5b1de2fd1091489eb745b19ac2709bd7f4dfd84",
+    "zh:855bfba0756d17ce07595ff57d7cf664443d1495127cb88fb063362734b8b22a",
+    "zh:aaec10f237921d60c581d1b7a66f0a8a8019d9802dc04af11b5b981f6682e01d",
+    "zh:e460835a38ffa1e74f6929904bfd14ef473d217fd537b7ce834abe5ce5e2ce07",
+    "zh:ecc4295215db0e4aea3c9329611c31e09a853e1ae207d56742403bd4f5516703",
+    "zh:ee6d9fae63a612072e00402894e14826af7a3351c235b9c5b423b7629a77ca29",
+    "zh:f2b5c8db74aa7ebcf7cd423672358437d42401675069ef67b01ff910054e49d5",
+    "zh:f5aff74d3eb96d4592c7bca5cd3ea89b469e84efbf382944bd0f844a57059c09",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/null" {
+  version     = "3.3.1"
+  constraints = "~> 3.0, ~> 3.2"
+  hashes = [
+    "h1:2wld81FnmHW0WVgy081sIfokCr2+NuatS8yjeLEet7Y=",
+    "h1:AClQjJ6X22V4qcRgcYSxiXCMmp2pz0G8WVQC7wAx66o=",
+    "h1:AY3XQbuviNd2X5VhHYEbhNta1m/CG3JD2BKFKhCt1Y4=",
+    "h1:CUOZUd7H11lsU+4tISlnYIiP5BqnX8IDwFCVqfLJyAg=",
+    "h1:JIfV0nA/pLWnIFGscvTfuavQCn2NeHxJBeb6UUg/joA=",
+    "h1:RejAh+nyCwqDGExGln2Kb4Ro5LyHak0eJe0P9g8CHPc=",
+    "h1:SHOuTZjYymsmy4asuRq6NC3yW+zdVZOOt4f5nrb+EPM=",
+    "h1:WwPat/gT4gO8GvvKNdSkkXWVD65JppLJfqKOt9HhOqQ=",
+    "h1:Z3hXVLrOyaRiiLmmL5UCOdcRMguwjN1x5TYNdmBDgls=",
+    "h1:dd78Ad5HdfPzPts7A9qIxfitXhAriV/qza38fr2ukjk=",
+    "h1:dyVb++KwDdybzLTE6bf7GZiVQ31iWsgKPWmhTQ8G42k=",
+    "h1:gD8ZH6WWe+5gg5+y8SpLWGPUDzSxcQ3HKP8IDM/wW3I=",
+    "h1:juXCww0zRQKFTDZoKqYR0+Sn1lu99oeL6pr0Jh6LWx0=",
+    "h1:kFAySmtsshyNV7IhIrEdASzVcvwy68eeZCVC66P7yNk=",
+    "h1:nS5azDopRisB2NInwDx3Hrfg2FdVt8Gw0gTQzC0rd70=",
+    "zh:164eb061d84e01759f391265865fb31828083d0a06b25f7af7e094cbdb18c799",
+    "zh:1bb9b669a82b52c0cba2860c71e9ee6699ef302f28cb8ed06f572d39bc6c7c4f",
+    "zh:1ea9b31a8f29302122c1e8d673693f3ac270336dae560af803cd1117265a469a",
+    "zh:238bd463cb0154fb935dc331da40c0a9cbe5db9cee615ae5f35ccad5eed7dc41",
+    "zh:30ef2b7384cf7e20f33fe75754b54cf669d59816f3ad4fc73bfb2b26fb6735e9",
+    "zh:35b5cded16e4b57c207d03ee0979b14baf486fa520e6edb7a2eecf18f1b85471",
+    "zh:3dc840d13a50cd215c7540573f27e2b61f739ba90aee5b7c3846079aa0ab5534",
+    "zh:3f9309a18db608f975d5691fcb47a6e14d77199156a52e9c39dcafe3737f2b07",
+    "zh:44263a219f7dbd1848b545d080110b4f7d0495e77b71cd3c7a0b5ec52a09accb",
+    "zh:4dec54aa5f445eeea035bbd4839bcded5e47ecd07cba0e70c5a09e9272cb592f",
+    "zh:5e8fb319d7c6d6c4566a18b9d0c91580b4901a96acd7fdc476bfc79f074368e2",
+    "zh:b0e8b6d41834b57fcfbb5ca00da52ccb757e1a95b6a2d546c0dae8bfbeca1cdf",
+    "zh:bbde4c3a1dcc1718027a61a4cdf661619d17af1b58df1038fe27bcf43c3dc29b",
+    "zh:c4140fff9f692baf29236557f706f9515f93229413438527d764023a82301da3",
+    "zh:f8e9d83184e4bbeb97c6f0d569833007c48ba5a7ff334def201df4991d03a962",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/random" {
+  version     = "3.9.0"
+  constraints = "~> 3.0"
+  hashes = [
+    "h1:8EQU5KSxezcjo/phRSe69rDOI0lk4pSaggj7FsskYp8=",
+    "h1:Lw9im2VBBJQ3RyAbHPQ0rcvcmmcZWm3x+kIOpN+Tv9s=",
+    "h1:U8KXqGCoNI9/guYbTvzgdtVk3fRthoG0UXwm1JoEpIs=",
+    "h1:YXaVd4p6qXPPVaxIBaIDNXmBwT02ZqDn0qD+tYpw8sA=",
+    "h1:cOpc03fphEt/G9Rfc4jLL/fW0D7tgvlXqiDKPF4vuww=",
+    "h1:g09RR7T1xWkeGrZwWvWMT9ncJrFGr1k3CBD585UmO7w=",
+    "h1:gGDdPPibmw2EWROx+sh1RGLjR5+nPwZyrf6/N9jXfeM=",
+    "h1:haE7/nXCOhXKP4oXeEnER3t5CaVQWqujz4nBnpeTUv4=",
+    "h1:ieSVpfZS2lKuMr05ph0QsOVpCzg7uk3cgKBaXR+Ikug=",
+    "h1:ig2s1IS9IzehorRjvVAnKIsUUj8fkgyxct1L/kswcc4=",
+    "h1:j3lS+ZEERFnoab8t1ppDrScGVP/cgWbzlCrEYKTCXYw=",
+    "h1:lxezrKmOiQIySHAM+os8qLVq7hqufDr8h3Hpzvsk+78=",
+    "h1:lzRqBJAG+NETxHbEZUJ/YP3RMEjZBinTX7VmgH3lw60=",
+    "h1:tdSNWK5ApqUsgbdYieyeYLTu6nIZUV3hR1oFqUfAuGo=",
+    "h1:xedet8yH/zI2CfdxsGlK0nlFWc/Bp61yrWsEa3fHB8g=",
+    "zh:03f1114cc20b8913523735ab76e0f0a2b16ce13c92923a53304bf85f07fc0dbc",
+    "zh:105b678ee72322a3067f105d7e05e940f6143238f377f6e87ff4ec909246ac2a",
+    "zh:55f3bbf13ea18cbace61a706566a80f25f33fe2b1780b6f3d7b582af2a05b6d2",
+    "zh:63adf996db48f082f7a6351eb485e219cd88795fc71e6ec60a837263ab0d2cb1",
+    "zh:7e99550738a4e3cc68b8a467714b0d69371025fe95e3326d5323d026d55653e9",
+    "zh:8342b54af3a18a37e075eeae61be57f4de2ba71b35d95c5075d402dd2c1f289d",
+    "zh:83ee18e32ac9dd5fc91298554b7c4cfa4c3a1db50f4c797945637cc93c0844ae",
+    "zh:993ecc0adbf6bd535a59fbc9b735d8c33950e6f6eb5e621d750da9b71d65d80a",
+    "zh:ad722bc59d4edbf1415e827fc007c0efe6e0e9462d5568bae20b34be1058a261",
+    "zh:ae9448e1f87b2f9a6c5197a0e9862162ec6b137cb3a3835e11522995d8939e7c",
+    "zh:bc9cdd3aac784f759125c6627f6f6416e8726a1c184eb9cf3e55b9edbc94c627",
+    "zh:c8e35b89572ba1c40a9b20022e033a3395fb8d42e7604d50c900f193ba10382e",
+    "zh:e2deaa8a9975ef81d9f62baed12c41286918b0a10908e0e031f13f69a3b730a1",
+    "zh:ee39707557210a0ab1098aa357d2cdfe502e5a312d0dbdffb09d08facc4d3fc5",
+    "zh:f81afe4eb63e8aa9e0ea71be6c990f0dc69cb360e7191c0742a991f4a5081b64",
+  ]
+}
diff --git a/examples/multi-runner-scale-set/README.md b/examples/multi-runner-scale-set/README.md
new file mode 100644
index 0000000000..d7119a30be
--- /dev/null
+++ b/examples/multi-runner-scale-set/README.md
@@ -0,0 +1,84 @@
+# Multi-runner scale-set example
+
+This example demonstrates the experimental multi-runner v2 interface. Shared
+defaults are configured with `global_config*` variables, while
+each runner lane uses `multi_runner_config` for its matcher,
+runner lifecycle, and compute-provider settings.
+
+The example creates four lanes from one deployment:
+
+- Linux ARM64 Amazon Linux runners.
+- Ephemeral Linux x64 Amazon Linux runners with job retry enabled.
+- Linux x64 runners managed by a GitHub Actions scale set.
+- Windows x64 Server Core 2022 runners.
+
+The v2 interface keeps provider-owned settings inside the selected provider
+configuration. For example, VPC and subnet settings are under
+`global_config_compute_provider.aws.ec2`, while the per-lane
+instance types and AMI filter are under each lane's compute provider block.
+
+The scale-set lane uses `orchestration_provider.scale_set`. Its controller
+network is configured under the global scale-set block and its GitHub
+installation ID is provided by `var.github_app`.
+
+Configure the GitHub App variables before applying:
+
+```bash
+terraform init
+terraform apply \
+  -var='github_app={id="123456",key_base64="...",installation_id="123456789"}' \
+  -var='scale_set={name="linux-scale-set",container={image="ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service@sha256:<release-digest>"}}'
+```
+
+The `github_app` value is sensitive and should be supplied through a secure
+variable source in real deployments rather than committed to configuration.
+The GitHub App must be installed for the configured GitHub account.
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
+| <a name="requirement_local"></a> [local](#requirement\_local) | ~> 2.0 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_random"></a> [random](#provider\_random) | 3.9.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_base"></a> [base](#module\_base) | ../base | n/a |
+| <a name="module_runners"></a> [runners](#module\_runners) | ../../modules/multi-runner | n/a |
+| <a name="module_webhook_github_app"></a> [webhook\_github\_app](#module\_webhook\_github\_app) | ../../modules/webhook-github-app | n/a |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [random_id.random](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_ami"></a> [ami](#input\_ami) | Optional AMI configuration keyed by runner lane. | <pre>map(object({<br/>    filter = optional(map(list(string)), { state = ["available"] })<br/>    owners = optional(list(string), ["amazon"])<br/>    id_ssm_parameter = optional(object({<br/>      arn = string<br/>    }), null)<br/>    kms_key = optional(object({<br/>      arn = string<br/>    }), null)<br/>  }))</pre> | `{}` | no |
+| <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | AWS region to deploy to. | `string` | `"eu-west-1"` | no |
+| <a name="input_environment"></a> [environment](#input\_environment) | Environment name, used as prefix. | `string` | `null` | no |
+| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub App ID, base64-encoded private key, and installation ID. | <pre>object({<br/>    id              = string<br/>    key_base64      = string<br/>    installation_id = optional(string, null)<br/>  })</pre> | n/a | yes |
+| <a name="input_runner_binaries_enabled"></a> [runner\_binaries\_enabled](#input\_runner\_binaries\_enabled) | Whether runner binary synchronization is enabled. | `bool` | `true` | no |
+| <a name="input_scale_set"></a> [scale\_set](#input\_scale\_set) | GitHub Actions scale-set configuration. | <pre>object({<br/>    name = string<br/>    container = optional(object({<br/>      image = optional(string, null)<br/>    }), {})<br/>  })</pre> | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_webhook_endpoint"></a> [webhook\_endpoint](#output\_webhook\_endpoint) | n/a |
+| <a name="output_webhook_secret"></a> [webhook\_secret](#output\_webhook\_secret) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/examples/multi-runner-scale-set/main.tf b/examples/multi-runner-scale-set/main.tf
new file mode 100644
index 0000000000..3bf1fd02a4
--- /dev/null
+++ b/examples/multi-runner-scale-set/main.tf
@@ -0,0 +1,208 @@
+locals {
+  environment = var.environment != null ? var.environment : "multi-runner-v2"
+  aws_region  = var.aws_region
+}
+
+resource "random_id" "random" {
+  byte_length = 20
+}
+
+module "base" {
+  source = "../base"
+
+  prefix     = local.environment
+  aws_region = local.aws_region
+}
+
+module "runners" {
+  source = "../../modules/multi-runner"
+
+  prefix     = local.environment
+  aws_region = local.aws_region
+
+  experimental_features = ["multi-runner-v2"]
+
+  global_config = {
+    tags = {
+      Example = local.environment
+      Project = "ProjectX"
+    }
+    runner = {
+      os           = "linux"
+      architecture = "x64"
+      extra_labels = ["v2"]
+    }
+  }
+
+  global_config_github = {
+    app = {
+      key_base64      = var.github_app.key_base64
+      id              = var.github_app.id
+      installation_id = var.github_app.installation_id
+      webhook_secret  = random_id.random.hex
+    }
+  }
+
+  global_config_lambda = {
+    architecture = "arm64"
+  }
+
+  global_config_orchestration_provider = {
+    webhook = {
+      eventbridge = {
+        enabled       = true
+        accept_events = ["workflow_job"]
+      }
+    }
+    scale_set = {
+      grouping = {
+        strategy = "runner_config"
+      }
+      container = var.scale_set.container
+      network = {
+        vpc_id     = module.base.vpc.vpc_id
+        subnet_ids = module.base.vpc.private_subnets
+      }
+    }
+  }
+
+  global_config_compute_provider = {
+    aws = {
+      ec2 = {
+        vpc_id      = module.base.vpc.vpc_id
+        subnet_ids  = module.base.vpc.private_subnets
+        ssm_enabled = true
+        runner_binaries = {
+          enabled = var.runner_binaries_enabled
+        }
+      }
+    }
+  }
+
+  multi_runner_config = {
+    linux-arm64 = {
+      runner = {
+        architecture = "arm64"
+        name_prefix  = "amazon-arm64-"
+        extra_labels = ["amazon"]
+      }
+      orchestration_provider = {
+        webhook = {
+          runner = {
+            maximum_count = 1
+          }
+          matcherConfig = {
+            exactMatch    = true
+            labelMatchers = [["self-hosted", "linux", "arm64", "amazon"]]
+          }
+        }
+      }
+      compute_provider = {
+        aws = {
+          ec2 = {
+            instance_types = ["t4g.large", "c6g.large"]
+            ami            = lookup(var.ami, "linux-arm64", null)
+          }
+        }
+      }
+    }
+
+    linux-x64 = {
+      runner = {
+        name_prefix  = "amazon-x64-"
+        extra_labels = ["amazon"]
+      }
+      orchestration_provider = {
+        webhook = {
+          runner = {
+            ephemeral     = true
+            maximum_count = 1
+          }
+          matcherConfig = {
+            labelMatchers = [["self-hosted", "linux", "x64", "amazon"]]
+            exactMatch    = false
+            priority      = 1
+          }
+          queue = {
+            delay_webhook_event = 0
+          }
+          job_retry = {
+            enabled = true
+          }
+        }
+      }
+      compute_provider = {
+        aws = {
+          ec2 = {
+            instance_types = ["m5a.large", "m5ad.large"]
+            ami            = lookup(var.ami, "linux-x64", null)
+          }
+        }
+      }
+    }
+
+    linux-scale-set = {
+      runner = {
+        name_prefix  = "scale-set-"
+        extra_labels = ["scale-set"]
+      }
+      orchestration_provider = {
+        scale_set = {
+          name = var.scale_set.name
+          runner = {
+            min_runners          = 0
+            max_runners          = 10
+            boot_time_in_minutes = 10
+          }
+        }
+      }
+      compute_provider = {
+        aws = {
+          ec2 = {
+            instance_types = ["m5.large"]
+            ami            = lookup(var.ami, "linux-scale-set", null)
+          }
+        }
+      }
+    }
+
+    windows-x64 = {
+      runner = {
+        os          = "windows"
+        name_prefix = "windows-x64-"
+      }
+      orchestration_provider = {
+        webhook = {
+          runner = {
+            boot_time_in_minutes = 20
+            maximum_count        = 1
+          }
+          matcherConfig = {
+            exactMatch    = true
+            labelMatchers = [["self-hosted", "windows", "x64", "servercore-2022"]]
+          }
+        }
+      }
+      compute_provider = {
+        aws = {
+          ec2 = {
+            instance_types = ["m5.large", "c5.large"]
+            ami            = lookup(var.ami, "windows-x64", null)
+          }
+        }
+      }
+    }
+  }
+}
+
+module "webhook_github_app" {
+  source     = "../../modules/webhook-github-app"
+  depends_on = [module.runners]
+
+  github_app = {
+    key_base64     = var.github_app.key_base64
+    id             = var.github_app.id
+    webhook_secret = random_id.random.hex
+  }
+  webhook_endpoint = module.runners.webhook.endpoint
+}
diff --git a/examples/multi-runner-scale-set/outputs.tf b/examples/multi-runner-scale-set/outputs.tf
new file mode 100644
index 0000000000..1feaf2e671
--- /dev/null
+++ b/examples/multi-runner-scale-set/outputs.tf
@@ -0,0 +1,8 @@
+output "webhook_endpoint" {
+  value = module.runners.webhook.endpoint
+}
+
+output "webhook_secret" {
+  sensitive = true
+  value     = random_id.random.hex
+}
diff --git a/examples/multi-runner-scale-set/providers.tf b/examples/multi-runner-scale-set/providers.tf
new file mode 100644
index 0000000000..eca2fe96a7
--- /dev/null
+++ b/examples/multi-runner-scale-set/providers.tf
@@ -0,0 +1,9 @@
+provider "aws" {
+  region = local.aws_region
+
+  default_tags {
+    tags = {
+      Example = local.environment
+    }
+  }
+}
diff --git a/examples/multi-runner-scale-set/variables.tf b/examples/multi-runner-scale-set/variables.tf
new file mode 100644
index 0000000000..c41fea1186
--- /dev/null
+++ b/examples/multi-runner-scale-set/variables.tf
@@ -0,0 +1,58 @@
+variable "github_app" {
+  description = "GitHub App ID, base64-encoded private key, and installation ID."
+
+  type = object({
+    id              = string
+    key_base64      = string
+    installation_id = optional(string, null)
+  })
+  sensitive = true
+}
+
+variable "scale_set" {
+  description = "GitHub Actions scale-set configuration."
+
+  type = object({
+    name = string
+    container = optional(object({
+      image = optional(string, null)
+    }), {})
+  })
+}
+
+variable "environment" {
+  description = "Environment name, used as prefix."
+
+  type    = string
+  default = null
+}
+
+variable "aws_region" {
+  description = "AWS region to deploy to."
+
+  type    = string
+  default = "eu-west-1"
+}
+
+variable "runner_binaries_enabled" {
+  description = "Whether runner binary synchronization is enabled."
+
+  type    = bool
+  default = true
+}
+
+variable "ami" {
+  description = "Optional AMI configuration keyed by runner lane."
+
+  type = map(object({
+    filter = optional(map(list(string)), { state = ["available"] })
+    owners = optional(list(string), ["amazon"])
+    id_ssm_parameter = optional(object({
+      arn = string
+    }), null)
+    kms_key = optional(object({
+      arn = string
+    }), null)
+  }))
+  default = {}
+}
diff --git a/examples/multi-runner-scale-set/versions.tf b/examples/multi-runner-scale-set/versions.tf
new file mode 100644
index 0000000000..1dfb3e5774
--- /dev/null
+++ b/examples/multi-runner-scale-set/versions.tf
@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.33"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
+  }
+  required_version = ">= 1.4.0"
+}

From 2f31a0bad825e8180cd1de2967704c6c72951ae5 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 16:10:41 +0200
Subject: [PATCH 29/52] test(ministack): cover scale-set controller integration

---
 .github/workflows/ministack.yml               |  38 ++++
 tests/ministack/README.md                     |  17 +-
 tests/ministack/multi-runner-scale-set.tfvars |  57 ++++++
 tests/ministack/multi-runner-v2.tfvars        |   2 +
 tests/ministack/run-example.sh                |  14 +-
 tests/ministack/run-scale-set-integration.sh  | 177 ++++++++++++++++++
 6 files changed, 298 insertions(+), 7 deletions(-)
 create mode 100644 tests/ministack/multi-runner-scale-set.tfvars
 create mode 100755 tests/ministack/run-scale-set-integration.sh

diff --git a/.github/workflows/ministack.yml b/.github/workflows/ministack.yml
index 5aec51a53c..c6d5007847 100644
--- a/.github/workflows/ministack.yml
+++ b/.github/workflows/ministack.yml
@@ -72,6 +72,7 @@ jobs:
           - ephemeral
           - multi-runner
           - multi-runner-v2
+          - multi-runner-scale-set
           - termination-watcher
     services:
       ministack:
@@ -194,3 +195,40 @@ jobs:
           MINISTACK_GITHUB_MOCK_PORT: "1080"
           MINISTACK_GITHUB_MOCK_URL: ${{ steps.mockserver.outputs.url }}
         run: sh tests/ministack/run-smoke.sh
+
+  integration_scale_set:
+    name: Run scale-set controller integration test against MiniStack
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    services:
+      ministack:
+        image: ghcr.io/ministackorg/ministack:1.5.10@sha256:706b2b83c6be7e4f4dbb6a0dc28ffdebb500c6c80b64cf7938f45040fb2158e8
+        ports:
+          - 4566:4566
+        options: --add-host=host.docker.internal:host-gateway
+        env:
+          MINISTACK_ACCOUNT_ID: "000000000000"
+          MINISTACK_REGION: eu-west-1
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
+        with:
+          terraform_version: latest
+          terraform_wrapper: false
+
+      - name: Mark repository as safe
+        shell: sh
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Run scale-set controller integration test
+        run: sh tests/ministack/run-scale-set-integration.sh
diff --git a/tests/ministack/README.md b/tests/ministack/README.md
index fe4cb223df..38c20aa34f 100644
--- a/tests/ministack/README.md
+++ b/tests/ministack/README.md
@@ -1,7 +1,8 @@
 # MiniStack example tests
 
 The MiniStack workflow runs the `base`, `prebuilt`, `default`, `ephemeral`,
-`multi-runner`, `multi-runner-v2`, and `termination-watcher` examples directly
+`multi-runner`, `multi-runner-v2`, `multi-runner-scale-set`, and
+`termination-watcher` examples directly
 with Terraform 1.5.6 and the latest Terraform release, and with OpenTofu 1.11
 and the latest OpenTofu release.
 The examples with input variables get their inputs from their own tfvars files
@@ -10,7 +11,7 @@ and uses the configuration checked into the example itself. No override files,
 setup module, or Terraform fixture configuration is checked in. The helper
 creates and removes a temporary AMI override for `default` and
 `ephemeral`, temporary SSM parameters for `multi-runner`, and temporary AMI
-fixtures for `multi-runner-v2`.
+fixtures plus an override for `multi-runner-v2` and `multi-runner-scale-set`.
 
 Start MiniStack, set the AWS endpoint and test credentials, then run:
 
@@ -27,6 +28,8 @@ tests/ministack/run-example.sh apply multi-runner
 # or
 tests/ministack/run-example.sh apply multi-runner-v2
 # or
+tests/ministack/run-example.sh apply multi-runner-scale-set
+# or
 tests/ministack/run-example.sh apply termination-watcher
 ```
 
@@ -35,8 +38,8 @@ ZIP fixtures in the paths expected by the modules when they are absent, and
 removes only the files it created. For `prebuilt`, it seeds AMI metadata through
 MiniStack's AWS-compatible EC2 API, then removes only the resources it created
 during cleanup. MiniStack v1.5.10 provides the EC2 image behavior needed by the
-`default`, `ephemeral`, and `multi-runner` examples, so they are included in
-the same lifecycle matrix.
+`default`, `ephemeral`, `multi-runner`, and `multi-runner-scale-set` examples,
+so they are included in the same lifecycle matrix.
 
 ## Webhook and runner lifecycle smoke test
 
@@ -85,3 +88,9 @@ override the hostname with `MINISTACK_GITHUB_MOCK_HOST` when using a different
 container runtime. When MiniStack is exposed on a non-default local port, use a
 host address reachable from its container for `AWS_ENDPOINT_URL`, for example
 `AWS_ENDPOINT_URL=http://<host-ip>:14568`, instead of `127.0.0.1`.
+
+The workflow also runs `run-scale-set-integration.sh`. It applies the
+`multi-runner-scale-set` example and verifies the managed ECS controller,
+Fargate task hardening, scale-set environment contract, and reconciler SSM
+parameter through MiniStack's AWS-compatible APIs. It does not send webhook
+events or exercise webhook scale-up, scale-down, or pool handlers.
diff --git a/tests/ministack/multi-runner-scale-set.tfvars b/tests/ministack/multi-runner-scale-set.tfvars
new file mode 100644
index 0000000000..438b7fd77d
--- /dev/null
+++ b/tests/ministack/multi-runner-scale-set.tfvars
@@ -0,0 +1,57 @@
+environment = "ministack-scale-set"
+aws_region  = "eu-west-1"
+
+github_app = {
+  id         = "0"
+  key_base64 = "ministack-invalid-key"
+  installation_id_ssm = {
+    name = "/ministack/scale-set/installation-id"
+    arn  = "arn:aws:ssm:eu-west-1:000000000000:parameter/ministack/scale-set/installation-id"
+  }
+}
+
+runner_binaries_enabled = false
+
+ami = {
+  "linux-arm64" = {
+    filter = {
+      name  = ["ministack-scale-set-linux-arm64"]
+      state = ["available"]
+    }
+    owners = ["self"]
+  }
+  "linux-x64" = {
+    filter = {
+      name  = ["ministack-scale-set-linux-x64"]
+      state = ["available"]
+    }
+    owners = ["self"]
+  }
+  "linux-scale-set" = {
+    filter = {
+      name  = ["ministack-scale-set-linux-x64"]
+      state = ["available"]
+    }
+    owners = ["self"]
+  }
+  "windows-x64" = {
+    filter = {
+      name  = ["ministack-scale-set-windows-x64"]
+      state = ["available"]
+    }
+    owners = ["self"]
+  }
+}
+
+scale_set = {
+  config_url = "https://github.com/example"
+  installation_id_ssm = {
+    name = "/ministack/scale-set/installation-id"
+    arn  = "arn:aws:ssm:eu-west-1:000000000000:parameter/ministack/scale-set/installation-id"
+  }
+  name                      = "ministack-scale-set"
+  id                        = 1
+  runner_group_id           = 1
+  runner_owner              = "example"
+  runner_registration_level = "organization"
+}
diff --git a/tests/ministack/multi-runner-v2.tfvars b/tests/ministack/multi-runner-v2.tfvars
index 0f9c6073fc..de54e291cf 100644
--- a/tests/ministack/multi-runner-v2.tfvars
+++ b/tests/ministack/multi-runner-v2.tfvars
@@ -6,6 +6,8 @@ github_app = {
   key_base64 = "ministack-invalid-key"
 }
 
+runner_binaries_enabled = false
+
 ami = {
   "linux-arm64" = {
     filter = {
diff --git a/tests/ministack/run-example.sh b/tests/ministack/run-example.sh
index 9ea64e58fc..331c3177a3 100755
--- a/tests/ministack/run-example.sh
+++ b/tests/ministack/run-example.sh
@@ -23,14 +23,14 @@ case "$iac_binary" in
 esac
 
 case "$example" in
-  base | prebuilt | default | ephemeral | multi-runner | multi-runner-v2)
+  base | prebuilt | default | ephemeral | multi-runner | multi-runner-v2 | multi-runner-scale-set)
     use_tfvars=true
     ;;
   termination-watcher)
     use_tfvars=false
     ;;
   *)
-  echo "Supported examples for the runner are: base, prebuilt, default, ephemeral, multi-runner, multi-runner-v2, termination-watcher" >&2
+  echo "Supported examples for the runner are: base, prebuilt, default, ephemeral, multi-runner, multi-runner-v2, multi-runner-scale-set, termination-watcher" >&2
   exit 64
   ;;
 esac
@@ -38,7 +38,7 @@ esac
 case "$action" in
   init | plan | apply | destroy) ;;
   *)
-    echo "Usage: $0 {init|plan|apply|destroy} {base|prebuilt|default|ephemeral|multi-runner|multi-runner-v2|termination-watcher} [TFVARS_FILE]" >&2
+    echo "Usage: $0 {init|plan|apply|destroy} {base|prebuilt|default|ephemeral|multi-runner|multi-runner-v2|multi-runner-scale-set|termination-watcher} [TFVARS_FILE]" >&2
     exit 64
     ;;
 esac
@@ -317,6 +317,14 @@ $lambda_zip"
       create_ami_fixture "ministack-v2-linux-x64" x86_64 >/dev/null
       create_ami_fixture "ministack-v2-windows-x64" x86_64 >/dev/null
       ;;
+    multi-runner-scale-set)
+      create_ami_fixture "ministack-scale-set-linux-x64" x86_64 >/dev/null
+      create_ami_fixture "ministack-scale-set-linux-arm64" arm64 >/dev/null
+      create_ami_fixture "ministack-scale-set-windows-x64" x86_64 >/dev/null
+      create_ssm_fixture \
+        "/ministack/scale-set/installation-id" \
+        "1"
+      ;;
   esac
 }
 
diff --git a/tests/ministack/run-scale-set-integration.sh b/tests/ministack/run-scale-set-integration.sh
new file mode 100755
index 0000000000..8e8b09a26c
--- /dev/null
+++ b/tests/ministack/run-scale-set-integration.sh
@@ -0,0 +1,177 @@
+#!/bin/sh
+
+set -eu
+
+export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-000000000000}"
+export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-test-only}"
+export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-eu-west-1}"
+export AWS_REGION="${AWS_REGION:-eu-west-1}"
+export AWS_ENDPOINT_URL="${AWS_ENDPOINT_URL:-http://localhost:4566}"
+export AWS_EC2_METADATA_DISABLED="${AWS_EC2_METADATA_DISABLED:-true}"
+
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+source_root=$(CDPATH='' cd -- "$script_dir/../.." && pwd)
+example="multi-runner-scale-set"
+tfvars_file="$script_dir/$example.tfvars"
+cluster_name="ministack-scale-set-scale-set"
+controller_group="linux-scale-set"
+config_path="/ministack-scale-set/scale-set-controller/$controller_group"
+expected_parameter_name="$config_path/linux-scale-set"
+service_file=$(mktemp "${TMPDIR:-/tmp}/terraform-aws-github-runner-scale-set-service.XXXXXX")
+task_file=$(mktemp "${TMPDIR:-/tmp}/terraform-aws-github-runner-scale-set-task.XXXXXX")
+terraform_state_exists=false
+
+cleanup() {
+  set +e
+  if [ "$terraform_state_exists" = true ]; then
+    "$source_root/tests/ministack/run-example.sh" destroy "$example" "$tfvars_file" >/dev/null 2>&1
+  fi
+  rm -f "$service_file" "$task_file"
+}
+trap cleanup EXIT INT TERM
+
+require_command() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    echo "$1 is required to run the scale-set MiniStack integration test." >&2
+    exit 69
+  fi
+}
+
+for command in aws curl python3 terraform; do
+  require_command "$command"
+done
+
+ministack_aws() {
+  aws --endpoint-url "$AWS_ENDPOINT_URL" --region "$AWS_DEFAULT_REGION" "$@"
+}
+
+wait_for_ministack() {
+  attempts=60
+
+  while ! curl -fsS --max-time 2 "$AWS_ENDPOINT_URL/_ministack/health" >/dev/null 2>&1; do
+    attempts=$((attempts - 1))
+    if [ "$attempts" -le 0 ]; then
+      echo "MiniStack did not become ready at $AWS_ENDPOINT_URL." >&2
+      exit 70
+    fi
+    sleep 1
+  done
+}
+
+assert_equal() {
+  expected="$1"
+  actual="$2"
+  description="$3"
+
+  if [ "$actual" != "$expected" ]; then
+    echo "Expected $description to be '$expected', got '$actual'." >&2
+    exit 1
+  fi
+  printf '  [PASS] %s\n' "$description"
+}
+
+assert_non_empty() {
+  value="$1"
+  description="$2"
+
+  if [ -z "$value" ] || [ "$value" = "None" ]; then
+    echo "Expected $description to be non-empty." >&2
+    exit 1
+  fi
+  printf '  [PASS] %s\n' "$description"
+}
+
+wait_for_ministack
+
+terraform_state_exists=true
+"$source_root/tests/ministack/run-example.sh" apply "$example" "$tfvars_file"
+
+cluster_status=$(ministack_aws ecs describe-clusters \
+  --clusters "$cluster_name" \
+  --query 'clusters[0].status' \
+  --output text)
+assert_equal ACTIVE "$cluster_status" "the scale-set ECS cluster is active"
+
+service_count=$(ministack_aws ecs list-services \
+  --cluster "$cluster_name" \
+  --query 'length(serviceArns)' \
+  --output text)
+assert_equal 1 "$service_count" "the scale-set controller service count"
+
+service_arn=$(ministack_aws ecs list-services \
+  --cluster "$cluster_name" \
+  --query 'serviceArns[0]' \
+  --output text)
+assert_non_empty "$service_arn" "the scale-set controller service ARN"
+
+ministack_aws ecs describe-services \
+  --cluster "$cluster_name" \
+  --services "$service_arn" \
+  --output json > "$service_file"
+
+task_definition=$(python3 - "$service_file" <<'PY'
+import json
+import sys
+
+with open(sys.argv[1], encoding="utf-8") as service_file:
+    service = json.load(service_file)["services"][0]
+
+assert service["status"] == "ACTIVE"
+assert service["desiredCount"] == 1
+assert service["launchType"] == "FARGATE"
+assert service["deploymentController"]["type"] == "ECS"
+assert service["enableExecuteCommand"] is False
+assert service["networkConfiguration"]["awsvpcConfiguration"]["assignPublicIp"] == "DISABLED"
+assert len(service["networkConfiguration"]["awsvpcConfiguration"]["securityGroups"]) == 1
+print(service["taskDefinition"])
+PY
+)
+assert_non_empty "$task_definition" "the scale-set controller task definition ARN"
+printf '  [PASS] the scale-set controller service uses one hardened Fargate task\n'
+
+ministack_aws ecs describe-task-definition \
+  --task-definition "$task_definition" \
+  --output json > "$task_file"
+
+python3 - "$task_file" "$config_path" <<'PY'
+import json
+import sys
+
+task_path = sys.argv[2]
+with open(sys.argv[1], encoding="utf-8") as task_file:
+    task_definition = json.load(task_file)["taskDefinition"]
+
+assert task_definition["family"].startswith("ministack-scale-set-ss-linux-scale-set-")
+container = next(
+    container
+    for container in task_definition["containerDefinitions"]
+    if container["name"] == "scale-set-controller"
+)
+assert container["image"].startswith(
+    "ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service:"
+)
+assert container["user"] == "10001:10001"
+assert container["privileged"] is False
+assert container["readonlyRootFilesystem"] is True
+assert container["linuxParameters"]["capabilities"]["drop"] == ["ALL"]
+
+environment = {entry["name"]: entry["value"] for entry in container["environment"]}
+assert environment["SCALE_SET_CONTROLLER_GROUP_NAME"] == "linux-scale-set"
+assert environment["SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH"] == task_path
+assert environment["SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION"]
+print("  [PASS] the scale-set task definition contains the controller contract and hardening")
+PY
+
+parameter_count=$(ministack_aws ssm get-parameters-by-path \
+  --path "$config_path" \
+  --query 'length(Parameters)' \
+  --output text)
+assert_equal 1 "$parameter_count" "the scale-set reconciler parameter count"
+
+parameter_name=$(ministack_aws ssm get-parameters-by-path \
+  --path "$config_path" \
+  --query 'Parameters[0].Name' \
+  --output text)
+assert_equal "$expected_parameter_name" "$parameter_name" "the scale-set reconciler parameter path"
+
+echo "Scale-set MiniStack integration test passed."

From 02457b41b6a3f7883109eeee313418566857aa29 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 17:11:41 +0200
Subject: [PATCH 30/52] fix(ministack): use scale-set installation ID string

---
 tests/ministack/multi-runner-scale-set.tfvars | 15 ++++-----------
 tests/ministack/run-example.sh                |  3 ---
 2 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/tests/ministack/multi-runner-scale-set.tfvars b/tests/ministack/multi-runner-scale-set.tfvars
index 438b7fd77d..67bc39ea7a 100644
--- a/tests/ministack/multi-runner-scale-set.tfvars
+++ b/tests/ministack/multi-runner-scale-set.tfvars
@@ -2,12 +2,9 @@ environment = "ministack-scale-set"
 aws_region  = "eu-west-1"
 
 github_app = {
-  id         = "0"
-  key_base64 = "ministack-invalid-key"
-  installation_id_ssm = {
-    name = "/ministack/scale-set/installation-id"
-    arn  = "arn:aws:ssm:eu-west-1:000000000000:parameter/ministack/scale-set/installation-id"
-  }
+  id              = "0"
+  key_base64      = "ministack-invalid-key"
+  installation_id = "1"
 }
 
 runner_binaries_enabled = false
@@ -44,11 +41,7 @@ ami = {
 }
 
 scale_set = {
-  config_url = "https://github.com/example"
-  installation_id_ssm = {
-    name = "/ministack/scale-set/installation-id"
-    arn  = "arn:aws:ssm:eu-west-1:000000000000:parameter/ministack/scale-set/installation-id"
-  }
+  config_url                = "https://github.com/example"
   name                      = "ministack-scale-set"
   id                        = 1
   runner_group_id           = 1
diff --git a/tests/ministack/run-example.sh b/tests/ministack/run-example.sh
index 331c3177a3..b8cd6d9a85 100755
--- a/tests/ministack/run-example.sh
+++ b/tests/ministack/run-example.sh
@@ -321,9 +321,6 @@ $lambda_zip"
       create_ami_fixture "ministack-scale-set-linux-x64" x86_64 >/dev/null
       create_ami_fixture "ministack-scale-set-linux-arm64" arm64 >/dev/null
       create_ami_fixture "ministack-scale-set-windows-x64" x86_64 >/dev/null
-      create_ssm_fixture \
-        "/ministack/scale-set/installation-id" \
-        "1"
       ;;
   esac
 }

From 4a42e08f032505743e9664a6ca4a674bd68a9d43 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Wed, 16 Sep 2026 12:44:39 +0200
Subject: [PATCH 31/52] revert(ci): remove scale-set MiniStack integration

---
 .github/workflows/ministack.yml              |  39 ----
 tests/ministack/run-scale-set-integration.sh | 177 -------------------
 2 files changed, 216 deletions(-)
 delete mode 100755 tests/ministack/run-scale-set-integration.sh

diff --git a/.github/workflows/ministack.yml b/.github/workflows/ministack.yml
index c6d5007847..80f8453732 100644
--- a/.github/workflows/ministack.yml
+++ b/.github/workflows/ministack.yml
@@ -72,7 +72,6 @@ jobs:
           - ephemeral
           - multi-runner
           - multi-runner-v2
-          - multi-runner-scale-set
           - termination-watcher
     services:
       ministack:
@@ -134,7 +133,6 @@ jobs:
           IAC_BINARY: ${{ matrix.iac.binary }}
           IAC_LOCK_FILE: ${{ matrix.iac.lockfile }}
         run: tests/ministack/run-example.sh destroy "$EXAMPLE"
-
   integration_smoke:
     name: Run webhook and pool lifecycle smoke test against MiniStack
     runs-on: ubuntu-latest
@@ -195,40 +193,3 @@ jobs:
           MINISTACK_GITHUB_MOCK_PORT: "1080"
           MINISTACK_GITHUB_MOCK_URL: ${{ steps.mockserver.outputs.url }}
         run: sh tests/ministack/run-smoke.sh
-
-  integration_scale_set:
-    name: Run scale-set controller integration test against MiniStack
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    services:
-      ministack:
-        image: ghcr.io/ministackorg/ministack:1.5.10@sha256:706b2b83c6be7e4f4dbb6a0dc28ffdebb500c6c80b64cf7938f45040fb2158e8
-        ports:
-          - 4566:4566
-        options: --add-host=host.docker.internal:host-gateway
-        env:
-          MINISTACK_ACCOUNT_ID: "000000000000"
-          MINISTACK_REGION: eu-west-1
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
-        with:
-          terraform_version: latest
-          terraform_wrapper: false
-
-      - name: Mark repository as safe
-        shell: sh
-        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
-
-      - name: Run scale-set controller integration test
-        run: sh tests/ministack/run-scale-set-integration.sh
diff --git a/tests/ministack/run-scale-set-integration.sh b/tests/ministack/run-scale-set-integration.sh
deleted file mode 100755
index 8e8b09a26c..0000000000
--- a/tests/ministack/run-scale-set-integration.sh
+++ /dev/null
@@ -1,177 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-000000000000}"
-export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-test-only}"
-export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-eu-west-1}"
-export AWS_REGION="${AWS_REGION:-eu-west-1}"
-export AWS_ENDPOINT_URL="${AWS_ENDPOINT_URL:-http://localhost:4566}"
-export AWS_EC2_METADATA_DISABLED="${AWS_EC2_METADATA_DISABLED:-true}"
-
-script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
-source_root=$(CDPATH='' cd -- "$script_dir/../.." && pwd)
-example="multi-runner-scale-set"
-tfvars_file="$script_dir/$example.tfvars"
-cluster_name="ministack-scale-set-scale-set"
-controller_group="linux-scale-set"
-config_path="/ministack-scale-set/scale-set-controller/$controller_group"
-expected_parameter_name="$config_path/linux-scale-set"
-service_file=$(mktemp "${TMPDIR:-/tmp}/terraform-aws-github-runner-scale-set-service.XXXXXX")
-task_file=$(mktemp "${TMPDIR:-/tmp}/terraform-aws-github-runner-scale-set-task.XXXXXX")
-terraform_state_exists=false
-
-cleanup() {
-  set +e
-  if [ "$terraform_state_exists" = true ]; then
-    "$source_root/tests/ministack/run-example.sh" destroy "$example" "$tfvars_file" >/dev/null 2>&1
-  fi
-  rm -f "$service_file" "$task_file"
-}
-trap cleanup EXIT INT TERM
-
-require_command() {
-  if ! command -v "$1" >/dev/null 2>&1; then
-    echo "$1 is required to run the scale-set MiniStack integration test." >&2
-    exit 69
-  fi
-}
-
-for command in aws curl python3 terraform; do
-  require_command "$command"
-done
-
-ministack_aws() {
-  aws --endpoint-url "$AWS_ENDPOINT_URL" --region "$AWS_DEFAULT_REGION" "$@"
-}
-
-wait_for_ministack() {
-  attempts=60
-
-  while ! curl -fsS --max-time 2 "$AWS_ENDPOINT_URL/_ministack/health" >/dev/null 2>&1; do
-    attempts=$((attempts - 1))
-    if [ "$attempts" -le 0 ]; then
-      echo "MiniStack did not become ready at $AWS_ENDPOINT_URL." >&2
-      exit 70
-    fi
-    sleep 1
-  done
-}
-
-assert_equal() {
-  expected="$1"
-  actual="$2"
-  description="$3"
-
-  if [ "$actual" != "$expected" ]; then
-    echo "Expected $description to be '$expected', got '$actual'." >&2
-    exit 1
-  fi
-  printf '  [PASS] %s\n' "$description"
-}
-
-assert_non_empty() {
-  value="$1"
-  description="$2"
-
-  if [ -z "$value" ] || [ "$value" = "None" ]; then
-    echo "Expected $description to be non-empty." >&2
-    exit 1
-  fi
-  printf '  [PASS] %s\n' "$description"
-}
-
-wait_for_ministack
-
-terraform_state_exists=true
-"$source_root/tests/ministack/run-example.sh" apply "$example" "$tfvars_file"
-
-cluster_status=$(ministack_aws ecs describe-clusters \
-  --clusters "$cluster_name" \
-  --query 'clusters[0].status' \
-  --output text)
-assert_equal ACTIVE "$cluster_status" "the scale-set ECS cluster is active"
-
-service_count=$(ministack_aws ecs list-services \
-  --cluster "$cluster_name" \
-  --query 'length(serviceArns)' \
-  --output text)
-assert_equal 1 "$service_count" "the scale-set controller service count"
-
-service_arn=$(ministack_aws ecs list-services \
-  --cluster "$cluster_name" \
-  --query 'serviceArns[0]' \
-  --output text)
-assert_non_empty "$service_arn" "the scale-set controller service ARN"
-
-ministack_aws ecs describe-services \
-  --cluster "$cluster_name" \
-  --services "$service_arn" \
-  --output json > "$service_file"
-
-task_definition=$(python3 - "$service_file" <<'PY'
-import json
-import sys
-
-with open(sys.argv[1], encoding="utf-8") as service_file:
-    service = json.load(service_file)["services"][0]
-
-assert service["status"] == "ACTIVE"
-assert service["desiredCount"] == 1
-assert service["launchType"] == "FARGATE"
-assert service["deploymentController"]["type"] == "ECS"
-assert service["enableExecuteCommand"] is False
-assert service["networkConfiguration"]["awsvpcConfiguration"]["assignPublicIp"] == "DISABLED"
-assert len(service["networkConfiguration"]["awsvpcConfiguration"]["securityGroups"]) == 1
-print(service["taskDefinition"])
-PY
-)
-assert_non_empty "$task_definition" "the scale-set controller task definition ARN"
-printf '  [PASS] the scale-set controller service uses one hardened Fargate task\n'
-
-ministack_aws ecs describe-task-definition \
-  --task-definition "$task_definition" \
-  --output json > "$task_file"
-
-python3 - "$task_file" "$config_path" <<'PY'
-import json
-import sys
-
-task_path = sys.argv[2]
-with open(sys.argv[1], encoding="utf-8") as task_file:
-    task_definition = json.load(task_file)["taskDefinition"]
-
-assert task_definition["family"].startswith("ministack-scale-set-ss-linux-scale-set-")
-container = next(
-    container
-    for container in task_definition["containerDefinitions"]
-    if container["name"] == "scale-set-controller"
-)
-assert container["image"].startswith(
-    "ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service:"
-)
-assert container["user"] == "10001:10001"
-assert container["privileged"] is False
-assert container["readonlyRootFilesystem"] is True
-assert container["linuxParameters"]["capabilities"]["drop"] == ["ALL"]
-
-environment = {entry["name"]: entry["value"] for entry in container["environment"]}
-assert environment["SCALE_SET_CONTROLLER_GROUP_NAME"] == "linux-scale-set"
-assert environment["SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH"] == task_path
-assert environment["SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION"]
-print("  [PASS] the scale-set task definition contains the controller contract and hardening")
-PY
-
-parameter_count=$(ministack_aws ssm get-parameters-by-path \
-  --path "$config_path" \
-  --query 'length(Parameters)' \
-  --output text)
-assert_equal 1 "$parameter_count" "the scale-set reconciler parameter count"
-
-parameter_name=$(ministack_aws ssm get-parameters-by-path \
-  --path "$config_path" \
-  --query 'Parameters[0].Name' \
-  --output text)
-assert_equal "$expected_parameter_name" "$parameter_name" "the scale-set reconciler parameter path"
-
-echo "Scale-set MiniStack integration test passed."

From 436bcaa390a95d9155c6cdcab43e0f7bbf7d1485 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Thu, 17 Sep 2026 16:50:01 +0200
Subject: [PATCH 32/52] feat(scale-set): isolate orchestration provider module

---
 .../scale-set/README.md                       |  256 ++++
 .../scale-set/cluster.tf                      |   14 +
 .../scale-set/config-store.tf                 |   27 +
 .../orchestration-providers/scale-set/data.tf |    5 +
 .../orchestration-providers/scale-set/iam.tf  |  217 ++++
 .../scale-set/locals.tf                       |  254 ++++
 .../scale-set/logging.tf                      |   19 +
 .../scale-set/networking.tf                   |   27 +
 .../scale-set/outputs.tf                      |   58 +
 .../scale-set/service.tf                      |   40 +
 .../orchestration-providers/scale-set/task.tf |  128 ++
 .../tests/computed-inputs.tftest.hcl          |   49 +
 .../tests/fixtures/computed-inputs/README.md  |   38 +
 .../tests/fixtures/computed-inputs/main.tf    |  100 ++
 .../fixtures/computed-inputs/versions.tf      |   10 +
 .../scale-set/tests/scale-set.tftest.hcl      | 1137 +++++++++++++++++
 .../scale-set/validations.tf                  |  425 ++++++
 .../scale-set/variables.tf                    |  200 +++
 .../scale-set/versions.tf                     |   10 +
 19 files changed, 3014 insertions(+)
 create mode 100644 modules/orchestration-providers/scale-set/README.md
 create mode 100644 modules/orchestration-providers/scale-set/cluster.tf
 create mode 100644 modules/orchestration-providers/scale-set/config-store.tf
 create mode 100644 modules/orchestration-providers/scale-set/data.tf
 create mode 100644 modules/orchestration-providers/scale-set/iam.tf
 create mode 100644 modules/orchestration-providers/scale-set/locals.tf
 create mode 100644 modules/orchestration-providers/scale-set/logging.tf
 create mode 100644 modules/orchestration-providers/scale-set/networking.tf
 create mode 100644 modules/orchestration-providers/scale-set/outputs.tf
 create mode 100644 modules/orchestration-providers/scale-set/service.tf
 create mode 100644 modules/orchestration-providers/scale-set/task.tf
 create mode 100644 modules/orchestration-providers/scale-set/tests/computed-inputs.tftest.hcl
 create mode 100644 modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
 create mode 100644 modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
 create mode 100644 modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
 create mode 100644 modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
 create mode 100644 modules/orchestration-providers/scale-set/validations.tf
 create mode 100644 modules/orchestration-providers/scale-set/variables.tf
 create mode 100644 modules/orchestration-providers/scale-set/versions.tf

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
new file mode 100644
index 0000000000..495a8cc314
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -0,0 +1,256 @@
+# Scale-set orchestration provider
+
+This internal module deploys long-running GitHub Actions runner scale-set controllers on ECS Fargate. It creates one deployment unit per resolved **controller group**:
+
+```text
+1 ECS service
+1 task definition
+1 running task during normal operation
+1 application container
+1 ScaleSetController supervising N independent reconcilers
+```
+
+Each reconciler still owns exactly one GitHub scale-set identity and one message session. Grouping only packs reconcilers into a shared task; it does not merge scale-set identity, session state, or compute-provider behavior. It does, however, intentionally union task IAM permissions and failure/deployment blast radius across all members of that controller group.
+
+This foundation adopts scale sets that were created elsewhere. It passes the configured name to the controller, which captures the scale-set and runner-group identifiers dynamically from GitHub; it does not create or delete the GitHub scale-set resource. The complete compute-provider contract must likewise come from its Terraform adapter; until that adapter and the public runner-config selection are wired, this internal module is not an end-to-end deployment interface.
+
+The normalized `(githubConfigUrl, scale_set.name)` ownership tuple must be globally unique across all groups. `runner_registration_level` selects organization or repository scope; `runner_owner` supplies the corresponding path appended to the GitHub server URL. A null enterprise-server URL resolves to GitHub.com. Enterprise-level registration is not supported by this module. Duplicate detection normalizes URL case, one trailing slash, and an explicit default `:443` port, so equivalent spellings cannot accidentally deploy two services against one GitHub message session. Scale-set names may repeat under different GitHub scopes.
+
+## Grouping
+
+`grouping.strategy` selects a plan-known grouping implementation:
+
+- `compute_provider` (default): one group per `compute_provider_contracts[*].type`.
+- `runner_config`: one group per runner-config key.
+- `custom`: explicit groups whose membership covers every runner config exactly once.
+
+```hcl
+grouping = {
+  strategy = "custom"
+  custom = {
+    groups = {
+      general = {
+        runner_configs = ["linux-small", "linux-large"]
+      }
+      critical = {
+        runner_configs = ["production"]
+      }
+    }
+  }
+}
+```
+
+Group names and memberships become Terraform `for_each` identities and must be known during planning. A group may contain at most 1000 runner configs, matching the service loader limit. Additional grouping algorithms can be added later by producing the same internal `map(list(runner_config_name))` shape.
+
+## Compute-provider capability boundary
+
+`compute_provider_contracts` is keyed exactly like `runner_configs`. A compute provider implements the scale-set desired-capacity interface by returning:
+
+```hcl
+{
+  type = "ec2" # plan-known grouping and runtime registry key
+  capabilities = {
+    scale_set = {
+      configuration_json = local.provider_owned_runtime_configuration
+      environment_variables = local.provider_owned_non_secret_environment
+      iam_statements     = local.provider_owned_compute_role_statements
+    }
+  }
+}
+```
+
+The symbolic locals above represent outputs from the selected compute-provider Terraform adapter; callers should not recreate the provider payload by hand. The provider-specific adapter owns the runtime configuration schema and the complete IAM statement set. This orchestration module treats configuration JSON as an opaque, non-secret object and combines only the selected group's statements into the corresponding compute role. Provider-owned process environment variables are also non-secret: duplicate names within a group must resolve to the same value, and reserved runtime names cannot be overridden. Runner-config-specific values stay in the SSM reconciler document, while credentials stay behind SSM references. Wildcard IAM actions are rejected. The rendered controller and compute-role policies are each checked against AWS's 10,240-byte inline role-policy quota with an explicit split-the-group error; group splitting remains the escape hatch when the union is too large or too broad.
+
+## Configuration delivery
+
+For the current ECS deployment, each task receives one bounded `SCALE_SET_CONTROLLER_MANIFEST` environment variable. Its value is JSON with this shape:
+
+```text
+{
+  "version": 1,
+  "groupName": "ec2",
+  "revision": "<sha256>",
+  "reconcilers": [
+    {
+      "schemaVersion": 1,
+      "runnerConfigName": "linux-small",
+      "runnerGroupName": "Default",
+      "scaleSetName": "linux-small",
+      "githubConfigUrl": "https://github.com/example",
+      "githubApp": {
+        "appIdParameterName": "/github/app-id",
+        "privateKeyParameterName": "/github/private-key",
+        "installationIdParameterName": "/github/installation-id"
+      },
+      "computeProvider": {
+        "type": "ec2",
+        "configuration": {}
+      },
+      "minRunners": 0,
+      "maxRunners": 20,
+      "bootTimeoutMinutes": 10,
+      "sessionOwner": "ec2.linux-small",
+      "workFolder": "_work",
+      "forceGhes": false,
+      "sslVerify": true
+    }
+  ]
+}
+```
+
+Each leaf is the flat `ScaleSetReconcilerConfig` consumed by the service. GitHub credential values never enter the manifest; it contains only the exact Parameter Store names used by the runtime. The manifest source is mutually exclusive with the service's SSM group-path source, so the task does not receive `SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH` or `SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION`.
+
+The module also keeps the per-reconciler SSM parameters available for the grouped configuration path while that delivery mode is being phased in. The task currently uses the manifest environment variable.
+
+Terraform derives `sessionOwner` locally as `<group>.<runner-config>`; if that would exceed the runtime's 256-character limit, the module truncates both readable components and appends a deterministic hash.
+
+The manifest must remain within the ECS task-definition size budget. Use the SSM group-path delivery mode for larger groups once it is enabled by the deployment configuration.
+
+The individual reconciler object has this shape:
+
+```json
+{
+  "schemaVersion": 1,
+  "runnerConfigName": "linux-small",
+  "runnerGroupName": "Default",
+  "githubConfigUrl": "https://github.com/example",
+  "scaleSetName": "linux-small",
+  "minRunners": 0,
+  "maxRunners": 20,
+  "bootTimeoutMinutes": 10,
+  "sessionOwner": "ec2.linux-small",
+  "workFolder": "_work",
+  "forceGhes": false,
+  "sslVerify": true,
+  "githubApp": {
+    "appIdParameterName": "/github/app-id",
+    "privateKeyParameterName": "/github/private-key",
+    "installationIdParameterName": "/github/installation-id"
+  },
+  "computeProvider": {
+    "type": "ec2",
+    "configuration": {}
+  }
+}
+```
+
+GitHub credential **values** never enter Terraform configuration, task definitions, or controller-config parameters. Each leaf carries only three Parameter Store names. The task role can read the exact credential parameter ARNs for its group and decrypt only explicitly declared KMS keys.
+
+## Container image
+
+The convenience default is:
+
+```text
+ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service:latest
+```
+
+ECS `versionConsistency` is enabled so all tasks in a deployment resolve a tag consistently. Production callers should set `container.image` to the digest published with a release:
+
+```hcl
+container = {
+  image = "ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service@sha256:<release-digest>"
+}
+```
+
+Public registry images need no pull permission. For a private ECR override, set `container.image` to the ECR image URI. The module grants the ECS task execution role wildcard ECR layer-pull permissions plus the unavoidable resource-unscoped `ecr:GetAuthorizationToken` action. The application task role is not used for image pulls. Repository-side access policy remains owned by the ECR module that owns the repository.
+
+For the official GHCR default, verify an anonymous pull after the first package publish. Package visibility may inherit repository or organization settings and must not be inferred only from a successful authenticated workflow push.
+
+## ECS and security behavior
+
+- A managed ECS cluster is created by default. Set `ecs.cluster.mode = "external"` and pass `ecs.cluster.arn` to reuse a cluster. The mode must be known at plan time; the ARN may be computed.
+- Every group gets a separate service, task definition, task role, execution role, log group, and security group.
+- `desired_count` is fixed at one. Deployment percentages are `minimum = 0` and `maximum = 100`, preventing old and new tasks from overlapping while session leasing is unavailable.
+- The ECS deployment circuit breaker and rollback are enabled.
+- Tasks run in supplied private subnets with public IP assignment disabled. Managed security groups have no ingress and allow only TCP/443 egress. The IPv4 Internet default is intended for controlled NAT/firewall paths and can be narrowed.
+- The application container runs with a numeric non-root UID/GID, a read-only root filesystem, init enabled, no privilege, and all Linux capabilities dropped.
+- ECS probes `/healthz` for liveness, and `container.health_path` accepts only that endpoint. `/readyz` remains an application readiness signal; reconnecting to GitHub should not cause ECS to restart every reconciler in a group.
+- CloudWatch encrypts logs at rest with an AWS-owned key by default. Set `logging.kms_key_arn` for a customer-managed key and ensure its key policy allows the regional CloudWatch Logs service.
+
+## Plan-shape requirements
+
+The following values control `for_each`, dynamic IAM statements, or resource ownership and must be known during planning:
+
+- runner-config map keys;
+- compute-contract map keys and provider `type`;
+- grouping strategy, custom group keys, and membership;
+- IAM statement keys and optional KMS/ECR wrapper presence;
+- optional ECS ephemeral-storage wrapper presence;
+- managed versus external cluster mode.
+
+Inner values such as scale-set names, SSM/KMS ARNs, provider configuration values, IAM actions/resources, and an external cluster ARN may be computed. Nullable computed values should be placed inside a plan-known wrapper rather than used as the wrapper itself.
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.33 |
+| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
+
+## Modules
+
+No modules.
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [aws_cloudwatch_log_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
+| [aws_ecs_cluster.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_cluster) | resource |
+| [aws_ecs_service.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource |
+| [aws_ecs_task_definition.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource |
+| [aws_iam_role.compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
+| [aws_iam_role_policy.compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_security_group.controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
+| [aws_ssm_parameter.reconciler_config](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [terraform_data.validate_compute_role_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_config_store](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_contract](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_group_task_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_grouping](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_runtime](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
+| [aws_iam_policy_document.compute](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.compute_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.task](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_iam_policy_document.task_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
+| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_config_store"></a> [config\_store](#input\_config\_store) | Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.<br/><br/>Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`. | <pre>object({<br/>    path_prefix = optional(string, null)<br/>    tier        = optional(string, "Standard")<br/>    tags        = optional(map(string), {})<br/>  })</pre> | `{}` | no |
+| <a name="input_container"></a> [container](#input\_container) | Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health\_path is fixed at /healthz, the ECS liveness endpoint. | <pre>object({<br/>    image                             = optional(string, null)<br/>    user                              = optional(string, "10001:10001")<br/>    health_port                       = optional(number, 8080)<br/>    health_path                       = optional(string, "/healthz")<br/>    health_check_command              = optional(list(string), null)<br/>    health_check_interval             = optional(number, 30)<br/>    health_check_timeout              = optional(number, 5)<br/>    health_check_retries              = optional(number, 3)<br/>    health_check_start_period         = optional(number, 30)<br/>    health_stale_after_seconds        = optional(number, 180)<br/>    shutdown_timeout_seconds          = optional(number, 110)<br/>    session_close_timeout_seconds     = optional(number, 10)<br/>    reconnect_initial_backoff_seconds = optional(number, 1)<br/>    reconnect_max_backoff_seconds     = optional(number, 30)<br/>    stop_timeout_seconds              = optional(number, 120)<br/>  })</pre> | `{}` | no |
+| <a name="input_ecs"></a> [ecs](#input\_ecs) | ECS substrate configuration. A managed cluster is created by default. For an external cluster, set `cluster.mode = "external"` and pass its ARN; the mode must be plan-known while the ARN may be computed. | <pre>object({<br/>    cluster = optional(object({<br/>      mode               = optional(string, "managed")<br/>      arn                = optional(string, null)<br/>      name               = optional(string, null)<br/>      container_insights = optional(bool, true)<br/>    }), {})<br/>    task = optional(object({<br/>      cpu              = optional(number, 512)<br/>      memory           = optional(number, 1024)<br/>      cpu_architecture = optional(string, "X86_64")<br/>      ephemeral_storage = optional(object({<br/>        size_in_gib = number<br/>      }), null)<br/>    }), {})<br/>    service = optional(object({<br/>      platform_version = optional(string, "LATEST")<br/>    }), {})<br/>    iam = optional(object({<br/>      path                 = optional(string, "/")<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
+| <a name="input_grouping"></a> [grouping](#input\_grouping) | Packing strategy for scale-set reconcilers. `compute_provider` creates one controller group per compute-provider type and is the default. `runner_config` creates one group per runner config. `custom` uses `custom.groups`; custom membership must cover every runner config exactly once.<br/><br/>The strategy, custom group keys, and memberships select Terraform `for_each` instances and must be known during planning. | <pre>object({<br/>    strategy = optional(string, "compute_provider")<br/>    custom = optional(object({<br/>      groups = map(object({<br/>        runner_configs = set(string)<br/>      }))<br/>    }), null)<br/>  })</pre> | `{}` | no |
+| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | Logging level for the scale-set controller container. | `string` | `"info"` | no |
+| <a name="input_logging"></a> [logging](#input\_logging) | CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key. | <pre>object({<br/>    retention_in_days = optional(number, 30)<br/>    kms_key_arn       = optional(string, null)<br/>    log_group_class   = optional(string, "STANDARD")<br/>    tags              = optional(map(string), {})<br/>  })</pre> | `{}` | no |
+| <a name="input_network"></a> [network](#input\_network) | Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required. | <pre>object({<br/>    vpc_id     = string<br/>    subnet_ids = set(string)<br/>    https_egress = optional(object({<br/>      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>      ipv6_cidrs = optional(set(string), [])<br/>    }), {})<br/>  })</pre> | n/a | yes |
+| <a name="input_prefix"></a> [prefix](#input\_prefix) | Stable prefix used for scale-set controller resources. | `string` | `"github-actions"` | no |
+| <a name="input_runner_configs"></a> [runner\_configs](#input\_runner\_configs) | Normalized scale-set runner configurations keyed by stable runner-config name.<br/><br/>Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects organization or repository registration, and `runner_owner` supplies the corresponding organization or owner/repository path. Enterprise-level registration is not supported by this module. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply. | <pre>map(object({<br/>    github = object({<br/>      enterprise_server = object({<br/>        url        = optional(string, null)<br/>        ssl_verify = optional(bool, true)<br/>      })<br/>      app = object({<br/>        app_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        private_key = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>        installation_id = object({<br/>          name        = string<br/>          arn         = string<br/>          kms_key_arn = optional(string, null)<br/>        })<br/>      })<br/>      runner_owner              = string<br/>      runner_registration_level = string<br/>      user_agent                = string<br/>    })<br/>    scale_set = object({<br/>      name = string<br/>      runner = optional(object({<br/>        labels               = optional(list(string), [])<br/>        group_name           = optional(string, "Default")<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    })<br/>    compute_provider = object({<br/>      type = string<br/>      capabilities = object({<br/>        scale_set = object({<br/>          role_arn              = optional(string, null)<br/>          configuration_json    = optional(string, "{}")<br/>          environment_variables = optional(map(string), {})<br/>          iam_statements = optional(map(object({<br/>            actions   = set(string)<br/>            resources = set(string)<br/>            conditions = optional(list(object({<br/>              test     = string<br/>              variable = string<br/>              values   = set(string)<br/>            })), [])<br/>          })), {})<br/>        })<br/>      })<br/>    })<br/>  }))</pre> | n/a | yes |
+| <a name="input_tags"></a> [tags](#input\_tags) | Tags applied to scale-set orchestration resources. | `map(string)` | `{}` | no |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_cluster"></a> [cluster](#output\_cluster) | Managed or external ECS cluster selected for all controller groups. |
+| <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | Controller-group resources keyed by stable resolved group name. |
+| <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | Non-secret SSM controller configuration parameters keyed by `<controller-group>/<runner-config>`. Values are intentionally not exposed. |
+| <a name="output_resolved_container_image"></a> [resolved\_container\_image](#output\_resolved\_container\_image) | Container image reference selected for the controller task definitions. |
+<!-- END_TF_DOCS -->
diff --git a/modules/orchestration-providers/scale-set/cluster.tf b/modules/orchestration-providers/scale-set/cluster.tf
new file mode 100644
index 0000000000..6c9a586da8
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/cluster.tf
@@ -0,0 +1,14 @@
+resource "aws_ecs_cluster" "controller" {
+  count = var.ecs.cluster.mode == "managed" ? 1 : 0
+
+  name = coalesce(var.ecs.cluster.name, "${var.prefix}-scale-set")
+
+  setting {
+    name  = "containerInsights"
+    value = var.ecs.cluster.container_insights ? "enabled" : "disabled"
+  }
+
+  tags = local.common_tags
+
+  depends_on = [terraform_data.validate_runtime]
+}
diff --git a/modules/orchestration-providers/scale-set/config-store.tf b/modules/orchestration-providers/scale-set/config-store.tf
new file mode 100644
index 0000000000..86cb42a73a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/config-store.tf
@@ -0,0 +1,27 @@
+resource "aws_ssm_parameter" "reconciler_config" {
+  for_each = local.reconciler_configs
+
+  name        = "${local.config_store_path_prefix}/${each.value.group_name}/${each.value.runner_name}"
+  description = "Non-secret scale-set reconciler configuration for ${each.value.runner_name}"
+  type        = "String"
+  tier        = var.config_store.tier
+  value       = local.reconciler_config_json[each.key]
+
+  tags = merge(
+    local.group_tags[each.value.group_name],
+    var.config_store.tags,
+  )
+
+  lifecycle {
+    precondition {
+      condition     = local.reconciler_config_bytes[each.key] <= local.config_store_max_bytes
+      error_message = "The encoded reconciler configuration exceeds the selected Parameter Store tier limit."
+    }
+  }
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_config_store,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/data.tf b/modules/orchestration-providers/scale-set/data.tf
new file mode 100644
index 0000000000..99b50de05a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/data.tf
@@ -0,0 +1,5 @@
+data "aws_caller_identity" "current" {}
+
+data "aws_partition" "current" {}
+
+data "aws_region" "current" {}
diff --git a/modules/orchestration-providers/scale-set/iam.tf b/modules/orchestration-providers/scale-set/iam.tf
new file mode 100644
index 0000000000..6065fff396
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/iam.tf
@@ -0,0 +1,217 @@
+data "aws_iam_policy_document" "task_assume_role" {
+  statement {
+    sid     = "AllowEcsTasks"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["ecs-tasks.amazonaws.com"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "aws:SourceAccount"
+      values   = [data.aws_caller_identity.current.account_id]
+    }
+
+    condition {
+      test     = "ArnLike"
+      variable = "aws:SourceArn"
+      values = [format(
+        "arn:%s:ecs:%s:%s:*",
+        data.aws_partition.current.partition,
+        data.aws_region.current.region,
+        data.aws_caller_identity.current.account_id,
+      )]
+    }
+  }
+}
+
+resource "aws_iam_role" "task" {
+  for_each = local.controller_groups
+
+  name                 = "${local.group_resource_names[each.key]}-task"
+  path                 = var.ecs.iam.path
+  permissions_boundary = var.ecs.iam.permissions_boundary
+  assume_role_policy   = data.aws_iam_policy_document.task_assume_role.json
+  tags                 = local.group_tags[each.key]
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_runtime,
+  ]
+}
+
+data "aws_iam_policy_document" "task" {
+  for_each = local.controller_groups
+
+  source_policy_documents = [local.group_github_kms_policy_json[each.key]]
+
+  statement {
+    sid       = "ReadControllerGroupConfig"
+    effect    = "Allow"
+    actions   = ["ssm:GetParametersByPath"]
+    resources = [local.group_config_path_arns[each.key]]
+  }
+
+  statement {
+    sid    = "ReadGitHubAppParameters"
+    effect = "Allow"
+    actions = [
+      "ssm:GetParameter",
+      "ssm:GetParameters",
+    ]
+    resources = [for parameter in local.group_github_parameters[each.key] : parameter.arn]
+  }
+
+  statement {
+    sid       = "AssumeComputeProviderRoles"
+    effect    = "Allow"
+    actions   = ["sts:AssumeRole"]
+    resources = [for runner_name in local.controller_groups[each.key] : local.compute_role_arns["${each.key}/${runner_name}"]]
+  }
+}
+
+resource "aws_iam_role_policy" "task" {
+  for_each = local.controller_groups
+
+  name   = "scale-set-controller"
+  role   = aws_iam_role.task[each.key].name
+  policy = data.aws_iam_policy_document.task[each.key].json
+
+  depends_on = [terraform_data.validate_group_task_policy]
+}
+
+data "aws_iam_policy_document" "compute_assume_role" {
+  for_each = local.compute_role_configs
+
+  statement {
+    sid     = "AllowScaleSetTask"
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type = "AWS"
+      identifiers = [format(
+        "arn:%s:iam::%s:root",
+        data.aws_partition.current.partition,
+        data.aws_caller_identity.current.account_id,
+      )]
+    }
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:PrincipalArn"
+      values = [format(
+        "arn:%s:iam::%s:role%s%s-task",
+        data.aws_partition.current.partition,
+        data.aws_caller_identity.current.account_id,
+        var.ecs.iam.path,
+        local.group_resource_names[each.value.group_name],
+      )]
+    }
+  }
+}
+
+resource "aws_iam_role" "compute" {
+  for_each = local.compute_role_configs
+
+  name                 = "${local.group_resource_names[each.value.group_name]}-compute-${substr(sha256(each.key), 0, 8)}"
+  path                 = var.ecs.iam.path
+  permissions_boundary = var.ecs.iam.permissions_boundary
+  assume_role_policy   = data.aws_iam_policy_document.compute_assume_role[each.key].json
+  tags                 = local.group_tags[each.value.group_name]
+}
+
+data "aws_iam_policy_document" "compute" {
+  for_each = local.compute_role_configs
+
+  dynamic "statement" {
+    for_each = local.reconciler_compute_iam_statements[each.key]
+
+    content {
+      effect    = "Allow"
+      actions   = statement.value.actions
+      resources = statement.value.resources
+
+      dynamic "condition" {
+        for_each = statement.value.conditions
+
+        content {
+          test     = condition.value.test
+          variable = condition.value.variable
+          values   = condition.value.values
+        }
+      }
+    }
+  }
+}
+
+resource "aws_iam_role_policy" "compute" {
+  for_each = local.compute_role_configs
+
+  name   = "scale-set-compute"
+  role   = aws_iam_role.compute[each.key].name
+  policy = data.aws_iam_policy_document.compute[each.key].json
+
+  depends_on = [terraform_data.validate_compute_role_policy]
+}
+
+resource "aws_iam_role" "execution" {
+  for_each = local.controller_groups
+
+  name                 = "${local.group_resource_names[each.key]}-exec"
+  path                 = var.ecs.iam.path
+  permissions_boundary = var.ecs.iam.permissions_boundary
+  assume_role_policy   = data.aws_iam_policy_document.task_assume_role.json
+  tags                 = local.group_tags[each.key]
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_runtime,
+  ]
+}
+
+data "aws_iam_policy_document" "execution" {
+  for_each = local.controller_groups
+
+  statement {
+    sid    = "WriteControllerLogs"
+    effect = "Allow"
+    actions = [
+      "logs:CreateLogStream",
+      "logs:PutLogEvents",
+    ]
+    resources = ["${aws_cloudwatch_log_group.controller[each.key].arn}:*"]
+  }
+
+  statement {
+    sid    = "PullPrivateEcrImage"
+    effect = "Allow"
+    actions = [
+      "ecr:BatchCheckLayerAvailability",
+      "ecr:BatchGetImage",
+      "ecr:GetDownloadUrlForLayer",
+    ]
+    resources = ["*"]
+  }
+
+  statement {
+    # ECR does not support resource-level permissions for authorization tokens.
+    sid       = "AuthorizePrivateEcrPull"
+    effect    = "Allow"
+    actions   = ["ecr:GetAuthorizationToken"]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "execution" {
+  for_each = local.controller_groups
+
+  name   = "scale-set-controller-execution"
+  role   = aws_iam_role.execution[each.key].name
+  policy = data.aws_iam_policy_document.execution[each.key].json
+}
diff --git a/modules/orchestration-providers/scale-set/locals.tf b/modules/orchestration-providers/scale-set/locals.tf
new file mode 100644
index 0000000000..523b6b5a26
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/locals.tf
@@ -0,0 +1,254 @@
+locals {
+  github_config_urls = {
+    for runner_name, runner_config in var.runner_configs : runner_name => format(
+      "%s%s",
+      trimsuffix(coalesce(runner_config.github.enterprise_server.url, "https://github.com"), "/"),
+      runner_config.github.runner_owner == null ? "" : "/${runner_config.github.runner_owner}",
+    )
+  }
+  declared_custom_groups = var.grouping.strategy == "custom" && var.grouping.custom != null ? {
+    for group_name, group in var.grouping.custom.groups : group_name => sort(tolist(group.runner_configs))
+  } : {}
+
+  controller_groups = (
+    var.grouping.strategy == "compute_provider" ? {
+      for provider_type in distinct([
+        for runner_name in keys(var.runner_configs) : var.runner_configs[runner_name].compute_provider.type
+        ]) : provider_type => [
+        for runner_name in keys(var.runner_configs) : runner_name
+        if var.runner_configs[runner_name].compute_provider.type == provider_type
+      ]
+    } :
+    var.grouping.strategy == "runner_config" ? {
+      for runner_name in keys(var.runner_configs) : runner_name => [runner_name]
+    } :
+    var.grouping.strategy == "custom" ? {
+      for group_name, runner_names in local.declared_custom_groups : group_name => [
+        for runner_name in runner_names : runner_name
+        if contains(keys(var.runner_configs), runner_name)
+      ]
+    } :
+    {}
+  )
+
+  group_resource_names = {
+    for group_name in keys(local.controller_groups) : group_name => format(
+      "%s-ss-%s-%s",
+      var.prefix,
+      substr(replace(lower(group_name), "/[^a-z0-9_-]/", "-"), 0, 14),
+      substr(sha256(group_name), 0, 8),
+    )
+  }
+
+  official_container_image = "ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service:latest"
+  resolved_container_image = coalesce(var.container.image, local.official_container_image)
+
+  resolved_health_check_command = var.container.health_check_command != null ? var.container.health_check_command : [
+    "CMD",
+    "node",
+    "-e",
+    "fetch('http://127.0.0.1:${var.container.health_port}${var.container.health_path}').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
+  ]
+
+  reconciler_configs = merge([
+    for group_name, runner_names in local.controller_groups : {
+      for runner_name in runner_names : "${group_name}/${runner_name}" => {
+        group_name  = group_name
+        runner_name = runner_name
+        value = merge({
+          schemaVersion      = 1
+          runnerConfigName   = runner_name
+          runnerGroupName    = var.runner_configs[runner_name].scale_set.runner.group_name
+          runnerLabels       = var.runner_configs[runner_name].scale_set.runner.labels
+          githubConfigUrl    = local.github_config_urls[runner_name]
+          scaleSetName       = var.runner_configs[runner_name].scale_set.name
+          minRunners         = var.runner_configs[runner_name].scale_set.runner.min_runners
+          maxRunners         = var.runner_configs[runner_name].scale_set.runner.max_runners
+          bootTimeoutMinutes = var.runner_configs[runner_name].scale_set.runner.boot_time_in_minutes
+          workFolder         = "_work"
+          sslVerify          = var.runner_configs[runner_name].github.enterprise_server.ssl_verify
+          forceGhes          = var.runner_configs[runner_name].github.enterprise_server.url != null
+          sessionOwner = (
+            length("${group_name}.${runner_name}") <= 256
+            ? "${group_name}.${runner_name}"
+            : "${substr(group_name, 0, 119)}.${substr(runner_name, 0, 119)}.${substr(sha256(format("%s.%s", group_name, runner_name)), 0, 16)}"
+          )
+          githubApp = {
+            appIdParameterName          = var.runner_configs[runner_name].github.app.app_id.name
+            privateKeyParameterName     = var.runner_configs[runner_name].github.app.private_key.name
+            installationIdParameterName = var.runner_configs[runner_name].github.app.installation_id.name
+          }
+          computeProvider = {
+            type          = var.runner_configs[runner_name].compute_provider.type
+            roleArn       = local.compute_role_arns["${group_name}/${runner_name}"]
+            configuration = jsondecode(var.runner_configs[runner_name].compute_provider.capabilities.scale_set.configuration_json)
+          }
+          userAgent = var.runner_configs[runner_name].github.user_agent
+        })
+      }
+    }
+  ]...)
+
+  config_store_path_prefix = coalesce(var.config_store.path_prefix, "/${var.prefix}/scale-set-controller")
+  group_config_paths = {
+    for group_name in keys(local.controller_groups) : group_name => "${local.config_store_path_prefix}/${group_name}"
+  }
+  group_config_revisions = {
+    for group_name, runner_names in local.controller_groups : group_name => sha256(jsonencode({
+      for runner_name in runner_names : runner_name => local.reconciler_configs["${group_name}/${runner_name}"].value
+    }))
+  }
+
+  group_controller_manifests = {
+    for group_name, runner_names in local.controller_groups : group_name => jsonencode({
+      version   = 1
+      groupName = group_name
+      revision  = local.group_config_revisions[group_name]
+      reconcilers = [
+        for runner_name in runner_names : local.reconciler_configs["${group_name}/${runner_name}"].value
+      ]
+    })
+  }
+  group_github_parameters = {
+    for group_name, runner_names in local.controller_groups : group_name => flatten([
+      for runner_name in runner_names : [
+        {
+          arn         = var.runner_configs[runner_name].github.app.app_id.arn
+          kms_key_arn = var.runner_configs[runner_name].github.app.app_id.kms_key_arn
+        },
+        {
+          arn         = var.runner_configs[runner_name].github.app.private_key.arn
+          kms_key_arn = var.runner_configs[runner_name].github.app.private_key.kms_key_arn
+        },
+        {
+          arn         = var.runner_configs[runner_name].github.app.installation_id.arn
+          kms_key_arn = var.runner_configs[runner_name].github.app.installation_id.kms_key_arn
+        },
+      ]
+    ])
+  }
+
+  group_github_kms_policy_json = {
+    for group_name, parameters in local.group_github_parameters : group_name => jsonencode({
+      Version = "2012-10-17"
+      Statement = length(compact([for parameter in parameters : parameter.kms_key_arn])) == 0 ? [] : [{
+        Sid      = "DecryptGitHubAppParameters"
+        Effect   = "Allow"
+        Action   = ["kms:Decrypt"]
+        Resource = distinct(compact([for parameter in parameters : parameter.kms_key_arn]))
+      }]
+    })
+  }
+
+  compute_role_configs = {
+    for config_key in flatten([
+      for group_name, runner_names in local.controller_groups : [
+        for runner_name in runner_names : {
+          key         = "${group_name}/${runner_name}"
+          group_name  = group_name
+          runner_name = runner_name
+        }
+      ]
+    ]) : config_key.key => config_key
+    if var.runner_configs[config_key.runner_name].compute_provider.capabilities.scale_set.role_arn == null
+  }
+
+  compute_role_arns = {
+    for config in flatten([
+      for group_name, runner_names in local.controller_groups : [
+        for runner_name in runner_names : {
+          key         = "${group_name}/${runner_name}"
+          group_name  = group_name
+          runner_name = runner_name
+        }
+      ]
+      ]) : config.key => (
+      var.runner_configs[config.runner_name].compute_provider.capabilities.scale_set.role_arn != null
+      ? var.runner_configs[config.runner_name].compute_provider.capabilities.scale_set.role_arn
+      : format(
+        "arn:%s:iam::%s:role%s%s-compute-%s",
+        data.aws_partition.current.partition,
+        data.aws_caller_identity.current.account_id,
+        var.ecs.iam.path,
+        local.group_resource_names[config.group_name],
+        substr(sha256(config.key), 0, 8),
+      )
+    )
+  }
+
+  reconciler_compute_iam_statements = {
+    for config_key, config in local.compute_role_configs : config_key => {
+      for statement_name, statement in var.runner_configs[config.runner_name].compute_provider.capabilities.scale_set.iam_statements :
+      statement_name => statement
+    }
+  }
+
+  group_compute_environment_entries = {
+    for group_name, runner_names in local.controller_groups : group_name => flatten([
+      for runner_name in runner_names : [
+        for name, value in var.runner_configs[runner_name].compute_provider.capabilities.scale_set.environment_variables : {
+          runner_name = runner_name
+          name        = name
+          value       = value
+        }
+      ]
+    ])
+  }
+
+  group_compute_environment_variables = {
+    for group_name, entries in local.group_compute_environment_entries : group_name => merge([
+      for entry in entries : { (entry.name) = entry.value }
+    ]...)
+  }
+
+  config_store_max_bytes = var.config_store.tier == "Advanced" ? 8192 : 4096
+
+  reconciler_config_json = {
+    for config_key, config in local.reconciler_configs : config_key => jsonencode(config.value)
+  }
+  reconciler_config_bytes = {
+    for config_key, config_json in local.reconciler_config_json : config_key => (
+      floor(length(base64encode(config_json)) * 3 / 4) -
+      (endswith(base64encode(config_json), "==") ? 2 : endswith(base64encode(config_json), "=") ? 1 : 0)
+    )
+  }
+
+  cluster_arn = var.ecs.cluster.mode == "managed" ? aws_ecs_cluster.controller[0].arn : var.ecs.cluster.arn
+
+  group_config_path_arns = {
+    for group_name, config_path in local.group_config_paths : group_name => format(
+      "arn:%s:ssm:%s:%s:parameter%s/*",
+      data.aws_partition.current.partition,
+      data.aws_region.current.region,
+      data.aws_caller_identity.current.account_id,
+      config_path,
+    )
+  }
+
+  fargate_memory_by_cpu = {
+    256   = [512, 1024, 2048]
+    512   = [1024, 2048, 3072, 4096]
+    1024  = range(2048, 9216, 1024)
+    2048  = range(4096, 17408, 1024)
+    4096  = range(8192, 31744, 1024)
+    8192  = range(16384, 65536, 4096)
+    16384 = range(32768, 131072, 8192)
+  }
+
+  common_tags = merge(
+    {
+      "ghr:component" = "scale-set-controller"
+    },
+    var.tags,
+  )
+
+  group_tags = {
+    for group_name, resource_name in local.group_resource_names : group_name => merge(
+      local.common_tags,
+      {
+        Name                   = resource_name
+        "ghr:controller-group" = group_name
+      },
+    )
+  }
+}
diff --git a/modules/orchestration-providers/scale-set/logging.tf b/modules/orchestration-providers/scale-set/logging.tf
new file mode 100644
index 0000000000..974106316a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/logging.tf
@@ -0,0 +1,19 @@
+resource "aws_cloudwatch_log_group" "controller" {
+  for_each = local.controller_groups
+
+  name              = "/aws/ecs/${local.group_resource_names[each.key]}"
+  retention_in_days = var.logging.retention_in_days
+  kms_key_id        = var.logging.kms_key_arn
+  log_group_class   = var.logging.log_group_class
+
+  tags = merge(
+    local.group_tags[each.key],
+    var.logging.tags,
+  )
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_runtime,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/networking.tf b/modules/orchestration-providers/scale-set/networking.tf
new file mode 100644
index 0000000000..5cd9d11203
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/networking.tf
@@ -0,0 +1,27 @@
+resource "aws_security_group" "controller" {
+  for_each = local.controller_groups
+
+  name        = local.group_resource_names[each.key]
+  description = "Private scale-set controller ${each.key}; no ingress and HTTPS-only egress"
+  vpc_id      = var.network.vpc_id
+
+  ingress = []
+
+  egress {
+    description      = "HTTPS to GitHub and AWS APIs"
+    from_port        = 443
+    to_port          = 443
+    protocol         = "tcp"
+    cidr_blocks      = sort(tolist(var.network.https_egress.ipv4_cidrs))
+    ipv6_cidr_blocks = sort(tolist(var.network.https_egress.ipv6_cidrs))
+  }
+
+  revoke_rules_on_delete = true
+  tags                   = local.group_tags[each.key]
+
+  depends_on = [
+    terraform_data.validate_contract,
+    terraform_data.validate_grouping,
+    terraform_data.validate_runtime,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/outputs.tf b/modules/orchestration-providers/scale-set/outputs.tf
new file mode 100644
index 0000000000..fd9d1b8c57
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/outputs.tf
@@ -0,0 +1,58 @@
+output "cluster" {
+  description = "Managed or external ECS cluster selected for all controller groups."
+  value = {
+    arn     = local.cluster_arn
+    managed = var.ecs.cluster.mode == "managed"
+  }
+}
+
+output "controller_groups" {
+  description = "Controller-group resources keyed by stable resolved group name."
+  value = {
+    for group_name, runner_names in local.controller_groups : group_name => {
+      runner_configs  = runner_names
+      config_path     = local.group_config_paths[group_name]
+      config_revision = local.group_config_revisions[group_name]
+      service = {
+        id   = aws_ecs_service.controller[group_name].id
+        name = aws_ecs_service.controller[group_name].name
+      }
+      task_definition = {
+        arn    = aws_ecs_task_definition.controller[group_name].arn
+        family = aws_ecs_task_definition.controller[group_name].family
+      }
+      task_role = {
+        arn  = aws_iam_role.task[group_name].arn
+        name = aws_iam_role.task[group_name].name
+      }
+      execution_role = {
+        arn  = aws_iam_role.execution[group_name].arn
+        name = aws_iam_role.execution[group_name].name
+      }
+      log_group = {
+        arn  = aws_cloudwatch_log_group.controller[group_name].arn
+        name = aws_cloudwatch_log_group.controller[group_name].name
+      }
+      security_group = {
+        arn = aws_security_group.controller[group_name].arn
+        id  = aws_security_group.controller[group_name].id
+      }
+    }
+  }
+}
+
+output "reconciler_config_parameters" {
+  description = "Non-secret SSM controller configuration parameters keyed by `<controller-group>/<runner-config>`. Values are intentionally not exposed."
+  value = {
+    for config_key, parameter in aws_ssm_parameter.reconciler_config : config_key => {
+      arn  = parameter.arn
+      name = parameter.name
+      tier = parameter.tier
+    }
+  }
+}
+
+output "resolved_container_image" {
+  description = "Container image reference selected for the controller task definitions."
+  value       = local.resolved_container_image
+}
diff --git a/modules/orchestration-providers/scale-set/service.tf b/modules/orchestration-providers/scale-set/service.tf
new file mode 100644
index 0000000000..953ebe4058
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/service.tf
@@ -0,0 +1,40 @@
+resource "aws_ecs_service" "controller" {
+  for_each = local.controller_groups
+
+  name             = local.group_resource_names[each.key]
+  cluster          = local.cluster_arn
+  task_definition  = aws_ecs_task_definition.controller[each.key].arn
+  desired_count    = 1
+  launch_type      = "FARGATE"
+  platform_version = var.ecs.service.platform_version
+
+  scheduling_strategy                = "REPLICA"
+  deployment_minimum_healthy_percent = 0
+  deployment_maximum_percent         = 100
+  enable_ecs_managed_tags            = true
+  enable_execute_command             = false
+  propagate_tags                     = "SERVICE"
+
+  deployment_circuit_breaker {
+    enable   = true
+    rollback = true
+  }
+
+  deployment_controller {
+    type = "ECS"
+  }
+
+  network_configuration {
+    assign_public_ip = false
+    security_groups  = [aws_security_group.controller[each.key].id]
+    subnets          = sort(tolist(var.network.subnet_ids))
+  }
+
+  tags = local.group_tags[each.key]
+
+  depends_on = [
+    aws_iam_role_policy.execution,
+    aws_iam_role_policy.task,
+    aws_iam_role_policy.compute,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/task.tf b/modules/orchestration-providers/scale-set/task.tf
new file mode 100644
index 0000000000..b1e6f44006
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/task.tf
@@ -0,0 +1,128 @@
+resource "aws_ecs_task_definition" "controller" {
+  for_each = local.controller_groups
+
+  family                   = local.group_resource_names[each.key]
+  requires_compatibilities = ["FARGATE"]
+  network_mode             = "awsvpc"
+  cpu                      = tostring(var.ecs.task.cpu)
+  memory                   = tostring(var.ecs.task.memory)
+  task_role_arn            = aws_iam_role.task[each.key].arn
+  execution_role_arn       = aws_iam_role.execution[each.key].arn
+
+  runtime_platform {
+    cpu_architecture        = var.ecs.task.cpu_architecture
+    operating_system_family = "LINUX"
+  }
+
+  dynamic "ephemeral_storage" {
+    for_each = var.ecs.task.ephemeral_storage == null ? [] : [var.ecs.task.ephemeral_storage]
+
+    content {
+      size_in_gib = ephemeral_storage.value.size_in_gib
+    }
+  }
+
+  container_definitions = jsonencode([
+    {
+      name                   = "scale-set-controller"
+      image                  = local.resolved_container_image
+      essential              = true
+      user                   = var.container.user
+      privileged             = false
+      readonlyRootFilesystem = true
+      stopTimeout            = var.container.stop_timeout_seconds
+      versionConsistency     = "enabled"
+      linuxParameters = {
+        initProcessEnabled = true
+        capabilities = {
+          drop = ["ALL"]
+        }
+      }
+      environment = concat(
+        [
+          {
+            name  = "LOG_LEVEL"
+            value = var.log_level
+          },
+          {
+            name  = "POWERTOOLS_SERVICE_NAME"
+            value = "scale-set-controller"
+          },
+          {
+            name  = "POWERTOOLS_LOG_LEVEL"
+            value = upper(var.log_level)
+          },
+          {
+            name  = "SCALE_SET_CONTROLLER_MANIFEST"
+            value = local.group_controller_manifests[each.key]
+          },
+          {
+            name  = "AWS_XRAY_CONTEXT_MISSING"
+            value = "IGNORE_ERROR"
+          },
+          {
+            name  = "AWS_REGION"
+            value = data.aws_region.current.region
+          },
+          {
+            name  = "AWS_DEFAULT_REGION"
+            value = data.aws_region.current.region
+          },
+          {
+            name  = "SCALE_SET_HEALTH_PORT"
+            value = tostring(var.container.health_port)
+          },
+          {
+            name  = "SCALE_SET_HEALTH_STALE_AFTER_SECONDS"
+            value = tostring(var.container.health_stale_after_seconds)
+          },
+          {
+            name  = "SCALE_SET_SHUTDOWN_TIMEOUT_SECONDS"
+            value = tostring(var.container.shutdown_timeout_seconds)
+          },
+          {
+            name  = "SCALE_SET_SESSION_CLOSE_TIMEOUT_SECONDS"
+            value = tostring(var.container.session_close_timeout_seconds)
+          },
+          {
+            name  = "SCALE_SET_RECONNECT_INITIAL_BACKOFF_SECONDS"
+            value = tostring(var.container.reconnect_initial_backoff_seconds)
+          },
+          {
+            name  = "SCALE_SET_RECONNECT_MAX_BACKOFF_SECONDS"
+            value = tostring(var.container.reconnect_max_backoff_seconds)
+          },
+        ],
+        [
+          for name in sort(keys(local.group_compute_environment_variables[each.key])) : {
+            name  = name
+            value = local.group_compute_environment_variables[each.key][name]
+          }
+        ],
+      )
+      healthCheck = {
+        command     = local.resolved_health_check_command
+        interval    = var.container.health_check_interval
+        timeout     = var.container.health_check_timeout
+        retries     = var.container.health_check_retries
+        startPeriod = var.container.health_check_start_period
+      }
+      logConfiguration = {
+        logDriver = "awslogs"
+        options = {
+          "awslogs-group"         = aws_cloudwatch_log_group.controller[each.key].name
+          "awslogs-region"        = data.aws_region.current.region
+          "awslogs-stream-prefix" = "controller"
+        }
+      }
+    }
+  ])
+
+  tags = local.group_tags[each.key]
+
+  depends_on = [
+    aws_iam_role_policy.execution,
+    aws_iam_role_policy.task,
+    aws_iam_role_policy.compute,
+  ]
+}
diff --git a/modules/orchestration-providers/scale-set/tests/computed-inputs.tftest.hcl b/modules/orchestration-providers/scale-set/tests/computed-inputs.tftest.hcl
new file mode 100644
index 0000000000..22640ccd7f
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/computed-inputs.tftest.hcl
@@ -0,0 +1,49 @@
+mock_provider "aws" {
+  mock_data "aws_caller_identity" {
+    defaults = {
+      account_id = "123456789012"
+    }
+  }
+
+  mock_data "aws_partition" {
+    defaults = {
+      partition = "aws"
+    }
+  }
+
+  mock_data "aws_region" {
+    defaults = {
+      region = "eu-west-1"
+    }
+  }
+
+  mock_data "aws_iam_policy_document" {
+    defaults = {
+      json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+    }
+  }
+
+  mock_resource "aws_iam_role" {
+    defaults = {
+      arn = "arn:aws:iam::123456789012:role/computed-test"
+    }
+  }
+}
+
+run "plans_with_computed_values_inside_known_wrappers" {
+  command = plan
+
+  module {
+    source = "./tests/fixtures/computed-inputs"
+  }
+
+  assert {
+    condition = (
+      toset(keys(output.controller_groups)) == toset(["ec2"]) &&
+      toset(output.controller_groups.ec2.runner_configs) == toset(["computed"]) &&
+      !output.cluster.managed &&
+      toset(keys(output.reconciler_config_parameters)) == toset(["ec2/computed"])
+    )
+    error_message = "Computed inner values and explicit nulls must not affect group, ownership, IAM-wrapper, or cluster resource shape."
+  }
+}
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
new file mode 100644
index 0000000000..25516ecf3a
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/README.md
@@ -0,0 +1,38 @@
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_subject"></a> [subject](#module\_subject) | ../../.. | n/a |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [terraform_data.computed](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_cluster"></a> [cluster](#output\_cluster) | n/a |
+| <a name="output_controller_groups"></a> [controller\_groups](#output\_controller\_groups) | n/a |
+| <a name="output_reconciler_config_parameters"></a> [reconciler\_config\_parameters](#output\_reconciler\_config\_parameters) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
new file mode 100644
index 0000000000..db8ae2b225
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/main.tf
@@ -0,0 +1,100 @@
+resource "terraform_data" "computed" {
+  input = {
+    external_cluster_arn = "arn:aws:ecs:eu-west-1:123456789012:cluster/external"
+    app_id_arn           = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/app-id"
+    private_key_arn      = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/private-key"
+    installation_id_arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/computed/installation-id"
+    kms_key_arn          = "arn:aws:kms:eu-west-1:123456789012:key/33333333-3333-3333-3333-333333333333"
+    launch_template_name = "lt-computed"
+    action               = "ec2:RunInstances"
+    resource             = "arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-computed"
+  }
+}
+
+module "subject" {
+  source = "../../.."
+
+  prefix = "computed-test"
+
+  runner_configs = {
+    computed = {
+      github = {
+        enterprise_server = {}
+        app = {
+          app_id = {
+            name = "/github/computed/app-id"
+            arn  = terraform_data.computed.output.app_id_arn
+          }
+          private_key = {
+            name        = "/github/computed/private-key"
+            arn         = terraform_data.computed.output.private_key_arn
+            kms_key_arn = terraform_data.computed.output.kms_key_arn
+          }
+          installation_id = {
+            name = "/github/computed/installation-id"
+            arn  = terraform_data.computed.output.installation_id_arn
+          }
+        }
+        runner_owner              = "example"
+        runner_registration_level = "organization"
+        user_agent                = "scale-set-test"
+      }
+      scale_set = {
+        name = "computed"
+      }
+      compute_provider = {
+        type = "ec2"
+        capabilities = {
+          scale_set = {
+            configuration_json = jsonencode({
+              region                 = "eu-west-1"
+              environment            = "computed-test"
+              runnerOwner            = "example"
+              runnerType             = "Org"
+              runnerNamePrefix       = "computed-"
+              jitConfigParameterPath = "/computed-test/runners/tokens"
+              subnets                = ["subnet-12345678"]
+              launchTemplateName     = terraform_data.computed.output.launch_template_name
+              ec2instanceCriteria = {
+                instanceTypes              = ["m7i.large"]
+                targetCapacityType         = "on-demand"
+                instanceAllocationStrategy = "lowest-price"
+              }
+              scaleErrors = []
+            })
+            iam_statements = {
+              run_instances = {
+                actions   = [terraform_data.computed.output.action]
+                resources = [terraform_data.computed.output.resource]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  ecs = {
+    cluster = {
+      mode = "external"
+      arn  = terraform_data.computed.output.external_cluster_arn
+    }
+  }
+
+  network = {
+    vpc_id     = "vpc-12345678"
+    subnet_ids = ["subnet-12345678"]
+  }
+}
+
+output "controller_groups" {
+  value = module.subject.controller_groups
+}
+
+output "cluster" {
+  value = module.subject.cluster
+}
+
+output "reconciler_config_parameters" {
+  value = module.subject.reconciler_config_parameters
+}
diff --git a/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
new file mode 100644
index 0000000000..0bedc91fd5
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/fixtures/computed-inputs/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.6"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.33"
+    }
+  }
+}
diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
new file mode 100644
index 0000000000..870a73b9b2
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -0,0 +1,1137 @@
+mock_provider "aws" {
+  mock_data "aws_caller_identity" {
+    defaults = {
+      account_id = "123456789012"
+    }
+  }
+
+  mock_data "aws_partition" {
+    defaults = {
+      partition = "aws"
+    }
+  }
+
+  mock_data "aws_region" {
+    defaults = {
+      region = "eu-west-1"
+    }
+  }
+
+  mock_data "aws_iam_policy_document" {
+    defaults = {
+      json = "{\"Version\":\"2012-10-17\",\"Statement\":[]}"
+    }
+  }
+
+  mock_resource "aws_iam_role" {
+    defaults = {
+      arn = "arn:aws:iam::123456789012:role/scale-set-test"
+    }
+  }
+
+  mock_resource "aws_ecs_cluster" {
+    defaults = {
+      arn = "arn:aws:ecs:eu-west-1:123456789012:cluster/scale-set-test"
+    }
+  }
+}
+
+variables {
+  prefix = "scale-set-test"
+
+  runner_configs = {
+    linux-small = {
+      github = {
+        enterprise_server = {
+          ssl_verify = false
+        }
+        app = {
+          app_id = {
+            name = "/github/linux-small/app-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/app-id"
+          }
+          private_key = {
+            name        = "/github/linux-small/private-key"
+            arn         = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/private-key"
+            kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/11111111-1111-1111-1111-111111111111"
+          }
+          installation_id = {
+            name = "/github/linux-small/installation-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/installation-id"
+          }
+        }
+        runner_owner              = "example"
+        runner_registration_level = "organization"
+        user_agent                = "scale-set-test"
+      }
+      scale_set = {
+        name = "linux-small"
+        runner = {
+          group_name  = "stable-group"
+          min_runners = 1
+          max_runners = 10
+        }
+      }
+      compute_provider = {
+        type = "ec2"
+        capabilities = {
+          scale_set = {
+            configuration_json = jsonencode({
+              region                 = "eu-west-1"
+              environment            = "scale-set-test"
+              runnerOwner            = "example"
+              runnerType             = "Org"
+              runnerNamePrefix       = "small-"
+              jitConfigParameterPath = "/scale-set-test/runners/tokens"
+              subnets                = ["subnet-11111111"]
+              launchTemplateName     = "lt-small"
+              ec2instanceCriteria = {
+                instanceTypes              = ["m7i.large"]
+                targetCapacityType         = "on-demand"
+                instanceAllocationStrategy = "lowest-price"
+              }
+              scaleErrors = []
+            })
+            environment_variables = {
+              EC2_CONTROLLER_MODE = "grouped"
+            }
+            iam_statements = {
+              run_instances = {
+                actions   = ["ec2:RunInstances"]
+                resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-small"]
+              }
+              read_ami = {
+                actions   = ["ssm:GetParameters"]
+                resources = ["arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/runners/config/ami_id"]
+              }
+            }
+          }
+        }
+      }
+    }
+    linux-large = {
+      github = {
+        enterprise_server = {
+          url = "https://github.example.test"
+        }
+        app = {
+          app_id = {
+            name = "/github/linux-large/app-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/app-id"
+          }
+          private_key = {
+            name = "/github/linux-large/private-key"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/private-key"
+          }
+          installation_id = {
+            name = "/github/linux-large/installation-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-large/installation-id"
+          }
+        }
+        runner_owner              = "example"
+        runner_registration_level = "organization"
+        user_agent                = "scale-set-test"
+      }
+      scale_set = {
+        name = "linux-large"
+        runner = {
+          min_runners = 0
+          max_runners = 20
+        }
+      }
+      compute_provider = {
+        type = "ec2"
+        capabilities = {
+          scale_set = {
+            configuration_json = jsonencode({
+              region                 = "eu-west-1"
+              environment            = "scale-set-test"
+              runnerOwner            = "example"
+              runnerType             = "Org"
+              runnerNamePrefix       = "large-"
+              jitConfigParameterPath = "/scale-set-test/runners/tokens"
+              subnets                = ["subnet-22222222"]
+              launchTemplateName     = "lt-large"
+              ec2instanceCriteria = {
+                instanceTypes              = ["m7i.xlarge"]
+                targetCapacityType         = "on-demand"
+                instanceAllocationStrategy = "lowest-price"
+              }
+              scaleErrors = []
+            })
+            environment_variables = {
+              EC2_CONTROLLER_MODE = "grouped"
+            }
+            iam_statements = {
+              run_instances = {
+                actions   = ["ec2:RunInstances"]
+                resources = ["arn:aws:ec2:eu-west-1:123456789012:launch-template/lt-large"]
+              }
+            }
+          }
+        }
+      }
+    }
+    microvm = {
+      github = {
+        enterprise_server = {}
+        app = {
+          app_id = {
+            name = "/github/microvm/app-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/app-id"
+          }
+          private_key = {
+            name = "/github/microvm/private-key"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/private-key"
+          }
+          installation_id = {
+            name = "/github/microvm/installation-id"
+            arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/installation-id"
+          }
+        }
+        runner_owner              = "example/repository"
+        runner_registration_level = "repository"
+        user_agent                = "scale-set-test"
+      }
+      scale_set = {
+        name = "microvm"
+        runner = {
+          min_runners = 0
+          max_runners = 5
+        }
+      }
+      compute_provider = {
+        # Future provider used only to prove grouping remains provider-neutral.
+        type = "microvm"
+        capabilities = {
+          scale_set = {
+            configuration_json = jsonencode({ image_arn = "arn:aws:lambda:eu-west-1:123456789012:runtime-management-config:microvm" })
+            iam_statements = {
+              run_microvm = {
+                actions   = ["lambda:InvokeFunction"]
+                resources = ["arn:aws:lambda:eu-west-1:123456789012:function:microvm"]
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  network = {
+    vpc_id     = "vpc-12345678"
+    subnet_ids = ["subnet-11111111", "subnet-22222222"]
+  }
+
+  logging = {
+    kms_key_arn = "arn:aws:kms:eu-west-1:123456789012:key/22222222-2222-2222-2222-222222222222"
+  }
+
+  tags = {
+    Test = "scale-set"
+  }
+}
+
+run "groups_by_compute_provider_and_hardens_each_task" {
+  command = plan
+
+  assert {
+    condition = (
+      toset(keys(output.controller_groups)) == toset(["ec2", "microvm"]) &&
+      toset(output.controller_groups["ec2"].runner_configs) == toset(["linux-small", "linux-large"]) &&
+      toset(output.controller_groups["microvm"].runner_configs) == toset(["microvm"])
+    )
+    error_message = "The default strategy must create one controller group per compute-provider type."
+  }
+
+  assert {
+    condition = (
+      length(aws_ecs_service.controller) == 2 &&
+      length(aws_ecs_task_definition.controller) == 2 &&
+      length(aws_iam_role.task) == 2 &&
+      length(aws_cloudwatch_log_group.controller) == 2 &&
+      length(aws_security_group.controller) == 2 &&
+      length(aws_ssm_parameter.reconciler_config) == 3
+    )
+    error_message = "Every group must own one service, task definition, task role, log group, and security group while every reconciler gets one config parameter."
+  }
+
+  assert {
+    condition = alltrue([
+      for service in values(aws_ecs_service.controller) : (
+        service.desired_count == 1 &&
+        service.deployment_minimum_healthy_percent == 0 &&
+        service.deployment_maximum_percent == 100 &&
+        service.deployment_circuit_breaker[0].enable &&
+        service.deployment_circuit_breaker[0].rollback &&
+        !service.network_configuration[0].assign_public_ip &&
+        length(service.network_configuration[0].security_groups) == 1
+      )
+    ])
+    error_message = "Services must run one private task and use stop-first deployment with circuit-breaker rollback."
+  }
+
+  assert {
+    condition = alltrue([
+      for task in values(aws_ecs_task_definition.controller) : (
+        length(jsondecode(task.container_definitions)) == 1 &&
+        jsondecode(task.container_definitions)[0].image == "ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service:latest" &&
+        jsondecode(task.container_definitions)[0].versionConsistency == "enabled" &&
+        jsondecode(task.container_definitions)[0].readonlyRootFilesystem &&
+        !jsondecode(task.container_definitions)[0].privileged &&
+        jsondecode(task.container_definitions)[0].user == "10001:10001" &&
+        jsondecode(task.container_definitions)[0].linuxParameters.capabilities.drop == ["ALL"] &&
+        jsondecode(task.container_definitions)[0].healthCheck.command[3] == "fetch('http://127.0.0.1:8080/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" &&
+        one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "LOG_LEVEL"]) == "info" &&
+        contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_MANIFEST") &&
+        one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "AWS_XRAY_CONTEXT_MISSING"]) == "IGNORE_ERROR" &&
+        one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "AWS_REGION"]) == "eu-west-1" &&
+        one([for entry in jsondecode(task.container_definitions)[0].environment : entry.value if entry.name == "AWS_DEFAULT_REGION"]) == "eu-west-1" &&
+        !contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_GROUP_CONFIG_PATH") &&
+        !contains([for entry in jsondecode(task.container_definitions)[0].environment : entry.name], "SCALE_SET_CONTROLLER_GROUP_CONFIG_REVISION")
+      )
+    ])
+    error_message = "Each task definition must contain one hardened controller container using manifest configuration and /healthz liveness."
+  }
+
+  assert {
+    condition = (
+      contains(flatten([
+        for task in values(aws_ecs_task_definition.controller) : [
+          for entry in jsondecode(task.container_definitions)[0].environment : [
+            for reconciler in jsondecode(entry.value).reconcilers : reconciler.runnerGroupName
+          ]
+          if entry.name == "SCALE_SET_CONTROLLER_MANIFEST"
+        ]
+      ]), "stable-group") &&
+      alltrue([
+        for task in values(aws_ecs_task_definition.controller) : alltrue([
+          for entry in jsondecode(task.container_definitions)[0].environment : entry.name != "SCALE_SET_CONTROLLER_MANIFEST" || (
+            jsondecode(entry.value).version == 1 &&
+            jsondecode(entry.value).groupName == one([
+              for group_name in keys(local.controller_groups) : group_name
+              if local.group_controller_manifests[group_name] == entry.value
+            ]) &&
+            length(jsondecode(entry.value).reconcilers) > 0 &&
+            alltrue([
+              for reconciler in jsondecode(entry.value).reconcilers : (
+                reconciler.schemaVersion == 1 &&
+                reconciler.runnerConfigName != null &&
+                reconciler.runnerGroupName != null &&
+                reconciler.scaleSetName != null &&
+                reconciler.githubConfigUrl != null &&
+                reconciler.githubApp.appIdParameterName != null &&
+                reconciler.githubApp.privateKeyParameterName != null &&
+                reconciler.computeProvider.type != null &&
+                reconciler.computeProvider.roleArn != null &&
+                reconciler.computeProvider.configuration != null &&
+                reconciler.minRunners != null &&
+                reconciler.maxRunners != null &&
+                reconciler.bootTimeoutMinutes != null &&
+                reconciler.sessionOwner != null &&
+                reconciler.workFolder != null &&
+                reconciler.forceGhes != null &&
+                reconciler.sslVerify != null
+              )
+            ])
+          )
+        ])
+      ])
+    )
+    error_message = "Each ECS task must receive a versioned ScaleSetControllerManifest with complete reconciler configuration."
+  }
+
+  assert {
+    condition = one([
+      for entry in jsondecode(aws_ecs_task_definition.controller["ec2"].container_definitions)[0].environment :
+      entry.value if entry.name == "EC2_CONTROLLER_MODE"
+    ]) == "grouped"
+    error_message = "Provider-owned non-secret environment variables must be merged into their controller group task."
+  }
+
+  assert {
+    condition = (
+      length(aws_security_group.controller["ec2"].ingress) == 0 &&
+      length(aws_security_group.controller["ec2"].egress) == 1 &&
+      one(aws_security_group.controller["ec2"].egress).from_port == 443 &&
+      one(aws_security_group.controller["ec2"].egress).to_port == 443 &&
+      aws_cloudwatch_log_group.controller["ec2"].kms_key_id == var.logging.kms_key_arn
+    )
+    error_message = "Controller networking must have no ingress and only HTTPS egress, and logs must honor customer-managed encryption."
+  }
+
+  assert {
+    condition = (
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).schemaVersion == 1 &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).runnerConfigName == "linux-small" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com/example" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).scaleSetName == "linux-small" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).bootTimeoutMinutes == 10 &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).sslVerify == false &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).forceGhes == false &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).userAgent == "scale-set-test" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubApp.privateKeyParameterName == "/github/linux-small/private-key" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).githubConfigUrl == "https://github.example.test/example" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).forceGhes == true &&
+      !contains(keys(jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value))), "runnerConfig")
+    )
+    error_message = "Each SSM leaf must use the frozen flat reconciler schema and contain references instead of GitHub credential values."
+  }
+
+  assert {
+    condition = (
+      contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/github/linux-small/private-key") &&
+      !contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/private-key") &&
+      contains(jsondecode(local.group_github_kms_policy_json["ec2"]).Statement[0].Resource, "arn:aws:kms:eu-west-1:123456789012:key/11111111-1111-1111-1111-111111111111") &&
+      length(jsondecode(local.group_github_kms_policy_json["microvm"]).Statement) == 0 &&
+      contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/scale-set-controller/ec2/*")
+      && contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.actions]), "sts:AssumeRole") &&
+      !contains(flatten([for statement in data.aws_iam_policy_document.task["ec2"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/runners/config/ami_id") &&
+      contains(flatten([for statement in data.aws_iam_policy_document.compute["ec2/linux-small"].statement : statement.actions]), "ssm:GetParameters") &&
+      contains(flatten([for statement in data.aws_iam_policy_document.compute["ec2/linux-small"].statement : statement.resources]), "arn:aws:ssm:eu-west-1:123456789012:parameter/scale-set-test/runners/config/ami_id")
+    )
+    error_message = "Controller IAM must contain only controller permissions, while provider permissions such as AMI SSM reads must be attached to the compute role."
+  }
+}
+
+run "supports_one_group_per_runner_config" {
+  command = plan
+
+  variables {
+    grouping = {
+      strategy = "runner_config"
+    }
+    container = {
+      image = "ghcr.io/example/scale-set-controller@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+  }
+
+  assert {
+    condition = (
+      toset(keys(output.controller_groups)) == toset(["linux-small", "linux-large", "microvm"]) &&
+      length(aws_ecs_service.controller) == 3 &&
+      output.resolved_container_image == "ghcr.io/example/scale-set-controller@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    )
+    error_message = "runner_config grouping must create one independently deployable controller task per runner config and honor an image override."
+  }
+}
+
+run "grants_execution_role_ecr_pull_permissions" {
+  command = plan
+
+  variables {
+    container = {
+      image = "999999999999.dkr.ecr.eu-west-1.amazonaws.com/scale-set-controller@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+  }
+
+  assert {
+    condition = (
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.resources
+      ]), "*") &&
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.actions
+      ]), "ecr:GetAuthorizationToken") &&
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.actions
+      ]), "ecr:BatchCheckLayerAvailability") &&
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.actions
+      ]), "ecr:BatchGetImage") &&
+      contains(flatten([
+        for statement in data.aws_iam_policy_document.execution["ec2"].statement : statement.actions
+      ]), "ecr:GetDownloadUrlForLayer")
+    )
+    error_message = "The ECS execution role must have wildcard ECR pull permissions, including the authorization-token permission."
+  }
+}
+
+run "supports_exact_custom_groups" {
+  command = plan
+
+  variables {
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          general = {
+            runner_configs = ["linux-small", "microvm"]
+          }
+          isolated = {
+            runner_configs = ["linux-large"]
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      toset(keys(output.controller_groups)) == toset(["general", "isolated"]) &&
+      toset(output.controller_groups.general.runner_configs) == toset(["linux-small", "microvm"]) &&
+      toset(output.controller_groups.isolated.runner_configs) == toset(["linux-large"])
+    )
+    error_message = "Custom grouping must preserve the exact declared assignment."
+  }
+}
+
+run "rejects_duplicate_custom_membership" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          first = {
+            runner_configs = ["linux-small", "linux-large"]
+          }
+          second = {
+            runner_configs = ["linux-small", "microvm"]
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_incomplete_custom_membership" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          partial = {
+            runner_configs = ["linux-small", "linux-large"]
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_readiness_path_as_ecs_liveness" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_runtime]
+  }
+
+  variables {
+    container = {
+      health_path = "/readyz"
+    }
+  }
+
+  expect_failures = [terraform_data.validate_runtime]
+}
+
+run "rejects_oversized_standard_parameter" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_config_store]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              configuration_json = jsonencode({ payload = join("", [for index in range(1000) : "xxxxxx"]) })
+            })
+          }
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_config_store]
+}
+
+run "accepts_advanced_parameter_within_eight_kib" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_config_store]
+  }
+
+  variables {
+    config_store = {
+      tier = "Advanced"
+    }
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              configuration_json = jsonencode({ payload = join("", [for index in range(800) : "xxxxxx"]) })
+            })
+          }
+        })
+      })
+    })
+  }
+
+  assert {
+    condition     = local.reconciler_config_bytes["ec2/linux-small"] > 4096 && local.reconciler_config_bytes["ec2/linux-small"] <= 8192
+    error_message = "Advanced Parameter Store tier must accept reconciler JSON between four and eight KiB."
+  }
+}
+
+run "assembles_github_config_url_from_registration_scope_and_owner" {
+  command = apply
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        github = merge(var.runner_configs.linux-small.github, {
+          runner_registration_level = "organization"
+          runner_owner              = "example"
+        })
+      })
+      linux-large = merge(var.runner_configs.linux-large, {
+        github = merge(var.runner_configs.linux-large.github, {
+          runner_registration_level = "organization"
+          runner_owner              = "example"
+        })
+      })
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          runner_registration_level = "repository"
+          runner_owner              = "example/repository"
+        })
+      })
+    })
+  }
+
+  assert {
+    condition = (
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-small"].value)).githubConfigUrl == "https://github.com/example" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["ec2/linux-large"].value)).githubConfigUrl == "https://github.example.test/example" &&
+      jsondecode(nonsensitive(aws_ssm_parameter.reconciler_config["microvm/microvm"].value)).githubConfigUrl == "https://github.com/example/repository"
+    )
+    error_message = "The reconciler config URL must combine the GitHub server with the configured organization or repository owner."
+  }
+}
+
+run "rejects_duplicate_scale_set_ownership_across_groups" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        github = merge(var.runner_configs.linux-small.github, {
+          enterprise_server = { url = "https://mygithub.com" }
+        })
+      })
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          enterprise_server         = { url = "https://mygithub.com:443/" }
+          runner_registration_level = "organization"
+          runner_owner              = "example"
+        })
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          name = "linux-small"
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_leading_zero_default_port_spelling" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          enterprise_server = { url = "https://github.com:0443/" }
+        })
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          name = "linux-small"
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_port_above_url_maximum" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          enterprise_server = { url = "https://github.com:65536/" }
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_non_ascii_scale_set_name" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          name = "microvm-☃"
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_invalid_compute_provider_type_identifier" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        compute_provider = merge(var.runner_configs.microvm.compute_provider, {
+          type = "AWS.MicroVM"
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_credential_arn_name_mismatch" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          app = merge(var.runner_configs.microvm.github.app, {
+            app_id = merge(var.runner_configs.microvm.github.app.app_id, {
+              arn = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/another/app-id"
+            })
+          })
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_cross_account_credential_parameter" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          app = merge(var.runner_configs.microvm.github.app, {
+            app_id = merge(var.runner_configs.microvm.github.app.app_id, {
+              arn = "arn:aws:ssm:eu-west-1:210987654321:parameter/github/microvm/app-id"
+            })
+          })
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "allows_same_scale_set_name_in_another_github_scope" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          enterprise_server = { url = "https://github.example.test" }
+        })
+        scale_set = merge(var.runner_configs.microvm.scale_set, {
+          name = "linux-small"
+        })
+      })
+    })
+  }
+
+  assert {
+    condition = length([
+      for runner_name, runner_config in var.runner_configs : format(
+        "%s#%s",
+        replace(trimsuffix(lower(local.github_config_urls[runner_name]), "/"), ":443", ""),
+        runner_config.scale_set.name,
+      )
+      ]) == length(distinct([
+        for runner_name, runner_config in var.runner_configs : format(
+          "%s#%s",
+          replace(trimsuffix(lower(local.github_config_urls[runner_name]), "/"), ":443", ""),
+          runner_config.scale_set.name,
+        )
+    ]))
+    error_message = "Scale-set names are scoped to their normalized enterprise-server URL."
+  }
+}
+
+run "bounds_default_session_owner_for_maximum_names" {
+  command = plan
+
+  variables {
+    grouping = {
+      strategy = "runner_config"
+    }
+    runner_configs = {
+      (join("", [for index in range(128) : "a"])) = {
+        github = {
+          enterprise_server         = {}
+          runner_owner              = "example"
+          runner_registration_level = "organization"
+          user_agent                = "scale-set-test"
+          app = {
+            app_id = {
+              name = "/github/max/app-id"
+              arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/max/app-id"
+            }
+            private_key = {
+              name = "/github/max/private-key"
+              arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/max/private-key"
+            }
+            installation_id = {
+              name = "/github/max/installation-id"
+              arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/max/installation-id"
+            }
+          }
+        }
+        scale_set = {
+          name = "maximum-name"
+        }
+        compute_provider = {
+          type = "ec2"
+          capabilities = {
+            scale_set = {
+              configuration_json = "{}"
+            }
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      length(one(values(local.reconciler_configs)).value.sessionOwner) == 256 &&
+      can(regex("^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$", one(values(local.reconciler_configs)).value.sessionOwner))
+    )
+    error_message = "A generated session owner must remain deterministic and within the runtime's 256-character limit."
+  }
+}
+
+run "rejects_controller_group_policy_above_inline_quota" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_group_task_policy["ec2"]]
+  }
+
+  override_data {
+    target = data.aws_iam_policy_document.task["ec2"]
+    values = {
+      json = <<-JSON
+        {"payload":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}
+      JSON
+    }
+  }
+
+  expect_failures = [terraform_data.validate_group_task_policy["ec2"]]
+}
+
+run "rejects_conflicting_group_environment_variables" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-large = merge(var.runner_configs.linux-large, {
+        compute_provider = merge(var.runner_configs.linux-large.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-large.compute_provider.capabilities.scale_set, {
+              environment_variables = {
+                EC2_CONTROLLER_MODE = "isolated"
+              }
+            })
+          }
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_controller_group_environment_above_task_definition_budget" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              environment_variables = merge(
+                var.runner_configs.linux-small.compute_provider.capabilities.scale_set.environment_variables,
+                {
+                  for index in range(16) : format("EC2_QUOTA_%02d", index) => join("", [for part in range(1024) : "xxxx"])
+                },
+              )
+            })
+          }
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_reserved_provider_environment_variables" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              environment_variables = {
+                SCALE_SET_OVERRIDE = "unsafe"
+              }
+            })
+          }
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_invalid_boot_timeout" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        scale_set = merge(var.runner_configs.linux-small.scale_set, {
+          runner = merge(var.runner_configs.linux-small.scale_set.runner, {
+            boot_time_in_minutes = 0
+          })
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_enterprise_runner_registration_level" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        github = merge(var.runner_configs.linux-small.github, {
+          runner_registration_level = "enterprise"
+          runner_owner              = null
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_invalid_runner_registration_level" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      linux-small = merge(var.runner_configs.linux-small, {
+        github = merge(var.runner_configs.linux-small.github, {
+          runner_registration_level = "invalid"
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
+
+run "rejects_controller_group_above_runtime_reconciler_limit" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    runner_configs = {
+      for index in range(1001) : format("runner-%04d", index) => var.runner_configs.linux-small
+    }
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          oversized = {
+            runner_configs = toset([for index in range(1001) : format("runner-%04d", index)])
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_controller_group_above_runtime_config_bytes" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_grouping]
+  }
+
+  variables {
+    config_store = {
+      tier = "Advanced"
+    }
+    runner_configs = {
+      for index in range(900) : format("runner-%04d", index) => merge(var.runner_configs.linux-small, {
+        compute_provider = merge(var.runner_configs.linux-small.compute_provider, {
+          capabilities = {
+            scale_set = merge(var.runner_configs.linux-small.compute_provider.capabilities.scale_set, {
+              configuration_json = jsonencode({
+                payload = join("", [for part in range(1000) : "xxxxx"])
+              })
+            })
+          }
+        })
+      })
+    }
+    grouping = {
+      strategy = "custom"
+      custom = {
+        groups = {
+          oversized = {
+            runner_configs = toset([for index in range(900) : format("runner-%04d", index)])
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_grouping]
+}
+
+run "rejects_runtime_invalid_credential_parameter_name" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_contract]
+  }
+
+  variables {
+    runner_configs = merge(var.runner_configs, {
+      microvm = merge(var.runner_configs.microvm, {
+        github = merge(var.runner_configs.microvm.github, {
+          app = merge(var.runner_configs.microvm.github.app, {
+            app_id = {
+              name = "/github/microvm/bad app-id"
+              arn  = "arn:aws:ssm:eu-west-1:123456789012:parameter/github/microvm/bad app-id"
+            }
+          })
+        })
+      })
+    })
+  }
+
+  expect_failures = [terraform_data.validate_contract]
+}
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
new file mode 100644
index 0000000000..9553581597
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -0,0 +1,425 @@
+locals {
+  group_compute_environment_base64 = {
+    for group_name, environment_variables in local.group_compute_environment_variables : group_name => base64encode(jsonencode([
+      for name in sort(keys(environment_variables)) : {
+        name  = name
+        value = environment_variables[name]
+      }
+    ]))
+  }
+  group_compute_environment_bytes = {
+    for group_name, encoded in local.group_compute_environment_base64 : group_name => (
+      floor(length(encoded) * 3 / 4) -
+      (endswith(encoded, "==") ? 2 : endswith(encoded, "=") ? 1 : 0)
+    )
+  }
+}
+
+resource "terraform_data" "validate_contract" {
+  lifecycle {
+    precondition {
+      condition = (
+        length(var.prefix) >= 1 &&
+        length(var.prefix) <= 20 &&
+        can(regex("^[a-z0-9][a-z0-9-]*$", var.prefix))
+      )
+      error_message = "prefix must contain 1 to 20 lowercase ASCII letters, digits, or hyphens and start with a letter or digit."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_name in keys(var.runner_configs) : (
+          length(runner_name) >= 1 &&
+          length(runner_name) <= 128 &&
+          can(regex("^[A-Za-z0-9][A-Za-z0-9._-]*$", runner_name))
+        )
+      ])
+      error_message = "runner-config keys must contain 1 to 128 ASCII letters, digits, dots, underscores, or hyphens and start with a letter or digit."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : contains([
+          "organization",
+          "repository",
+        ], runner_config.github.runner_registration_level)
+      ])
+      error_message = "runner_registration_level must be organization or repository."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : (
+          runner_config.github.runner_owner != null && can(regex(
+            runner_config.github.runner_registration_level == "organization"
+            ? "^[A-Za-z0-9_.-]+$"
+            : "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$",
+            runner_config.github.runner_owner,
+          ))
+        )
+      ])
+      error_message = "runner_owner must be an organization or owner/repository path for organization and repository registration levels."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_name, runner_config in var.runner_configs : (
+          can(regex("^https://[A-Za-z0-9.-]+(:[1-9][0-9]{0,4})?(/[A-Za-z0-9_.-]+(/[A-Za-z0-9_.-]+)?)?/?$", local.github_config_urls[runner_name])) &&
+          try(tonumber(regex("^https://[A-Za-z0-9.-]+:([0-9]+)", local.github_config_urls[runner_name])[0]), 443) <= 65535
+        )
+      ])
+      error_message = "Each assembled GitHub config URL must be an HTTPS GitHub Enterprise Server URL without credentials, query, fragment, or whitespace."
+    }
+
+    precondition {
+      condition = length([
+        for runner_name, runner_config in var.runner_configs : format(
+          "%s#%s",
+          replace(trimsuffix(lower(local.github_config_urls[runner_name]), "/"), ":443", ""),
+          runner_config.scale_set.name,
+        )
+        ]) == length(distinct([
+          for runner_name, runner_config in var.runner_configs : format(
+            "%s#%s",
+            replace(trimsuffix(lower(local.github_config_urls[runner_name]), "/"), ":443", ""),
+            runner_config.scale_set.name,
+          )
+      ]))
+      error_message = "Each normalized githubConfigUrl and scale_set.name tuple must be unique across runner_configs so two controller services cannot own the same message session. URL matching ignores case, one trailing slash, and the default HTTPS port."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : (
+          alltrue([
+            for parameter in [
+              runner_config.github.app.app_id,
+              runner_config.github.app.private_key,
+              runner_config.github.app.installation_id,
+              ] : (
+              length(parameter.name) <= 2048 &&
+              can(regex("^/[A-Za-z0-9_./-]+$", parameter.name)) &&
+              !endswith(parameter.name, "/") &&
+              !strcontains(parameter.name, "//") &&
+              parameter.arn == format(
+                "arn:%s:ssm:%s:%s:parameter%s",
+                data.aws_partition.current.partition,
+                data.aws_region.current.region,
+                data.aws_caller_identity.current.account_id,
+                parameter.name,
+              ) &&
+              (parameter.kms_key_arn == null ? true : can(regex("^arn:[^:]+:kms:[^:]+:[0-9]{12}:key/.+$", parameter.kms_key_arn)))
+            )
+          ])
+        )
+      ])
+      error_message = "GitHub App credentials must use valid absolute SSM parameter names and exact same-account, same-region parameter ARNs; optional KMS references must be key ARNs."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : (
+          can(regex("^[ -~]{1,128}$", runner_config.scale_set.name)) &&
+          runner_config.scale_set.runner.min_runners >= 0 &&
+          floor(runner_config.scale_set.runner.min_runners) == runner_config.scale_set.runner.min_runners &&
+          runner_config.scale_set.runner.max_runners >= 1 &&
+          runner_config.scale_set.runner.max_runners <= 10000 &&
+          floor(runner_config.scale_set.runner.max_runners) == runner_config.scale_set.runner.max_runners &&
+          runner_config.scale_set.runner.min_runners <= runner_config.scale_set.runner.max_runners &&
+          runner_config.scale_set.runner.boot_time_in_minutes >= 1 &&
+          runner_config.scale_set.runner.boot_time_in_minutes <= 120 &&
+          floor(runner_config.scale_set.runner.boot_time_in_minutes) == runner_config.scale_set.runner.boot_time_in_minutes &&
+          length(runner_config.github.user_agent) <= 256 &&
+          can(regex("^[ -~]+$", runner_config.github.user_agent))
+        )
+      ])
+      error_message = "Scale-set names must be valid, boot_time_in_minutes must be an integer from 1 through 120, and min_runners must be between zero and max_runners (maximum 10000)."
+    }
+
+    precondition {
+      condition = alltrue([
+        for runner_config in values(var.runner_configs) : (
+          can(regex("^[a-z][a-z0-9_-]{0,63}$", runner_config.compute_provider.type)) &&
+          can(keys(jsondecode(runner_config.compute_provider.capabilities.scale_set.configuration_json))) &&
+          length(runner_config.compute_provider.capabilities.scale_set.environment_variables) <= 64 &&
+          alltrue([
+            for name, value in runner_config.compute_provider.capabilities.scale_set.environment_variables : (
+              can(regex("^[A-Z][A-Z0-9_]{0,127}$", name)) &&
+              !contains(["PATH", "HOME", "HOSTNAME", "PWD", "SHLVL"], name) &&
+              alltrue([
+                for prefix in ["AWS_", "ECS_", "GITHUB_", "SCALE_SET_", "NODE_"] :
+                !startswith(name, prefix)
+              ]) &&
+              length(regexall("[\\x00-\\x1F\\x7F]", value)) == 0 &&
+              (
+                floor(length(base64encode(value)) * 3 / 4) -
+                (endswith(base64encode(value), "==") ? 2 : endswith(base64encode(value), "=") ? 1 : 0)
+              ) <= 4096
+            )
+          ]) &&
+          alltrue([
+            for statement_name, statement in runner_config.compute_provider.capabilities.scale_set.iam_statements : (
+              can(regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$", statement_name)) &&
+              length(statement.actions) > 0 &&
+              length(statement.resources) > 0 &&
+              alltrue([for action in statement.actions : !strcontains(action, "*")]) &&
+              alltrue([
+                for condition in statement.conditions : (
+                  length(condition.test) > 0 &&
+                  length(condition.variable) > 0 &&
+                  length(condition.values) > 0
+                )
+              ])
+            )
+          ])
+        )
+      ])
+      error_message = "Each compute-provider scale-set capability must have safe identifiers, object-shaped configuration JSON, non-secret environment variables with safe unreserved names and bounded values, and non-empty least-privilege IAM statements without wildcard actions."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, entries in local.group_compute_environment_entries : alltrue([
+          for name in distinct([for entry in entries : entry.name]) :
+          length(distinct([for entry in entries : entry.value if entry.name == name])) <= 1
+        ])
+      ])
+      error_message = "Compute-provider environment variables grouped into the same controller task must use identical values for duplicate names. Use a different grouping strategy when providers require conflicting process settings."
+    }
+  }
+}
+
+resource "terraform_data" "validate_grouping" {
+  lifecycle {
+    precondition {
+      condition     = contains(["compute_provider", "runner_config", "custom"], var.grouping.strategy)
+      error_message = "grouping.strategy must be compute_provider, runner_config, or custom."
+    }
+
+    precondition {
+      condition = (
+        var.grouping.strategy == "custom"
+        ? var.grouping.custom != null && length(var.grouping.custom.groups) > 0
+        : var.grouping.custom == null
+      )
+      error_message = "grouping.custom must be non-null and non-empty only when grouping.strategy is custom."
+    }
+
+    precondition {
+      condition = var.grouping.strategy != "custom" ? true : alltrue([
+        for group_name, group in var.grouping.custom.groups : (
+          can(regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$", group_name)) &&
+          length(group.runner_configs) > 0
+        )
+      ])
+      error_message = "Custom group names must be stable, safe identifiers of at most 64 characters, and every group must contain at least one runner config."
+    }
+
+    precondition {
+      condition = var.grouping.strategy != "custom" ? true : (
+        length(flatten(values(local.declared_custom_groups))) == length(distinct(flatten(values(local.declared_custom_groups)))) &&
+        length(setsubtract(toset(flatten(values(local.declared_custom_groups))), toset(keys(var.runner_configs)))) == 0 &&
+        length(setsubtract(toset(keys(var.runner_configs)), toset(flatten(values(local.declared_custom_groups))))) == 0
+      )
+      error_message = "Custom groups must contain every runner config exactly once and cannot contain unknown runner configs."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, runner_names in local.controller_groups : (
+          can(regex("^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$", group_name)) &&
+          length(runner_names) > 0 &&
+          length(runner_names) <= 1000
+        )
+      ])
+      error_message = "Resolved controller groups must have safe, non-empty, plan-known names and contain at most 1000 runner configs."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, runner_names in local.controller_groups : sum([
+          for runner_name in runner_names : local.reconciler_config_bytes["${group_name}/${runner_name}"]
+        ]) <= 4 * 1024 * 1024
+      ])
+      error_message = "A controller group's decoded reconciler configuration must not exceed the runtime's 4 MiB aggregate limit. Split the group or reduce provider configuration size."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, environment_bytes in local.group_compute_environment_bytes : environment_bytes <= 48 * 1024
+      ])
+      error_message = "A controller group's compute-provider environment JSON must not exceed 49152 bytes. This reserves 16 KiB of AWS's 64 KiB ECS task-definition quota for the fixed task definition; split the group or reduce provider environment settings."
+    }
+
+    precondition {
+      condition = alltrue([
+        for group_name, manifest_bytes in local.group_controller_manifests : (
+          length(manifest_bytes) + local.group_compute_environment_bytes[group_name] <= 48 * 1024
+        )
+      ])
+      error_message = "A controller group's manifest and compute-provider environment JSON must fit the ECS task-definition budget; split the group or reduce provider configuration."
+    }
+  }
+}
+
+resource "terraform_data" "validate_runtime" {
+  lifecycle {
+    precondition {
+      condition = (
+        var.container.image == null ? true : (
+          length(trimspace(var.container.image)) > 0 &&
+          length(regexall("[[:space:]]", var.container.image)) == 0
+      ))
+      error_message = "Container image references must be non-empty and cannot contain whitespace."
+    }
+
+    precondition {
+      condition = (
+        can(regex("^[1-9][0-9]{0,9}(:[1-9][0-9]{0,9})?$", var.container.user)) &&
+        var.container.health_port >= 1 && var.container.health_port <= 65535 &&
+        (var.container.health_check_command == null ? true : (
+          length(var.container.health_check_command) >= 2 &&
+          contains(["CMD", "CMD-SHELL"], var.container.health_check_command[0])
+        ))
+      )
+      error_message = "The container must use a numeric non-root UID (and optional GID), a valid health port, and a valid ECS health-check command."
+    }
+
+    precondition {
+      condition     = var.container.health_path == "/healthz"
+      error_message = "container.health_path must be /healthz, the scale-set service liveness endpoint."
+    }
+
+    precondition {
+      condition = (
+        var.container.health_check_interval >= 5 && var.container.health_check_interval <= 300 &&
+        var.container.health_check_timeout >= 2 && var.container.health_check_timeout <= 60 &&
+        var.container.health_check_timeout < var.container.health_check_interval &&
+        var.container.health_check_retries >= 1 && var.container.health_check_retries <= 10 &&
+        var.container.health_check_start_period >= 0 && var.container.health_check_start_period <= 300 &&
+        var.container.health_stale_after_seconds >= 30 && var.container.health_stale_after_seconds <= 3600 &&
+        var.container.shutdown_timeout_seconds >= 1 && var.container.shutdown_timeout_seconds <= 119 &&
+        var.container.session_close_timeout_seconds >= 1 && var.container.session_close_timeout_seconds <= 60 &&
+        var.container.reconnect_initial_backoff_seconds >= 1 && var.container.reconnect_initial_backoff_seconds <= 300 &&
+        var.container.reconnect_max_backoff_seconds >= 1 && var.container.reconnect_max_backoff_seconds <= 3600 &&
+        var.container.reconnect_initial_backoff_seconds <= var.container.reconnect_max_backoff_seconds &&
+        var.container.stop_timeout_seconds >= 2 && var.container.stop_timeout_seconds <= 120 &&
+        var.container.shutdown_timeout_seconds < var.container.stop_timeout_seconds
+      )
+      error_message = "Container health and shutdown timings must be within ECS limits, with health timeout below interval and application shutdown below task stop timeout."
+    }
+
+    precondition {
+      condition = (
+        contains(keys(local.fargate_memory_by_cpu), tostring(var.ecs.task.cpu)) &&
+        contains(lookup(local.fargate_memory_by_cpu, tostring(var.ecs.task.cpu), []), var.ecs.task.memory)
+      )
+      error_message = "ecs.task.cpu and ecs.task.memory must be a supported Fargate CPU/memory combination."
+    }
+
+    precondition {
+      condition = (
+        contains(["X86_64", "ARM64"], var.ecs.task.cpu_architecture) &&
+        (var.ecs.task.ephemeral_storage == null ? true : (
+          var.ecs.task.ephemeral_storage.size_in_gib >= 21 && var.ecs.task.ephemeral_storage.size_in_gib <= 200
+        ))
+      )
+      error_message = "ecs.task.cpu_architecture must be X86_64 or ARM64, and optional ephemeral storage must be between 21 and 200 GiB."
+    }
+
+    precondition {
+      condition = (
+        contains(["managed", "external"], var.ecs.cluster.mode) &&
+        (var.ecs.cluster.mode == "external" ? (
+          var.ecs.cluster.arn != null && can(regex("^arn:[^:]+:ecs:[^:]+:[0-9]{12}:cluster/.+$", var.ecs.cluster.arn))
+          ) : (
+          var.ecs.cluster.arn == null &&
+          (var.ecs.cluster.name == null ? true : can(regex("^[A-Za-z0-9_-]{1,255}$", var.ecs.cluster.name)))
+        ))
+      )
+      error_message = "Use a valid external ECS cluster ARN only with cluster.mode external; managed cluster names may contain letters, digits, underscores, and hyphens."
+    }
+
+    precondition {
+      condition = (
+        startswith(var.ecs.iam.path, "/") &&
+        endswith(var.ecs.iam.path, "/") &&
+        length(var.ecs.iam.path) <= 512
+      )
+      error_message = "ecs.iam.path must start and end with a slash and be at most 512 characters."
+    }
+
+    precondition {
+      condition = (
+        length(var.network.vpc_id) > 0 &&
+        length(var.network.subnet_ids) > 0 &&
+        length(var.network.https_egress.ipv4_cidrs) + length(var.network.https_egress.ipv6_cidrs) > 0 &&
+        alltrue([for cidr in var.network.https_egress.ipv4_cidrs : can(cidrnetmask(cidr))]) &&
+        alltrue([for cidr in var.network.https_egress.ipv6_cidrs : can(cidrhost(cidr, 0)) && strcontains(cidr, ":")])
+      )
+      error_message = "network must select a VPC and at least one subnet, and HTTPS egress must contain valid IPv4 or IPv6 CIDRs."
+    }
+
+    precondition {
+      condition = (
+        contains(["STANDARD", "INFREQUENT_ACCESS"], var.logging.log_group_class) &&
+        contains([1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653], var.logging.retention_in_days) &&
+        (var.logging.kms_key_arn == null ? true : can(regex("^arn:[^:]+:kms:[^:]+:[0-9]{12}:key/.+$", var.logging.kms_key_arn)))
+      )
+      error_message = "logging must use a supported class and retention period; kms_key_arn must be a KMS key ARN when set."
+    }
+  }
+}
+
+resource "terraform_data" "validate_config_store" {
+  lifecycle {
+    precondition {
+      condition = (
+        contains(["Standard", "Advanced"], var.config_store.tier) &&
+        startswith(local.config_store_path_prefix, "/") &&
+        !endswith(local.config_store_path_prefix, "/") &&
+        length(local.config_store_path_prefix) >= 2 &&
+        can(regex("^/[A-Za-z0-9_.\\/-]+$", local.config_store_path_prefix))
+      )
+      error_message = "config_store must use Standard or Advanced tier and a valid absolute SSM path prefix without a trailing slash."
+    }
+
+    precondition {
+      condition = alltrue([
+        for config_key, config in local.reconciler_configs : (
+          length("${local.config_store_path_prefix}/${config.group_name}/${config.runner_name}") <= 1011 &&
+          local.reconciler_config_bytes[config_key] <= local.config_store_max_bytes
+        )
+      ])
+      error_message = "Each reconciler SSM parameter name and encoded JSON value must fit the selected Parameter Store tier. Split large controller groups or reduce provider configuration when necessary."
+    }
+  }
+}
+
+resource "terraform_data" "validate_group_task_policy" {
+  for_each = local.controller_groups
+
+  lifecycle {
+    precondition {
+      condition = (
+        floor(length(base64encode(data.aws_iam_policy_document.task[each.key].json)) * 3 / 4) -
+        (endswith(base64encode(data.aws_iam_policy_document.task[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task[each.key].json), "=") ? 1 : 0)
+      ) <= 10240
+      error_message = "Controller group ${each.key} produces a task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce controller permissions."
+    }
+  }
+}
+
+resource "terraform_data" "validate_compute_role_policy" {
+  for_each = local.compute_role_configs
+
+  lifecycle {
+    precondition {
+      condition = (
+        floor(length(base64encode(data.aws_iam_policy_document.compute[each.key].json)) * 3 / 4) -
+        (endswith(base64encode(data.aws_iam_policy_document.compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.compute[each.key].json), "=") ? 1 : 0)
+      ) <= 10240
+      error_message = "Compute role ${each.key} produces an inline policy exceeding AWS's 10240-byte role-policy quota. Split the group or reduce provider IAM statements."
+    }
+  }
+}
diff --git a/modules/orchestration-providers/scale-set/variables.tf b/modules/orchestration-providers/scale-set/variables.tf
new file mode 100644
index 0000000000..236dfc8213
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/variables.tf
@@ -0,0 +1,200 @@
+variable "prefix" {
+  description = "Stable prefix used for scale-set controller resources."
+  type        = string
+  default     = "github-actions"
+  nullable    = false
+}
+
+variable "log_level" {
+  description = "Logging level for the scale-set controller container."
+  type        = string
+  default     = "info"
+  nullable    = false
+}
+
+variable "runner_configs" {
+  description = <<-EOT
+    Normalized scale-set runner configurations keyed by stable runner-config name.
+
+    Map keys must be known during planning. Credential values are never accepted: `github.app` contains only the exact GitHub App Parameter Store references used by the runtime. `github.enterprise_server` and `github.user_agent` carry the global GitHub settings needed to render each reconciler configuration. `scale_set.runner.group_name` selects the GitHub runner group. `runner_registration_level` selects organization or repository registration, and `runner_owner` supplies the corresponding organization or owner/repository path. Enterprise-level registration is not supported by this module. `compute_provider` carries the provider-neutral scale-set capability contract for this runner configuration. Parameter and optional KMS ARNs, scale-set names, and other inner values may remain unknown until apply.
+  EOT
+  type = map(object({
+    github = object({
+      enterprise_server = object({
+        url        = optional(string, null)
+        ssl_verify = optional(bool, true)
+      })
+      app = object({
+        app_id = object({
+          name        = string
+          arn         = string
+          kms_key_arn = optional(string, null)
+        })
+        private_key = object({
+          name        = string
+          arn         = string
+          kms_key_arn = optional(string, null)
+        })
+        installation_id = object({
+          name        = string
+          arn         = string
+          kms_key_arn = optional(string, null)
+        })
+      })
+      runner_owner              = string
+      runner_registration_level = string
+      user_agent                = string
+    })
+    scale_set = object({
+      name = string
+      runner = optional(object({
+        labels               = optional(list(string), [])
+        group_name           = optional(string, "Default")
+        min_runners          = optional(number, 0)
+        max_runners          = optional(number, 10)
+        boot_time_in_minutes = optional(number, 10)
+      }), {})
+    })
+    compute_provider = object({
+      type = string
+      capabilities = object({
+        scale_set = object({
+          role_arn              = optional(string, null)
+          configuration_json    = optional(string, "{}")
+          environment_variables = optional(map(string), {})
+          iam_statements = optional(map(object({
+            actions   = set(string)
+            resources = set(string)
+            conditions = optional(list(object({
+              test     = string
+              variable = string
+              values   = set(string)
+            })), [])
+          })), {})
+        })
+      })
+    })
+  }))
+  nullable = false
+}
+
+variable "grouping" {
+  description = <<-EOT
+    Packing strategy for scale-set reconcilers. `compute_provider` creates one controller group per compute-provider type and is the default. `runner_config` creates one group per runner config. `custom` uses `custom.groups`; custom membership must cover every runner config exactly once.
+
+    The strategy, custom group keys, and memberships select Terraform `for_each` instances and must be known during planning.
+  EOT
+  type = object({
+    strategy = optional(string, "compute_provider")
+    custom = optional(object({
+      groups = map(object({
+        runner_configs = set(string)
+      }))
+    }), null)
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "container" {
+  description = "Scale-set controller image and runtime settings. A null image uses the internal official convenience image; production callers should use the release digest. Filesystem and Linux capability hardening are enforced by the module; health_path is fixed at /healthz, the ECS liveness endpoint."
+  type = object({
+    image                             = optional(string, null)
+    user                              = optional(string, "10001:10001")
+    health_port                       = optional(number, 8080)
+    health_path                       = optional(string, "/healthz")
+    health_check_command              = optional(list(string), null)
+    health_check_interval             = optional(number, 30)
+    health_check_timeout              = optional(number, 5)
+    health_check_retries              = optional(number, 3)
+    health_check_start_period         = optional(number, 30)
+    health_stale_after_seconds        = optional(number, 180)
+    shutdown_timeout_seconds          = optional(number, 110)
+    session_close_timeout_seconds     = optional(number, 10)
+    reconnect_initial_backoff_seconds = optional(number, 1)
+    reconnect_max_backoff_seconds     = optional(number, 30)
+    stop_timeout_seconds              = optional(number, 120)
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "config_store" {
+  description = <<-EOT
+    Non-secret controller configuration storage. The module writes one SSM String parameter per reconciler below `path_prefix/<controller-group>/<runner-config>`. The task receives only its group path and a SHA-256 revision, then loads the group with `GetParametersByPath`.
+
+    Standard parameters are limited to 4096 encoded bytes and Advanced parameters to 8192 encoded bytes. Null `path_prefix` resolves to `/<prefix>/scale-set-controller`.
+  EOT
+  type = object({
+    path_prefix = optional(string, null)
+    tier        = optional(string, "Standard")
+    tags        = optional(map(string), {})
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "ecs" {
+  description = <<-EOT
+    ECS substrate configuration. A managed cluster is created by default. For an external cluster, set `cluster.mode = "external"` and pass its ARN; the mode must be plan-known while the ARN may be computed.
+  EOT
+  type = object({
+    cluster = optional(object({
+      mode               = optional(string, "managed")
+      arn                = optional(string, null)
+      name               = optional(string, null)
+      container_insights = optional(bool, true)
+    }), {})
+    task = optional(object({
+      cpu              = optional(number, 512)
+      memory           = optional(number, 1024)
+      cpu_architecture = optional(string, "X86_64")
+      ephemeral_storage = optional(object({
+        size_in_gib = number
+      }), null)
+    }), {})
+    service = optional(object({
+      platform_version = optional(string, "LATEST")
+    }), {})
+    iam = optional(object({
+      path                 = optional(string, "/")
+      permissions_boundary = optional(string, null)
+    }), {})
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "network" {
+  description = <<-EOT
+    Private Fargate networking. Tasks never receive public IP addresses and the managed security groups have no ingress. HTTPS egress defaults to IPv4 Internet access because GitHub endpoints cannot be represented as security-group destinations; route it through controlled NAT, firewall, or proxy infrastructure when required.
+  EOT
+  type = object({
+    vpc_id     = string
+    subnet_ids = set(string)
+    https_egress = optional(object({
+      ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])
+      ipv6_cidrs = optional(set(string), [])
+    }), {})
+  })
+  nullable = false
+}
+
+variable "logging" {
+  description = "CloudWatch Logs configuration. CloudWatch encrypts logs at rest with an AWS-owned key by default; set `kms_key_arn` to use a customer-managed key."
+  type = object({
+    retention_in_days = optional(number, 30)
+    kms_key_arn       = optional(string, null)
+    log_group_class   = optional(string, "STANDARD")
+    tags              = optional(map(string), {})
+  })
+  default  = {}
+  nullable = false
+}
+
+variable "tags" {
+  description = "Tags applied to scale-set orchestration resources."
+  type        = map(string)
+  default     = {}
+  nullable    = false
+}
diff --git a/modules/orchestration-providers/scale-set/versions.tf b/modules/orchestration-providers/scale-set/versions.tf
new file mode 100644
index 0000000000..0bedc91fd5
--- /dev/null
+++ b/modules/orchestration-providers/scale-set/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.5.6"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.33"
+    }
+  }
+}

From 36bc08b9dee6d00ff435c87eb7cc8fd351478a14 Mon Sep 17 00:00:00 2001
From: Ederson Brilhante <contato@edersonbrilhante.com.br>
Date: Thu, 17 Sep 2026 17:14:10 +0200
Subject: [PATCH 33/52] fix(scale-set): validate compute task policy

---
 .../scale-set/tests/scale-set.tftest.hcl           |  6 +++---
 .../scale-set/validations.tf                       | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
index 870a73b9b2..8a2d319e32 100644
--- a/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
+++ b/modules/orchestration-providers/scale-set/tests/scale-set.tftest.hcl
@@ -887,11 +887,11 @@ run "rejects_controller_group_policy_above_inline_quota" {
   command = plan
 
   plan_options {
-    target = [terraform_data.validate_group_task_policy["ec2"]]
+    target = [terraform_data.validate_group_compute_policy["ec2"]]
   }
 
   override_data {
-    target = data.aws_iam_policy_document.task["ec2"]
+    target = data.aws_iam_policy_document.task_compute["ec2"]
     values = {
       json = <<-JSON
         {"payload":"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"}
@@ -899,7 +899,7 @@ run "rejects_controller_group_policy_above_inline_quota" {
     }
   }
 
-  expect_failures = [terraform_data.validate_group_task_policy["ec2"]]
+  expect_failures = [terraform_data.validate_group_compute_policy["ec2"]]
 }
 
 run "rejects_conflicting_group_environment_variables" {
diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index 9553581597..d956e21f2f 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -423,3 +423,17 @@ resource "terraform_data" "validate_compute_role_policy" {
     }
   }
 }
+
+resource "terraform_data" "validate_group_compute_policy" {
+  for_each = local.controller_groups
+
+  lifecycle {
+    precondition {
+      condition = (
+        floor(length(base64encode(data.aws_iam_policy_document.task_compute[each.key].json)) * 3 / 4) -
+        (endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "=") ? 1 : 0)
+      ) <= 10240
+      error_message = "Controller group ${each.key} produces a compute-provider task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
+    }
+  }
+}

From 8175f99507099d439d233f9971abc3a259681b97 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 15:25:37 +0000
Subject: [PATCH 34/52] docs: auto update terraform docs

---
 modules/orchestration-providers/scale-set/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/modules/orchestration-providers/scale-set/README.md b/modules/orchestration-providers/scale-set/README.md
index 495a8cc314..cc7c90eb23 100644
--- a/modules/orchestration-providers/scale-set/README.md
+++ b/modules/orchestration-providers/scale-set/README.md
@@ -218,6 +218,7 @@ No modules.
 | [terraform_data.validate_compute_role_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_config_store](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_contract](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
+| [terraform_data.validate_group_compute_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_group_task_policy](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_grouping](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |
 | [terraform_data.validate_runtime](https://registry.terraform.io/providers/hashicorp/terraform/latest/docs/resources/data) | resource |

From ed6f7498fff3a80414673ce0e00c7bf28ba499bd Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Fri, 11 Sep 2026 12:06:45 +0200
Subject: [PATCH 35/52] fix(terraform): limit minimum to scale-set module

---
 examples/multi-runner-v2/versions.tf                            | 2 +-
 examples/multi-runner/versions.tf                               | 2 +-
 modules/compute-providers/aws/ec2/trust-policy/versions.tf      | 2 +-
 modules/compute-providers/aws/ec2/versions.tf                   | 2 +-
 modules/orchestration-providers/webhook/job-retry/versions.tf   | 2 +-
 modules/orchestration-providers/webhook/pool/versions.tf        | 2 +-
 .../orchestration-providers/webhook/scale-runners/versions.tf   | 2 +-
 modules/orchestration-providers/webhook/versions.tf             | 2 +-
 modules/runner-config/versions.tf                               | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/examples/multi-runner-v2/versions.tf b/examples/multi-runner-v2/versions.tf
index 6af69ab915..1dfb3e5774 100644
--- a/examples/multi-runner-v2/versions.tf
+++ b/examples/multi-runner-v2/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 }
diff --git a/examples/multi-runner/versions.tf b/examples/multi-runner/versions.tf
index 6af69ab915..1dfb3e5774 100644
--- a/examples/multi-runner/versions.tf
+++ b/examples/multi-runner/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 }
diff --git a/modules/compute-providers/aws/ec2/trust-policy/versions.tf b/modules/compute-providers/aws/ec2/trust-policy/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/compute-providers/aws/ec2/trust-policy/versions.tf
+++ b/modules/compute-providers/aws/ec2/trust-policy/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/compute-providers/aws/ec2/versions.tf b/modules/compute-providers/aws/ec2/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/compute-providers/aws/ec2/versions.tf
+++ b/modules/compute-providers/aws/ec2/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/job-retry/versions.tf b/modules/orchestration-providers/webhook/job-retry/versions.tf
index 1238b79cc3..fcec7c620d 100644
--- a/modules/orchestration-providers/webhook/job-retry/versions.tf
+++ b/modules/orchestration-providers/webhook/job-retry/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/pool/versions.tf b/modules/orchestration-providers/webhook/pool/versions.tf
index 1238b79cc3..fcec7c620d 100644
--- a/modules/orchestration-providers/webhook/pool/versions.tf
+++ b/modules/orchestration-providers/webhook/pool/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/scale-runners/versions.tf b/modules/orchestration-providers/webhook/scale-runners/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/orchestration-providers/webhook/scale-runners/versions.tf
+++ b/modules/orchestration-providers/webhook/scale-runners/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/versions.tf b/modules/orchestration-providers/webhook/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/orchestration-providers/webhook/versions.tf
+++ b/modules/orchestration-providers/webhook/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {
diff --git a/modules/runner-config/versions.tf b/modules/runner-config/versions.tf
index 0bedc91fd5..3ef011ea0a 100644
--- a/modules/runner-config/versions.tf
+++ b/modules/runner-config/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.5.6"
+  required_version = ">= 1.4.0"
 
   required_providers {
     aws = {

From a5b31c5496db4f5d6ecf5da0ef520e8726173d57 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 15:20:14 +0200
Subject: [PATCH 36/52] feat(scale-set): sync orchestration module changes

---
 .../scale-set/validations.tf                       | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index d956e21f2f..9553581597 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -423,17 +423,3 @@ resource "terraform_data" "validate_compute_role_policy" {
     }
   }
 }
-
-resource "terraform_data" "validate_group_compute_policy" {
-  for_each = local.controller_groups
-
-  lifecycle {
-    precondition {
-      condition = (
-        floor(length(base64encode(data.aws_iam_policy_document.task_compute[each.key].json)) * 3 / 4) -
-        (endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "=") ? 1 : 0)
-      ) <= 10240
-      error_message = "Controller group ${each.key} produces a compute-provider task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
-    }
-  }
-}

From 27be2bc0cdfe329a781cc519558c8bd19f575858 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 16:08:10 +0200
Subject: [PATCH 37/52] feat(scale-set): wire orchestration through runner
 config

---
 modules/compute-providers/aws/ec2/outputs.tf  |   2 +
 .../compute-providers/aws/ec2/scale-set.tf    | 254 +++++++++++++
 .../config.experimental.effective.tf          |   7 +-
 .../config.experimental.resolved.tf           |   1 +
 .../config.experimental.translation.tf        |   6 +-
 modules/multi-runner/main.tf                  |   5 +-
 .../orchestration-provider.scale-set.tf       |  62 ++++
 modules/multi-runner/outputs.tf               |  11 +-
 modules/multi-runner/queues.tf                |  15 +-
 modules/multi-runner/runners.experimental.tf  |   1 +
 .../tests/config-resolution.tftest.hcl        | 333 +++++++++++++++++-
 modules/multi-runner/validations.tf           |  34 +-
 .../variables.experimental.github.tf          |  15 +-
 ...les.experimental.orchestration-provider.tf |  72 ++++
 modules/multi-runner/variables.tf             |  13 +
 .../runner-config/orchestration-provider.tf   |   7 +-
 modules/runner-config/outputs.tf              |  25 +-
 modules/runner-config/validations.tf          |   7 +-
 .../variables.orchestration-provider.tf       |  11 +-
 modules/ssm/outputs.tf                        |   4 +
 modules/ssm/ssm.tf                            |   9 +
 modules/ssm/variables.tf                      |   5 +
 22 files changed, 874 insertions(+), 25 deletions(-)
 create mode 100644 modules/compute-providers/aws/ec2/scale-set.tf
 create mode 100644 modules/multi-runner/orchestration-provider.scale-set.tf

diff --git a/modules/compute-providers/aws/ec2/outputs.tf b/modules/compute-providers/aws/ec2/outputs.tf
index 422383df0f..83b2647fca 100644
--- a/modules/compute-providers/aws/ec2/outputs.tf
+++ b/modules/compute-providers/aws/ec2/outputs.tf
@@ -16,6 +16,8 @@ output "resources" {
 output "provider" {
   description = "Nested EC2 compute-provider contract consumed by runner-config."
   value = {
+    type                  = "ec2"
+    capabilities          = { scale_set = local.scale_set_capability }
     environment_variables = local.provider_environment_variables
     policies              = local.provider_policies
     resources             = local.provider_resources
diff --git a/modules/compute-providers/aws/ec2/scale-set.tf b/modules/compute-providers/aws/ec2/scale-set.tf
new file mode 100644
index 0000000000..439652db58
--- /dev/null
+++ b/modules/compute-providers/aws/ec2/scale-set.tf
@@ -0,0 +1,254 @@
+# Provider-owned runtime and IAM fragments for the additive scale-set
+# orchestration capability. GitHub credentials, GitHub scope, desired capacity,
+# and boot timeout remain orchestration-owned and are not serialized here.
+locals {
+  scale_set_ec2_instance_criteria = merge(
+    {
+      instanceTypes              = var.config.instance_types
+      targetCapacityType         = var.config.instance_target_capacity_type
+      instanceAllocationStrategy = var.config.instance_allocation_strategy
+    },
+    var.config.instance_type_priorities == null ? {} : {
+      instanceTypePriorities = var.config.instance_type_priorities
+    },
+    var.config.instance_max_spot_price == null ? {} : {
+      maxSpotPrice = var.config.instance_max_spot_price
+    },
+  )
+
+  scale_set_runtime_configuration = merge(
+    {
+      region                  = var.aws_region
+      environment             = var.prefix
+      runnerNamePrefix        = var.runner.name_prefix
+      jitConfigParameterPath  = "${var.ssm.paths.root}/${var.ssm.paths.tokens}"
+      subnets                 = var.config.subnet_ids
+      launchTemplateName      = aws_launch_template.runner.name
+      ec2instanceCriteria     = local.scale_set_ec2_instance_criteria
+      onDemandFailoverOnError = var.config.on_demand_failover_for_errors
+      useDedicatedHost        = var.config.use_dedicated_host
+      ssmParameterTags = [
+        for key in sort(keys(local.ssm_parameter_tags)) : {
+          Key   = key
+          Value = local.ssm_parameter_tags[key]
+        }
+      ]
+    },
+    local.ami_id_ssm_external ? {
+      amiIdSsmParameterName = local.ami_id_ssm_parameter_name
+    } : {},
+  )
+
+  scale_set_owned_instance_conditions = [
+    {
+      test     = "StringEquals"
+      variable = "ec2:ResourceTag/ghr:Application"
+      values   = toset(["github-action-runner"])
+    },
+    {
+      test     = "StringEquals"
+      variable = "ec2:ResourceTag/ghr:created_by"
+      values   = toset(["scale-set-service"])
+    },
+    {
+      test     = "StringEquals"
+      variable = "ec2:ResourceTag/ghr:environment"
+      values   = toset([var.prefix])
+    },
+  ]
+
+  scale_set_owned_request_conditions = [
+    {
+      test     = "StringEquals"
+      variable = "aws:RequestTag/ghr:Application"
+      values   = toset(["github-action-runner"])
+    },
+    {
+      test     = "StringEquals"
+      variable = "aws:RequestTag/ghr:created_by"
+      values   = toset(["scale-set-service"])
+    },
+    {
+      test     = "StringEquals"
+      variable = "aws:RequestTag/ghr:environment"
+      values   = toset([var.prefix])
+    },
+  ]
+
+  scale_set_launch_dependency_resources = toset(concat(
+    [
+      "arn:${var.aws_partition}:ec2:${var.aws_region}::image/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:*:snapshot/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:dedicated-host/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:network-interface/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:placement-group/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:security-group/*",
+      aws_launch_template.runner.arn,
+    ],
+    [
+      for subnet_id in var.config.subnet_ids :
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:subnet/${subnet_id}"
+    ],
+    var.config.key_name == null ? [] : [
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:key-pair/${var.config.key_name}",
+    ],
+  ))
+
+  scale_set_create_fleet_dependency_resources = toset(concat(
+    [
+      "arn:${var.aws_partition}:ec2:${var.aws_region}::image/*",
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:placement-group/*",
+      aws_launch_template.runner.arn,
+    ],
+    [
+      for subnet_id in var.config.subnet_ids :
+      "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:subnet/${subnet_id}"
+    ],
+  ))
+
+  scale_set_iam_statements = merge(
+    {
+      describe_ec2 = {
+        actions = toset([
+          "ec2:DescribeInstances",
+          "ec2:DescribeLaunchTemplateVersions",
+          "ec2:DescribeTags",
+        ])
+        # These EC2 Describe APIs do not support resource-level permissions.
+        resources  = toset(["*"])
+        conditions = []
+      }
+      create_fleet_dependencies = {
+        actions    = toset(["ec2:CreateFleet"])
+        resources  = local.scale_set_create_fleet_dependency_resources
+        conditions = []
+      }
+      create_owned_fleet_capacity = {
+        actions = toset(["ec2:CreateFleet"])
+        resources = toset([
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:fleet/*",
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:instance/*",
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:volume/*",
+        ])
+        conditions = local.scale_set_owned_request_conditions
+      }
+      run_instances_dependencies = {
+        actions    = toset(["ec2:RunInstances"])
+        resources  = local.scale_set_launch_dependency_resources
+        conditions = []
+      }
+      run_owned_instances = {
+        actions = toset(["ec2:RunInstances"])
+        resources = toset([
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:instance/*",
+          "arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:volume/*",
+        ])
+        conditions = local.scale_set_owned_request_conditions
+      }
+      tag_runners_on_create = {
+        actions   = toset(["ec2:CreateTags"])
+        resources = toset(["arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:*/*"])
+        conditions = [
+          {
+            test     = "StringEquals"
+            variable = "ec2:CreateAction"
+            values   = toset(["CreateFleet", "RunInstances"])
+          },
+        ]
+      }
+      update_owned_runner_tags = {
+        actions   = toset(["ec2:CreateTags"])
+        resources = toset(["arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:instance/*"])
+        conditions = concat(local.scale_set_owned_instance_conditions, [
+          {
+            test     = "ForAllValues:StringEquals"
+            variable = "aws:TagKeys"
+            values = toset([
+              "ghr:github_runner_id",
+              "ghr:runner_name",
+              "ghr:scale_set_state",
+            ])
+          },
+        ])
+      }
+      terminate_owned_runners = {
+        actions    = toset(["ec2:TerminateInstances"])
+        resources  = toset(["arn:${var.aws_partition}:ec2:${var.aws_region}:${data.aws_caller_identity.current.account_id}:instance/*"])
+        conditions = local.scale_set_owned_instance_conditions
+      }
+      pass_runner_role = {
+        actions   = toset(["iam:PassRole"])
+        resources = toset([var.runner.iam.role.arn])
+        conditions = [
+          {
+            test     = "StringEquals"
+            variable = "iam:PassedToService"
+            values   = toset(["ec2.amazonaws.com"])
+          },
+        ]
+      }
+      publish_runner_jit_configuration = {
+        actions = toset([
+          "ssm:AddTagsToResource",
+          "ssm:DeleteParameter",
+          "ssm:PutParameter",
+        ])
+        resources = toset([
+          "${local.ssm_parameter_arn_prefix}${var.ssm.paths.root}/${var.ssm.paths.tokens}/*",
+        ])
+        conditions = []
+      }
+    },
+    local.ami_id_ssm_external ? {
+      read_external_ami_parameter = {
+        actions    = toset(["ssm:GetParameter"])
+        resources  = toset([local.ami_id_ssm_parameter_arn])
+        conditions = []
+      }
+    } : {},
+    local.ami_kms_key_enabled ? {
+      use_ami_kms_key = {
+        actions = toset([
+          "kms:Decrypt",
+          "kms:DescribeKey",
+          "kms:ReEncryptFrom",
+          "kms:ReEncryptTo",
+        ])
+        resources  = toset([local.ami_kms_key_arn])
+        conditions = []
+      }
+      create_ami_kms_grant = {
+        actions   = toset(["kms:CreateGrant"])
+        resources = toset([local.ami_kms_key_arn])
+        conditions = [
+          {
+            test     = "Bool"
+            variable = "kms:GrantIsForAWSResource"
+            values   = toset(["true"])
+          },
+        ]
+      }
+    } : {},
+    var.config.create_service_linked_role_spot ? {
+      create_spot_service_linked_role = {
+        actions = toset(["iam:CreateServiceLinkedRole"])
+        resources = toset([
+          "arn:${var.aws_partition}:iam::${data.aws_caller_identity.current.account_id}:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot",
+        ])
+        conditions = [
+          {
+            test     = "StringEquals"
+            variable = "iam:AWSServiceName"
+            values   = toset(["spot.amazonaws.com"])
+          },
+        ]
+      }
+    } : {},
+  )
+
+  scale_set_capability = {
+    configuration_json    = jsonencode(local.scale_set_runtime_configuration)
+    environment_variables = {}
+    iam_statements        = local.scale_set_iam_statements
+  }
+}
diff --git a/modules/multi-runner/config.experimental.effective.tf b/modules/multi-runner/config.experimental.effective.tf
index 1a53a16520..4e54b5070b 100644
--- a/modules/multi-runner/config.experimental.effective.tf
+++ b/modules/multi-runner/config.experimental.effective.tf
@@ -16,8 +16,10 @@ locals {
         })
 
         github = {
-          enterprise_server = local.normalized_config.github.enterprise_server
-          user_agent        = local.normalized_config.github.user_agent
+          enterprise_server         = local.normalized_config.github.enterprise_server
+          runner_owner              = local.normalized_config.github.runner_owner
+          runner_registration_level = local.normalized_config.github.runner_registration_level
+          user_agent                = local.normalized_config.github.user_agent
         }
 
         lambda = merge(v.lambda, {
@@ -35,6 +37,7 @@ locals {
               artifact = local.normalized_config.orchestration_provider.webhook.lambda.artifact
             })
           })
+          scale_set = v.orchestration_provider.scale_set
         }
 
         ssm = merge(v.ssm, {
diff --git a/modules/multi-runner/config.experimental.resolved.tf b/modules/multi-runner/config.experimental.resolved.tf
index fc29e81a8d..a0643d0823 100644
--- a/modules/multi-runner/config.experimental.resolved.tf
+++ b/modules/multi-runner/config.experimental.resolved.tf
@@ -295,6 +295,7 @@ locals {
               tags = merge(local.normalized_config.orchestration_provider.webhook.queue.tags, v.orchestration_provider.webhook.queue.tags)
             })
           })
+          scale_set = v.orchestration_provider.scale_set
         }
 
         ssm = merge(v.ssm, {
diff --git a/modules/multi-runner/config.experimental.translation.tf b/modules/multi-runner/config.experimental.translation.tf
index 301d37ec4d..4d7b7d8257 100644
--- a/modules/multi-runner/config.experimental.translation.tf
+++ b/modules/multi-runner/config.experimental.translation.tf
@@ -38,7 +38,9 @@ locals {
       url        = var.ghes_url
       ssl_verify = var.ghes_ssl_verify
     }
-    user_agent = var.user_agent
+    runner_owner              = null
+    runner_registration_level = "enterprise"
+    user_agent                = var.user_agent
   }
 
   stable_to_v2_lambda = {
@@ -141,6 +143,7 @@ locals {
         encryption = var.queue_encryption
       }
     }
+    scale_set = null
   }
 
   stable_to_v2_ssm = {
@@ -427,6 +430,7 @@ locals {
             }
           }
         }
+        scale_set = null
       }
 
       ssm = {
diff --git a/modules/multi-runner/main.tf b/modules/multi-runner/main.tf
index 23d51b7f65..99a41d5207 100644
--- a/modules/multi-runner/main.tf
+++ b/modules/multi-runner/main.tf
@@ -3,8 +3,9 @@ locals {
     "ghr:environment" = var.prefix
   })
 
-  primary_app_id         = coalesce(local.effective_config.github.app.id_ssm, module.ssm.parameters.github_app_id)
-  primary_app_key_base64 = coalesce(local.effective_config.github.app.key_base64_ssm, module.ssm.parameters.github_app_key_base64)
+  primary_app_id              = coalesce(local.effective_config.github.app.id_ssm, module.ssm.parameters.github_app_id)
+  primary_app_key_base64      = coalesce(local.effective_config.github.app.key_base64_ssm, module.ssm.parameters.github_app_key_base64)
+  primary_app_installation_id = local.effective_config.github.app.installation_id_ssm != null ? local.effective_config.github.app.installation_id_ssm : module.ssm.parameters.github_app_installation_id
 
   github_app_parameters = {
     id             = local.primary_app_id
diff --git a/modules/multi-runner/orchestration-provider.scale-set.tf b/modules/multi-runner/orchestration-provider.scale-set.tf
new file mode 100644
index 0000000000..137c7c15b6
--- /dev/null
+++ b/modules/multi-runner/orchestration-provider.scale-set.tf
@@ -0,0 +1,62 @@
+locals {
+  scale_set_runner_configs = {
+    for runner_name, runner_config in local.effective_config.multi_runner_config : runner_name => {
+      github = {
+        enterprise_server = local.effective_config.github.enterprise_server
+        app = {
+          app_id = {
+            name        = local.primary_app_id.name
+            arn         = local.primary_app_id.arn
+            kms_key_arn = local.effective_config.ssm.kms_key_id
+          }
+          private_key = {
+            name        = local.primary_app_key_base64.name
+            arn         = local.primary_app_key_base64.arn
+            kms_key_arn = local.effective_config.ssm.kms_key_id
+          }
+          installation_id = {
+            name        = local.primary_app_installation_id.name
+            arn         = local.primary_app_installation_id.arn
+            kms_key_arn = local.effective_config.ssm.kms_key_id
+          }
+        }
+        runner_owner              = local.effective_config.github.runner_owner
+        runner_registration_level = local.effective_config.github.runner_registration_level
+        user_agent                = local.effective_config.github.user_agent
+      }
+      scale_set = {
+        name = runner_config.orchestration_provider.scale_set.name
+        runner = {
+          labels               = runner_config.runner.labels
+          group_name           = runner_config.runner.group_name
+          min_runners          = runner_config.orchestration_provider.scale_set.runner.min_runners
+          max_runners          = runner_config.orchestration_provider.scale_set.runner.max_runners
+          boot_time_in_minutes = runner_config.orchestration_provider.scale_set.runner.boot_time_in_minutes
+        }
+      }
+      compute_provider = module.runner_configs[runner_name].compute_provider_contract
+    }
+    if runner_config.orchestration_provider.scale_set != null
+  }
+}
+
+module "orchestration_scale_set" {
+  source = "../orchestration-providers/scale-set"
+  count  = length(local.scale_set_runner_configs) > 0 ? 1 : 0
+
+  prefix         = var.prefix
+  log_level      = var.global_config_observability.logs.level
+  runner_configs = local.scale_set_runner_configs
+
+  grouping     = try(local.effective_config.orchestration_provider.scale_set.grouping, {})
+  container    = try(local.effective_config.orchestration_provider.scale_set.container, {})
+  config_store = try(local.effective_config.orchestration_provider.scale_set.config_store, {})
+  ecs          = try(local.effective_config.orchestration_provider.scale_set.ecs, {})
+  network      = try(local.effective_config.orchestration_provider.scale_set.network, {})
+  logging      = try(local.effective_config.orchestration_provider.scale_set.logging, {})
+  tags = merge(
+    local.effective_config.tags,
+    try(local.effective_config.orchestration_provider.scale_set.tags, {}),
+    { "ghr:environment" = var.prefix },
+  )
+}
diff --git a/modules/multi-runner/outputs.tf b/modules/multi-runner/outputs.tf
index 6b7632ffc6..2ec43c8c56 100644
--- a/modules/multi-runner/outputs.tf
+++ b/modules/multi-runner/outputs.tf
@@ -20,7 +20,6 @@ output "runners_map" {
     }
   }
 }
-
 output "runners_map_v2" {
   value = { for runner_key, runner in module.runner_configs : runner_key => {
     runner                 = runner.runner
@@ -33,6 +32,16 @@ output "runners_map_v2" {
   }
 }
 
+output "scale_set" {
+  description = "Shared scale-set orchestration resources, or null when no runner configuration selects scale_set."
+  value = length(module.orchestration_scale_set) == 0 ? null : {
+    cluster                      = module.orchestration_scale_set[0].cluster
+    controller_groups            = module.orchestration_scale_set[0].controller_groups
+    reconciler_config_parameters = module.orchestration_scale_set[0].reconciler_config_parameters
+    resolved_container_image     = module.orchestration_scale_set[0].resolved_container_image
+  }
+}
+
 output "binaries_syncer_map" {
   value = { for runner_binary_key, runner_binary in module.runner_binaries : runner_binary_key => {
     lambda           = runner_binary.lambda
diff --git a/modules/multi-runner/queues.tf b/modules/multi-runner/queues.tf
index 0f57020571..c969bc6881 100644
--- a/modules/multi-runner/queues.tf
+++ b/modules/multi-runner/queues.tf
@@ -26,8 +26,15 @@ data "aws_iam_policy_document" "deny_insecure_transport" {
   }
 }
 
+locals {
+  webhook_queue_configs = {
+    for config, values in local.effective_config.multi_runner_config : config => values
+    if values.orchestration_provider.webhook != null
+  }
+}
+
 resource "aws_sqs_queue" "queued_builds" {
-  for_each                   = local.effective_config.multi_runner_config
+  for_each                   = local.webhook_queue_configs
   name                       = "${var.prefix}-${each.key}-queued-builds"
   delay_seconds              = each.value.orchestration_provider.webhook.queue.delay_webhook_event
   visibility_timeout_seconds = each.value.orchestration_provider.webhook.queue.visibility_timeout_seconds
@@ -50,14 +57,14 @@ resource "aws_sqs_queue" "queued_builds" {
 }
 
 resource "aws_sqs_queue_policy" "build_queue_policy" {
-  for_each  = local.effective_config.multi_runner_config
+  for_each  = local.webhook_queue_configs
   queue_url = aws_sqs_queue.queued_builds[each.key].id
   policy    = data.aws_iam_policy_document.deny_insecure_transport.json
 }
 
 resource "aws_sqs_queue" "queued_builds_dlq" {
   for_each = {
-    for config, values in local.effective_config.multi_runner_config : config => values
+    for config, values in local.webhook_queue_configs : config => values
     if values.orchestration_provider.webhook.queue.redrive_build_queue.enabled
   }
   name = "${var.prefix}-${each.key}-queued-builds_dead_letter"
@@ -74,7 +81,7 @@ resource "aws_sqs_queue" "queued_builds_dlq" {
 
 resource "aws_sqs_queue_policy" "build_queue_dlq_policy" {
   for_each = {
-    for config, values in local.effective_config.multi_runner_config : config => values
+    for config, values in local.webhook_queue_configs : config => values
     if values.orchestration_provider.webhook.queue.redrive_build_queue.enabled
   }
   queue_url = aws_sqs_queue.queued_builds_dlq[each.key].id
diff --git a/modules/multi-runner/runners.experimental.tf b/modules/multi-runner/runners.experimental.tf
index 55c850eb84..b1d504442a 100644
--- a/modules/multi-runner/runners.experimental.tf
+++ b/modules/multi-runner/runners.experimental.tf
@@ -37,6 +37,7 @@ module "runner_configs" {
       lambda    = each.value.orchestration_provider.webhook.lambda
       job_retry = each.value.orchestration_provider.webhook.job_retry
     }
+    scale_set = each.value.orchestration_provider.scale_set
   }
   ssm              = each.value.ssm
   observability    = each.value.observability
diff --git a/modules/multi-runner/tests/config-resolution.tftest.hcl b/modules/multi-runner/tests/config-resolution.tftest.hcl
index 40aa71a426..abc337a0ed 100644
--- a/modules/multi-runner/tests/config-resolution.tftest.hcl
+++ b/modules/multi-runner/tests/config-resolution.tftest.hcl
@@ -65,9 +65,10 @@ variables {
 
   global_config_github = {
     app = {
-      key_base64     = "experimental-app-key"
-      id             = "experimental-app-id"
-      webhook_secret = "experimental-webhook-secret"
+      key_base64      = "experimental-app-key"
+      id              = "experimental-app-id"
+      installation_id = "experimental-app-installation"
+      webhook_secret  = "experimental-webhook-secret"
     }
   }
 
@@ -392,6 +393,8 @@ run "v2_inputs_resolve_lane_over_global" {
       && keys(module.runner_configs) == ["lane"]
       && length(output.runners_map) == 0
       && keys(output.runners_map_v2) == ["lane"]
+      && keys(aws_sqs_queue.queued_builds) == ["lane"]
+      && keys(aws_sqs_queue_policy.build_queue_policy) == ["lane"]
     )
     error_message = "Experimental v2 configurations must route through module.runner_configs and skip the legacy runners module."
   }
@@ -513,3 +516,327 @@ run "v2_inputs_reject_legacy_runner_config" {
     }
   }
 }
+
+run "scale_set_only_lane_omits_webhook_queues" {
+  command = plan
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_orchestration_provider = {
+      webhook = {
+        eventbridge = {
+          enabled = false
+        }
+        lambda = {
+          artifact = {
+            s3 = {
+              key = "scale-runners.zip"
+            }
+          }
+          webhook = {
+            artifact = {
+              s3 = {
+                key = "scale-webhook.zip"
+              }
+            }
+          }
+        }
+      }
+      scale_set = {
+        network = {
+          vpc_id     = "vpc-scale-set"
+          subnet_ids = ["subnet-scale-set"]
+        }
+      }
+    }
+
+    multi_runner_config = {
+      scale = {
+        runner = {
+          os           = "linux"
+          architecture = "x64"
+        }
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-only"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+              binaries_syncer = {
+                enabled = false
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      local.resolved_config.multi_runner_config["scale"].orchestration_provider.webhook == null
+      && local.resolved_config.multi_runner_config["scale"].orchestration_provider.scale_set.name == "scale-only"
+      && keys(aws_sqs_queue.queued_builds) == []
+      && keys(aws_sqs_queue_policy.build_queue_policy) == []
+      && keys(aws_sqs_queue.queued_builds_dlq) == []
+      && keys(aws_sqs_queue_policy.build_queue_dlq_policy) == []
+      && length(module.orchestration_scale_set) == 1
+    )
+    error_message = "A scale-set-only lane must not create or access webhook SQS resources."
+  }
+}
+
+run "mixed_webhook_and_scale_set_lanes_create_webhook_queues_only_for_webhook" {
+  command = plan
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_orchestration_provider = {
+      webhook = {
+        eventbridge = {
+          enabled = false
+        }
+        lambda = {
+          artifact = {
+            s3 = {
+              key = "mixed-runners.zip"
+            }
+          }
+          webhook = {
+            artifact = {
+              s3 = {
+                key = "mixed-webhook.zip"
+              }
+            }
+          }
+        }
+      }
+      scale_set = {
+        network = {
+          vpc_id     = "vpc-scale-set"
+          subnet_ids = ["subnet-scale-set"]
+        }
+      }
+    }
+
+    multi_runner_config = {
+      webhook = {
+        orchestration_provider = {
+          webhook = {
+            matcherConfig = {
+              labelMatchers = [["self-hosted", "linux", "x64"]]
+            }
+          }
+          scale_set = null
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-webhook"
+              subnet_ids     = ["subnet-webhook"]
+              binaries_syncer = {
+                enabled = false
+              }
+            }
+          }
+        }
+      }
+      scale = {
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-mixed"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+              binaries_syncer = {
+                enabled = false
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      keys(aws_sqs_queue.queued_builds) == ["webhook"]
+      && keys(aws_sqs_queue_policy.build_queue_policy) == ["webhook"]
+      && keys(module.runner_configs) == ["scale", "webhook"]
+    )
+    error_message = "Mixed provider lanes must create webhook queues only for the webhook lane while routing both lanes through v2 runner configs."
+  }
+}
+
+run "scale_set_lane_requires_owner_for_non_enterprise_registration" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_v2]
+  }
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_github = {
+      app = {
+        key_base64     = "experimental-app-key"
+        id             = "experimental-app-id"
+        webhook_secret = "experimental-webhook-secret"
+      }
+      runner_registration_level = "organization"
+    }
+
+    multi_runner_config = {
+      scale = {
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-missing-owner"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_v2]
+}
+
+run "scale_set_queue_for_each_keys_are_plan_known" {
+  command = plan
+
+  plan_options {
+    target = [aws_sqs_queue.queued_builds, aws_sqs_queue.queued_builds_dlq]
+  }
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_orchestration_provider = {
+      scale_set = {
+        network = {
+          vpc_id     = "vpc-scale-set"
+          subnet_ids = ["subnet-scale-set"]
+        }
+      }
+    }
+
+    multi_runner_config = {
+      scale = {
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-plan-known"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+              binaries_syncer = {
+                enabled = false
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  assert {
+    condition = (
+      keys(aws_sqs_queue.queued_builds) == []
+      && keys(aws_sqs_queue.queued_builds_dlq) == []
+    )
+    error_message = "Webhook queue for_each keys must be known and empty for a scale-set-only plan."
+  }
+}
+
+run "v2_lane_requires_exactly_one_orchestration_provider" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_v2]
+  }
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    multi_runner_config = {
+      missing = {
+        orchestration_provider = {}
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-missing-provider"
+              subnet_ids     = ["subnet-missing-provider"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_v2]
+}
+
+run "v2_lane_rejects_multiple_orchestration_providers" {
+  command = plan
+
+  plan_options {
+    target = [terraform_data.validate_v2]
+  }
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    multi_runner_config = {
+      multiple = {
+        orchestration_provider = {
+          webhook = {}
+          scale_set = {
+            name = "multiple-providers"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-multiple-providers"
+              subnet_ids     = ["subnet-multiple-providers"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_v2]
+}
diff --git a/modules/multi-runner/validations.tf b/modules/multi-runner/validations.tf
index 257d479b56..8930bcc00a 100644
--- a/modules/multi-runner/validations.tf
+++ b/modules/multi-runner/validations.tf
@@ -80,14 +80,44 @@ resource "terraform_data" "validate_v2" {
     precondition {
       condition = alltrue([
         for config in local.resolved_config.multi_runner_config : (
-          try(config.orchestration_provider.webhook != null, false) &&
           try(config.compute_provider.aws.ec2 != null, false) &&
           try(length(config.compute_provider.aws.ec2.instance_types) > 0, false) &&
           try(config.compute_provider.aws.ec2.vpc_id != null, false) &&
           try(length(config.compute_provider.aws.ec2.subnet_ids) > 0, false)
         )
       ])
-      error_message = "Each experimental v2 runner lane requires a webhook provider, EC2 instance_types, vpc_id, and at least one subnet."
+      error_message = "Each experimental v2 runner lane requires the supported aws.ec2 compute provider with instance_types, vpc_id, and at least one subnet."
     }
+
+    precondition {
+      condition = alltrue([
+        for config in local.resolved_config.multi_runner_config : (
+          try(config.orchestration_provider.webhook != null, false) !=
+          try(config.orchestration_provider.scale_set != null, false)
+        )
+      ])
+      error_message = "Each experimental v2 runner lane requires exactly one orchestration provider: webhook or scale_set."
+    }
+
+    precondition {
+      condition = alltrue([
+        for config in local.resolved_config.multi_runner_config : (
+          try(config.orchestration_provider.scale_set, null) == null ? true : (
+            contains([
+              "enterprise",
+              "organization",
+              "repository",
+            ], try(var.global_config_github.runner_registration_level, null)) &&
+            (
+              var.global_config_github.runner_registration_level == "enterprise"
+              ? try(var.global_config_github.runner_owner, null) == null
+              : try(var.global_config_github.runner_owner, null) != null
+            )
+          )
+        )
+      ])
+      error_message = "Scale-set lanes require global_config_github.runner_registration_level to be enterprise, organization, or repository; runner_owner must be null for enterprise or set for organization and repository registration."
+    }
+
   }
 }
diff --git a/modules/multi-runner/variables.experimental.github.tf b/modules/multi-runner/variables.experimental.github.tf
index 6a783f7d59..79e993cf18 100644
--- a/modules/multi-runner/variables.experimental.github.tf
+++ b/modules/multi-runner/variables.experimental.github.tf
@@ -13,6 +13,10 @@ variable "global_config_github" {
         id_ssm: "SSM parameter containing the GitHub App ID."
         id_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."
         id_ssm.name: "Name of the SSM parameter containing the GitHub App ID."
+        installation_id: "GitHub App installation ID for the primary scale-set installation."
+        installation_id_ssm: "SSM parameter containing the primary GitHub App installation ID."
+        installation_id_ssm.arn: "ARN of the SSM parameter containing the primary GitHub App installation ID."
+        installation_id_ssm.name: "Name of the SSM parameter containing the primary GitHub App installation ID."
         webhook_secret: "GitHub App webhook secret."
         webhook_secret_ssm: "SSM parameter containing the GitHub App webhook secret."
         webhook_secret_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."
@@ -33,6 +37,8 @@ variable "global_config_github" {
       additional_apps.installation_id_ssm.name: "Name of the SSM parameter containing an additional App installation ID."
       enterprise_server.url: "GitHub Enterprise Server URL."
       enterprise_server.ssl_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."
+      runner_owner: "GitHub organization or owner/repository path for organization- or repository-level scale-set registration."
+      runner_registration_level: "GitHub scale-set registration scope: enterprise, organization, or repository."
       user_agent: "User-Agent value sent with GitHub API requests."
     }
   EOT
@@ -48,6 +54,11 @@ variable "global_config_github" {
         arn  = string
         name = string
       }))
+      installation_id = optional(string)
+      installation_id_ssm = optional(object({
+        arn  = string
+        name = string
+      }))
       webhook_secret = optional(string)
       webhook_secret_ssm = optional(object({
         arn  = string
@@ -66,7 +77,9 @@ variable "global_config_github" {
       url        = optional(string, null)
       ssl_verify = optional(bool, true)
     }), {})
-    user_agent = optional(string, "github-aws-runners")
+    runner_owner              = optional(string, null)
+    runner_registration_level = optional(string, "enterprise")
+    user_agent                = optional(string, "github-aws-runners")
   })
   default = {}
 }
diff --git a/modules/multi-runner/variables.experimental.orchestration-provider.tf b/modules/multi-runner/variables.experimental.orchestration-provider.tf
index 9919d3645e..41a51d6204 100644
--- a/modules/multi-runner/variables.experimental.orchestration-provider.tf
+++ b/modules/multi-runner/variables.experimental.orchestration-provider.tf
@@ -173,6 +173,78 @@ variable "global_config_orchestration_provider" {
           sqs_managed_sse_enabled           = true
         })
       }), {})
+
+    }), {})
+
+    scale_set = optional(object({
+      grouping = optional(object({
+        strategy = optional(string, "compute_provider")
+        custom = optional(object({
+          groups = map(object({
+            runner_configs = set(string)
+          }))
+        }), null)
+      }), {})
+      container = optional(object({
+        image                             = optional(string, null)
+        user                              = optional(string, "10001:10001")
+        health_port                       = optional(number, 8080)
+        health_path                       = optional(string, "/healthz")
+        health_check_command              = optional(list(string), null)
+        health_check_interval             = optional(number, 30)
+        health_check_timeout              = optional(number, 5)
+        health_check_retries              = optional(number, 3)
+        health_check_start_period         = optional(number, 30)
+        health_stale_after_seconds        = optional(number, 180)
+        shutdown_timeout_seconds          = optional(number, 110)
+        session_close_timeout_seconds     = optional(number, 10)
+        reconnect_initial_backoff_seconds = optional(number, 1)
+        reconnect_max_backoff_seconds     = optional(number, 30)
+        stop_timeout_seconds              = optional(number, 120)
+      }), {})
+      config_store = optional(object({
+        path_prefix = optional(string, null)
+        tier        = optional(string, "Standard")
+        tags        = optional(map(string), {})
+      }), {})
+      ecs = optional(object({
+        cluster = optional(object({
+          mode               = optional(string, "managed")
+          arn                = optional(string, null)
+          name               = optional(string, null)
+          container_insights = optional(bool, true)
+        }), {})
+        task = optional(object({
+          cpu              = optional(number, 512)
+          memory           = optional(number, 1024)
+          cpu_architecture = optional(string, "X86_64")
+          ephemeral_storage = optional(object({
+            size_in_gib = number
+          }), null)
+        }), {})
+        service = optional(object({
+          platform_version = optional(string, "LATEST")
+        }), {})
+        iam = optional(object({
+          path                 = optional(string, "/")
+          permissions_boundary = optional(string, null)
+        }), {})
+      }), {})
+      network = optional(object({
+        vpc_id     = optional(string, null)
+        subnet_ids = optional(set(string), null)
+        https_egress = optional(object({
+          ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])
+          ipv6_cidrs = optional(set(string), [])
+        }), {})
+      }), {})
+      logging = optional(object({
+        retention_in_days = optional(number, 30)
+        kms_key_arn       = optional(string, null)
+        log_group_class   = optional(string, "STANDARD")
+        tags              = optional(map(string), {})
+      }), {})
+      tags = optional(map(string), {})
     }), {})
   })
   default = {}
diff --git a/modules/multi-runner/variables.tf b/modules/multi-runner/variables.tf
index 793e126e4e..bf47576d67 100644
--- a/modules/multi-runner/variables.tf
+++ b/modules/multi-runner/variables.tf
@@ -19,6 +19,11 @@ variable "github_app" {
       arn  = string
       name = string
     }))
+    installation_id = optional(string)
+    installation_id_ssm = optional(object({
+      arn  = string
+      name = string
+    }))
     webhook_secret = optional(string)
     webhook_secret_ssm = optional(object({
       arn  = string
@@ -386,6 +391,14 @@ variable "multi_runner_config" {
           }), {})
         }), {})
       }), null)
+      scale_set = optional(object({
+        name = string
+        runner = optional(object({
+          min_runners          = optional(number, 0)
+          max_runners          = optional(number, 10)
+          boot_time_in_minutes = optional(number, 10)
+        }), {})
+      }), null)
     }), {})
 
     ssm = optional(object({
diff --git a/modules/runner-config/orchestration-provider.tf b/modules/runner-config/orchestration-provider.tf
index 16238fa6c6..bd804ad846 100644
--- a/modules/runner-config/orchestration-provider.tf
+++ b/modules/runner-config/orchestration-provider.tf
@@ -7,11 +7,16 @@ locals {
   orchestration_provider_type = one(keys(local.orchestration_providers))
 
   orchestration_provider_enabled = {
-    webhook = local.orchestration_provider_type == "webhook"
+    webhook   = local.orchestration_provider_type == "webhook"
+    scale_set = local.orchestration_provider_type == "scale_set"
   }
 
   orchestration_provider_runner_lifecycle = {
     webhook = one(module.orchestration_webhook[*].runner_lifecycle)
+    scale_set = {
+      ephemeral          = true
+      jit_config_enabled = true
+    }
   }[local.orchestration_provider_type]
 }
 
diff --git a/modules/runner-config/outputs.tf b/modules/runner-config/outputs.tf
index 486e3261eb..d52230ba5f 100644
--- a/modules/runner-config/outputs.tf
+++ b/modules/runner-config/outputs.tf
@@ -22,13 +22,26 @@ output "pool" {
 
 output "orchestration_provider" {
   description = "Resources grouped under the selected runner orchestration provider."
+  value = merge(
+    {
+      webhook = local.orchestration_provider_enabled.webhook ? {
+        scale_up   = one(module.orchestration_webhook[*].scale_up)
+        scale_down = one(module.orchestration_webhook[*].scale_down)
+        pool       = one(module.orchestration_webhook[*].pool)
+        job_retry  = one(module.orchestration_webhook[*].job_retry)
+      } : null
+    },
+    local.orchestration_provider_enabled.scale_set ? {
+      scale_set = {}
+    } : {},
+  )
+}
+
+output "compute_provider_contract" {
+  description = "Provider-neutral compute-provider capabilities consumed by topology-level orchestration."
   value = {
-    webhook = local.orchestration_provider_enabled.webhook ? {
-      scale_up   = one(module.orchestration_webhook[*].scale_up)
-      scale_down = one(module.orchestration_webhook[*].scale_down)
-      pool       = one(module.orchestration_webhook[*].pool)
-      job_retry  = one(module.orchestration_webhook[*].job_retry)
-    } : null
+    type         = local.provider_contract.type
+    capabilities = local.provider_contract.capabilities
   }
 }
 
diff --git a/modules/runner-config/validations.tf b/modules/runner-config/validations.tf
index f510bf0422..0c4ff5bcf0 100644
--- a/modules/runner-config/validations.tf
+++ b/modules/runner-config/validations.tf
@@ -90,7 +90,12 @@ resource "terraform_data" "validate_config" {
         for provider_name, provider_config in var.orchestration_provider : provider_name
         if provider_config != null
       ]) == 1
-      error_message = "Exactly one orchestration provider must be configured. Supported providers: webhook."
+      error_message = "Exactly one orchestration provider must be configured. Supported providers: webhook and scale_set."
+    }
+
+    precondition {
+      condition     = var.orchestration_provider.scale_set == null ? true : local.provider_contract.capabilities.scale_set != null
+      error_message = "The selected compute provider must expose a scale_set capability when scale_set orchestration is selected."
     }
 
     precondition {
diff --git a/modules/runner-config/variables.orchestration-provider.tf b/modules/runner-config/variables.orchestration-provider.tf
index 44fa3525fd..d51136c85f 100644
--- a/modules/runner-config/variables.orchestration-provider.tf
+++ b/modules/runner-config/variables.orchestration-provider.tf
@@ -3,7 +3,8 @@ variable "orchestration_provider" {
   description = <<-EOT
     Runner demand-orchestration provider configuration. Exactly one provider block must be non-null. Wrapper presence selects the provider and must therefore be known during planning; values inside the selected provider may remain unknown until apply.
 
-    - `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls. Future providers can be added as sibling blocks without moving this contract.
+    - `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls.
+    - `scale_set`: Selects scale-set orchestration for this runner config. The multi-runner topology owns the shared controller service and passes this plan-known selection marker to runner-config. Scale-set runners always use ephemeral JIT registration.
     - `webhook.runner`: Runner lifecycle, boot timeout, and capacity settings owned by webhook orchestration.
     - `webhook.runner.boot_time_in_minutes`: Expected runner boot duration used by scale-down and pool controls. The default is `5`.
     - `webhook.runner.ephemeral`: Registers runners in ephemeral mode. The default is `false`.
@@ -137,6 +138,14 @@ variable "orchestration_provider" {
         }), {})
       }), {})
     }), null)
+    scale_set = optional(object({
+      name = string
+      runner = optional(object({
+        min_runners          = optional(number, 0)
+        max_runners          = optional(number, 10)
+        boot_time_in_minutes = optional(number, 10)
+      }), {})
+    }), null)
   })
   nullable = false
 
diff --git a/modules/ssm/outputs.tf b/modules/ssm/outputs.tf
index e1afaf990e..f37b28d939 100644
--- a/modules/ssm/outputs.tf
+++ b/modules/ssm/outputs.tf
@@ -8,6 +8,10 @@ output "parameters" {
       name = var.github_app.key_base64_ssm != null ? var.github_app.key_base64_ssm.name : aws_ssm_parameter.github_app_key_base64[0].name
       arn  = var.github_app.key_base64_ssm != null ? var.github_app.key_base64_ssm.arn : aws_ssm_parameter.github_app_key_base64[0].arn
     }
+    github_app_installation_id = var.github_app.installation_id_ssm != null || var.github_app.installation_id != null ? {
+      name = var.github_app.installation_id_ssm != null ? var.github_app.installation_id_ssm.name : aws_ssm_parameter.github_app_installation_id[0].name
+      arn  = var.github_app.installation_id_ssm != null ? var.github_app.installation_id_ssm.arn : aws_ssm_parameter.github_app_installation_id[0].arn
+    } : null
     github_app_webhook_secret = {
       name = var.github_app.webhook_secret_ssm != null ? var.github_app.webhook_secret_ssm.name : aws_ssm_parameter.github_app_webhook_secret[0].name
       arn  = var.github_app.webhook_secret_ssm != null ? var.github_app.webhook_secret_ssm.arn : aws_ssm_parameter.github_app_webhook_secret[0].arn
diff --git a/modules/ssm/ssm.tf b/modules/ssm/ssm.tf
index 9467a136e5..ab8a406f2d 100644
--- a/modules/ssm/ssm.tf
+++ b/modules/ssm/ssm.tf
@@ -16,6 +16,15 @@ resource "aws_ssm_parameter" "github_app_key_base64" {
   tags   = var.tags
 }
 
+resource "aws_ssm_parameter" "github_app_installation_id" {
+  count  = var.github_app.installation_id_ssm != null || var.github_app.installation_id == null ? 0 : 1
+  name   = "${var.path_prefix}/github_app_installation_id"
+  type   = "SecureString"
+  value  = var.github_app.installation_id
+  key_id = local.kms_key_arn
+  tags   = var.tags
+}
+
 resource "aws_ssm_parameter" "github_app_webhook_secret" {
   count  = var.github_app.webhook_secret_ssm != null ? 0 : 1
   name   = "${var.path_prefix}/github_app_webhook_secret"
diff --git a/modules/ssm/variables.tf b/modules/ssm/variables.tf
index d7387ecc30..d1c0f41f36 100644
--- a/modules/ssm/variables.tf
+++ b/modules/ssm/variables.tf
@@ -17,6 +17,11 @@ variable "github_app" {
       arn  = string
       name = string
     }))
+    installation_id = optional(string)
+    installation_id_ssm = optional(object({
+      arn  = string
+      name = string
+    }))
     webhook_secret = optional(string)
     webhook_secret_ssm = optional(object({
       arn  = string

From 9e307f5dd1f4ccbcf311d3eddddbd85ec9ee3b03 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 20:25:05 +0200
Subject: [PATCH 38/52] fix(ec2): grant scale-set AMI SSM read access

---
 .../compute-providers/aws/ec2/scale-set.tf    | 15 ++++++----
 .../aws/ec2/tests/provider.tftest.hcl         | 29 +++++++++++++++++++
 2 files changed, 38 insertions(+), 6 deletions(-)

diff --git a/modules/compute-providers/aws/ec2/scale-set.tf b/modules/compute-providers/aws/ec2/scale-set.tf
index 439652db58..dcbefd55f4 100644
--- a/modules/compute-providers/aws/ec2/scale-set.tf
+++ b/modules/compute-providers/aws/ec2/scale-set.tf
@@ -198,14 +198,17 @@ locals {
         ])
         conditions = []
       }
-    },
-    local.ami_id_ssm_external ? {
-      read_external_ami_parameter = {
-        actions    = toset(["ssm:GetParameter"])
-        resources  = toset([local.ami_id_ssm_parameter_arn])
+      read_ami_parameter = {
+        actions = toset([
+          "ssm:GetParameter",
+          "ssm:GetParameters",
+        ])
+        resources = toset([
+          local.ami_id_ssm_module_managed ? aws_ssm_parameter.runner_ami_id[0].arn : local.ami_id_ssm_parameter_arn,
+        ])
         conditions = []
       }
-    } : {},
+    },
     local.ami_kms_key_enabled ? {
       use_ami_kms_key = {
         actions = toset([
diff --git a/modules/compute-providers/aws/ec2/tests/provider.tftest.hcl b/modules/compute-providers/aws/ec2/tests/provider.tftest.hcl
index bc92537279..99feb7ef8e 100644
--- a/modules/compute-providers/aws/ec2/tests/provider.tftest.hcl
+++ b/modules/compute-providers/aws/ec2/tests/provider.tftest.hcl
@@ -138,6 +138,15 @@ run "separates_control_plane_contract_from_ec2_resources" {
     error_message = "An external AMI SSM parameter must enable the pool managed policy attachment at plan time."
   }
 
+  assert {
+    condition = (
+      contains(output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.actions, "ssm:GetParameter")
+      && contains(output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.actions, "ssm:GetParameters")
+      && contains(output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.resources, "arn:aws:ssm:eu-west-1:123456789012:parameter/github-runner/ami-id")
+    )
+    error_message = "The scale-set compute role must read an external AMI parameter with both single and batched SSM actions."
+  }
+
   assert {
     condition = (
       contains(flatten([
@@ -199,6 +208,26 @@ run "separates_control_plane_contract_from_ec2_resources" {
 
 }
 
+run "includes_managed_ami_read_in_scale_set_contract" {
+  command = plan
+
+  variables {
+    config = merge(var.config, {
+      ami = merge(var.config.ami, {
+        id_ssm_parameter = null
+      })
+    })
+  }
+
+  assert {
+    condition = (
+      contains(output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.actions, "ssm:GetParameters")
+      && output.provider.capabilities.scale_set.iam_statements.read_ami_parameter.resources != toset([])
+    )
+    error_message = "The scale-set compute role must read the module-managed AMI parameter."
+  }
+}
+
 run "accepts_partial_typed_compute_options" {
   command = plan
 

From b0505758249deb0b0753bfd1d0ae5d8e6befcfc3 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Wed, 16 Sep 2026 16:05:45 +0200
Subject: [PATCH 39/52] fix(multi-runner): validate scale-set installation ID

---
 .../orchestration-provider.scale-set.tf       |  4 +-
 .../tests/config-resolution.tftest.hcl        | 42 +++++++++++++++++++
 modules/multi-runner/validations.tf           | 12 ++++++
 3 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/modules/multi-runner/orchestration-provider.scale-set.tf b/modules/multi-runner/orchestration-provider.scale-set.tf
index 137c7c15b6..f18a7c1230 100644
--- a/modules/multi-runner/orchestration-provider.scale-set.tf
+++ b/modules/multi-runner/orchestration-provider.scale-set.tf
@@ -14,7 +14,7 @@ locals {
             arn         = local.primary_app_key_base64.arn
             kms_key_arn = local.effective_config.ssm.kms_key_id
           }
-          installation_id = {
+          installation_id = local.primary_app_installation_id == null ? null : {
             name        = local.primary_app_installation_id.name
             arn         = local.primary_app_installation_id.arn
             kms_key_arn = local.effective_config.ssm.kms_key_id
@@ -42,7 +42,7 @@ locals {
 
 module "orchestration_scale_set" {
   source = "../orchestration-providers/scale-set"
-  count  = length(local.scale_set_runner_configs) > 0 ? 1 : 0
+  count  = length(local.scale_set_runner_configs) > 0 && local.primary_app_installation_id != null ? 1 : 0
 
   prefix         = var.prefix
   log_level      = var.global_config_observability.logs.level
diff --git a/modules/multi-runner/tests/config-resolution.tftest.hcl b/modules/multi-runner/tests/config-resolution.tftest.hcl
index abc337a0ed..cb9e78917c 100644
--- a/modules/multi-runner/tests/config-resolution.tftest.hcl
+++ b/modules/multi-runner/tests/config-resolution.tftest.hcl
@@ -726,6 +726,48 @@ run "scale_set_lane_requires_owner_for_non_enterprise_registration" {
   expect_failures = [terraform_data.validate_v2]
 }
 
+run "scale_set_lane_requires_installation_id" {
+  command = plan
+
+  variables {
+    experimental_features = ["multi-runner-v2"]
+
+    global_config_github = {
+      app = {
+        key_base64     = "experimental-app-key"
+        id             = "experimental-app-id"
+        webhook_secret = "experimental-webhook-secret"
+      }
+    }
+
+    multi_runner_config = {
+      scale = {
+        runner = {
+          os           = "linux"
+          architecture = "x64"
+        }
+        orchestration_provider = {
+          webhook = null
+          scale_set = {
+            name = "scale-missing-installation"
+          }
+        }
+        compute_provider = {
+          aws = {
+            ec2 = {
+              instance_types = ["m5.large"]
+              vpc_id         = "vpc-scale-set"
+              subnet_ids     = ["subnet-scale-set"]
+            }
+          }
+        }
+      }
+    }
+  }
+
+  expect_failures = [terraform_data.validate_v2]
+}
+
 run "scale_set_queue_for_each_keys_are_plan_known" {
   command = plan
 
diff --git a/modules/multi-runner/validations.tf b/modules/multi-runner/validations.tf
index 8930bcc00a..eb80f03a1c 100644
--- a/modules/multi-runner/validations.tf
+++ b/modules/multi-runner/validations.tf
@@ -119,5 +119,17 @@ resource "terraform_data" "validate_v2" {
       error_message = "Scale-set lanes require global_config_github.runner_registration_level to be enterprise, organization, or repository; runner_owner must be null for enterprise or set for organization and repository registration."
     }
 
+    precondition {
+      condition = alltrue([
+        for config in local.resolved_config.multi_runner_config : (
+          try(config.orchestration_provider.scale_set, null) == null ? true : (
+            try(var.global_config_github.app.installation_id, null) != null ||
+            try(var.global_config_github.app.installation_id_ssm, null) != null
+          )
+        )
+      ])
+      error_message = "Scale-set lanes require global_config_github.app.installation_id or global_config_github.app.installation_id_ssm."
+    }
+
   }
 }

From 7006515ab39468feabe43a29738f38d10b39e994 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Wed, 16 Sep 2026 17:20:30 +0200
Subject: [PATCH 40/52] fix(multi-runner): use supported scale-set registration
 in fixtures

---
 .../tests/config-resolution.tftest.hcl        | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/modules/multi-runner/tests/config-resolution.tftest.hcl b/modules/multi-runner/tests/config-resolution.tftest.hcl
index cb9e78917c..ff61de79f9 100644
--- a/modules/multi-runner/tests/config-resolution.tftest.hcl
+++ b/modules/multi-runner/tests/config-resolution.tftest.hcl
@@ -523,6 +523,17 @@ run "scale_set_only_lane_omits_webhook_queues" {
   variables {
     experimental_features = ["multi-runner-v2"]
 
+    global_config_github = {
+      app = {
+        key_base64      = "experimental-app-key"
+        id              = "experimental-app-id"
+        installation_id = "experimental-app-installation"
+        webhook_secret  = "experimental-webhook-secret"
+      }
+      runner_owner              = "example"
+      runner_registration_level = "organization"
+    }
+
     global_config_orchestration_provider = {
       webhook = {
         eventbridge = {
@@ -599,6 +610,17 @@ run "mixed_webhook_and_scale_set_lanes_create_webhook_queues_only_for_webhook" {
   variables {
     experimental_features = ["multi-runner-v2"]
 
+    global_config_github = {
+      app = {
+        key_base64      = "experimental-app-key"
+        id              = "experimental-app-id"
+        installation_id = "experimental-app-installation"
+        webhook_secret  = "experimental-webhook-secret"
+      }
+      runner_owner              = "example"
+      runner_registration_level = "organization"
+    }
+
     global_config_orchestration_provider = {
       webhook = {
         eventbridge = {
@@ -738,6 +760,8 @@ run "scale_set_lane_requires_installation_id" {
         id             = "experimental-app-id"
         webhook_secret = "experimental-webhook-secret"
       }
+      runner_owner              = "example"
+      runner_registration_level = "organization"
     }
 
     multi_runner_config = {

From ba1ca25dcfc6d3d0eca85668082ad3e3b2520650 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Thu, 17 Sep 2026 00:03:52 +0200
Subject: [PATCH 41/52] fix(multi-runner): remove enterprise scale-set
 registration

---
 modules/multi-runner/validations.tf                   | 9 ++-------
 modules/multi-runner/variables.experimental.github.tf | 4 ++--
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/modules/multi-runner/validations.tf b/modules/multi-runner/validations.tf
index eb80f03a1c..dafb757a9f 100644
--- a/modules/multi-runner/validations.tf
+++ b/modules/multi-runner/validations.tf
@@ -104,19 +104,14 @@ resource "terraform_data" "validate_v2" {
         for config in local.resolved_config.multi_runner_config : (
           try(config.orchestration_provider.scale_set, null) == null ? true : (
             contains([
-              "enterprise",
               "organization",
               "repository",
             ], try(var.global_config_github.runner_registration_level, null)) &&
-            (
-              var.global_config_github.runner_registration_level == "enterprise"
-              ? try(var.global_config_github.runner_owner, null) == null
-              : try(var.global_config_github.runner_owner, null) != null
-            )
+            try(var.global_config_github.runner_owner, null) != null
           )
         )
       ])
-      error_message = "Scale-set lanes require global_config_github.runner_registration_level to be enterprise, organization, or repository; runner_owner must be null for enterprise or set for organization and repository registration."
+      error_message = "Scale-set lanes require global_config_github.runner_registration_level to be organization or repository; runner_owner must be set for organization and repository registration."
     }
 
     precondition {
diff --git a/modules/multi-runner/variables.experimental.github.tf b/modules/multi-runner/variables.experimental.github.tf
index 79e993cf18..79ea3a65cf 100644
--- a/modules/multi-runner/variables.experimental.github.tf
+++ b/modules/multi-runner/variables.experimental.github.tf
@@ -38,7 +38,7 @@ variable "global_config_github" {
       enterprise_server.url: "GitHub Enterprise Server URL."
       enterprise_server.ssl_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."
       runner_owner: "GitHub organization or owner/repository path for organization- or repository-level scale-set registration."
-      runner_registration_level: "GitHub scale-set registration scope: enterprise, organization, or repository."
+      runner_registration_level: "GitHub scale-set registration scope: organization or repository."
       user_agent: "User-Agent value sent with GitHub API requests."
     }
   EOT
@@ -78,7 +78,7 @@ variable "global_config_github" {
       ssl_verify = optional(bool, true)
     }), {})
     runner_owner              = optional(string, null)
-    runner_registration_level = optional(string, "enterprise")
+    runner_registration_level = optional(string, "organization")
     user_agent                = optional(string, "github-aws-runners")
   })
   default = {}

From 8888bbc262e4afa54edd8e7d8850903bbdc05006 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Thu, 17 Sep 2026 00:09:55 +0200
Subject: [PATCH 42/52] fix(multi-runner): align translated registration scope

---
 modules/multi-runner/config.experimental.translation.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/multi-runner/config.experimental.translation.tf b/modules/multi-runner/config.experimental.translation.tf
index 4d7b7d8257..fb8f09b96e 100644
--- a/modules/multi-runner/config.experimental.translation.tf
+++ b/modules/multi-runner/config.experimental.translation.tf
@@ -39,7 +39,7 @@ locals {
       ssl_verify = var.ghes_ssl_verify
     }
     runner_owner              = null
-    runner_registration_level = "enterprise"
+    runner_registration_level = "organization"
     user_agent                = var.user_agent
   }
 

From ca0d9668a843de42f303d85f6a6cefec57c332ab Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 01:32:56 +0200
Subject: [PATCH 43/52] feat(scale-set): update orchestration provider module

---
 .../scale-set/validations.tf                       | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index 9553581597..d956e21f2f 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -423,3 +423,17 @@ resource "terraform_data" "validate_compute_role_policy" {
     }
   }
 }
+
+resource "terraform_data" "validate_group_compute_policy" {
+  for_each = local.controller_groups
+
+  lifecycle {
+    precondition {
+      condition = (
+        floor(length(base64encode(data.aws_iam_policy_document.task_compute[each.key].json)) * 3 / 4) -
+        (endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "=") ? 1 : 0)
+      ) <= 10240
+      error_message = "Controller group ${each.key} produces a compute-provider task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
+    }
+  }
+}

From 273bcae13cf55185b119375ada2bc703f96f7d6c Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 01:54:45 +0200
Subject: [PATCH 44/52] fix(scale-set): isolate compute task policy

---
 .../scale-set/validations.tf                       | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index d956e21f2f..90209e23ce 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -437,3 +437,17 @@ resource "terraform_data" "validate_group_compute_policy" {
     }
   }
 }
+
+resource "terraform_data" "validate_group_compute_policy" {
+  for_each = local.controller_groups
+
+  lifecycle {
+    precondition {
+      condition = (
+        floor(length(base64encode(data.aws_iam_policy_document.task_compute[each.key].json)) * 3 / 4) -
+        (endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "=") ? 1 : 0)
+      ) <= 10240
+      error_message = "Controller group ${each.key} produces a compute-provider task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
+    }
+  }
+}

From 58bde59c98eb791601b19a253c12ffbb37fb5ec5 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Tue, 15 Sep 2026 15:20:14 +0200
Subject: [PATCH 45/52] feat(scale-set): sync orchestration module changes

---
 .../scale-set/validations.tf                       | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/modules/orchestration-providers/scale-set/validations.tf b/modules/orchestration-providers/scale-set/validations.tf
index 90209e23ce..d956e21f2f 100644
--- a/modules/orchestration-providers/scale-set/validations.tf
+++ b/modules/orchestration-providers/scale-set/validations.tf
@@ -437,17 +437,3 @@ resource "terraform_data" "validate_group_compute_policy" {
     }
   }
 }
-
-resource "terraform_data" "validate_group_compute_policy" {
-  for_each = local.controller_groups
-
-  lifecycle {
-    precondition {
-      condition = (
-        floor(length(base64encode(data.aws_iam_policy_document.task_compute[each.key].json)) * 3 / 4) -
-        (endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "==") ? 2 : endswith(base64encode(data.aws_iam_policy_document.task_compute[each.key].json), "=") ? 1 : 0)
-      ) <= 10240
-      error_message = "Controller group ${each.key} produces a compute-provider task-role policy exceeding AWS's 10240-byte inline role-policy quota. Split the group or reduce provider IAM statements."
-    }
-  }
-}

From a0e6803946b5bee1d25bf2618ea0ac687e9ab7f4 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <contato@edersonbrilhante.com.br>
Date: Thu, 17 Sep 2026 17:08:54 +0200
Subject: [PATCH 46/52] fix(terraform): restore minimum version constraints

---
 examples/multi-runner-v2/versions.tf                            | 2 +-
 examples/multi-runner/versions.tf                               | 2 +-
 modules/compute-providers/aws/ec2/versions.tf                   | 2 +-
 modules/orchestration-providers/webhook/job-retry/versions.tf   | 2 +-
 modules/orchestration-providers/webhook/pool/versions.tf        | 2 +-
 .../orchestration-providers/webhook/scale-runners/versions.tf   | 2 +-
 modules/orchestration-providers/webhook/versions.tf             | 2 +-
 modules/runner-config/versions.tf                               | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/examples/multi-runner-v2/versions.tf b/examples/multi-runner-v2/versions.tf
index 1dfb3e5774..6af69ab915 100644
--- a/examples/multi-runner-v2/versions.tf
+++ b/examples/multi-runner-v2/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 }
diff --git a/examples/multi-runner/versions.tf b/examples/multi-runner/versions.tf
index 1dfb3e5774..6af69ab915 100644
--- a/examples/multi-runner/versions.tf
+++ b/examples/multi-runner/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 }
diff --git a/modules/compute-providers/aws/ec2/versions.tf b/modules/compute-providers/aws/ec2/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/compute-providers/aws/ec2/versions.tf
+++ b/modules/compute-providers/aws/ec2/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/job-retry/versions.tf b/modules/orchestration-providers/webhook/job-retry/versions.tf
index fcec7c620d..1238b79cc3 100644
--- a/modules/orchestration-providers/webhook/job-retry/versions.tf
+++ b/modules/orchestration-providers/webhook/job-retry/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/pool/versions.tf b/modules/orchestration-providers/webhook/pool/versions.tf
index fcec7c620d..1238b79cc3 100644
--- a/modules/orchestration-providers/webhook/pool/versions.tf
+++ b/modules/orchestration-providers/webhook/pool/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/scale-runners/versions.tf b/modules/orchestration-providers/webhook/scale-runners/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/orchestration-providers/webhook/scale-runners/versions.tf
+++ b/modules/orchestration-providers/webhook/scale-runners/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/orchestration-providers/webhook/versions.tf b/modules/orchestration-providers/webhook/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/orchestration-providers/webhook/versions.tf
+++ b/modules/orchestration-providers/webhook/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {
diff --git a/modules/runner-config/versions.tf b/modules/runner-config/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/runner-config/versions.tf
+++ b/modules/runner-config/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {

From 481331ca37670ac50a4c4b70fe68169f09bc197d Mon Sep 17 00:00:00 2001
From: Ederson Brilhante <contato@edersonbrilhante.com.br>
Date: Thu, 17 Sep 2026 17:17:38 +0200
Subject: [PATCH 47/52] fix(terraform): restore trust policy minimum version

---
 modules/compute-providers/aws/ec2/trust-policy/versions.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/compute-providers/aws/ec2/trust-policy/versions.tf b/modules/compute-providers/aws/ec2/trust-policy/versions.tf
index 3ef011ea0a..0bedc91fd5 100644
--- a/modules/compute-providers/aws/ec2/trust-policy/versions.tf
+++ b/modules/compute-providers/aws/ec2/trust-policy/versions.tf
@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 
   required_providers {
     aws = {

From b3f3e572a1287b6fb65d769031e21eaddb28b36a Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 15:55:04 +0000
Subject: [PATCH 48/52] docs: auto update terraform docs

---
 modules/multi-runner/README.md  | 10 ++++++----
 modules/runner-config/README.md |  3 ++-
 modules/ssm/README.md           |  3 ++-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/modules/multi-runner/README.md b/modules/multi-runner/README.md
index 2866af815e..404a281580 100644
--- a/modules/multi-runner/README.md
+++ b/modules/multi-runner/README.md
@@ -119,6 +119,7 @@ module "multi-runner" {
 |------|--------|---------|
 | <a name="module_ami_housekeeper"></a> [ami\_housekeeper](#module\_ami\_housekeeper) | ../ami-housekeeper | n/a |
 | <a name="module_instance_termination_watcher"></a> [instance\_termination\_watcher](#module\_instance\_termination\_watcher) | ../termination-watcher | n/a |
+| <a name="module_orchestration_scale_set"></a> [orchestration\_scale\_set](#module\_orchestration\_scale\_set) | ../orchestration-providers/scale-set | n/a |
 | <a name="module_runner_binaries"></a> [runner\_binaries](#module\_runner\_binaries) | ../runner-binaries-syncer | n/a |
 | <a name="module_runner_configs"></a> [runner\_configs](#module\_runner\_configs) | ../runner-config | n/a |
 | <a name="module_runners"></a> [runners](#module\_runners) | ../runners | n/a |
@@ -160,13 +161,13 @@ module "multi-runner" {
 | <a name="input_experimental_features"></a> [experimental\_features](#input\_experimental\_features) | Explicit acknowledgement for opt-in features whose schemas may change<br/>while experimental. Set to ["multi-runner-v2"] when using the v2<br/>provider-boundary configuration. This flag will become a deprecated no-op<br/>for one release when the feature graduates. | `set(string)` | `[]` | no |
 | <a name="input_ghes_ssl_verify"></a> [ghes\_ssl\_verify](#input\_ghes\_ssl\_verify) | GitHub Enterprise SSL verification. Set to 'false' when custom certificate (chains) is used for GitHub Enterprise Server (insecure). | `bool` | `true` | no |
 | <a name="input_ghes_url"></a> [ghes\_url](#input\_ghes\_url) | GitHub Enterprise Server URL. Example: https://github.internal.co - DO NOT SET IF USING PUBLIC GITHUB. .However if you are using GitHub Enterprise Cloud with data-residency (ghe.com), set the endpoint here. Example - https://companyname.ghe.com\| | `string` | `null` | no |
-| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters for the stable v1 interface, see your github app.<br/>  Omit this value when using the experimental v2 interface and provide the<br/>  app through `global_config_github` instead.<br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here,<br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | `{}` | no |
+| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters for the stable v1 interface, see your github app.<br/>  Omit this value when using the experimental v2 interface and provide the<br/>  app through `global_config_github` instead.<br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here,<br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    installation_id = optional(string)<br/>    installation_id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config"></a> [global\_config](#input\_global\_config) | Global defaults shared by all runner lanes.<br/><br/>global\_config = {<br/>  tags: "Tags applied to resources created for all runner lanes."<br/>  roles: {<br/>    path: "IAM path used for roles created for runner resources."<br/>    permissions\_boundary: "Optional IAM permissions boundary ARN applied to created roles."<br/>  }<br/>  runner: {<br/>    os: "Default operating system for runners."<br/>    architecture: "Default runner architecture."<br/>    disable\_default\_labels: "Whether to omit the default operating-system, architecture, and self-hosted labels."<br/>    extra\_labels: "Additional labels applied to all runners."<br/>    group\_name: "Default GitHub runner group."<br/>    name\_prefix: "Prefix for runner names."<br/>    run\_as\_root: "Whether the GitHub Actions runner executes as root."<br/>    run\_as: "User that runs the GitHub Actions agent when it is not running as root."<br/>    auto\_update\_disabled: "Whether automatic GitHub Actions runner updates are disabled."<br/>    tags: "Tags applied to runner resources."<br/>    hooks: {<br/>      job\_started: "Script executed when a job starts on a runner."<br/>      job\_completed: "Script executed when a job completes on a runner."<br/>    }<br/>    iam: {<br/>      role.arn: "Existing IAM role ARN to use for runners."<br/>      managed\_policy\_arns: "Managed policy ARNs attached to the runner IAM role."<br/>      additional\_trust\_policy\_json: "Additional trust policy JSON merged into the runner role trust policy."<br/>      path: "IAM path used for the runner role."<br/>      permissions\_boundary: "Optional IAM permissions boundary ARN for the runner role."<br/>    }<br/>  }<br/>} | <pre>object({<br/>    tags = optional(map(string), {})<br/><br/>    roles = optional(object({<br/>      path                 = optional(string, null)<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/><br/>    runner = optional(object({<br/>      os                     = optional(string, null)<br/>      architecture           = optional(string, null)<br/>      disable_default_labels = optional(bool, false)<br/>      extra_labels           = optional(list(string), [])<br/>      group_name             = optional(string, "Default")<br/>      name_prefix            = optional(string, "")<br/>      run_as_root            = optional(bool, false)<br/>      run_as                 = optional(string, "ec2-user")<br/>      auto_update_disabled   = optional(bool, false)<br/>      tags                   = optional(map(string), {})<br/>      hooks = optional(object({<br/>        job_started   = optional(string, "")<br/>        job_completed = optional(string, "")<br/>      }), {})<br/>      iam = optional(object({<br/>        role = optional(object({<br/>          arn = string<br/>        }), null)<br/>        managed_policy_arns          = optional(map(string), {})<br/>        additional_trust_policy_json = optional(string, null)<br/>        path                         = optional(string, null)<br/>        permissions_boundary         = optional(string, null)<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_compute_provider"></a> [global\_config\_compute\_provider](#input\_global\_config\_compute\_provider) | Global compute-provider configuration shared by all runner lanes.<br/><br/>global\_config\_compute\_provider = {<br/>  selections: "Compute-provider selections keyed by namespace."<br/>  selections.namespace: "Provider namespace used to resolve a compute implementation."<br/>  selections.type: "Compute-provider type selected for the namespace."<br/>  aws.ec2.vpc\_id: "Default VPC for EC2 runners."<br/>  aws.ec2.subnet\_ids: "Default subnets for EC2 runners."<br/>  aws.ec2.managed\_security\_group\_enabled: "Whether the module manages the default runner security group."<br/>  aws.ec2.egress\_rules: "Egress rules for the managed runner security group."<br/>  aws.ec2.egress\_rules.cidr\_blocks: "IPv4 CIDR blocks allowed by an egress rule."<br/>  aws.ec2.egress\_rules.ipv6\_cidr\_blocks: "IPv6 CIDR blocks allowed by an egress rule."<br/>  aws.ec2.egress\_rules.prefix\_list\_ids: "AWS prefix lists allowed by an egress rule."<br/>  aws.ec2.egress\_rules.from\_port: "Start of the egress port range."<br/>  aws.ec2.egress\_rules.protocol: "Protocol for the egress rule."<br/>  aws.ec2.egress\_rules.security\_groups: "Referenced security groups allowed by an egress rule."<br/>  aws.ec2.egress\_rules.self: "Whether the security group itself is allowed by an egress rule."<br/>  aws.ec2.egress\_rules.to\_port: "End of the egress port range."<br/>  aws.ec2.egress\_rules.description: "Description of the egress rule."<br/>  aws.ec2.additional\_security\_group\_ids: "Additional security groups attached to EC2 runners."<br/>  aws.ec2.cloudwatch\_agent.config: "CloudWatch Agent configuration for EC2 runners."<br/>  aws.ec2.instance\_profile\_path: "IAM path used for the EC2 instance profile."<br/>  aws.ec2.key\_name: "EC2 key pair name assigned to runner instances."<br/>  aws.ec2.associate\_public\_ipv4\_address: "Whether runner instances receive a public IPv4 address."<br/>  aws.ec2.tags: "Tags applied to EC2 runner resources."<br/>  aws.ec2.ami.housekeeper.enabled: "Whether AMI cleanup is enabled."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.maxItems: "Maximum number of AMIs retained by cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.minimumDaysOld: "Minimum AMI age in days before cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters: "AMI filters used to select AMIs for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters.Name: "AMI filter name."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.amiFilters.Values: "Values matched by the AMI filter."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.launchTemplateNames: "Launch template names associated with AMIs eligible for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.ssmParameterNames: "SSM parameter names associated with AMIs eligible for cleanup."<br/>  aws.ec2.ami.housekeeper.cleanup\_config.dryRun: "Whether AMI cleanup reports changes without deleting AMIs."<br/>  aws.ec2.ami.housekeeper.artifact.zip: "Local ZIP artifact used for the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.artifact.s3.key: "S3 object key for the AMI housekeeper Lambda artifact."<br/>  aws.ec2.ami.housekeeper.artifact.s3.object\_version: "Optional S3 object version for the AMI housekeeper artifact."<br/>  aws.ec2.ami.housekeeper.lambda.memory\_size: "Memory allocated to the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.lambda.timeout: "Timeout in seconds for the AMI housekeeper Lambda."<br/>  aws.ec2.ami.housekeeper.schedule.expression: "Schedule expression for AMI cleanup."<br/>  aws.ec2.instance\_termination\_watcher.enabled: "Whether the instance termination watcher is enabled."<br/>  aws.ec2.instance\_termination\_watcher.features.runner\_deregistration.enabled: "Whether terminated runners are deregistered."<br/>  aws.ec2.instance\_termination\_watcher.features.spot\_termination\_handler.enabled: "Whether spot termination events trigger runner handling."<br/>  aws.ec2.instance\_termination\_watcher.features.spot\_termination\_notification\_watcher.enabled: "Whether spot termination notification monitoring is enabled."<br/>  aws.ec2.instance\_termination\_watcher.environment\_variables: "Environment variables passed to the termination watcher."<br/>  aws.ec2.instance\_termination\_watcher.artifact.zip: "Local ZIP artifact used for the termination watcher Lambda."<br/>  aws.ec2.instance\_termination\_watcher.artifact.s3.key: "S3 object key for the termination watcher Lambda artifact."<br/>  aws.ec2.instance\_termination\_watcher.artifact.s3.object\_version: "Optional S3 object version for the termination watcher artifact."<br/>  aws.ec2.instance\_termination\_watcher.lambda.memory\_size: "Memory allocated to the termination watcher Lambda."<br/>  aws.ec2.instance\_termination\_watcher.lambda.timeout: "Timeout in seconds for the termination watcher Lambda."<br/>  aws.ec2.runner\_binaries.enabled: "Whether runner binary synchronization is enabled."<br/>  aws.ec2.runner\_binaries.s3.encryption.enabled: "Whether runner-binary S3 encryption is enabled."<br/>  aws.ec2.runner\_binaries.s3.encryption.bucket\_key\_enabled: "Whether an S3 bucket key is used for KMS encryption."<br/>  aws.ec2.runner\_binaries.s3.encryption.sse\_algorithm: "S3 server-side encryption algorithm."<br/>  aws.ec2.runner\_binaries.s3.encryption.kms\_master\_key\_id: "KMS key ID used for runner-binary S3 encryption."<br/>  aws.ec2.runner\_binaries.s3.tags: "Tags applied to the runner-binary S3 bucket."<br/>  aws.ec2.runner\_binaries.s3.versioning: "S3 versioning state for the runner-binary bucket."<br/>  aws.ec2.runner\_binaries.s3.logging.bucket: "S3 bucket receiving runner-binary access logs."<br/>  aws.ec2.runner\_binaries.s3.logging.prefix: "Prefix for runner-binary S3 access logs."<br/>  aws.ec2.runner\_binaries.syncer.artifact.zip: "Local ZIP artifact used for the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.artifact.s3.key: "S3 object key for the runner-binary syncer artifact."<br/>  aws.ec2.runner\_binaries.syncer.artifact.s3.object\_version: "Optional S3 object version for the runner-binary syncer artifact."<br/>  aws.ec2.runner\_binaries.syncer.lambda.memory\_size: "Memory allocated to the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.lambda.timeout: "Timeout in seconds for the runner-binary syncer Lambda."<br/>  aws.ec2.runner\_binaries.syncer.schedule.expression: "Schedule expression for runner-binary synchronization."<br/>  aws.ec2.runner\_binaries.syncer.schedule.state: "EventBridge rule state for runner-binary synchronization."<br/>} | <pre>object({<br/>    selections = optional(map(object({<br/>      namespace = string<br/>      type      = string<br/>    })), null)<br/>    aws = optional(object({<br/>      ec2 = optional(object({<br/>        vpc_id                         = optional(string, null)<br/>        subnet_ids                     = optional(list(string), null)<br/>        managed_security_group_enabled = optional(bool, true)<br/>        egress_rules = optional(list(object({<br/>          cidr_blocks      = list(string)<br/>          ipv6_cidr_blocks = list(string)<br/>          prefix_list_ids  = list(string)<br/>          from_port        = number<br/>          protocol         = string<br/>          security_groups  = list(string)<br/>          self             = bool<br/>          to_port          = number<br/>          description      = string<br/>          })), [{<br/>          cidr_blocks      = ["0.0.0.0/0"]<br/>          ipv6_cidr_blocks = ["::/0"]<br/>          prefix_list_ids  = null<br/>          from_port        = 0<br/>          protocol         = "-1"<br/>          security_groups  = null<br/>          self             = null<br/>          to_port          = 0<br/>          description      = null<br/>        }])<br/>        additional_security_group_ids = optional(list(string), [])<br/>        cloudwatch_agent = optional(object({<br/>          config = optional(string, null)<br/>        }), {})<br/>        instance_profile_path         = optional(string, null)<br/>        key_name                      = optional(string, null)<br/>        associate_public_ipv4_address = optional(bool, false)<br/>        tags                          = optional(map(string), {})<br/>        ami = optional(object({<br/>          housekeeper = optional(object({<br/>            enabled = optional(bool, false)<br/>            cleanup_config = optional(object({<br/>              maxItems       = optional(number)<br/>              minimumDaysOld = optional(number)<br/>              amiFilters = optional(list(object({<br/>                Name   = string<br/>                Values = list(string)<br/>              })))<br/>              launchTemplateNames = optional(list(string))<br/>              ssmParameterNames   = optional(list(string))<br/>              dryRun              = optional(bool)<br/>            }), {})<br/>            artifact = optional(object({<br/>              zip = optional(string, null)<br/>              s3 = optional(object({<br/>                key            = string<br/>                object_version = optional(string, null)<br/>              }), null)<br/>            }), {})<br/>            lambda = optional(object({<br/>              memory_size = optional(number, 256)<br/>              timeout     = optional(number, 300)<br/>            }), {})<br/>            schedule = optional(object({<br/>              expression = optional(string, "cron(11 7 * * ? *)")<br/>            }), {})<br/>          }), {})<br/>        }), {})<br/>        instance_termination_watcher = optional(object({<br/>          enabled = optional(bool, false)<br/>          features = optional(object({<br/>            runner_deregistration = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>            spot_termination_handler = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>            spot_termination_notification_watcher = optional(object({<br/>              enabled = optional(bool, true)<br/>            }), {})<br/>          }), {})<br/>          environment_variables = optional(map(string), {})<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          lambda = optional(object({<br/>            memory_size = optional(number, null)<br/>            timeout     = optional(number, null)<br/>          }), {})<br/>        }), {})<br/>        runner_binaries = optional(object({<br/>          enabled = optional(bool, true)<br/>          s3 = optional(object({<br/>            encryption = optional(object({<br/>              enabled            = optional(bool, true)<br/>              bucket_key_enabled = optional(bool, null)<br/>              sse_algorithm      = optional(string, "AES256")<br/>              kms_master_key_id  = optional(string, null)<br/>            }), {})<br/>            tags       = optional(map(string), {})<br/>            versioning = optional(string, "Disabled")<br/>            logging = optional(object({<br/>              bucket = optional(string, null)<br/>              prefix = optional(string, null)<br/>            }), {})<br/>          }), {})<br/>          syncer = optional(object({<br/>            artifact = optional(object({<br/>              zip = optional(string, null)<br/>              s3 = optional(object({<br/>                key            = string<br/>                object_version = optional(string, null)<br/>              }), null)<br/>            }), {})<br/>            lambda = optional(object({<br/>              memory_size = optional(number, 256)<br/>              timeout     = optional(number, 300)<br/>            }), {})<br/>            schedule = optional(object({<br/>              expression = optional(string, "cron(27 * * * ? *)")<br/>              state      = optional(string, "ENABLED")<br/>            }), {})<br/>          }), {})<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_global_config_github"></a> [global\_config\_github](#input\_global\_config\_github) | Global GitHub configuration shared by all runner lanes.<br/><br/>global\_config\_github = {<br/>  app: {<br/>    key\_base64: "Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm: "SSM parameter containing the Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm.arn: "ARN of the SSM parameter containing the GitHub App private key."<br/>    key\_base64\_ssm.name: "Name of the SSM parameter containing the GitHub App private key."<br/>    id: "GitHub App ID."<br/>    id\_ssm: "SSM parameter containing the GitHub App ID."<br/>    id\_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."<br/>    id\_ssm.name: "Name of the SSM parameter containing the GitHub App ID."<br/>    webhook\_secret: "GitHub App webhook secret."<br/>    webhook\_secret\_ssm: "SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.name: "Name of the SSM parameter containing the GitHub App webhook secret."<br/>  }<br/>  additional\_apps: "Additional GitHub Apps used to distribute GitHub API requests."<br/>  additional\_apps.key\_base64: "Base64-encoded private key for an additional GitHub App."<br/>  additional\_apps.key\_base64\_ssm: "SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.arn: "ARN of the SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.name: "Name of the SSM parameter containing an additional App private key."<br/>  additional\_apps.id: "ID of an additional GitHub App."<br/>  additional\_apps.id\_ssm: "SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.arn: "ARN of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.name: "Name of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.installation\_id: "Optional installation ID for an additional GitHub App."<br/>  additional\_apps.installation\_id\_ssm: "SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.arn: "ARN of the SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.name: "Name of the SSM parameter containing an additional App installation ID."<br/>  enterprise\_server.url: "GitHub Enterprise Server URL."<br/>  enterprise\_server.ssl\_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."<br/>  user\_agent: "User-Agent value sent with GitHub API requests."<br/>} | <pre>object({<br/>    app = optional(object({<br/>      key_base64 = optional(string)<br/>      key_base64_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      id = optional(string)<br/>      id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      webhook_secret = optional(string)<br/>      webhook_secret_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>    }), null)<br/>    additional_apps = optional(list(object({<br/>      key_base64          = optional(string)<br/>      key_base64_ssm      = optional(object({ arn = string, name = string }))<br/>      id                  = optional(string)<br/>      id_ssm              = optional(object({ arn = string, name = string }))<br/>      installation_id     = optional(string)<br/>      installation_id_ssm = optional(object({ arn = string, name = string }))<br/>    })), [])<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>    user_agent = optional(string, "github-aws-runners")<br/>  })</pre> | `{}` | no |
+| <a name="input_global_config_github"></a> [global\_config\_github](#input\_global\_config\_github) | Global GitHub configuration shared by all runner lanes.<br/><br/>global\_config\_github = {<br/>  app: {<br/>    key\_base64: "Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm: "SSM parameter containing the Base64-encoded GitHub App private key."<br/>    key\_base64\_ssm.arn: "ARN of the SSM parameter containing the GitHub App private key."<br/>    key\_base64\_ssm.name: "Name of the SSM parameter containing the GitHub App private key."<br/>    id: "GitHub App ID."<br/>    id\_ssm: "SSM parameter containing the GitHub App ID."<br/>    id\_ssm.arn: "ARN of the SSM parameter containing the GitHub App ID."<br/>    id\_ssm.name: "Name of the SSM parameter containing the GitHub App ID."<br/>    installation\_id: "GitHub App installation ID for the primary scale-set installation."<br/>    installation\_id\_ssm: "SSM parameter containing the primary GitHub App installation ID."<br/>    installation\_id\_ssm.arn: "ARN of the SSM parameter containing the primary GitHub App installation ID."<br/>    installation\_id\_ssm.name: "Name of the SSM parameter containing the primary GitHub App installation ID."<br/>    webhook\_secret: "GitHub App webhook secret."<br/>    webhook\_secret\_ssm: "SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.arn: "ARN of the SSM parameter containing the GitHub App webhook secret."<br/>    webhook\_secret\_ssm.name: "Name of the SSM parameter containing the GitHub App webhook secret."<br/>  }<br/>  additional\_apps: "Additional GitHub Apps used to distribute GitHub API requests."<br/>  additional\_apps.key\_base64: "Base64-encoded private key for an additional GitHub App."<br/>  additional\_apps.key\_base64\_ssm: "SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.arn: "ARN of the SSM parameter containing an additional App private key."<br/>  additional\_apps.key\_base64\_ssm.name: "Name of the SSM parameter containing an additional App private key."<br/>  additional\_apps.id: "ID of an additional GitHub App."<br/>  additional\_apps.id\_ssm: "SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.arn: "ARN of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.id\_ssm.name: "Name of the SSM parameter containing an additional GitHub App ID."<br/>  additional\_apps.installation\_id: "Optional installation ID for an additional GitHub App."<br/>  additional\_apps.installation\_id\_ssm: "SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.arn: "ARN of the SSM parameter containing an additional App installation ID."<br/>  additional\_apps.installation\_id\_ssm.name: "Name of the SSM parameter containing an additional App installation ID."<br/>  enterprise\_server.url: "GitHub Enterprise Server URL."<br/>  enterprise\_server.ssl\_verify: "Whether to verify the GitHub Enterprise Server TLS certificate."<br/>  runner\_owner: "GitHub organization or owner/repository path for organization- or repository-level scale-set registration."<br/>  runner\_registration\_level: "GitHub scale-set registration scope: organization or repository."<br/>  user\_agent: "User-Agent value sent with GitHub API requests."<br/>} | <pre>object({<br/>    app = optional(object({<br/>      key_base64 = optional(string)<br/>      key_base64_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      id = optional(string)<br/>      id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      installation_id = optional(string)<br/>      installation_id_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>      webhook_secret = optional(string)<br/>      webhook_secret_ssm = optional(object({<br/>        arn  = string<br/>        name = string<br/>      }))<br/>    }), null)<br/>    additional_apps = optional(list(object({<br/>      key_base64          = optional(string)<br/>      key_base64_ssm      = optional(object({ arn = string, name = string }))<br/>      id                  = optional(string)<br/>      id_ssm              = optional(object({ arn = string, name = string }))<br/>      installation_id     = optional(string)<br/>      installation_id_ssm = optional(object({ arn = string, name = string }))<br/>    })), [])<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>    runner_owner              = optional(string, null)<br/>    runner_registration_level = optional(string, "organization")<br/>    user_agent                = optional(string, "github-aws-runners")<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_lambda"></a> [global\_config\_lambda](#input\_global\_config\_lambda) | Global Lambda configuration shared by all runner lanes.<br/><br/>global\_config\_lambda = {<br/>  artifact.s3.bucket: "S3 bucket containing Lambda deployment artifacts."<br/>  runtime: "Default Lambda runtime."<br/>  architecture: "Default Lambda instruction-set architecture."<br/>  principals: "Additional AWS principals allowed to invoke the Lambda functions."<br/>  principals.type: "Principal type, such as AWS account, service, or organization."<br/>  principals.identifiers: "Identifiers allowed for the principal type."<br/>  subnet\_ids: "Subnets used by Lambda functions."<br/>  security\_group\_ids: "Security groups attached to Lambda functions."<br/>  tags: "Tags applied to Lambda functions and related resources."<br/>  role.path: "IAM path used for Lambda execution roles."<br/>  role.permissions\_boundary: "Optional IAM permissions boundary ARN for Lambda execution roles."<br/>} | <pre>object({<br/>    artifact = optional(object({<br/>      s3 = optional(object({<br/>        bucket = optional(string, null)<br/>      }), {})<br/>    }), {})<br/>    runtime      = optional(string, "nodejs24.x")<br/>    architecture = optional(string, "arm64")<br/>    principals = optional(list(object({<br/>      type        = string<br/>      identifiers = list(string)<br/>    })), [])<br/>    subnet_ids         = optional(list(string), [])<br/>    security_group_ids = optional(list(string), [])<br/>    tags               = optional(map(string), {})<br/>    role = optional(object({<br/>      path                 = optional(string, null)<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_observability"></a> [global\_config\_observability](#input\_global\_config\_observability) | Global observability configuration shared by all runner lanes.<br/><br/>global\_config\_observability = {<br/>  logs.level: "Log level for module resources."<br/>  logs.retention\_in\_days: "CloudWatch log retention period in days."<br/>  logs.kms\_key\_id: "KMS key ID used to encrypt CloudWatch log groups."<br/>  logs.class: "CloudWatch log group class."<br/>  logs.tags: "Tags applied to CloudWatch log groups."<br/>  tracing.mode: "Tracing mode used by instrumented resources."<br/>  tracing.capture\_http\_requests: "Whether HTTP requests are captured by tracing."<br/>  tracing.capture\_error: "Whether errors are captured by tracing."<br/>  metrics.enabled: "Whether module metrics are enabled."<br/>  metrics.namespace: "CloudWatch namespace used for module metrics."<br/>  metrics.metric.github\_app\_rate\_limit.enabled: "Whether GitHub App rate-limit metrics are emitted."<br/>  metrics.metric.job\_retry.enabled: "Whether job-retry metrics are emitted."<br/>  metrics.metric.spot\_termination\_warning.enabled: "Whether spot-termination warning metrics are emitted."<br/>} | <pre>object({<br/>    logs = optional(object({<br/>      level             = optional(string, "info")<br/>      retention_in_days = optional(number, 180)<br/>      kms_key_id        = optional(string, null)<br/>      class             = optional(string, "STANDARD")<br/>      tags              = optional(map(string), {})<br/>    }), {})<br/>    tracing = optional(object({<br/>      mode                  = optional(string, null)<br/>      capture_http_requests = optional(bool, false)<br/>      capture_error         = optional(bool, false)<br/>    }), {})<br/>    metrics = optional(object({<br/>      enabled   = optional(bool, false)<br/>      namespace = optional(string, "GitHub Runners")<br/>      metric = optional(object({<br/>        github_app_rate_limit = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        spot_termination_warning = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_global_config_orchestration_provider"></a> [global\_config\_orchestration\_provider](#input\_global\_config\_orchestration\_provider) | Global orchestration-provider configuration shared by all runner lanes.<br/><br/>global\_config\_orchestration\_provider = {<br/>  webhook: {<br/>    queue\_selection\_strategy: "Strategy used to select the build queue for a webhook event."<br/>    eventbridge.enabled: "Whether EventBridge integration is enabled for webhook events."<br/>    eventbridge.accept\_events: "Event types accepted by the EventBridge integration."<br/>    matcher\_config\_parameter\_store\_tier: "SSM Parameter Store tier used for matcher configuration."<br/>    runner.boot\_time\_in\_minutes: "Expected runner boot time used by orchestration."<br/>    runner.ephemeral: "Whether runners created by the orchestration provider are ephemeral."<br/>    runner.jit\_config\_enabled: "Whether JIT runner configuration is enabled."<br/>    runner.maximum\_count: "Maximum number of runners that orchestration may create."<br/>    github.repository\_white\_list: "Repositories allowed to use the webhook configuration."<br/>    lambda.artifact.zip: "Local ZIP artifact used for orchestration Lambda functions."<br/>    lambda.artifact.s3.key: "S3 object key for the orchestration Lambda artifact."<br/>    lambda.artifact.s3.object\_version: "Optional S3 object version for the orchestration Lambda artifact."<br/>    lambda.scale.up.memory\_size: "Memory allocated to the scale-up Lambda."<br/>    lambda.scale.up.timeout: "Timeout in seconds for the scale-up Lambda."<br/>    lambda.scale.up.reserved\_concurrent\_executions: "Reserved concurrent executions for the scale-up Lambda."<br/>    lambda.scale.up.job\_queued\_check\_enabled: "Whether the scale-up Lambda checks queued jobs."<br/>    lambda.scale.up.event\_source\_mapping.batch\_size: "Maximum records passed to one scale-up Lambda invocation."<br/>    lambda.scale.up.event\_source\_mapping.maximum\_batching\_window\_in\_seconds: "Maximum time to batch records before invoking the scale-up Lambda."<br/>    lambda.scale.up.tags: "Tags applied to the scale-up Lambda."<br/>    lambda.scale.down.memory\_size: "Memory allocated to the scale-down Lambda."<br/>    lambda.scale.down.timeout: "Timeout in seconds for the scale-down Lambda."<br/>    lambda.scale.down.schedule\_expression: "Schedule expression for scale-down processing."<br/>    lambda.scale.down.minimum\_running\_time\_in\_minutes: "Minimum runner lifetime before scale-down."<br/>    lambda.scale.down.idle\_confirmation\_seconds: "Seconds a runner must consistently report not-busy before scale-down terminates it; 0 disables the confirmation window."<br/>    lambda.scale.down.idle\_config: "Scheduled minimum idle-runner pool settings."<br/>    lambda.scale.down.idle\_config.cron: "Cron expression defining when the idle-runner count applies."<br/>    lambda.scale.down.idle\_config.timeZone: "Time zone used to evaluate the idle-runner schedule."<br/>    lambda.scale.down.idle\_config.idleCount: "Minimum number of idle runners maintained during the schedule."<br/>    lambda.scale.down.idle\_config.evictionStrategy: "Strategy used when evicting idle runners."<br/>    lambda.scale.down.tags: "Tags applied to the scale-down Lambda."<br/>    lambda.webhook.artifact.zip: "Local ZIP artifact used for the webhook Lambda."<br/>    lambda.webhook.artifact.s3.key: "S3 object key for the webhook Lambda artifact."<br/>    lambda.webhook.artifact.s3.object\_version: "Optional S3 object version for the webhook Lambda artifact."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings: "API Gateway access-log destination and format."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.destination\_arn: "ARN of the API Gateway access-log destination."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.format: "API Gateway access-log format."<br/>    lambda.webhook.memory\_size: "Memory allocated to the webhook Lambda."<br/>    lambda.webhook.timeout: "Timeout in seconds for the webhook Lambda."<br/>    lambda.webhook.tags: "Tags applied to the webhook Lambda."<br/>    lambda.pool.memory\_size: "Memory allocated to the pool Lambda."<br/>    lambda.pool.timeout: "Timeout in seconds for the pool Lambda."<br/>    lambda.pool.reserved\_concurrent\_executions: "Reserved concurrent executions for the pool Lambda."<br/>    lambda.pool.config: "Scheduled runner-pool size configuration."<br/>    lambda.pool.config.schedule\_expression: "Schedule expression for the pool size."<br/>    lambda.pool.config.schedule\_expression\_timezone: "Time zone used to evaluate the pool schedule."<br/>    lambda.pool.config.size: "Runner pool size applied by the schedule."<br/>    lambda.pool.include\_busy\_runners: "Whether busy runners are included in pool sizing."<br/>    lambda.pool.runner\_owner: "GitHub organization that owns the runner pool."<br/>    lambda.pool.tags: "Tags applied to the pool Lambda."<br/>    queue.delay\_webhook\_event: "Seconds a webhook event remains invisible in the build queue before processing."<br/>    queue.job\_queue\_retention\_in\_seconds: "Seconds a queued job is retained before it is purged."<br/>    queue.visibility\_timeout\_seconds: "Build queue visibility timeout in seconds."<br/>    queue.redrive\_build\_queue.enabled: "Whether the build queue dead-letter queue is enabled."<br/>    queue.redrive\_build\_queue.maxReceiveCount: "Maximum receives before a message is moved to the dead-letter queue."<br/>    queue.tags: "Tags applied to build queues."<br/>    queue.encryption.kms\_data\_key\_reuse\_period\_seconds: "KMS data-key reuse period for queue encryption."<br/>    queue.encryption.kms\_master\_key\_id: "KMS key ID used for queue encryption."<br/>    queue.encryption.sqs\_managed\_sse\_enabled: "Whether SQS-managed server-side encryption is enabled."<br/>  }<br/>} | <pre>object({<br/>    webhook = optional(object({<br/>      queue_selection_strategy = optional(string, "first")<br/>      eventbridge = optional(object({<br/>        enabled       = optional(bool, true)<br/>        accept_events = optional(list(string), [])<br/>      }), {})<br/>      matcher_config_parameter_store_tier = optional(string, "Standard")<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, null)<br/>      }), {})<br/><br/>      github = optional(object({<br/>        repository_white_list = optional(list(string), [])<br/>      }), {})<br/><br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 30)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_confirmation_seconds       = optional(number, 0)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        webhook = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          api_gateway_access_log_settings = optional(object({<br/>            destination_arn = string<br/>            format          = string<br/>          }), null)<br/>          memory_size = optional(number, 256)<br/>          timeout     = optional(number, 10)<br/>          tags        = optional(map(string), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/><br/>      queue = optional(object({<br/>        delay_webhook_event            = optional(number, 30)<br/>        job_queue_retention_in_seconds = optional(number, 86400)<br/>        visibility_timeout_seconds     = optional(number, 180)<br/>        redrive_build_queue = optional(object({<br/>          enabled         = optional(bool, false)<br/>          maxReceiveCount = optional(number, null)<br/>          }), {<br/>          enabled         = false<br/>          maxReceiveCount = null<br/>        })<br/>        tags = optional(map(string), {})<br/>        encryption = optional(object({<br/>          kms_data_key_reuse_period_seconds = number<br/>          kms_master_key_id                 = string<br/>          sqs_managed_sse_enabled           = bool<br/>          }), {<br/>          kms_data_key_reuse_period_seconds = null<br/>          kms_master_key_id                 = null<br/>          sqs_managed_sse_enabled           = true<br/>        })<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
+| <a name="input_global_config_orchestration_provider"></a> [global\_config\_orchestration\_provider](#input\_global\_config\_orchestration\_provider) | Global orchestration-provider configuration shared by all runner lanes.<br/><br/>global\_config\_orchestration\_provider = {<br/>  webhook: {<br/>    queue\_selection\_strategy: "Strategy used to select the build queue for a webhook event."<br/>    eventbridge.enabled: "Whether EventBridge integration is enabled for webhook events."<br/>    eventbridge.accept\_events: "Event types accepted by the EventBridge integration."<br/>    matcher\_config\_parameter\_store\_tier: "SSM Parameter Store tier used for matcher configuration."<br/>    runner.boot\_time\_in\_minutes: "Expected runner boot time used by orchestration."<br/>    runner.ephemeral: "Whether runners created by the orchestration provider are ephemeral."<br/>    runner.jit\_config\_enabled: "Whether JIT runner configuration is enabled."<br/>    runner.maximum\_count: "Maximum number of runners that orchestration may create."<br/>    github.repository\_white\_list: "Repositories allowed to use the webhook configuration."<br/>    lambda.artifact.zip: "Local ZIP artifact used for orchestration Lambda functions."<br/>    lambda.artifact.s3.key: "S3 object key for the orchestration Lambda artifact."<br/>    lambda.artifact.s3.object\_version: "Optional S3 object version for the orchestration Lambda artifact."<br/>    lambda.scale.up.memory\_size: "Memory allocated to the scale-up Lambda."<br/>    lambda.scale.up.timeout: "Timeout in seconds for the scale-up Lambda."<br/>    lambda.scale.up.reserved\_concurrent\_executions: "Reserved concurrent executions for the scale-up Lambda."<br/>    lambda.scale.up.job\_queued\_check\_enabled: "Whether the scale-up Lambda checks queued jobs."<br/>    lambda.scale.up.event\_source\_mapping.batch\_size: "Maximum records passed to one scale-up Lambda invocation."<br/>    lambda.scale.up.event\_source\_mapping.maximum\_batching\_window\_in\_seconds: "Maximum time to batch records before invoking the scale-up Lambda."<br/>    lambda.scale.up.tags: "Tags applied to the scale-up Lambda."<br/>    lambda.scale.down.memory\_size: "Memory allocated to the scale-down Lambda."<br/>    lambda.scale.down.timeout: "Timeout in seconds for the scale-down Lambda."<br/>    lambda.scale.down.schedule\_expression: "Schedule expression for scale-down processing."<br/>    lambda.scale.down.minimum\_running\_time\_in\_minutes: "Minimum runner lifetime before scale-down."<br/>    lambda.scale.down.idle\_confirmation\_seconds: "Seconds a runner must consistently report not-busy before scale-down terminates it; 0 disables the confirmation window."<br/>    lambda.scale.down.idle\_config: "Scheduled minimum idle-runner pool settings."<br/>    lambda.scale.down.idle\_config.cron: "Cron expression defining when the idle-runner count applies."<br/>    lambda.scale.down.idle\_config.timeZone: "Time zone used to evaluate the idle-runner schedule."<br/>    lambda.scale.down.idle\_config.idleCount: "Minimum number of idle runners maintained during the schedule."<br/>    lambda.scale.down.idle\_config.evictionStrategy: "Strategy used when evicting idle runners."<br/>    lambda.scale.down.tags: "Tags applied to the scale-down Lambda."<br/>    lambda.webhook.artifact.zip: "Local ZIP artifact used for the webhook Lambda."<br/>    lambda.webhook.artifact.s3.key: "S3 object key for the webhook Lambda artifact."<br/>    lambda.webhook.artifact.s3.object\_version: "Optional S3 object version for the webhook Lambda artifact."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings: "API Gateway access-log destination and format."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.destination\_arn: "ARN of the API Gateway access-log destination."<br/>    lambda.webhook.api\_gateway\_access\_log\_settings.format: "API Gateway access-log format."<br/>    lambda.webhook.memory\_size: "Memory allocated to the webhook Lambda."<br/>    lambda.webhook.timeout: "Timeout in seconds for the webhook Lambda."<br/>    lambda.webhook.tags: "Tags applied to the webhook Lambda."<br/>    lambda.pool.memory\_size: "Memory allocated to the pool Lambda."<br/>    lambda.pool.timeout: "Timeout in seconds for the pool Lambda."<br/>    lambda.pool.reserved\_concurrent\_executions: "Reserved concurrent executions for the pool Lambda."<br/>    lambda.pool.config: "Scheduled runner-pool size configuration."<br/>    lambda.pool.config.schedule\_expression: "Schedule expression for the pool size."<br/>    lambda.pool.config.schedule\_expression\_timezone: "Time zone used to evaluate the pool schedule."<br/>    lambda.pool.config.size: "Runner pool size applied by the schedule."<br/>    lambda.pool.include\_busy\_runners: "Whether busy runners are included in pool sizing."<br/>    lambda.pool.runner\_owner: "GitHub organization that owns the runner pool."<br/>    lambda.pool.tags: "Tags applied to the pool Lambda."<br/>    queue.delay\_webhook\_event: "Seconds a webhook event remains invisible in the build queue before processing."<br/>    queue.job\_queue\_retention\_in\_seconds: "Seconds a queued job is retained before it is purged."<br/>    queue.visibility\_timeout\_seconds: "Build queue visibility timeout in seconds."<br/>    queue.redrive\_build\_queue.enabled: "Whether the build queue dead-letter queue is enabled."<br/>    queue.redrive\_build\_queue.maxReceiveCount: "Maximum receives before a message is moved to the dead-letter queue."<br/>    queue.tags: "Tags applied to build queues."<br/>    queue.encryption.kms\_data\_key\_reuse\_period\_seconds: "KMS data-key reuse period for queue encryption."<br/>    queue.encryption.kms\_master\_key\_id: "KMS key ID used for queue encryption."<br/>    queue.encryption.sqs\_managed\_sse\_enabled: "Whether SQS-managed server-side encryption is enabled."<br/>  }<br/>} | <pre>object({<br/>    webhook = optional(object({<br/>      queue_selection_strategy = optional(string, "first")<br/>      eventbridge = optional(object({<br/>        enabled       = optional(bool, true)<br/>        accept_events = optional(list(string), [])<br/>      }), {})<br/>      matcher_config_parameter_store_tier = optional(string, "Standard")<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, null)<br/>      }), {})<br/><br/>      github = optional(object({<br/>        repository_white_list = optional(list(string), [])<br/>      }), {})<br/><br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 30)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_confirmation_seconds       = optional(number, 0)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        webhook = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          api_gateway_access_log_settings = optional(object({<br/>            destination_arn = string<br/>            format          = string<br/>          }), null)<br/>          memory_size = optional(number, 256)<br/>          timeout     = optional(number, 10)<br/>          tags        = optional(map(string), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/><br/>      queue = optional(object({<br/>        delay_webhook_event            = optional(number, 30)<br/>        job_queue_retention_in_seconds = optional(number, 86400)<br/>        visibility_timeout_seconds     = optional(number, 180)<br/>        redrive_build_queue = optional(object({<br/>          enabled         = optional(bool, false)<br/>          maxReceiveCount = optional(number, null)<br/>          }), {<br/>          enabled         = false<br/>          maxReceiveCount = null<br/>        })<br/>        tags = optional(map(string), {})<br/>        encryption = optional(object({<br/>          kms_data_key_reuse_period_seconds = number<br/>          kms_master_key_id                 = string<br/>          sqs_managed_sse_enabled           = bool<br/>          }), {<br/>          kms_data_key_reuse_period_seconds = null<br/>          kms_master_key_id                 = null<br/>          sqs_managed_sse_enabled           = true<br/>        })<br/>      }), {})<br/><br/>    }), {})<br/><br/>    scale_set = optional(object({<br/>      grouping = optional(object({<br/>        strategy = optional(string, "compute_provider")<br/>        custom = optional(object({<br/>          groups = map(object({<br/>            runner_configs = set(string)<br/>          }))<br/>        }), null)<br/>      }), {})<br/>      container = optional(object({<br/>        image                             = optional(string, null)<br/>        user                              = optional(string, "10001:10001")<br/>        health_port                       = optional(number, 8080)<br/>        health_path                       = optional(string, "/healthz")<br/>        health_check_command              = optional(list(string), null)<br/>        health_check_interval             = optional(number, 30)<br/>        health_check_timeout              = optional(number, 5)<br/>        health_check_retries              = optional(number, 3)<br/>        health_check_start_period         = optional(number, 30)<br/>        health_stale_after_seconds        = optional(number, 180)<br/>        shutdown_timeout_seconds          = optional(number, 110)<br/>        session_close_timeout_seconds     = optional(number, 10)<br/>        reconnect_initial_backoff_seconds = optional(number, 1)<br/>        reconnect_max_backoff_seconds     = optional(number, 30)<br/>        stop_timeout_seconds              = optional(number, 120)<br/>      }), {})<br/>      config_store = optional(object({<br/>        path_prefix = optional(string, null)<br/>        tier        = optional(string, "Standard")<br/>        tags        = optional(map(string), {})<br/>      }), {})<br/>      ecs = optional(object({<br/>        cluster = optional(object({<br/>          mode               = optional(string, "managed")<br/>          arn                = optional(string, null)<br/>          name               = optional(string, null)<br/>          container_insights = optional(bool, true)<br/>        }), {})<br/>        task = optional(object({<br/>          cpu              = optional(number, 512)<br/>          memory           = optional(number, 1024)<br/>          cpu_architecture = optional(string, "X86_64")<br/>          ephemeral_storage = optional(object({<br/>            size_in_gib = number<br/>          }), null)<br/>        }), {})<br/>        service = optional(object({<br/>          platform_version = optional(string, "LATEST")<br/>        }), {})<br/>        iam = optional(object({<br/>          path                 = optional(string, "/")<br/>          permissions_boundary = optional(string, null)<br/>        }), {})<br/>      }), {})<br/>      network = optional(object({<br/>        vpc_id     = optional(string, null)<br/>        subnet_ids = optional(set(string), null)<br/>        https_egress = optional(object({<br/>          ipv4_cidrs = optional(set(string), ["0.0.0.0/0"])<br/>          ipv6_cidrs = optional(set(string), [])<br/>        }), {})<br/>      }), {})<br/>      logging = optional(object({<br/>        retention_in_days = optional(number, 30)<br/>        kms_key_arn       = optional(string, null)<br/>        log_group_class   = optional(string, "STANDARD")<br/>        tags              = optional(map(string), {})<br/>      }), {})<br/>      tags = optional(map(string), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_global_config_ssm"></a> [global\_config\_ssm](#input\_global\_config\_ssm) | Global SSM configuration shared by all runner lanes.<br/><br/>global\_config\_ssm = {<br/>  paths.root: "Root path for SSM parameters."<br/>  paths.app: "Path segment for application parameters."<br/>  paths.webhook: "Path segment for webhook parameters."<br/>  paths.tokens: "Path segment for runner token parameters."<br/>  paths.config: "Path segment for runner configuration parameters."<br/>  kms\_key\_id: "KMS key ID used to encrypt SSM parameters."<br/>  tags: "Tags applied to SSM resources."<br/>  parameters.tags: "Tags applied to runner configuration parameters."<br/>  housekeeper.schedule\_expression: "Schedule for the SSM parameter housekeeper."<br/>  housekeeper.state: "EventBridge rule state for the SSM parameter housekeeper."<br/>  housekeeper.tags: "Tags applied to the SSM housekeeper resources."<br/>  housekeeper.lambda.artifact.zip: "Local ZIP artifact used for the SSM housekeeper Lambda."<br/>  housekeeper.lambda.artifact.s3.key: "S3 object key for the SSM housekeeper Lambda artifact."<br/>  housekeeper.lambda.artifact.s3.object\_version: "Optional S3 object version for the SSM housekeeper artifact."<br/>  housekeeper.lambda.memory\_size: "Memory allocated to the SSM housekeeper Lambda."<br/>  housekeeper.lambda.timeout: "Timeout in seconds for the SSM housekeeper Lambda."<br/>  housekeeper.config.tokenPath: "Parameter path containing runner tokens to clean up."<br/>  housekeeper.config.minimumDaysOld: "Minimum age in days before an old token is eligible for cleanup."<br/>  housekeeper.config.dryRun: "Whether the SSM housekeeper reports cleanup without deleting parameters."<br/>} | <pre>object({<br/>    paths = optional(object({<br/>      root    = optional(string, null)<br/>      app     = optional(string, "app")<br/>      webhook = optional(string, "webhook")<br/>      tokens  = optional(string, "runners/tokens")<br/>      config  = optional(string, "runners/config")<br/>    }), {})<br/>    kms_key_id = optional(string, null)<br/>    tags       = optional(map(string), {})<br/>    parameters = optional(object({<br/>      tags = optional(map(string), {})<br/>    }), {})<br/>    housekeeper = optional(object({<br/>      schedule_expression = optional(string, "rate(1 day)")<br/>      state               = optional(string, "ENABLED")<br/>      tags                = optional(map(string), {})<br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        memory_size = optional(number, 512)<br/>        timeout     = optional(number, 60)<br/>      }), {})<br/>      config = optional(object({<br/>        tokenPath      = optional(string, null)<br/>        minimumDaysOld = optional(number, 1)<br/>        dryRun         = optional(bool, false)<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_iam_overrides"></a> [iam\_overrides](#input\_iam\_overrides) | This map provides the possibility to override some IAM defaults. The following attributes are supported: `instance_profile_name` overrides the instance profile name used in the launch template. `runner_role_arn` overrides the IAM role ARN used for the runner instances. | <pre>object({<br/>    override_instance_profile = optional(bool, null)<br/>    instance_profile_name     = optional(string, null)<br/>    override_runner_role      = optional(bool, null)<br/>    runner_role_arn           = optional(string, null)<br/>  })</pre> | <pre>{<br/>  "instance_profile_name": null,<br/>  "override_instance_profile": false,<br/>  "override_runner_role": false,<br/>  "runner_role_arn": null<br/>}</pre> | no |
 | <a name="input_instance_profile_path"></a> [instance\_profile\_path](#input\_instance\_profile\_path) | The path that will be added to the instance\_profile, if not set the environment name will be used. | `string` | `null` | no |
@@ -188,7 +189,7 @@ module "multi-runner" {
 | <a name="input_logging_retention_in_days"></a> [logging\_retention\_in\_days](#input\_logging\_retention\_in\_days) | Specifies the number of days you want to retain log events for the lambda log group. Possible values are: 0, 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653. | `number` | `180` | no |
 | <a name="input_matcher_config_parameter_store_tier"></a> [matcher\_config\_parameter\_store\_tier](#input\_matcher\_config\_parameter\_store\_tier) | The tier of the parameter store for the matcher configuration. Valid values are `Standard`, and `Advanced`. | `string` | `"Standard"` | no |
 | <a name="input_metrics"></a> [metrics](#input\_metrics) | Configuration for metrics created by the module, by default metrics are disabled to avoid additional costs. When metrics are enable all metrics are created unless explicit configured otherwise. | <pre>object({<br/>    enable    = optional(bool, false)<br/>    namespace = optional(string, "GitHub Runners")<br/>    metric = optional(object({<br/>      enable_github_app_rate_limit    = optional(bool, true)<br/>      enable_job_retry                = optional(bool, true)<br/>      enable_spot_termination_warning = optional(bool, true)<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_multi_runner_config"></a> [multi\_runner\_config](#input\_multi\_runner\_config) | Accepts either the stable v1 runner configuration shape or the provider-boundary v2 shape. Entries with `runner_config` use the v1 shape; entries without `runner_config` use the v2 shape. A v2 entry does not need matcher configuration. A v2 entry must be acknowledged with `experimental_features = ["multi-runner-v2"]`; the v2 shape is experimental and may change before graduation.<br/><br/>    multi\_runner\_config = {<br/>      runner\_config: {<br/>        runner\_os: "The EC2 Operating System type to use for action runner instances (linux, osx, windows)."<br/>        runner\_architecture: "The platform architecture of the runner instance\_type."<br/>        runner\_metadata\_options: "(Optional) Metadata options for the ec2 runner instances."<br/>        ami: "(Optional) AMI configuration for the action runner instances. This object allows you to specify all AMI-related settings in one place."<br/>        create\_service\_linked\_role\_spot: (Optional) create the serviced linked role for spot instances that is required by the scale-up lambda.<br/>        credit\_specification: "(Optional) The credit specification of the runner instance\_type. Can be unset, `standard` or `unlimited`.<br/>        delay\_webhook\_event: "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."<br/>        disable\_runner\_autoupdate: "Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"<br/>        ebs\_optimized: "The EC2 EBS optimized configuration."<br/>        enable\_ephemeral\_runners: "Enable ephemeral runners, runners will only be used once."<br/>        enable\_job\_queued\_check: Enables JIT configuration for creating runners instead of registration token based registraton. JIT configuration will only be applied for ephemeral runners. By default JIT configuration is enabled for ephemeral runners an can be disabled via this override. When running on GHES without support for JIT configuration this variable should be set to true for ephemeral runners."<br/>        enable\_on\_demand\_failover\_for\_errors: "Enable on-demand failover. For example to fall back to on demand when no spot capacity is available the variable can be set to `InsufficientInstanceCapacity`. When not defined the default behavior is to retry later."<br/>        scale\_errors: "List of AWS error codes that should trigger retry during scale up. This list replaces the module default scale-up retry errors"<br/>        enable\_organization\_runners: "Register runners to organization, instead of repo level"<br/>        enable\_runner\_binaries\_syncer: "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."<br/>        enable\_ssm\_on\_runners: "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."<br/>        enable\_userdata: "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."<br/>        instance\_allocation\_strategy: "The allocation strategy for creating instances. For spot, AWS recommends `price-capacity-optimized`; for on-demand, use `lowest-price` or `prioritized`. The AWS default is `lowest-price`."<br/>        instance\_type\_priorities: "A map of instance type to priority for the `prioritized` and `capacity-optimized-prioritized` allocation strategies. Lower numbers mean higher priority. If not provided, priorities are assigned based on the order of `instance_types`."<br/>        instance\_max\_spot\_price: "Max price price for spot instances per hour. This variable will be passed to the create fleet as max spot price for the fleet."<br/>        instance\_target\_capacity\_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."<br/>        instance\_types: "List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux, macOS Sequoia for osx, Windows Server Core for win)."<br/>        job\_queue\_retention\_in\_seconds: "The number of seconds the job is held in the queue before it is purged"<br/>        minimum\_running\_time\_in\_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy."<br/>        pool\_runner\_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."<br/>        runner\_additional\_security\_group\_ids: "List of additional security groups IDs to apply to the runner. If added outside the multi\_runner\_config block, the additional security group(s) will be applied to all runner configs. If added inside the multi\_runner\_config, the additional security group(s) will be applied to the individual runner."<br/>        runner\_as\_root: "Run the action runner under the root user. Variable `runner_run_as` will be ignored."<br/>        runner\_boot\_time\_in\_minutes: "The minimum time for an EC2 runner to boot and register as a runner."<br/>        scale\_down\_idle\_confirmation\_seconds: "Number of seconds a runner must consistently report not-busy before scale-down terminates it. GitHub's busy flag can be stale, so a single not-busy reading is not sufficient evidence a runner is idle. 0 keeps the previous single-reading behaviour."<br/>        runner\_disable\_default\_labels: "Disable default labels for the runners (os, architecture and `self-hosted`). If enabled, the runner will only have the extra labels provided in `runner_extra_labels`. In case you on own start script is used, this configuration parameter needs to be parsed via SSM."<br/>        runner\_extra\_labels: "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `multi_runner_config.matcherConfig.exactMatch`. GitHub read-only labels should not be provided."<br/>        runner\_group\_name: "Name of the runner group."<br/>        runner\_name\_prefix: "Prefix for the GitHub runner name."<br/>        runner\_run\_as: "Run the GitHub actions agent as user."<br/>        runners\_maximum\_count: "The maximum number of runners that will be created. Setting the variable to `-1` disables the maximum check."<br/>        scale\_down\_schedule\_expression: "Scheduler expression to check every x for scale down."<br/>        scale\_up\_reserved\_concurrent\_executions: "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."<br/>        lambda\_event\_source\_mapping\_batch\_size: "(Optional) Maximum number of records per Lambda invocation for this runner flavor. Overrides the module-level `lambda_event_source_mapping_batch_size` when set."<br/>        lambda\_event\_source\_mapping\_maximum\_batching\_window\_in\_seconds: "(Optional) Maximum seconds to gather records before invoking Lambda for this runner flavor. Overrides the module-level `lambda_event_source_mapping_maximum_batching_window_in_seconds` when set."<br/>        userdata\_template: "Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored."<br/>        enable\_jit\_config: "Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is available. In case you are upgrading from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI."<br/>        enable\_runner\_detailed\_monitoring: "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."<br/>        enable\_cloudwatch\_agent: "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."<br/>        cloudwatch\_config: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."<br/>        userdata\_pre\_install: "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"<br/>        userdata\_post\_install: "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"<br/>        runner\_hook\_job\_started: "Script to be ran in the runner environment at the beginning of every job"<br/>        runner\_hook\_job\_completed: "Script to be ran in the runner environment at the end of every job"<br/>        runner\_ec2\_tags: "Map of tags that will be added to the launch template instance tag specifications."<br/>        runner\_iam\_role\_managed\_policy\_arns: "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"<br/>        vpc\_id: "The VPC for security groups of the action runners. If not set uses the value of `var.vpc_id`."<br/>        subnet\_ids: "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. If not set, uses the value of `var.subnet_ids`."<br/>        idle\_config: "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."<br/>        license\_specifications: "Optional EC2 License Manager license configuration ARNs for the runner launch template. Required for macOS dedicated-host runners when the host resource group uses a Mac dedicated host license configuration."<br/>        use\_dedicated\_host: "Experimental! Can be removed / changed without trigger a major release. Whether to use EC2 dedicated hosts for the runners. Needed for macos runners Note that using dedicated hosts can increase cost significantly."<br/>        runner\_log\_files: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."<br/>        block\_device\_mappings: "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`, `volume_initialization_rate`."<br/>        job\_retry: "Experimental! Can be removed / changed without trigger a major release. Configure job retries. The configuration enables job retries (for ephemeral runners). After creating the instances a message will be published to a job retry queue. The job retry check lambda is checking after a delay if the job is queued. If not the message will be published again on the scale-up (build queue). Using this feature can impact the rate limit of the GitHub app."<br/>        pool\_config: "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1. Use `schedule_expression_timezone` to override the schedule time zone (defaults to UTC)."<br/>        iam\_overrides: "Allows to (optionally) override the instance profile and runner role created by the module. Set `override_instance_profile` to true and provide the `instance_profile_name` to use an existing instance profile. Set `override_runner_role` to true and provide the `runner_role_arn` to use an existing role for the runner instances."<br/>      }<br/>      # V2 contract<br/>      tags: "Tags applied to resources created for this runner configuration."<br/>      runner: "Runner settings such as the operating system, architecture, labels, hooks, runner group, name prefix, and IAM role configuration."<br/>      lambda: "Lambda settings such as runtime, architecture, networking, tags, and execution-role options for this runner configuration."<br/>      # Webhook, queue, and scale-up/scale-down orchestration settings.<br/>      orchestration\_provider: {<br/>        webhook: {<br/>          matcherConfig: "Label matching and dynamic-label policy used to route workflow jobs to this runner configuration."<br/>          runner: "Runner lifecycle settings including boot time, ephemeral mode, JIT configuration, and maximum runner count."<br/>          queue: "Build queue delay, retention, visibility timeout, redrive, and tags."<br/>        }<br/>      }<br/>      ssm: "SSM parameter paths, tags, and housekeeper settings for runner configuration storage."<br/>      observability: "Logging, tracing, and metric settings for the resources in this runner configuration."<br/>      # Compute settings for the runner provider.<br/>      compute\_provider: {<br/>        aws: {<br/>          ec2: "AWS EC2 runner settings, including AMI selection, instance types, capacity strategy, VPC and subnet placement, storage, user data, and runner access."<br/>        }<br/>      }<br/>      matcherConfig: {<br/>        labelMatchers: "The list of list of labels supported by the runner configuration. `[[self-hosted, linux, x64, example]]`"<br/>        exactMatch: "DEPRECATED: Use `bidirectionalLabelMatch` instead. If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ workflow label matches it will trigger the webhook. Note: this only checks that workflow labels are a subset of runner labels, not the reverse."<br/>        bidirectionalLabelMatch: "If set to true, the runner labels and workflow job labels must be an exact two-way match (same set, any order, no extras or missing labels). This is stricter than `exactMatch` which only checks that workflow labels are a subset of runner labels. When false, if __any__ workflow label matches it will trigger the webhook."<br/>        priority: "If set it defines the priority of the matcher, the matcher with the lowest priority will be evaluated first. Default is 999, allowed values 0-999."<br/>        enableDynamicLabels: "Experimental! When true the dispatcher allows `ghr-*` dynamic labels for jobs routed to this runner. Default false."<br/>        awsDynamicLabelsPolicy: "Optional AWS dynamic label policy evaluated by the dispatcher. Only effective when `enableDynamicLabels = true`. Jobs whose provider dynamic labels violate every matching runner's policy are rejected with a 202 (a warning is logged). Evaluation: keys in `blocked_keys` are always rejected; keys in `restricted_keys` are allowed only when their value passes the rule; unlisted keys are allowed. Schema: `{ blocked_keys = [<key>], restricted_keys = { <key> = { allowed = [globs], denied = [globs], max = number|string } } }`. Keys use the dynamic label suffix, e.g. `instance-type` for `ghr-ec2-instance-type`."<br/>      }<br/>      redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."<br/>    } | <pre>map(object({<br/>    # V1 contract<br/>    runner_config = optional(object({<br/>      runner_os           = string<br/>      runner_architecture = string<br/>      runner_metadata_options = optional(map(any), {<br/>        instance_metadata_tags      = "enabled"<br/>        http_endpoint               = "enabled"<br/>        http_tokens                 = "required"<br/>        http_put_response_hop_limit = 1<br/>      })<br/>      ami = optional(object({<br/>        filter               = optional(map(list(string)), { state = ["available"] })<br/>        owners               = optional(list(string), ["amazon"])<br/>        id_ssm_parameter_arn = optional(string, null)<br/>        kms_key_arn          = optional(string, null)<br/>      }), null)<br/>      create_service_linked_role_spot      = optional(bool, false)<br/>      credit_specification                 = optional(string, null)<br/>      delay_webhook_event                  = optional(number, 30)<br/>      disable_runner_autoupdate            = optional(bool, false)<br/>      ebs_optimized                        = optional(bool, false)<br/>      enable_ephemeral_runners             = optional(bool, false)<br/>      enable_job_queued_check              = optional(bool, null)<br/>      enable_on_demand_failover_for_errors = optional(list(string), [])<br/>      scale_errors = optional(list(string), [<br/>        "UnfulfillableCapacity",<br/>        "MaxSpotInstanceCountExceeded",<br/>        "TargetCapacityLimitExceededException",<br/>        "RequestLimitExceeded",<br/>        "ResourceLimitExceeded",<br/>        "MaxSpotInstanceCountExceeded",<br/>        "MaxSpotFleetRequestCountExceeded",<br/>        "InsufficientInstanceCapacity",<br/>        "InsufficientCapacityOnHost",<br/>      ])<br/>      enable_organization_runners                                    = optional(bool, false)<br/>      enable_runner_binaries_syncer                                  = optional(bool, true)<br/>      enable_ssm_on_runners                                          = optional(bool, false)<br/>      enable_userdata                                                = optional(bool, true)<br/>      instance_allocation_strategy                                   = optional(string, "lowest-price")<br/>      instance_type_priorities                                       = optional(map(number), null)<br/>      instance_max_spot_price                                        = optional(string, null)<br/>      instance_target_capacity_type                                  = optional(string, "spot")<br/>      instance_types                                                 = list(string)<br/>      job_queue_retention_in_seconds                                 = optional(number, 86400)<br/>      minimum_running_time_in_minutes                                = optional(number, null)<br/>      pool_runner_owner                                              = optional(string, null)<br/>      runner_as_root                                                 = optional(bool, false)<br/>      runner_boot_time_in_minutes                                    = optional(number, 5)<br/>      scale_down_idle_confirmation_seconds                           = optional(number, 0)<br/>      runner_disable_default_labels                                  = optional(bool, false)<br/>      runner_extra_labels                                            = optional(list(string), [])<br/>      runner_group_name                                              = optional(string, "Default")<br/>      runner_name_prefix                                             = optional(string, "")<br/>      runner_run_as                                                  = optional(string, "ec2-user")<br/>      runners_maximum_count                                          = number<br/>      runner_additional_security_group_ids                           = optional(list(string), [])<br/>      scale_down_schedule_expression                                 = optional(string, "cron(*/5 * * * ? *)")<br/>      scale_up_reserved_concurrent_executions                        = optional(number, 1)<br/>      lambda_event_source_mapping_batch_size                         = optional(number, null)<br/>      lambda_event_source_mapping_maximum_batching_window_in_seconds = optional(number, null)<br/>      userdata_template                                              = optional(string, null)<br/>      userdata_content                                               = optional(string, null)<br/>      enable_jit_config                                              = optional(bool, null)<br/>      enable_runner_detailed_monitoring                              = optional(bool, false)<br/>      enable_cloudwatch_agent                                        = optional(bool, true)<br/>      cloudwatch_config                                              = optional(string, null)<br/>      userdata_pre_install                                           = optional(string, "")<br/>      userdata_post_install                                          = optional(string, "")<br/>      runner_hook_job_started                                        = optional(string, "")<br/>      runner_hook_job_completed                                      = optional(string, "")<br/>      runner_ec2_tags                                                = optional(map(string), {})<br/>      runner_iam_role_managed_policy_arns                            = optional(list(string), [])<br/>      vpc_id                                                         = optional(string, null)<br/>      subnet_ids                                                     = optional(list(string), null)<br/>      idle_config = optional(list(object({<br/>        cron             = string<br/>        timeZone         = string<br/>        idleCount        = number<br/>        evictionStrategy = optional(string, "oldest_first")<br/>      })), [])<br/>      cpu_options = optional(object({<br/>        core_count            = optional(number)<br/>        threads_per_core      = optional(number)<br/>        amd_sev_snp           = optional(string)<br/>        nested_virtualization = optional(string)<br/>      }), null)<br/>      placement = optional(object({<br/>        affinity                = optional(string)<br/>        availability_zone       = optional(string)<br/>        group_id                = optional(string)<br/>        group_name              = optional(string)<br/>        host_id                 = optional(string)<br/>        host_resource_group_arn = optional(string)<br/>        spread_domain           = optional(string)<br/>        tenancy                 = optional(string)<br/>        partition_number        = optional(number)<br/>      }), null)<br/>      license_specifications = optional(list(object({<br/>        license_configuration_arn = string<br/>      })), [])<br/>      use_dedicated_host = optional(bool, false)<br/>      runner_log_files = optional(list(object({<br/>        log_group_name   = string<br/>        prefix_log_group = bool<br/>        file_path        = string<br/>        log_stream_name  = string<br/>        log_class        = optional(string, "STANDARD")<br/>      })), null)<br/>      block_device_mappings = optional(list(object({<br/>        delete_on_termination      = optional(bool, true)<br/>        device_name                = optional(string, "/dev/xvda")<br/>        encrypted                  = optional(bool, true)<br/>        iops                       = optional(number)<br/>        kms_key_id                 = optional(string)<br/>        snapshot_id                = optional(string)<br/>        throughput                 = optional(number)<br/>        volume_initialization_rate = optional(number)<br/>        volume_size                = number<br/>        volume_type                = optional(string, "gp3")<br/>        })), [{<br/>        volume_size = 30<br/>      }])<br/>      pool_config = optional(list(object({<br/>        schedule_expression          = string<br/>        schedule_expression_timezone = optional(string)<br/>        size                         = number<br/>      })), [])<br/>      job_retry = optional(object({<br/>        enable             = optional(bool, false)<br/>        delay_in_seconds   = optional(number, 300)<br/>        delay_backoff      = optional(number, 2)<br/>        lambda_memory_size = optional(number, 256)<br/>        lambda_timeout     = optional(number, 30)<br/>        max_attempts       = optional(number, 1)<br/>      }), {})<br/>      iam_overrides = optional(object({<br/>        override_instance_profile = optional(bool, null)<br/>        instance_profile_name     = optional(string, null)<br/>        override_runner_role      = optional(bool, null)<br/>        runner_role_arn           = optional(string, null)<br/>        }), {<br/>        override_instance_profile = false<br/>        instance_profile_name     = null<br/>        override_runner_role      = false<br/>        runner_role_arn           = null<br/>      })<br/>    }), null)<br/>    matcherConfig = optional(object({<br/>      labelMatchers           = list(list(string))<br/>      exactMatch              = optional(bool, false)<br/>      bidirectionalLabelMatch = optional(bool, false)<br/>      priority                = optional(number, 999)<br/>      enableDynamicLabels     = optional(bool, false)<br/>      awsDynamicLabelsPolicy  = optional(any, null)<br/>    }), null)<br/>    redrive_build_queue = optional(object({<br/>      enabled         = bool<br/>      maxReceiveCount = number<br/>      }), {<br/>      enabled         = false<br/>      maxReceiveCount = null<br/>    })<br/><br/>    # V2 Contract<br/>    tags = optional(map(string), {})<br/><br/>    runner = optional(object({<br/>      os                     = optional(string, null)<br/>      architecture           = optional(string, null)<br/>      disable_default_labels = optional(bool, null)<br/>      extra_labels           = optional(list(string), null)<br/>      group_name             = optional(string, null)<br/>      name_prefix            = optional(string, null)<br/>      run_as_root            = optional(bool, null)<br/>      run_as                 = optional(string, null)<br/>      auto_update_disabled   = optional(bool, null)<br/>      tags                   = optional(map(string), {})<br/>      hooks = optional(object({<br/>        job_started   = optional(string, null)<br/>        job_completed = optional(string, null)<br/>      }), {})<br/>      iam = optional(object({<br/>        role = optional(object({<br/>          arn = string<br/>        }), null)<br/>        managed_policy_arns          = optional(map(string), null)<br/>        additional_trust_policy_json = optional(string, null)<br/>        path                         = optional(string, null)<br/>        permissions_boundary         = optional(string, null)<br/>      }), {})<br/>    }), {})<br/><br/>    lambda = optional(object({<br/>      runtime            = optional(string, null)<br/>      architecture       = optional(string, null)<br/>      subnet_ids         = optional(list(string), null)<br/>      security_group_ids = optional(list(string), null)<br/>      tags               = optional(map(string), {})<br/>      role = optional(object({<br/>        path                 = optional(string, null)<br/>        permissions_boundary = optional(string, null)<br/>      }), {})<br/>    }), {})<br/><br/>    orchestration_provider = optional(object({<br/>      webhook = optional(object({<br/>        runner = optional(object({<br/>          boot_time_in_minutes = optional(number, null)<br/>          ephemeral            = optional(bool, null)<br/>          jit_config_enabled   = optional(bool, null)<br/>          maximum_count        = optional(number, null)<br/>        }), {})<br/>        github = optional(object({<br/>          organization_runners = optional(bool, false)<br/>        }), {})<br/>        matcherConfig = optional(object({<br/>          labelMatchers           = list(list(string))<br/>          exactMatch              = optional(bool, false)<br/>          bidirectionalLabelMatch = optional(bool, false)<br/>          priority                = optional(number, 999)<br/>          dynamic_labels_enabled  = optional(bool, false)<br/>          awsDynamicLabelsPolicy = optional(object({<br/>            blocked_keys = optional(list(string), [])<br/>            restricted_keys = optional(map(object({<br/>              allowed = optional(list(string), [])<br/>              denied  = optional(list(string), [])<br/>              max     = optional(string, null)<br/>            })), {})<br/>          }), null)<br/>        }), null)<br/>        queue = optional(object({<br/>          delay_webhook_event            = optional(number, null)<br/>          job_queue_retention_in_seconds = optional(number, null)<br/>          visibility_timeout_seconds     = optional(number, null)<br/>          redrive_build_queue = optional(object({<br/>            enabled         = optional(bool, null)<br/>            maxReceiveCount = optional(number, null)<br/>          }), null)<br/>          tags = optional(map(string), {})<br/>        }), {})<br/>        lambda = optional(object({<br/>          scale = optional(object({<br/>            up = optional(object({<br/>              memory_size                    = optional(number, null)<br/>              timeout                        = optional(number, null)<br/>              reserved_concurrent_executions = optional(number, null)<br/>              job_queued_check_enabled       = optional(bool, null)<br/>              event_source_mapping = optional(object({<br/>                batch_size                         = optional(number, null)<br/>                maximum_batching_window_in_seconds = optional(number, null)<br/>              }), {})<br/>              tags = optional(map(string), {})<br/>            }), {})<br/>            down = optional(object({<br/>              memory_size                     = optional(number, null)<br/>              timeout                         = optional(number, null)<br/>              schedule_expression             = optional(string, null)<br/>              minimum_running_time_in_minutes = optional(number, null)<br/>              idle_confirmation_seconds       = optional(number, null)<br/>              idle_config = optional(list(object({<br/>                cron             = string<br/>                timeZone         = string<br/>                idleCount        = number<br/>                evictionStrategy = optional(string, "oldest_first")<br/>              })), null)<br/>              tags = optional(map(string), {})<br/>            }), {})<br/>          }), {})<br/>          pool = optional(object({<br/>            memory_size                    = optional(number, null)<br/>            timeout                        = optional(number, null)<br/>            reserved_concurrent_executions = optional(number, null)<br/>            config = optional(list(object({<br/>              schedule_expression          = string<br/>              schedule_expression_timezone = optional(string)<br/>              size                         = number<br/>            })), null)<br/>            include_busy_runners = optional(bool, null)<br/>            runner_owner         = optional(string, null)<br/>            tags                 = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled          = optional(bool, false)<br/>          delay_in_seconds = optional(number, 300)<br/>          delay_backoff    = optional(number, 2)<br/>          max_attempts     = optional(number, 1)<br/>          tags             = optional(map(string), {})<br/>          lambda = optional(object({<br/>            memory_size                    = optional(number, 256)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            timeout                        = optional(number, 30)<br/>          }), {})<br/>        }), {})<br/>      }), null)<br/>    }), {})<br/><br/>    ssm = optional(object({<br/>      paths = optional(object({<br/>        root   = optional(string, null)<br/>        tokens = optional(string, null)<br/>        config = optional(string, null)<br/>      }), {})<br/>      tags = optional(map(string), {})<br/>      parameters = optional(object({<br/>        tags = optional(map(string), {})<br/>      }), {})<br/>      housekeeper = optional(object({<br/>        schedule_expression = optional(string, null)<br/>        state               = optional(string, null)<br/>        tags                = optional(map(string), {})<br/>        lambda = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          memory_size = optional(number, null)<br/>          timeout     = optional(number, null)<br/>        }), {})<br/>        config = optional(object({<br/>          tokenPath      = optional(string, null)<br/>          minimumDaysOld = optional(number, null)<br/>          dryRun         = optional(bool, null)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/><br/>    observability = optional(object({<br/>      logs = optional(object({<br/>        level             = optional(string, null)<br/>        retention_in_days = optional(number, null)<br/>        kms_key_id        = optional(string, null)<br/>        class             = optional(string, null)<br/>        tags              = optional(map(string), {})<br/>      }), {})<br/>      tracing = optional(object({<br/>        mode                  = optional(string, null)<br/>        capture_http_requests = optional(bool, null)<br/>        capture_error         = optional(bool, null)<br/>      }), {})<br/>      metrics = optional(object({<br/>        enabled   = optional(bool, null)<br/>        namespace = optional(string, null)<br/>        metric = optional(object({<br/>          github_app_rate_limit = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          job_retry = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          spot_termination_warning = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/><br/>    compute_provider = optional(object({<br/>      aws = optional(object({<br/>        ec2 = optional(object({<br/>          metadata_options = optional(object({<br/>            instance_metadata_tags      = optional(string, "enabled")<br/>            http_endpoint               = optional(string, "enabled")<br/>            http_tokens                 = optional(string, "required")<br/>            http_put_response_hop_limit = optional(number, 1)<br/>          }), {})<br/>          ami = optional(object({<br/>            filter = optional(map(list(string)), { state = ["available"] })<br/>            owners = optional(list(string), ["amazon"])<br/>            id_ssm_parameter = optional(object({<br/>              arn = string<br/>            }), null)<br/>            kms_key = optional(object({<br/>              arn = string<br/>            }), null)<br/>          }), null)<br/>          block_device_mappings = optional(list(object({<br/>            delete_on_termination      = optional(bool, true)<br/>            device_name                = optional(string, "/dev/xvda")<br/>            encrypted                  = optional(bool, true)<br/>            iops                       = optional(number)<br/>            kms_key_id                 = optional(string)<br/>            snapshot_id                = optional(string)<br/>            throughput                 = optional(number)<br/>            volume_initialization_rate = optional(number)<br/>            volume_size                = number<br/>            volume_type                = optional(string, "gp3")<br/>          })), [{ volume_size = 30 }])<br/>          create_service_linked_role_spot = optional(bool, false)<br/>          credit_specification            = optional(string, null)<br/>          ebs_optimized                   = optional(bool, false)<br/>          cloudwatch_agent = optional(object({<br/>            enabled = optional(bool, true)<br/>            config  = optional(string, null)<br/>          }), {})<br/>          binaries_syncer = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          detailed_monitoring_enabled = optional(bool, false)<br/>          ssm_enabled                 = optional(bool, false)<br/>          user_data = optional(object({<br/>            enabled               = optional(bool, true)<br/>            template              = optional(string, null)<br/>            content               = optional(string, null)<br/>            pre_install           = optional(string, "")<br/>            post_install          = optional(string, "")<br/>            debug_logging_enabled = optional(bool, false)<br/>          }), {})<br/>          instance_allocation_strategy   = optional(string, "lowest-price")<br/>          instance_max_spot_price        = optional(string, null)<br/>          instance_target_capacity_type  = optional(string, "spot")<br/>          instance_type_priorities       = optional(map(number), null)<br/>          instance_types                 = optional(list(string), [])<br/>          additional_security_group_ids  = optional(list(string), null)<br/>          managed_security_group_enabled = optional(bool, null)<br/>          egress_rules = optional(list(object({<br/>            cidr_blocks      = list(string)<br/>            ipv6_cidr_blocks = list(string)<br/>            prefix_list_ids  = list(string)<br/>            from_port        = number<br/>            protocol         = string<br/>            security_groups  = list(string)<br/>            self             = bool<br/>            to_port          = number<br/>            description      = string<br/>          })), null)<br/>          instance_profile_path         = optional(string, null)<br/>          key_name                      = optional(string, null)<br/>          associate_public_ipv4_address = optional(bool, null)<br/>          instance_profile = optional(object({<br/>            name = string<br/>          }), null)<br/>          on_demand_failover_for_errors = optional(list(string), [])<br/>          scale_errors = optional(list(string), [<br/>            "UnfulfillableCapacity",<br/>            "MaxSpotInstanceCountExceeded",<br/>            "TargetCapacityLimitExceededException",<br/>            "RequestLimitExceeded",<br/>            "ResourceLimitExceeded",<br/>            "MaxSpotInstanceCountExceeded",<br/>            "MaxSpotFleetRequestCountExceeded",<br/>            "InsufficientInstanceCapacity",<br/>            "InsufficientCapacityOnHost",<br/>          ])<br/>          subnet_ids = optional(list(string), null)<br/>          vpc_id     = optional(string, null)<br/>          cpu_options = optional(object({<br/>            core_count            = optional(number)<br/>            threads_per_core      = optional(number)<br/>            amd_sev_snp           = optional(string)<br/>            nested_virtualization = optional(string)<br/>          }), null)<br/>          placement = optional(object({<br/>            affinity                = optional(string)<br/>            availability_zone       = optional(string)<br/>            group_id                = optional(string)<br/>            group_name              = optional(string)<br/>            host_id                 = optional(string)<br/>            host_resource_group_arn = optional(string)<br/>            spread_domain           = optional(string)<br/>            tenancy                 = optional(string)<br/>            partition_number        = optional(number)<br/>          }), null)<br/>          license_specifications = optional(list(object({<br/>            license_configuration_arn = string<br/>          })), [])<br/>          use_dedicated_host = optional(bool, false)<br/>          log_files = optional(list(object({<br/>            log_group_name   = string<br/>            prefix_log_group = bool<br/>            file_path        = string<br/>            log_stream_name  = string<br/>            log_class        = optional(string, "STANDARD")<br/>          })), null)<br/>          tags = optional(map(string), {})<br/>        }), null)<br/>      }), {})<br/>    }), {})<br/>  }))</pre> | `{}` | no |
+| <a name="input_multi_runner_config"></a> [multi\_runner\_config](#input\_multi\_runner\_config) | Accepts either the stable v1 runner configuration shape or the provider-boundary v2 shape. Entries with `runner_config` use the v1 shape; entries without `runner_config` use the v2 shape. A v2 entry does not need matcher configuration. A v2 entry must be acknowledged with `experimental_features = ["multi-runner-v2"]`; the v2 shape is experimental and may change before graduation.<br/><br/>    multi\_runner\_config = {<br/>      runner\_config: {<br/>        runner\_os: "The EC2 Operating System type to use for action runner instances (linux, osx, windows)."<br/>        runner\_architecture: "The platform architecture of the runner instance\_type."<br/>        runner\_metadata\_options: "(Optional) Metadata options for the ec2 runner instances."<br/>        ami: "(Optional) AMI configuration for the action runner instances. This object allows you to specify all AMI-related settings in one place."<br/>        create\_service\_linked\_role\_spot: (Optional) create the serviced linked role for spot instances that is required by the scale-up lambda.<br/>        credit\_specification: "(Optional) The credit specification of the runner instance\_type. Can be unset, `standard` or `unlimited`.<br/>        delay\_webhook\_event: "The number of seconds the event accepted by the webhook is invisible on the queue before the scale up lambda will receive the event."<br/>        disable\_runner\_autoupdate: "Disable the auto update of the github runner agent. Be aware there is a grace period of 30 days, see also the [GitHub article](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/)"<br/>        ebs\_optimized: "The EC2 EBS optimized configuration."<br/>        enable\_ephemeral\_runners: "Enable ephemeral runners, runners will only be used once."<br/>        enable\_job\_queued\_check: Enables JIT configuration for creating runners instead of registration token based registraton. JIT configuration will only be applied for ephemeral runners. By default JIT configuration is enabled for ephemeral runners an can be disabled via this override. When running on GHES without support for JIT configuration this variable should be set to true for ephemeral runners."<br/>        enable\_on\_demand\_failover\_for\_errors: "Enable on-demand failover. For example to fall back to on demand when no spot capacity is available the variable can be set to `InsufficientInstanceCapacity`. When not defined the default behavior is to retry later."<br/>        scale\_errors: "List of AWS error codes that should trigger retry during scale up. This list replaces the module default scale-up retry errors"<br/>        enable\_organization\_runners: "Register runners to organization, instead of repo level"<br/>        enable\_runner\_binaries\_syncer: "Option to disable the lambda to sync GitHub runner distribution, useful when using a pre-build AMI."<br/>        enable\_ssm\_on\_runners: "Enable to allow access the runner instances for debugging purposes via SSM. Note that this adds additional permissions to the runner instances."<br/>        enable\_userdata: "Should the userdata script be enabled for the runner. Set this to false if you are using your own prebuilt AMI."<br/>        instance\_allocation\_strategy: "The allocation strategy for creating instances. For spot, AWS recommends `price-capacity-optimized`; for on-demand, use `lowest-price` or `prioritized`. The AWS default is `lowest-price`."<br/>        instance\_type\_priorities: "A map of instance type to priority for the `prioritized` and `capacity-optimized-prioritized` allocation strategies. Lower numbers mean higher priority. If not provided, priorities are assigned based on the order of `instance_types`."<br/>        instance\_max\_spot\_price: "Max price price for spot instances per hour. This variable will be passed to the create fleet as max spot price for the fleet."<br/>        instance\_target\_capacity\_type: "Default lifecycle used for runner instances, can be either `spot` or `on-demand`."<br/>        instance\_types: "List of instance types for the action runner. Defaults are based on runner\_os (al2023 for linux, macOS Sequoia for osx, Windows Server Core for win)."<br/>        job\_queue\_retention\_in\_seconds: "The number of seconds the job is held in the queue before it is purged"<br/>        minimum\_running\_time\_in\_minutes: "The time an ec2 action runner should be running at minimum before terminated if not busy."<br/>        pool\_runner\_owner: "The pool will deploy runners to the GitHub org ID, set this value to the org to which you want the runners deployed. Repo level is not supported."<br/>        runner\_additional\_security\_group\_ids: "List of additional security groups IDs to apply to the runner. If added outside the multi\_runner\_config block, the additional security group(s) will be applied to all runner configs. If added inside the multi\_runner\_config, the additional security group(s) will be applied to the individual runner."<br/>        runner\_as\_root: "Run the action runner under the root user. Variable `runner_run_as` will be ignored."<br/>        runner\_boot\_time\_in\_minutes: "The minimum time for an EC2 runner to boot and register as a runner."<br/>        scale\_down\_idle\_confirmation\_seconds: "Number of seconds a runner must consistently report not-busy before scale-down terminates it. GitHub's busy flag can be stale, so a single not-busy reading is not sufficient evidence a runner is idle. 0 keeps the previous single-reading behaviour."<br/>        runner\_disable\_default\_labels: "Disable default labels for the runners (os, architecture and `self-hosted`). If enabled, the runner will only have the extra labels provided in `runner_extra_labels`. In case you on own start script is used, this configuration parameter needs to be parsed via SSM."<br/>        runner\_extra\_labels: "Extra (custom) labels for the runners (GitHub). Separate each label by a comma. Labels checks on the webhook can be enforced by setting `multi_runner_config.matcherConfig.exactMatch`. GitHub read-only labels should not be provided."<br/>        runner\_group\_name: "Name of the runner group."<br/>        runner\_name\_prefix: "Prefix for the GitHub runner name."<br/>        runner\_run\_as: "Run the GitHub actions agent as user."<br/>        runners\_maximum\_count: "The maximum number of runners that will be created. Setting the variable to `-1` disables the maximum check."<br/>        scale\_down\_schedule\_expression: "Scheduler expression to check every x for scale down."<br/>        scale\_up\_reserved\_concurrent\_executions: "Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations."<br/>        lambda\_event\_source\_mapping\_batch\_size: "(Optional) Maximum number of records per Lambda invocation for this runner flavor. Overrides the module-level `lambda_event_source_mapping_batch_size` when set."<br/>        lambda\_event\_source\_mapping\_maximum\_batching\_window\_in\_seconds: "(Optional) Maximum seconds to gather records before invoking Lambda for this runner flavor. Overrides the module-level `lambda_event_source_mapping_maximum_batching_window_in_seconds` when set."<br/>        userdata\_template: "Alternative user-data template, replacing the default template. By providing your own user\_data you have to take care of installing all required software, including the action runner. Variables userdata\_pre/post\_install are ignored."<br/>        enable\_jit\_config: "Overwrite the default behavior for JIT configuration. By default JIT configuration is enabled for ephemeral runners and disabled for non-ephemeral runners. In case of GHES check first if the JIT config API is available. In case you are upgrading from 3.x to 4.x you can set `enable_jit_config` to `false` to avoid a breaking change when having your own AMI."<br/>        enable\_runner\_detailed\_monitoring: "Should detailed monitoring be enabled for the runner. Set this to true if you want to use detailed monitoring. See https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html for details."<br/>        enable\_cloudwatch\_agent: "Enabling the cloudwatch agent on the ec2 runner instances, the runner contains default config. Configuration can be overridden via `cloudwatch_config`."<br/>        cloudwatch\_config: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."<br/>        userdata\_pre\_install: "Script to be ran before the GitHub Actions runner is installed on the EC2 instances"<br/>        userdata\_post\_install: "Script to be ran after the GitHub Actions runner is installed on the EC2 instances"<br/>        runner\_hook\_job\_started: "Script to be ran in the runner environment at the beginning of every job"<br/>        runner\_hook\_job\_completed: "Script to be ran in the runner environment at the end of every job"<br/>        runner\_ec2\_tags: "Map of tags that will be added to the launch template instance tag specifications."<br/>        runner\_iam\_role\_managed\_policy\_arns: "Attach AWS or customer-managed IAM policies (by ARN) to the runner IAM role"<br/>        vpc\_id: "The VPC for security groups of the action runners. If not set uses the value of `var.vpc_id`."<br/>        subnet\_ids: "List of subnets in which the action runners will be launched, the subnets needs to be subnets in the `vpc_id`. If not set, uses the value of `var.subnet_ids`."<br/>        idle\_config: "List of time period that can be defined as cron expression to keep a minimum amount of runners active instead of scaling down to 0. By defining this list you can ensure that in time periods that match the cron expression within 5 seconds a runner is kept idle."<br/>        license\_specifications: "Optional EC2 License Manager license configuration ARNs for the runner launch template. Required for macOS dedicated-host runners when the host resource group uses a Mac dedicated host license configuration."<br/>        use\_dedicated\_host: "Experimental! Can be removed / changed without trigger a major release. Whether to use EC2 dedicated hosts for the runners. Needed for macos runners Note that using dedicated hosts can increase cost significantly."<br/>        runner\_log\_files: "(optional) Replaces the module default cloudwatch log config. See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-Configuration-File-Details.html for details."<br/>        block\_device\_mappings: "The EC2 instance block device configuration. Takes the following keys: `device_name`, `delete_on_termination`, `volume_type`, `volume_size`, `encrypted`, `iops`, `throughput`, `kms_key_id`, `snapshot_id`, `volume_initialization_rate`."<br/>        job\_retry: "Experimental! Can be removed / changed without trigger a major release. Configure job retries. The configuration enables job retries (for ephemeral runners). After creating the instances a message will be published to a job retry queue. The job retry check lambda is checking after a delay if the job is queued. If not the message will be published again on the scale-up (build queue). Using this feature can impact the rate limit of the GitHub app."<br/>        pool\_config: "The configuration for updating the pool. The `pool_size` to adjust to by the events triggered by the `schedule_expression`. For example you can configure a cron expression for week days to adjust the pool to 10 and another expression for the weekend to adjust the pool to 1. Use `schedule_expression_timezone` to override the schedule time zone (defaults to UTC)."<br/>        iam\_overrides: "Allows to (optionally) override the instance profile and runner role created by the module. Set `override_instance_profile` to true and provide the `instance_profile_name` to use an existing instance profile. Set `override_runner_role` to true and provide the `runner_role_arn` to use an existing role for the runner instances."<br/>      }<br/>      # V2 contract<br/>      tags: "Tags applied to resources created for this runner configuration."<br/>      runner: "Runner settings such as the operating system, architecture, labels, hooks, runner group, name prefix, and IAM role configuration."<br/>      lambda: "Lambda settings such as runtime, architecture, networking, tags, and execution-role options for this runner configuration."<br/>      # Webhook, queue, and scale-up/scale-down orchestration settings.<br/>      orchestration\_provider: {<br/>        webhook: {<br/>          matcherConfig: "Label matching and dynamic-label policy used to route workflow jobs to this runner configuration."<br/>          runner: "Runner lifecycle settings including boot time, ephemeral mode, JIT configuration, and maximum runner count."<br/>          queue: "Build queue delay, retention, visibility timeout, redrive, and tags."<br/>        }<br/>      }<br/>      ssm: "SSM parameter paths, tags, and housekeeper settings for runner configuration storage."<br/>      observability: "Logging, tracing, and metric settings for the resources in this runner configuration."<br/>      # Compute settings for the runner provider.<br/>      compute\_provider: {<br/>        aws: {<br/>          ec2: "AWS EC2 runner settings, including AMI selection, instance types, capacity strategy, VPC and subnet placement, storage, user data, and runner access."<br/>        }<br/>      }<br/>      matcherConfig: {<br/>        labelMatchers: "The list of list of labels supported by the runner configuration. `[[self-hosted, linux, x64, example]]`"<br/>        exactMatch: "DEPRECATED: Use `bidirectionalLabelMatch` instead. If set to true all labels in the workflow job must match the GitHub labels (os, architecture and `self-hosted`). When false if __any__ workflow label matches it will trigger the webhook. Note: this only checks that workflow labels are a subset of runner labels, not the reverse."<br/>        bidirectionalLabelMatch: "If set to true, the runner labels and workflow job labels must be an exact two-way match (same set, any order, no extras or missing labels). This is stricter than `exactMatch` which only checks that workflow labels are a subset of runner labels. When false, if __any__ workflow label matches it will trigger the webhook."<br/>        priority: "If set it defines the priority of the matcher, the matcher with the lowest priority will be evaluated first. Default is 999, allowed values 0-999."<br/>        enableDynamicLabels: "Experimental! When true the dispatcher allows `ghr-*` dynamic labels for jobs routed to this runner. Default false."<br/>        awsDynamicLabelsPolicy: "Optional AWS dynamic label policy evaluated by the dispatcher. Only effective when `enableDynamicLabels = true`. Jobs whose provider dynamic labels violate every matching runner's policy are rejected with a 202 (a warning is logged). Evaluation: keys in `blocked_keys` are always rejected; keys in `restricted_keys` are allowed only when their value passes the rule; unlisted keys are allowed. Schema: `{ blocked_keys = [<key>], restricted_keys = { <key> = { allowed = [globs], denied = [globs], max = number|string } } }`. Keys use the dynamic label suffix, e.g. `instance-type` for `ghr-ec2-instance-type`."<br/>      }<br/>      redrive\_build\_queue: "Set options to attach (optional) a dead letter queue to the build queue, the queue between the webhook and the scale up lambda. You have the following options. 1. Disable by setting `enabled` to false. 2. Enable by setting `enabled` to `true`, `maxReceiveCount` to a number of max retries."<br/>    } | <pre>map(object({<br/>    # V1 contract<br/>    runner_config = optional(object({<br/>      runner_os           = string<br/>      runner_architecture = string<br/>      runner_metadata_options = optional(map(any), {<br/>        instance_metadata_tags      = "enabled"<br/>        http_endpoint               = "enabled"<br/>        http_tokens                 = "required"<br/>        http_put_response_hop_limit = 1<br/>      })<br/>      ami = optional(object({<br/>        filter               = optional(map(list(string)), { state = ["available"] })<br/>        owners               = optional(list(string), ["amazon"])<br/>        id_ssm_parameter_arn = optional(string, null)<br/>        kms_key_arn          = optional(string, null)<br/>      }), null)<br/>      create_service_linked_role_spot      = optional(bool, false)<br/>      credit_specification                 = optional(string, null)<br/>      delay_webhook_event                  = optional(number, 30)<br/>      disable_runner_autoupdate            = optional(bool, false)<br/>      ebs_optimized                        = optional(bool, false)<br/>      enable_ephemeral_runners             = optional(bool, false)<br/>      enable_job_queued_check              = optional(bool, null)<br/>      enable_on_demand_failover_for_errors = optional(list(string), [])<br/>      scale_errors = optional(list(string), [<br/>        "UnfulfillableCapacity",<br/>        "MaxSpotInstanceCountExceeded",<br/>        "TargetCapacityLimitExceededException",<br/>        "RequestLimitExceeded",<br/>        "ResourceLimitExceeded",<br/>        "MaxSpotInstanceCountExceeded",<br/>        "MaxSpotFleetRequestCountExceeded",<br/>        "InsufficientInstanceCapacity",<br/>        "InsufficientCapacityOnHost",<br/>      ])<br/>      enable_organization_runners                                    = optional(bool, false)<br/>      enable_runner_binaries_syncer                                  = optional(bool, true)<br/>      enable_ssm_on_runners                                          = optional(bool, false)<br/>      enable_userdata                                                = optional(bool, true)<br/>      instance_allocation_strategy                                   = optional(string, "lowest-price")<br/>      instance_type_priorities                                       = optional(map(number), null)<br/>      instance_max_spot_price                                        = optional(string, null)<br/>      instance_target_capacity_type                                  = optional(string, "spot")<br/>      instance_types                                                 = list(string)<br/>      job_queue_retention_in_seconds                                 = optional(number, 86400)<br/>      minimum_running_time_in_minutes                                = optional(number, null)<br/>      pool_runner_owner                                              = optional(string, null)<br/>      runner_as_root                                                 = optional(bool, false)<br/>      runner_boot_time_in_minutes                                    = optional(number, 5)<br/>      scale_down_idle_confirmation_seconds                           = optional(number, 0)<br/>      runner_disable_default_labels                                  = optional(bool, false)<br/>      runner_extra_labels                                            = optional(list(string), [])<br/>      runner_group_name                                              = optional(string, "Default")<br/>      runner_name_prefix                                             = optional(string, "")<br/>      runner_run_as                                                  = optional(string, "ec2-user")<br/>      runners_maximum_count                                          = number<br/>      runner_additional_security_group_ids                           = optional(list(string), [])<br/>      scale_down_schedule_expression                                 = optional(string, "cron(*/5 * * * ? *)")<br/>      scale_up_reserved_concurrent_executions                        = optional(number, 1)<br/>      lambda_event_source_mapping_batch_size                         = optional(number, null)<br/>      lambda_event_source_mapping_maximum_batching_window_in_seconds = optional(number, null)<br/>      userdata_template                                              = optional(string, null)<br/>      userdata_content                                               = optional(string, null)<br/>      enable_jit_config                                              = optional(bool, null)<br/>      enable_runner_detailed_monitoring                              = optional(bool, false)<br/>      enable_cloudwatch_agent                                        = optional(bool, true)<br/>      cloudwatch_config                                              = optional(string, null)<br/>      userdata_pre_install                                           = optional(string, "")<br/>      userdata_post_install                                          = optional(string, "")<br/>      runner_hook_job_started                                        = optional(string, "")<br/>      runner_hook_job_completed                                      = optional(string, "")<br/>      runner_ec2_tags                                                = optional(map(string), {})<br/>      runner_iam_role_managed_policy_arns                            = optional(list(string), [])<br/>      vpc_id                                                         = optional(string, null)<br/>      subnet_ids                                                     = optional(list(string), null)<br/>      idle_config = optional(list(object({<br/>        cron             = string<br/>        timeZone         = string<br/>        idleCount        = number<br/>        evictionStrategy = optional(string, "oldest_first")<br/>      })), [])<br/>      cpu_options = optional(object({<br/>        core_count            = optional(number)<br/>        threads_per_core      = optional(number)<br/>        amd_sev_snp           = optional(string)<br/>        nested_virtualization = optional(string)<br/>      }), null)<br/>      placement = optional(object({<br/>        affinity                = optional(string)<br/>        availability_zone       = optional(string)<br/>        group_id                = optional(string)<br/>        group_name              = optional(string)<br/>        host_id                 = optional(string)<br/>        host_resource_group_arn = optional(string)<br/>        spread_domain           = optional(string)<br/>        tenancy                 = optional(string)<br/>        partition_number        = optional(number)<br/>      }), null)<br/>      license_specifications = optional(list(object({<br/>        license_configuration_arn = string<br/>      })), [])<br/>      use_dedicated_host = optional(bool, false)<br/>      runner_log_files = optional(list(object({<br/>        log_group_name   = string<br/>        prefix_log_group = bool<br/>        file_path        = string<br/>        log_stream_name  = string<br/>        log_class        = optional(string, "STANDARD")<br/>      })), null)<br/>      block_device_mappings = optional(list(object({<br/>        delete_on_termination      = optional(bool, true)<br/>        device_name                = optional(string, "/dev/xvda")<br/>        encrypted                  = optional(bool, true)<br/>        iops                       = optional(number)<br/>        kms_key_id                 = optional(string)<br/>        snapshot_id                = optional(string)<br/>        throughput                 = optional(number)<br/>        volume_initialization_rate = optional(number)<br/>        volume_size                = number<br/>        volume_type                = optional(string, "gp3")<br/>        })), [{<br/>        volume_size = 30<br/>      }])<br/>      pool_config = optional(list(object({<br/>        schedule_expression          = string<br/>        schedule_expression_timezone = optional(string)<br/>        size                         = number<br/>      })), [])<br/>      job_retry = optional(object({<br/>        enable             = optional(bool, false)<br/>        delay_in_seconds   = optional(number, 300)<br/>        delay_backoff      = optional(number, 2)<br/>        lambda_memory_size = optional(number, 256)<br/>        lambda_timeout     = optional(number, 30)<br/>        max_attempts       = optional(number, 1)<br/>      }), {})<br/>      iam_overrides = optional(object({<br/>        override_instance_profile = optional(bool, null)<br/>        instance_profile_name     = optional(string, null)<br/>        override_runner_role      = optional(bool, null)<br/>        runner_role_arn           = optional(string, null)<br/>        }), {<br/>        override_instance_profile = false<br/>        instance_profile_name     = null<br/>        override_runner_role      = false<br/>        runner_role_arn           = null<br/>      })<br/>    }), null)<br/>    matcherConfig = optional(object({<br/>      labelMatchers           = list(list(string))<br/>      exactMatch              = optional(bool, false)<br/>      bidirectionalLabelMatch = optional(bool, false)<br/>      priority                = optional(number, 999)<br/>      enableDynamicLabels     = optional(bool, false)<br/>      awsDynamicLabelsPolicy  = optional(any, null)<br/>    }), null)<br/>    redrive_build_queue = optional(object({<br/>      enabled         = bool<br/>      maxReceiveCount = number<br/>      }), {<br/>      enabled         = false<br/>      maxReceiveCount = null<br/>    })<br/><br/>    # V2 Contract<br/>    tags = optional(map(string), {})<br/><br/>    runner = optional(object({<br/>      os                     = optional(string, null)<br/>      architecture           = optional(string, null)<br/>      disable_default_labels = optional(bool, null)<br/>      extra_labels           = optional(list(string), null)<br/>      group_name             = optional(string, null)<br/>      name_prefix            = optional(string, null)<br/>      run_as_root            = optional(bool, null)<br/>      run_as                 = optional(string, null)<br/>      auto_update_disabled   = optional(bool, null)<br/>      tags                   = optional(map(string), {})<br/>      hooks = optional(object({<br/>        job_started   = optional(string, null)<br/>        job_completed = optional(string, null)<br/>      }), {})<br/>      iam = optional(object({<br/>        role = optional(object({<br/>          arn = string<br/>        }), null)<br/>        managed_policy_arns          = optional(map(string), null)<br/>        additional_trust_policy_json = optional(string, null)<br/>        path                         = optional(string, null)<br/>        permissions_boundary         = optional(string, null)<br/>      }), {})<br/>    }), {})<br/><br/>    lambda = optional(object({<br/>      runtime            = optional(string, null)<br/>      architecture       = optional(string, null)<br/>      subnet_ids         = optional(list(string), null)<br/>      security_group_ids = optional(list(string), null)<br/>      tags               = optional(map(string), {})<br/>      role = optional(object({<br/>        path                 = optional(string, null)<br/>        permissions_boundary = optional(string, null)<br/>      }), {})<br/>    }), {})<br/><br/>    orchestration_provider = optional(object({<br/>      webhook = optional(object({<br/>        runner = optional(object({<br/>          boot_time_in_minutes = optional(number, null)<br/>          ephemeral            = optional(bool, null)<br/>          jit_config_enabled   = optional(bool, null)<br/>          maximum_count        = optional(number, null)<br/>        }), {})<br/>        github = optional(object({<br/>          organization_runners = optional(bool, false)<br/>        }), {})<br/>        matcherConfig = optional(object({<br/>          labelMatchers           = list(list(string))<br/>          exactMatch              = optional(bool, false)<br/>          bidirectionalLabelMatch = optional(bool, false)<br/>          priority                = optional(number, 999)<br/>          dynamic_labels_enabled  = optional(bool, false)<br/>          awsDynamicLabelsPolicy = optional(object({<br/>            blocked_keys = optional(list(string), [])<br/>            restricted_keys = optional(map(object({<br/>              allowed = optional(list(string), [])<br/>              denied  = optional(list(string), [])<br/>              max     = optional(string, null)<br/>            })), {})<br/>          }), null)<br/>        }), null)<br/>        queue = optional(object({<br/>          delay_webhook_event            = optional(number, null)<br/>          job_queue_retention_in_seconds = optional(number, null)<br/>          visibility_timeout_seconds     = optional(number, null)<br/>          redrive_build_queue = optional(object({<br/>            enabled         = optional(bool, null)<br/>            maxReceiveCount = optional(number, null)<br/>          }), null)<br/>          tags = optional(map(string), {})<br/>        }), {})<br/>        lambda = optional(object({<br/>          scale = optional(object({<br/>            up = optional(object({<br/>              memory_size                    = optional(number, null)<br/>              timeout                        = optional(number, null)<br/>              reserved_concurrent_executions = optional(number, null)<br/>              job_queued_check_enabled       = optional(bool, null)<br/>              event_source_mapping = optional(object({<br/>                batch_size                         = optional(number, null)<br/>                maximum_batching_window_in_seconds = optional(number, null)<br/>              }), {})<br/>              tags = optional(map(string), {})<br/>            }), {})<br/>            down = optional(object({<br/>              memory_size                     = optional(number, null)<br/>              timeout                         = optional(number, null)<br/>              schedule_expression             = optional(string, null)<br/>              minimum_running_time_in_minutes = optional(number, null)<br/>              idle_confirmation_seconds       = optional(number, null)<br/>              idle_config = optional(list(object({<br/>                cron             = string<br/>                timeZone         = string<br/>                idleCount        = number<br/>                evictionStrategy = optional(string, "oldest_first")<br/>              })), null)<br/>              tags = optional(map(string), {})<br/>            }), {})<br/>          }), {})<br/>          pool = optional(object({<br/>            memory_size                    = optional(number, null)<br/>            timeout                        = optional(number, null)<br/>            reserved_concurrent_executions = optional(number, null)<br/>            config = optional(list(object({<br/>              schedule_expression          = string<br/>              schedule_expression_timezone = optional(string)<br/>              size                         = number<br/>            })), null)<br/>            include_busy_runners = optional(bool, null)<br/>            runner_owner         = optional(string, null)<br/>            tags                 = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled          = optional(bool, false)<br/>          delay_in_seconds = optional(number, 300)<br/>          delay_backoff    = optional(number, 2)<br/>          max_attempts     = optional(number, 1)<br/>          tags             = optional(map(string), {})<br/>          lambda = optional(object({<br/>            memory_size                    = optional(number, 256)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            timeout                        = optional(number, 30)<br/>          }), {})<br/>        }), {})<br/>      }), null)<br/>      scale_set = optional(object({<br/>        name = string<br/>        runner = optional(object({<br/>          min_runners          = optional(number, 0)<br/>          max_runners          = optional(number, 10)<br/>          boot_time_in_minutes = optional(number, 10)<br/>        }), {})<br/>      }), null)<br/>    }), {})<br/><br/>    ssm = optional(object({<br/>      paths = optional(object({<br/>        root   = optional(string, null)<br/>        tokens = optional(string, null)<br/>        config = optional(string, null)<br/>      }), {})<br/>      tags = optional(map(string), {})<br/>      parameters = optional(object({<br/>        tags = optional(map(string), {})<br/>      }), {})<br/>      housekeeper = optional(object({<br/>        schedule_expression = optional(string, null)<br/>        state               = optional(string, null)<br/>        tags                = optional(map(string), {})<br/>        lambda = optional(object({<br/>          artifact = optional(object({<br/>            zip = optional(string, null)<br/>            s3 = optional(object({<br/>              key            = string<br/>              object_version = optional(string, null)<br/>            }), null)<br/>          }), {})<br/>          memory_size = optional(number, null)<br/>          timeout     = optional(number, null)<br/>        }), {})<br/>        config = optional(object({<br/>          tokenPath      = optional(string, null)<br/>          minimumDaysOld = optional(number, null)<br/>          dryRun         = optional(bool, null)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/><br/>    observability = optional(object({<br/>      logs = optional(object({<br/>        level             = optional(string, null)<br/>        retention_in_days = optional(number, null)<br/>        kms_key_id        = optional(string, null)<br/>        class             = optional(string, null)<br/>        tags              = optional(map(string), {})<br/>      }), {})<br/>      tracing = optional(object({<br/>        mode                  = optional(string, null)<br/>        capture_http_requests = optional(bool, null)<br/>        capture_error         = optional(bool, null)<br/>      }), {})<br/>      metrics = optional(object({<br/>        enabled   = optional(bool, null)<br/>        namespace = optional(string, null)<br/>        metric = optional(object({<br/>          github_app_rate_limit = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          job_retry = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          spot_termination_warning = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/><br/>    compute_provider = optional(object({<br/>      aws = optional(object({<br/>        ec2 = optional(object({<br/>          metadata_options = optional(object({<br/>            instance_metadata_tags      = optional(string, "enabled")<br/>            http_endpoint               = optional(string, "enabled")<br/>            http_tokens                 = optional(string, "required")<br/>            http_put_response_hop_limit = optional(number, 1)<br/>          }), {})<br/>          ami = optional(object({<br/>            filter = optional(map(list(string)), { state = ["available"] })<br/>            owners = optional(list(string), ["amazon"])<br/>            id_ssm_parameter = optional(object({<br/>              arn = string<br/>            }), null)<br/>            kms_key = optional(object({<br/>              arn = string<br/>            }), null)<br/>          }), null)<br/>          block_device_mappings = optional(list(object({<br/>            delete_on_termination      = optional(bool, true)<br/>            device_name                = optional(string, "/dev/xvda")<br/>            encrypted                  = optional(bool, true)<br/>            iops                       = optional(number)<br/>            kms_key_id                 = optional(string)<br/>            snapshot_id                = optional(string)<br/>            throughput                 = optional(number)<br/>            volume_initialization_rate = optional(number)<br/>            volume_size                = number<br/>            volume_type                = optional(string, "gp3")<br/>          })), [{ volume_size = 30 }])<br/>          create_service_linked_role_spot = optional(bool, false)<br/>          credit_specification            = optional(string, null)<br/>          ebs_optimized                   = optional(bool, false)<br/>          cloudwatch_agent = optional(object({<br/>            enabled = optional(bool, true)<br/>            config  = optional(string, null)<br/>          }), {})<br/>          binaries_syncer = optional(object({<br/>            enabled = optional(bool, null)<br/>          }), {})<br/>          detailed_monitoring_enabled = optional(bool, false)<br/>          ssm_enabled                 = optional(bool, false)<br/>          user_data = optional(object({<br/>            enabled               = optional(bool, true)<br/>            template              = optional(string, null)<br/>            content               = optional(string, null)<br/>            pre_install           = optional(string, "")<br/>            post_install          = optional(string, "")<br/>            debug_logging_enabled = optional(bool, false)<br/>          }), {})<br/>          instance_allocation_strategy   = optional(string, "lowest-price")<br/>          instance_max_spot_price        = optional(string, null)<br/>          instance_target_capacity_type  = optional(string, "spot")<br/>          instance_type_priorities       = optional(map(number), null)<br/>          instance_types                 = optional(list(string), [])<br/>          additional_security_group_ids  = optional(list(string), null)<br/>          managed_security_group_enabled = optional(bool, null)<br/>          egress_rules = optional(list(object({<br/>            cidr_blocks      = list(string)<br/>            ipv6_cidr_blocks = list(string)<br/>            prefix_list_ids  = list(string)<br/>            from_port        = number<br/>            protocol         = string<br/>            security_groups  = list(string)<br/>            self             = bool<br/>            to_port          = number<br/>            description      = string<br/>          })), null)<br/>          instance_profile_path         = optional(string, null)<br/>          key_name                      = optional(string, null)<br/>          associate_public_ipv4_address = optional(bool, null)<br/>          instance_profile = optional(object({<br/>            name = string<br/>          }), null)<br/>          on_demand_failover_for_errors = optional(list(string), [])<br/>          scale_errors = optional(list(string), [<br/>            "UnfulfillableCapacity",<br/>            "MaxSpotInstanceCountExceeded",<br/>            "TargetCapacityLimitExceededException",<br/>            "RequestLimitExceeded",<br/>            "ResourceLimitExceeded",<br/>            "MaxSpotInstanceCountExceeded",<br/>            "MaxSpotFleetRequestCountExceeded",<br/>            "InsufficientInstanceCapacity",<br/>            "InsufficientCapacityOnHost",<br/>          ])<br/>          subnet_ids = optional(list(string), null)<br/>          vpc_id     = optional(string, null)<br/>          cpu_options = optional(object({<br/>            core_count            = optional(number)<br/>            threads_per_core      = optional(number)<br/>            amd_sev_snp           = optional(string)<br/>            nested_virtualization = optional(string)<br/>          }), null)<br/>          placement = optional(object({<br/>            affinity                = optional(string)<br/>            availability_zone       = optional(string)<br/>            group_id                = optional(string)<br/>            group_name              = optional(string)<br/>            host_id                 = optional(string)<br/>            host_resource_group_arn = optional(string)<br/>            spread_domain           = optional(string)<br/>            tenancy                 = optional(string)<br/>            partition_number        = optional(number)<br/>          }), null)<br/>          license_specifications = optional(list(object({<br/>            license_configuration_arn = string<br/>          })), [])<br/>          use_dedicated_host = optional(bool, false)<br/>          log_files = optional(list(object({<br/>            log_group_name   = string<br/>            prefix_log_group = bool<br/>            file_path        = string<br/>            log_stream_name  = string<br/>            log_class        = optional(string, "STANDARD")<br/>          })), null)<br/>          tags = optional(map(string), {})<br/>        }), null)<br/>      }), {})<br/>    }), {})<br/>  }))</pre> | `{}` | no |
 | <a name="input_parameter_store_tags"></a> [parameter\_store\_tags](#input\_parameter\_store\_tags) | Map of tags that will be added to all the SSM Parameter Store parameters created by the Lambda function. | `map(string)` | `{}` | no |
 | <a name="input_pool_lambda_reserved_concurrent_executions"></a> [pool\_lambda\_reserved\_concurrent\_executions](#input\_pool\_lambda\_reserved\_concurrent\_executions) | Amount of reserved concurrent executions for the scale-up lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. | `number` | `1` | no |
 | <a name="input_pool_lambda_timeout"></a> [pool\_lambda\_timeout](#input\_pool\_lambda\_timeout) | Time out for the pool lambda in seconds. | `number` | `60` | no |
@@ -239,6 +240,7 @@ module "multi-runner" {
 | <a name="output_instance_termination_watcher"></a> [instance\_termination\_watcher](#output\_instance\_termination\_watcher) | n/a |
 | <a name="output_runners_map"></a> [runners\_map](#output\_runners\_map) | n/a |
 | <a name="output_runners_map_v2"></a> [runners\_map\_v2](#output\_runners\_map\_v2) | n/a |
+| <a name="output_scale_set"></a> [scale\_set](#output\_scale\_set) | Shared scale-set orchestration resources, or null when no runner configuration selects scale\_set. |
 | <a name="output_ssm_parameters"></a> [ssm\_parameters](#output\_ssm\_parameters) | n/a |
 | <a name="output_webhook"></a> [webhook](#output\_webhook) | n/a |
 <!-- END_TF_DOCS -->
diff --git a/modules/runner-config/README.md b/modules/runner-config/README.md
index 7c1585dca2..41c0b1a191 100644
--- a/modules/runner-config/README.md
+++ b/modules/runner-config/README.md
@@ -114,7 +114,7 @@ yarn run dist
 | <a name="input_github"></a> [github](#input\_github) | GitHub API and runner-registration configuration.<br/><br/>- `app_parameters.key_base64`: Parameter Store reference for the primary GitHub App private key.<br/>- `app_parameters.id`: Parameter Store reference for the primary GitHub App ID.<br/>- `app_parameters.additional_apps_manifest`: Optional Parameter Store reference containing the additional GitHub App manifest.<br/>- `app_parameters.additional_app_parameter_arns`: ARNs of the additional GitHub App credential parameters.<br/>- `enterprise_server.url`: Optional GitHub Enterprise Server base URL. Null selects GitHub.com.<br/>- `enterprise_server.ssl_verify`: Enables TLS certificate verification for GitHub Enterprise Server requests.<br/>- `user_agent`: Optional User-Agent value added to GitHub API requests. | <pre>object({<br/>    app_parameters = object({<br/>      key_base64 = map(string)<br/>      id         = map(string)<br/>      additional_apps_manifest = optional(object({<br/>        name = string<br/>        arn  = string<br/>      }), null)<br/>      additional_app_parameter_arns = optional(list(string), [])<br/>    })<br/>    enterprise_server = optional(object({<br/>      url        = optional(string, null)<br/>      ssl_verify = optional(bool, true)<br/>    }), {})<br/>    user_agent = optional(string, null)<br/>  })</pre> | n/a | yes |
 | <a name="input_lambda"></a> [lambda](#input\_lambda) | Common Lambda substrate independent of the selected runner orchestration provider.<br/><br/>- `artifact.s3.bucket`: Optional shared S3 bucket containing component-owned Lambda artifacts. An orchestration provider selects its own object key and version; the bucket alone selects no artifact.<br/>- `runtime`: Runtime used by the control-plane Lambda functions.<br/>- `architecture`: Instruction-set architecture used by the control-plane Lambda functions. Supported values are `arm64` and `x86_64`.<br/>- `subnet_ids`: Subnets used for Lambda VPC configuration.<br/>- `security_group_ids`: Security groups used for Lambda VPC configuration.<br/>- `tags`: Shared tags applied to Lambda function resources only. These override module-level `tags`; component `tags` override this map when keys conflict.<br/>- `principals`: Additional principals allowed to assume the control-plane Lambda roles.<br/>- `role.path`: IAM path for module-managed Lambda execution roles. Defaults to a path derived from `prefix`.<br/>- `role.permissions_boundary`: Permissions-boundary ARN applied to module-managed Lambda execution roles. | <pre>object({<br/>    artifact = optional(object({<br/>      s3 = optional(object({<br/>        bucket = optional(string, null)<br/>      }), {})<br/>    }), {})<br/>    runtime            = optional(string, "nodejs24.x")<br/>    architecture       = optional(string, "arm64")<br/>    subnet_ids         = optional(list(string), [])<br/>    security_group_ids = optional(list(string), [])<br/>    tags               = optional(map(string), {})<br/>    principals = optional(list(object({<br/>      type        = string<br/>      identifiers = list(string)<br/>    })), [])<br/>    role = optional(object({<br/>      path                 = optional(string, null)<br/>      permissions_boundary = optional(string, null)<br/>    }), {})<br/>  })</pre> | `{}` | no |
 | <a name="input_observability"></a> [observability](#input\_observability) | Logging, tracing, and metrics configuration for control-plane and provider resources.<br/><br/>- `logs.level`: Application log level supplied to the control-plane functions.<br/>- `logs.retention_in_days`: CloudWatch Logs retention period.<br/>- `logs.kms_key_id`: Optional KMS key ID or ARN used to encrypt CloudWatch log groups.<br/>- `logs.class`: CloudWatch log-group class. Supported values are `STANDARD` and `INFREQUENT_ACCESS`.<br/>- `logs.tags`: Shared tags for CloudWatch log groups. These override module-level `tags`; component `tags` override this map when keys conflict.<br/>- `tracing.mode`: Optional Lambda active-tracing mode. Null disables X-Ray tracing configuration.<br/>- `tracing.capture_http_requests`: Enables HTTP request capture in the tracing helper.<br/>- `tracing.capture_error`: Enables error capture in the tracing helper.<br/>- `metrics.enabled`: Enables module-emitted metrics.<br/>- `metrics.namespace`: CloudWatch namespace used for emitted metrics.<br/>- `metrics.metric.github_app_rate_limit.enabled`: Emits GitHub App rate-limit metrics.<br/>- `metrics.metric.job_retry.enabled`: Emits job-retry metrics.<br/>- `metrics.metric.spot_termination_warning.enabled`: Emits spot-termination warning metrics where supported. | <pre>object({<br/>    logs = optional(object({<br/>      level             = optional(string, "info")<br/>      retention_in_days = optional(number, 180)<br/>      kms_key_id        = optional(string, null)<br/>      class             = optional(string, "STANDARD")<br/>      tags              = optional(map(string), {})<br/>    }), {})<br/>    tracing = optional(object({<br/>      mode                  = optional(string, null)<br/>      capture_http_requests = optional(bool, false)<br/>      capture_error         = optional(bool, false)<br/>    }), {})<br/>    metrics = optional(object({<br/>      enabled   = optional(bool, false)<br/>      namespace = optional(string, "GitHub Runners")<br/>      metric = optional(object({<br/>        github_app_rate_limit = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        job_retry = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>        spot_termination_warning = optional(object({<br/>          enabled = optional(bool, true)<br/>        }), {})<br/>      }), {})<br/>    }), {})<br/>  })</pre> | `{}` | no |
-| <a name="input_orchestration_provider"></a> [orchestration\_provider](#input\_orchestration\_provider) | Runner demand-orchestration provider configuration. Exactly one provider block must be non-null. Wrapper presence selects the provider and must therefore be known during planning; values inside the selected provider may remain unknown until apply.<br/><br/>- `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls. Future providers can be added as sibling blocks without moving this contract.<br/>- `webhook.runner`: Runner lifecycle, boot timeout, and capacity settings owned by webhook orchestration.<br/>- `webhook.runner.boot_time_in_minutes`: Expected runner boot duration used by scale-down and pool controls. The default is `5`.<br/>- `webhook.runner.ephemeral`: Registers runners in ephemeral mode. The default is `false`.<br/>- `webhook.runner.jit_config_enabled`: Explicitly enables or disables just-in-time configuration. The default is null, which follows `runner.ephemeral`.<br/>- `webhook.runner.maximum_count`: Maximum number of runners managed for this runner configuration. The default is `3`.<br/>- `webhook.github.organization_runners`: Registers runners at organization scope when true; otherwise registration is repository-scoped.<br/>- `webhook.queue.build.arn`: ARN of the runner configuration's build queue.<br/>- `webhook.queue.build.url`: URL of the runner configuration's build queue.<br/>- `webhook.queue.kms_key_id`: Optional KMS key ARN encrypting the build queue. The default is null and is independent from the Parameter Store KMS key.<br/>- `webhook.queue.tags`: Tags inherited by queue-related provider resources before component-specific overrides. The default is `{}`.<br/>- `webhook.lambda.artifact`: Runner-control artifact shared by scale, pool, and job-retry components. Set at most one of `zip` or `s3`; no selection uses the packaged runner archive.<br/>- `webhook.lambda.artifact.zip`: Optional local path to the runner-control Lambda archive. The default is null.<br/>- `webhook.lambda.artifact.s3`: Optional S3 object selector in the common `lambda.artifact.s3.bucket`. Wrapper presence must be known during planning, selecting it requires a non-null common bucket, and the default is null.<br/>- `webhook.lambda.artifact.s3.key`: Object key of the runner-control Lambda archive.<br/>- `webhook.lambda.artifact.s3.object_version`: Optional object version of the runner-control Lambda archive. The default is null.<br/>- `webhook.lambda.scale.up.memory_size`: Memory allocated to the scale-up Lambda in MB. The default is `512`.<br/>- `webhook.lambda.scale.up.timeout`: Scale-up Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.scale.up.reserved_concurrent_executions`: Reserved concurrency for scale-up. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.lambda.scale.up.job_queued_check_enabled`: Enables queued-job verification before scaling. The default is null, which follows the resolved runner mode.<br/>- `webhook.lambda.scale.up.event_source_mapping.batch_size`: Maximum build-queue records delivered per scale-up invocation. The default is `10`.<br/>- `webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds`: Maximum batching window for build-queue records. The default is `0`.<br/>- `webhook.lambda.scale.up.tags`: Tags applied within scale-up resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.lambda.scale.down.memory_size`: Memory allocated to the scale-down Lambda in MB. The default is `512`.<br/>- `webhook.lambda.scale.down.timeout`: Scale-down Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.scale.down.schedule_expression`: EventBridge schedule expression that invokes scale-down. The default is `cron(*/5 * * * ? *)`.<br/>- `webhook.lambda.scale.down.minimum_running_time_in_minutes`: Optional minimum runner age before scale-down may terminate it. The default is null, which selects the operating-system default.<br/>- `webhook.lambda.scale.down.idle_confirmation_seconds`: Number of seconds a runner must consistently report not-busy before scale-down terminates it. The default is `0`, which preserves the single-reading behavior.<br/>- `webhook.lambda.scale.down.idle_config`: Time-based desired idle-runner configurations. The default is `[]`.<br/>- `webhook.lambda.scale.down.idle_config[].cron`: Cron expression identifying when the idle configuration applies.<br/>- `webhook.lambda.scale.down.idle_config[].timeZone`: IANA time zone used to evaluate the cron expression.<br/>- `webhook.lambda.scale.down.idle_config[].idleCount`: Number of idle runners retained during the matching period.<br/>- `webhook.lambda.scale.down.idle_config[].evictionStrategy`: Selection strategy used when excess idle runners are removed. The default is `oldest_first`.<br/>- `webhook.lambda.scale.down.tags`: Tags applied within scale-down resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.lambda.pool.memory_size`: Memory allocated to the pool Lambda in MB. The default is `512`.<br/>- `webhook.lambda.pool.timeout`: Pool Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.pool.reserved_concurrent_executions`: Reserved concurrency for the pool Lambda. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.lambda.pool.config`: Scheduled target pool sizes. The default is `[]`, which disables the pool component.<br/>- `webhook.lambda.pool.config[].schedule_expression`: Scheduler expression that activates the target size.<br/>- `webhook.lambda.pool.config[].schedule_expression_timezone`: Optional IANA time zone used to evaluate the schedule.<br/>- `webhook.lambda.pool.config[].size`: Desired number of runners for the schedule.<br/>- `webhook.lambda.pool.include_busy_runners`: Includes busy runners when reconciling scheduled pool capacity. The default is `false`.<br/>- `webhook.lambda.pool.runner_owner`: Optional GitHub organization or repository owner used for pooled runners. The default is null.<br/>- `webhook.lambda.pool.tags`: Tags applied within pool resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.job_retry.enabled`: Creates the retry queue, Lambda function, event-source mapping, and related IAM resources. The default is `false`.<br/>- `webhook.job_retry.delay_in_seconds`: Initial delay before a queued-job retry check. The default is `300`.<br/>- `webhook.job_retry.delay_backoff`: Multiplier applied to the delay after each unsuccessful check. The default is `2`.<br/>- `webhook.job_retry.max_attempts`: Maximum retry-check attempts before the message is no longer republished. The default is `1`.<br/>- `webhook.job_retry.tags`: Tags applied within job-retry resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.job_retry.lambda.memory_size`: Memory allocated to the job-retry Lambda in MB. The default is `256`.<br/>- `webhook.job_retry.lambda.reserved_concurrent_executions`: Reserved concurrency for job retry. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.job_retry.lambda.timeout`: Job-retry Lambda timeout in seconds and visibility timeout for its retry queue. The default is `30`. | <pre>object({<br/>    webhook = optional(object({<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, 3)<br/>      }), {})<br/>      github = object({<br/>        organization_runners = bool<br/>      })<br/>      queue = object({<br/>        build = object({<br/>          arn = string<br/>          url = string<br/>        })<br/>        kms_key_id = optional(string, null)<br/>        tags       = optional(map(string), {})<br/>      })<br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 60)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_confirmation_seconds       = optional(number, 0)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/>      job_retry = optional(object({<br/>        enabled          = optional(bool, false)<br/>        delay_in_seconds = optional(number, 300)<br/>        delay_backoff    = optional(number, 2)<br/>        max_attempts     = optional(number, 1)<br/>        tags             = optional(map(string), {})<br/>        lambda = optional(object({<br/>          memory_size                    = optional(number, 256)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          timeout                        = optional(number, 30)<br/>        }), {})<br/>      }), {})<br/>    }), null)<br/>  })</pre> | n/a | yes |
+| <a name="input_orchestration_provider"></a> [orchestration\_provider](#input\_orchestration\_provider) | Runner demand-orchestration provider configuration. Exactly one provider block must be non-null. Wrapper presence selects the provider and must therefore be known during planning; values inside the selected provider may remain unknown until apply.<br/><br/>- `webhook`: Selects the workflow-job webhook control plane. It owns runner lifecycle and capacity, the build queue reference, the runner-control artifact, scale-up, scale-down, scheduled pool, and optional job-retry controls.<br/>- `scale_set`: Selects scale-set orchestration for this runner config. The multi-runner topology owns the shared controller service and passes this plan-known selection marker to runner-config. Scale-set runners always use ephemeral JIT registration.<br/>- `webhook.runner`: Runner lifecycle, boot timeout, and capacity settings owned by webhook orchestration.<br/>- `webhook.runner.boot_time_in_minutes`: Expected runner boot duration used by scale-down and pool controls. The default is `5`.<br/>- `webhook.runner.ephemeral`: Registers runners in ephemeral mode. The default is `false`.<br/>- `webhook.runner.jit_config_enabled`: Explicitly enables or disables just-in-time configuration. The default is null, which follows `runner.ephemeral`.<br/>- `webhook.runner.maximum_count`: Maximum number of runners managed for this runner configuration. The default is `3`.<br/>- `webhook.github.organization_runners`: Registers runners at organization scope when true; otherwise registration is repository-scoped.<br/>- `webhook.queue.build.arn`: ARN of the runner configuration's build queue.<br/>- `webhook.queue.build.url`: URL of the runner configuration's build queue.<br/>- `webhook.queue.kms_key_id`: Optional KMS key ARN encrypting the build queue. The default is null and is independent from the Parameter Store KMS key.<br/>- `webhook.queue.tags`: Tags inherited by queue-related provider resources before component-specific overrides. The default is `{}`.<br/>- `webhook.lambda.artifact`: Runner-control artifact shared by scale, pool, and job-retry components. Set at most one of `zip` or `s3`; no selection uses the packaged runner archive.<br/>- `webhook.lambda.artifact.zip`: Optional local path to the runner-control Lambda archive. The default is null.<br/>- `webhook.lambda.artifact.s3`: Optional S3 object selector in the common `lambda.artifact.s3.bucket`. Wrapper presence must be known during planning, selecting it requires a non-null common bucket, and the default is null.<br/>- `webhook.lambda.artifact.s3.key`: Object key of the runner-control Lambda archive.<br/>- `webhook.lambda.artifact.s3.object_version`: Optional object version of the runner-control Lambda archive. The default is null.<br/>- `webhook.lambda.scale.up.memory_size`: Memory allocated to the scale-up Lambda in MB. The default is `512`.<br/>- `webhook.lambda.scale.up.timeout`: Scale-up Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.scale.up.reserved_concurrent_executions`: Reserved concurrency for scale-up. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.lambda.scale.up.job_queued_check_enabled`: Enables queued-job verification before scaling. The default is null, which follows the resolved runner mode.<br/>- `webhook.lambda.scale.up.event_source_mapping.batch_size`: Maximum build-queue records delivered per scale-up invocation. The default is `10`.<br/>- `webhook.lambda.scale.up.event_source_mapping.maximum_batching_window_in_seconds`: Maximum batching window for build-queue records. The default is `0`.<br/>- `webhook.lambda.scale.up.tags`: Tags applied within scale-up resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.lambda.scale.down.memory_size`: Memory allocated to the scale-down Lambda in MB. The default is `512`.<br/>- `webhook.lambda.scale.down.timeout`: Scale-down Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.scale.down.schedule_expression`: EventBridge schedule expression that invokes scale-down. The default is `cron(*/5 * * * ? *)`.<br/>- `webhook.lambda.scale.down.minimum_running_time_in_minutes`: Optional minimum runner age before scale-down may terminate it. The default is null, which selects the operating-system default.<br/>- `webhook.lambda.scale.down.idle_confirmation_seconds`: Number of seconds a runner must consistently report not-busy before scale-down terminates it. The default is `0`, which preserves the single-reading behavior.<br/>- `webhook.lambda.scale.down.idle_config`: Time-based desired idle-runner configurations. The default is `[]`.<br/>- `webhook.lambda.scale.down.idle_config[].cron`: Cron expression identifying when the idle configuration applies.<br/>- `webhook.lambda.scale.down.idle_config[].timeZone`: IANA time zone used to evaluate the cron expression.<br/>- `webhook.lambda.scale.down.idle_config[].idleCount`: Number of idle runners retained during the matching period.<br/>- `webhook.lambda.scale.down.idle_config[].evictionStrategy`: Selection strategy used when excess idle runners are removed. The default is `oldest_first`.<br/>- `webhook.lambda.scale.down.tags`: Tags applied within scale-down resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.lambda.pool.memory_size`: Memory allocated to the pool Lambda in MB. The default is `512`.<br/>- `webhook.lambda.pool.timeout`: Pool Lambda timeout in seconds. The default is `60`.<br/>- `webhook.lambda.pool.reserved_concurrent_executions`: Reserved concurrency for the pool Lambda. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.lambda.pool.config`: Scheduled target pool sizes. The default is `[]`, which disables the pool component.<br/>- `webhook.lambda.pool.config[].schedule_expression`: Scheduler expression that activates the target size.<br/>- `webhook.lambda.pool.config[].schedule_expression_timezone`: Optional IANA time zone used to evaluate the schedule.<br/>- `webhook.lambda.pool.config[].size`: Desired number of runners for the schedule.<br/>- `webhook.lambda.pool.include_busy_runners`: Includes busy runners when reconciling scheduled pool capacity. The default is `false`.<br/>- `webhook.lambda.pool.runner_owner`: Optional GitHub organization or repository owner used for pooled runners. The default is null.<br/>- `webhook.lambda.pool.tags`: Tags applied within pool resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.job_retry.enabled`: Creates the retry queue, Lambda function, event-source mapping, and related IAM resources. The default is `false`.<br/>- `webhook.job_retry.delay_in_seconds`: Initial delay before a queued-job retry check. The default is `300`.<br/>- `webhook.job_retry.delay_backoff`: Multiplier applied to the delay after each unsuccessful check. The default is `2`.<br/>- `webhook.job_retry.max_attempts`: Maximum retry-check attempts before the message is no longer republished. The default is `1`.<br/>- `webhook.job_retry.tags`: Tags applied within job-retry resource scopes after common provider tags. The default is `{}`.<br/>- `webhook.job_retry.lambda.memory_size`: Memory allocated to the job-retry Lambda in MB. The default is `256`.<br/>- `webhook.job_retry.lambda.reserved_concurrent_executions`: Reserved concurrency for job retry. The default is `1`; use `-1` for unreserved concurrency.<br/>- `webhook.job_retry.lambda.timeout`: Job-retry Lambda timeout in seconds and visibility timeout for its retry queue. The default is `30`. | <pre>object({<br/>    webhook = optional(object({<br/>      runner = optional(object({<br/>        boot_time_in_minutes = optional(number, 5)<br/>        ephemeral            = optional(bool, false)<br/>        jit_config_enabled   = optional(bool, null)<br/>        maximum_count        = optional(number, 3)<br/>      }), {})<br/>      github = object({<br/>        organization_runners = bool<br/>      })<br/>      queue = object({<br/>        build = object({<br/>          arn = string<br/>          url = string<br/>        })<br/>        kms_key_id = optional(string, null)<br/>        tags       = optional(map(string), {})<br/>      })<br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        scale = optional(object({<br/>          up = optional(object({<br/>            memory_size                    = optional(number, 512)<br/>            timeout                        = optional(number, 60)<br/>            reserved_concurrent_executions = optional(number, 1)<br/>            job_queued_check_enabled       = optional(bool, null)<br/>            event_source_mapping = optional(object({<br/>              batch_size                         = optional(number, 10)<br/>              maximum_batching_window_in_seconds = optional(number, 0)<br/>            }), {})<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>          down = optional(object({<br/>            memory_size                     = optional(number, 512)<br/>            timeout                         = optional(number, 60)<br/>            schedule_expression             = optional(string, "cron(*/5 * * * ? *)")<br/>            minimum_running_time_in_minutes = optional(number, null)<br/>            idle_confirmation_seconds       = optional(number, 0)<br/>            idle_config = optional(list(object({<br/>              cron             = string<br/>              timeZone         = string<br/>              idleCount        = number<br/>              evictionStrategy = optional(string, "oldest_first")<br/>            })), [])<br/>            tags = optional(map(string), {})<br/>          }), {})<br/>        }), {})<br/>        pool = optional(object({<br/>          memory_size                    = optional(number, 512)<br/>          timeout                        = optional(number, 60)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          config = optional(list(object({<br/>            schedule_expression          = string<br/>            schedule_expression_timezone = optional(string)<br/>            size                         = number<br/>          })), [])<br/>          include_busy_runners = optional(bool, false)<br/>          runner_owner         = optional(string, null)<br/>          tags                 = optional(map(string), {})<br/>        }), {})<br/>      }), {})<br/>      job_retry = optional(object({<br/>        enabled          = optional(bool, false)<br/>        delay_in_seconds = optional(number, 300)<br/>        delay_backoff    = optional(number, 2)<br/>        max_attempts     = optional(number, 1)<br/>        tags             = optional(map(string), {})<br/>        lambda = optional(object({<br/>          memory_size                    = optional(number, 256)<br/>          reserved_concurrent_executions = optional(number, 1)<br/>          timeout                        = optional(number, 30)<br/>        }), {})<br/>      }), {})<br/>    }), null)<br/>    scale_set = optional(object({<br/>      name = string<br/>      runner = optional(object({<br/>        min_runners          = optional(number, 0)<br/>        max_runners          = optional(number, 10)<br/>        boot_time_in_minutes = optional(number, 10)<br/>      }), {})<br/>    }), null)<br/>  })</pre> | n/a | yes |
 | <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix used for naming resources. | `string` | `"github-actions"` | no |
 | <a name="input_runner"></a> [runner](#input\_runner) | Provider-neutral GitHub runner configuration.<br/><br/>- `os`: Runner operating system. Supported values are `linux`, `osx`, and `windows`.<br/>- `architecture`: Runner distribution architecture, such as `x64` or `arm64`.<br/>- `disable_default_labels`: Prevents GitHub's default self-hosted, operating-system, and architecture labels from being registered.<br/>- `labels`: Complete set of labels supplied to the control-plane functions.<br/>- `group_name`: GitHub runner group used during registration.<br/>- `name_prefix`: Prefix added to registered runner names.<br/>- `run_as_root`: Runs the runner service as root when supported by the compute provider.<br/>- `run_as`: Operating-system user used when `run_as_root` is false.<br/>- `auto_update_disabled`: Disables the GitHub runner application's built-in updater.<br/>- `tags`: Additional tags for common runner resources, currently the managed runner IAM role. These override module-level `tags` with the same key.<br/>- `hooks.job_started`: Script content installed as the runner job-started hook.<br/>- `hooks.job_completed`: Script content installed as the runner job-completed hook.<br/>- `iam.role.arn`: ARN of an externally managed runner role. When set, this module does not create or modify that role.<br/>- `iam.managed_policy_arns`: Named managed-policy ARNs attached to the module-managed runner role.<br/>- `iam.additional_trust_policy_json`: Optional IAM policy document merged with the selected compute provider's default runner-role trust policy.<br/>- `iam.path`: IAM path for the module-managed runner role. Defaults to a path derived from `prefix`.<br/>- `iam.permissions_boundary`: Permissions-boundary ARN for the module-managed runner role. | <pre>object({<br/>    os                     = optional(string, "linux")<br/>    architecture           = optional(string, "x64")<br/>    disable_default_labels = optional(bool, false)<br/>    labels                 = list(string)<br/>    group_name             = optional(string, "Default")<br/>    name_prefix            = optional(string, "")<br/>    run_as_root            = optional(bool, false)<br/>    run_as                 = optional(string, "ec2-user")<br/>    auto_update_disabled   = optional(bool, false)<br/>    tags                   = optional(map(string), {})<br/>    hooks = optional(object({<br/>      job_started   = optional(string, "")<br/>      job_completed = optional(string, "")<br/>    }), {})<br/>    iam = optional(object({<br/>      role = optional(object({<br/>        arn = string<br/>      }), null)<br/>      managed_policy_arns          = optional(map(string), {})<br/>      additional_trust_policy_json = optional(string, null)<br/>      path                         = optional(string, null)<br/>      permissions_boundary         = optional(string, null)<br/>    }), {})<br/>  })</pre> | n/a | yes |
 | <a name="input_ssm"></a> [ssm](#input\_ssm) | Parameter Store paths, encryption, tag scopes, and housekeeper configuration.<br/><br/>- `paths.root`: Root Parameter Store path for this runner configuration.<br/>- `paths.tokens`: Path segment under `paths.root` used for registration tokens and just-in-time configuration.<br/>- `paths.config`: Path segment under `paths.root` used for persistent runner configuration.<br/>- `kms_key_id`: Optional customer-managed KMS key ARN used by control-plane IAM policies to decrypt shared GitHub App parameters. The ARN may be unknown until apply; null omits the provider-owned KMS statements. It does not select encryption for runtime-created runner parameters.<br/>- `tags`: Shared tags for SSM-related resources. These override module-level `tags` and are inherited by parameter and housekeeper resources.<br/>- `parameters.tags`: Tags for Terraform-managed runner configuration parameters and temporary parameters created by the scale-up and pool Lambdas. These override module-level and `ssm.tags` values with the same key.<br/>- `housekeeper.schedule_expression`: EventBridge schedule expression that invokes the SSM housekeeper.<br/>- `housekeeper.state`: EventBridge rule state, such as `ENABLED` or `DISABLED`.<br/>- `housekeeper.tags`: Tags for housekeeper resources, including the Lambda function, log group, EventBridge rule, and IAM role. These override module-level, `ssm.tags`, shared Lambda, and shared log tags when keys conflict.<br/>- `housekeeper.lambda.artifact`: Component-owned SSM-housekeeper artifact selection. Set at most one of `zip` or `s3`; when neither is selected, the module uses its packaged runner control-plane archive. This selector does not inherit an orchestration-provider artifact.<br/>- `housekeeper.lambda.artifact.zip`: Optional local path to the SSM-housekeeper Lambda archive.<br/>- `housekeeper.lambda.artifact.s3`: Optional object key and version in the shared `lambda.artifact.s3.bucket`. Selecting S3 requires that common bucket.<br/>- `housekeeper.lambda.artifact.s3.key`: Object key of the SSM-housekeeper Lambda archive.<br/>- `housekeeper.lambda.artifact.s3.object_version`: Optional object version of the SSM-housekeeper Lambda archive.<br/>- `housekeeper.lambda.memory_size`: Memory allocated to the SSM housekeeper Lambda in MB.<br/>- `housekeeper.lambda.timeout`: SSM housekeeper Lambda timeout in seconds.<br/>- `housekeeper.config.tokenPath`: Parameter Store token path cleaned by the housekeeper. When omitted, the configured runner token path is used.<br/>- `housekeeper.config.minimumDaysOld`: Minimum parameter age in days before deletion is allowed.<br/>- `housekeeper.config.dryRun`: Reports eligible parameters without deleting them when true. | <pre>object({<br/>    paths = object({<br/>      root   = string<br/>      tokens = string<br/>      config = string<br/>    })<br/>    kms_key_id = optional(string, null)<br/>    tags       = optional(map(string), {})<br/>    parameters = optional(object({<br/>      tags = optional(map(string), {})<br/>    }), {})<br/>    housekeeper = optional(object({<br/>      schedule_expression = optional(string, "rate(1 day)")<br/>      state               = optional(string, "ENABLED")<br/>      tags                = optional(map(string), {})<br/>      lambda = optional(object({<br/>        artifact = optional(object({<br/>          zip = optional(string, null)<br/>          s3 = optional(object({<br/>            key            = string<br/>            object_version = optional(string, null)<br/>          }), null)<br/>        }), {})<br/>        memory_size = optional(number, 512)<br/>        timeout     = optional(number, 60)<br/>      }), {})<br/>      config = optional(object({<br/>        tokenPath      = optional(string)<br/>        minimumDaysOld = optional(number, 1)<br/>        dryRun         = optional(bool, false)<br/>      }), {})<br/>    }), {})<br/>  })</pre> | n/a | yes |
@@ -124,6 +124,7 @@ yarn run dist
 
 | Name | Description |
 |------|-------------|
+| <a name="output_compute_provider_contract"></a> [compute\_provider\_contract](#output\_compute\_provider\_contract) | Provider-neutral compute-provider capabilities consumed by topology-level orchestration. |
 | <a name="output_orchestration_provider"></a> [orchestration\_provider](#output\_orchestration\_provider) | Resources grouped under the selected runner orchestration provider. |
 | <a name="output_pool"></a> [pool](#output\_pool) | Scheduled pool resources. Null when no pool configuration is supplied. |
 | <a name="output_provider"></a> [provider](#output\_provider) | Provider-specific resources grouped under the selected provider namespace and type. |
diff --git a/modules/ssm/README.md b/modules/ssm/README.md
index e35c340071..9a3f98a379 100644
--- a/modules/ssm/README.md
+++ b/modules/ssm/README.md
@@ -31,6 +31,7 @@ No modules.
 | [aws_ssm_parameter.additional_github_app_key_base64](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [aws_ssm_parameter.additional_github_apps_manifest](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [aws_ssm_parameter.github_app_id](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
+| [aws_ssm_parameter.github_app_installation_id](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [aws_ssm_parameter.github_app_key_base64](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 | [aws_ssm_parameter.github_app_webhook_secret](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
 
@@ -39,7 +40,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_additional_github_apps"></a> [additional\_github\_apps](#input\_additional\_github\_apps) | Additional GitHub Apps for distributing API rate limit usage. | <pre>list(object({<br/>    key_base64          = optional(string)<br/>    key_base64_ssm      = optional(object({ arn = string, name = string }))<br/>    id                  = optional(string)<br/>    id_ssm              = optional(object({ arn = string, name = string }))<br/>    installation_id     = optional(string)<br/>    installation_id_ssm = optional(object({ arn = string, name = string }))<br/>  }))</pre> | `[]` | no |
-| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters, see your github app. <br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here, <br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | n/a | yes |
+| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub app parameters, see your github app. <br/>  You can optionally create the SSM parameters yourself and provide the ARN and name here, through the `*_ssm` attributes.<br/>  If you chose to provide the configuration values directly here, <br/>  please ensure the key is the base64-encoded `.pem` file (the output of `base64 app.private-key.pem`, not the content of `private-key.pem`).<br/>  Note: the provided SSM parameters arn and name have a precedence over the actual value (i.e `key_base64_ssm` has a precedence over `key_base64` etc). | <pre>object({<br/>    key_base64 = optional(string)<br/>    key_base64_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    id = optional(string)<br/>    id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    installation_id = optional(string)<br/>    installation_id_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>    webhook_secret = optional(string)<br/>    webhook_secret_ssm = optional(object({<br/>      arn  = string<br/>      name = string<br/>    }))<br/>  })</pre> | n/a | yes |
 | <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | Optional CMK Key ARN to be used for Parameter Store. | `string` | `null` | no |
 | <a name="input_path_prefix"></a> [path\_prefix](#input\_path\_prefix) | The path prefix used for naming resources | `string` | n/a | yes |
 | <a name="input_tags"></a> [tags](#input\_tags) | Map of tags that will be added to created resources. By default resources will be tagged with name and environment. | `map(string)` | `{}` | no |

From 4b1b11ab07f7899501428b990dd696bc74b2b712 Mon Sep 17 00:00:00 2001
From: Ederson Brilhante <contato@edersonbrilhante.com.br>
Date: Thu, 17 Sep 2026 17:20:23 +0200
Subject: [PATCH 49/52] feat(examples): add scale-set orchestration example

---
 .../.terraform.lock.hcl                       |  93 ++++++++
 .../.terraform.lock.hcl.tofu                  | 150 +++++++++++++
 examples/multi-runner-scale-set/README.md     |  84 +++++++
 examples/multi-runner-scale-set/main.tf       | 208 ++++++++++++++++++
 examples/multi-runner-scale-set/outputs.tf    |   8 +
 examples/multi-runner-scale-set/providers.tf  |   9 +
 examples/multi-runner-scale-set/variables.tf  |  58 +++++
 examples/multi-runner-scale-set/versions.tf   |  17 ++
 8 files changed, 627 insertions(+)
 create mode 100644 examples/multi-runner-scale-set/.terraform.lock.hcl
 create mode 100644 examples/multi-runner-scale-set/.terraform.lock.hcl.tofu
 create mode 100644 examples/multi-runner-scale-set/README.md
 create mode 100644 examples/multi-runner-scale-set/main.tf
 create mode 100644 examples/multi-runner-scale-set/outputs.tf
 create mode 100644 examples/multi-runner-scale-set/providers.tf
 create mode 100644 examples/multi-runner-scale-set/variables.tf
 create mode 100644 examples/multi-runner-scale-set/versions.tf

diff --git a/examples/multi-runner-scale-set/.terraform.lock.hcl b/examples/multi-runner-scale-set/.terraform.lock.hcl
new file mode 100644
index 0000000000..c96d2b19bf
--- /dev/null
+++ b/examples/multi-runner-scale-set/.terraform.lock.hcl
@@ -0,0 +1,93 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "6.63.0"
+  constraints = ">= 5.0.0, >= 6.21.0, >= 6.33.0"
+  hashes = [
+    "h1:9cre7jh1lSs/9igpgAcENMUAUlYW3HCtkav3up4oit0=",
+    "h1:dRlYHkc+r6fgzF57WC7Zjcmb6sF/6TTGDEgwGK+LAZY=",
+    "zh:005d56736afd17d963998c405cee6f434dbc23a415109f9435ff1542879ae611",
+    "zh:026ef126321a86ad7080b5d858e2527f96f5289678cbcd8856296e229c43339d",
+    "zh:06e0b58b2d1eddb5137fc86bee7ad2d07953c0bc3f57cccfc5ae0d2456068a3a",
+    "zh:07221735d61ababed84734e5ffcfc5bd59d01f29f029166ba5f2175895dceed1",
+    "zh:1a72db00583112bdb8c19b213a78a3f5de754fffc08f07e061f4e326289fab7d",
+    "zh:32968e74a53b03e97a084dc7050c22ef661fb5b3ea8a44f5a63e47bc45ad0e7c",
+    "zh:4b357dfe4b820e3e4acd2881cff8288b2186491e63416751f0d12692ba478ceb",
+    "zh:81e30884d7de686265e7d87bb92527e802878c65a378470ede2a1e9f4e40ccc9",
+    "zh:82e137297f6a5a08b9ce2138f7aabea245ad99495d9d9eff502f752d6ca90dbd",
+    "zh:8eb83b67099f0ea9df238a979dff933ff50ce06a2e3ff05a48556a10f10dd204",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:d0ba30886cbe41850fee689f51ef9088578f323cfd21817bb409951d43c465eb",
+    "zh:dd48e7089784454bc03d713e9057f5ca0ea1613bd402125054a51894957b7925",
+    "zh:f250fa81e54cf60fcb0e9c0fc4ac043f1ecc2ac24967f628b3609364fcab3d04",
+    "zh:f38fc09fc25a8d2cf89a4d4cd6a5ef7cb1aad72798dbdcad58b8876b6a551a54",
+    "zh:f7c7380fdf126e1901f2084588dbfd724c76cb131ccfa795a541219111103c06",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/local" {
+  version     = "2.9.0"
+  constraints = "~> 2.0"
+  hashes = [
+    "h1:9rBZCMNpxKwMlRbWH2QpwD3kqUCAejdOZQ/aiiDObXQ=",
+    "h1:m24fjcInWvTVZ1XSo2MaNuKPe+X/gfG8SIi09rA7a7M=",
+    "zh:0baa4566cf77f1ff52f4293d1c8536202dd23edc197c3196413a28343c3ac3a0",
+    "zh:16b5559c3c07088ddad11a9bb9e9c0799999363c2958e9a5be2bcbbf2cd9ca64",
+    "zh:197c79015a10d1cce904a8ea722cbc750c42aeae2da53f44a6a0751d9fd1aa90",
+    "zh:29d0b03e5343a80677ebfeb2e2c31cbe4b1f65e736e53417454a4277fec2544c",
+    "zh:4896bfa6cf1d2fd562b47ef2e87f47862ae92a04f8ad5d764380f0c6653473b8",
+    "zh:531f8529cbca49f681883e57761a05a8398afaef6d1ab0d205d26bf12f4428e8",
+    "zh:6aaf5011d83161c86d2bfb80c0923ec934e578288758da2f37acb7aec129004b",
+    "zh:7430275253d3d3c40aa6179e0ec0d63212874dbbc06c5a51b9d07ec590f9756c",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:be17dc611e95e26cdf6cad79dfccf1064f0e32032a2efeb939a9bbe7fb1cbfe9",
+    "zh:f0e3b0aa644202e1d79d2000dca91f6019425da71e9800fa23f27e51c034f195",
+    "zh:f62bae4519e4ead49182ddc8afe8cf61e2a4c3ba3973b0fbba967736a2696aa3",
+    "zh:fcafa360a5b0b96244f26f4e3a6d642b716a376557142c2442ff2fb12d11da18",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/null" {
+  version     = "3.3.1"
+  constraints = "~> 3.0, ~> 3.2"
+  hashes = [
+    "h1:TuxJq10DVnRP7c5HBZPyyvQGcckNVfijyU1eXEu5e4M=",
+    "h1:m5FqidbIgh+E9OigiZh8/xbkvpUQFSj3hZo/jqNLCLQ=",
+    "zh:08c59776542ea16e5a8545752787b17ff412922182b4cfabe16139197be8ac44",
+    "zh:123109cc7e5ed6d515787fbc212f2a3fd5e75647bb24ab7c801ccd4d4ed42451",
+    "zh:14b3fa4372754b54844b41d5dbd4671a292d8d6828b90169061feb4d7b15dd05",
+    "zh:56a4daaa3212f57b764bf3d1f333141c6610c5f21abb240e0111221f7c7fa4d4",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7e888a026dbacd2474a42264227ae35f639780f0f0c613529d10a95cd61988b3",
+    "zh:85a53646267e87d600df7124e4767ffde9bba3b6356d45d961618bdd68131cc7",
+    "zh:8ffa0e9c7c39b2ab0905b472465d6e35ef0b776b3f6273bb34c150340b61bff1",
+    "zh:9846510a1841530d4403f4818e233f91e3b3bade7441047599fbf800742f65be",
+    "zh:afa98d44860875f037c6def0a7e6ff208e042712ba771f620482b143cd336891",
+    "zh:bdca130d9ef27488ae0b13bc8fd8019e8bbdd4f2ceff29da066bd333165d68c5",
+    "zh:cb3b94cbca88210dd0d1f11e2b8a89333f48c3857faf8f70f589072ce7c28610",
+    "zh:f0c0ba87925fe32f84b80f7513b1efb1b0866f51f899ba825e95ad59ff09b018",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/random" {
+  version     = "3.9.0"
+  constraints = "~> 3.0"
+  hashes = [
+    "h1:OO+IuvQJSPmWdN8AyyIEvPJbLvDQpgX/zbktoa9KsJE=",
+    "h1:UlBuNVuCGJ39tTv2c5gz2NRZnQbXfbIWbTzWcth5o74=",
+    "zh:161ad0bd9a75768c82f53fb6e7172a9d8be2d4889b012645a34795031aaf1bf1",
+    "zh:19dc9a5b17729725ccfc4f45b0500af0ee5bc6b6b160c7adb8f2bf617d2c80ea",
+    "zh:269eda8fe42daa7974d5a34d166c3ba9defe80cde86c01e4dadcfdf2e1f05e5f",
+    "zh:373f7c65566f8f2cc7f45d698654feb9d988996957e1266a69ca00c52d6d16d0",
+    "zh:5599d16804c41c83009ec621b6d6b6f74e102f5827678a4750f8809055546b61",
+    "zh:583be0440469a22bff70dcfa56593b01566860b29607437264adb51060cf46fc",
+    "zh:5f211d8ec3f2e1f414870d9584bfe26e6995560ef81c748f8447a48164767398",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7b547fd16216761ef86efc3ed516ac5ac0c5c42b7c7eb24a08cef2d93f69ed5e",
+    "zh:7e7c0679daf2a382151d05068c8c3f0dae6b7b7dccf818827b73dd08638df2ef",
+    "zh:8089dec888a8038b9b4fb23b3df7e1057293dbc5b60b42cc47ff690d69d4b61b",
+    "zh:c51f15a031edfd6f23ce8ced3446ca7f8d8d647e2499890d7d5d10d5016d7257",
+    "zh:c94784f005708890dc6895afd53636ec00ec1e430b15d41e5aebfb1d4b39bd04",
+  ]
+}
diff --git a/examples/multi-runner-scale-set/.terraform.lock.hcl.tofu b/examples/multi-runner-scale-set/.terraform.lock.hcl.tofu
new file mode 100644
index 0000000000..577519c08d
--- /dev/null
+++ b/examples/multi-runner-scale-set/.terraform.lock.hcl.tofu
@@ -0,0 +1,150 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hashicorp/aws" {
+  version     = "6.63.0"
+  constraints = ">= 5.0.0, >= 6.21.0, >= 6.33.0"
+  hashes = [
+    "h1:1jhQJPHOPu2mzDG/ke3tK8PNcEqQHA4vhF05WWlM/yg=",
+    "h1:3+pvT0KN/bkJ6TBuExj+gxptEozhnpo80Ztblwq85eo=",
+    "h1:5aTequ87wZS7Mh4dEIayDGKcFdaFgHtw74NtqY5Idi0=",
+    "h1:AMRlrrM3z1SmrslOtotqKq02zapxLKtXaSN9Jbs0Oho=",
+    "h1:OTjECFWTDxsjcUfOKCNBp75Z5lGrW/KplRDsjTZYT2g=",
+    "h1:b8LORLOKMOOl+nK1M2UhCjELSjjziClJuAv6hYuySHs=",
+    "h1:bUfTX1giRLOyfDbBvsDbwR3tJmsTFRWcOTQdj2npDWA=",
+    "h1:dzs4kwx+itVGAH7yEOyeoWcE3LNRMnWtlt4ROgyAa0M=",
+    "h1:lnjou+SiwpYJ+j9PXWozXPHSPlhxIZb0RqpsSEBzfGw=",
+    "h1:pqzUeHAQj9NctgkwaynaF2aB+3QiZXcoslzMGjT743w=",
+    "h1:qTXEWOWxA6sfUpC29UXrsbHnNzWH7+j1RTUVG4YCm+U=",
+    "h1:qdHKOKt/ISn9RLjUe22OZBpN3F7H2DFeHJL/CSc2x8E=",
+    "h1:tpNzIZBzzUW7/kLU3BhYf3jhdO5uNwYfNmgC9B8kvMM=",
+    "h1:uVVlFgjg6GyxJLbCsTO1+R5fTNbZ73mLpVpSd0mMrFk=",
+    "h1:xGJsV5IFf7c11cXzJrsY40hiJCghp4odT0eJyTyAUYY=",
+    "zh:039a03e920e55f14a691feb67216a2d142bfee603128e15f9c5138f9ecd85016",
+    "zh:14e060b7f46ca7b0fa009b91aef419c58cbdff854de96e9a1d853166f8d902fd",
+    "zh:18803e8fe2c291c8db5526c71b3287ff7c81453f10ca6d8e69cdf9c535b00783",
+    "zh:1b83fce6e31a6095e932d80a7c3f47ac04252653a2de2b98ec6204563310fcba",
+    "zh:2add7bc976ceebb1a94d84598762c9b9cf281ca52ec83deeb4e95e90aa200a12",
+    "zh:2f22cd5372408f11937fa5513a7b960d3cebc334c5ec65fc5322c3bac1c1f664",
+    "zh:41c5e857dacfd83b7ca12a435204957ff6ca8830b9efefd0d381ad4d63b19779",
+    "zh:4eace6246e46999782d219bc4f50f83d19ef9156bacf5ca1528da12da4918015",
+    "zh:5e1c1281c3f929399e2ed3dbdce03426fd57a9ec55cd36e04acf1712aa5954ba",
+    "zh:608272b1f5d75ead123c9d933aa1fed7dc832cedd1506019046b4c8fdcc91dce",
+    "zh:6b3680f8a2f7be2c171953aba89d639fb2624b9cf52ec304e16434874566601d",
+    "zh:99aa1006f2141f3341a02020e1c91abfb02280e57c77e0415c98b8d900353d88",
+    "zh:9ad235bef34a89a8dd9943f9fa9f05cc729bb52a4e0dc926a31bb13cb0ae2418",
+    "zh:e0e3ac361e04748a4ca0c1cdbb6abab2aa817f4ad67e1692817d16e370161d59",
+    "zh:f60962c982a41fde956e796425e7194b4311741c179c060c1c8b5e16a557d635",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/local" {
+  version     = "2.9.0"
+  constraints = "~> 2.0"
+  hashes = [
+    "h1:1dtKYW/5a1qob3yneL6WzOlnSGfYtJ6a2XeejCk9yb4=",
+    "h1:5NseXq5wU8O20ersTtV4ocrLYFFtgFr7n0pRLO1W2Rw=",
+    "h1:5d22ZPPK4iiygPbwRz/PJF5Es/0axVpMlPRpCR0Padw=",
+    "h1:AnwyolirmIlBMjH6+tV8bKkvT+5axJNYxi2y2IguiX4=",
+    "h1:PBp+HeseY021Fw3sLznCG27idgwPoff4cBuNmKgPL2w=",
+    "h1:VDxIhe4GbzdOCdmt7mQaqdwERQW6GSI7Roonts42Gr0=",
+    "h1:ZO6eWWnf8LjjV1q/JNeL9WLtZ6fwIttOnyN5LjCNSEo=",
+    "h1:dPIAf8oUAz+vW2E0iZunMvpuPddRZIztRsPSY1u+VnY=",
+    "h1:fwTDVG9AhFVKQZIb1EXkHv4FqzsZNlLWgkyPGDmZZEE=",
+    "h1:kDc465XPC7/6XFCjrMC4mTqhA9ef0FHKuJ3ZgfGNfeg=",
+    "h1:kGbjxrI2P8MHeyVtE1U3Q1TbyF71ExnHxtkrE+Aj6UU=",
+    "h1:kcoK6Afbsj54u9zaEqpecWAFKytqjBijtguCNwV3d4M=",
+    "h1:rxomJjDwOo+YZ+WIPc25FqEgsz9orh/2MCyUcZmFjvw=",
+    "h1:t0CMn/Rkwquw8l2yQ+O4ApzbMZfY2UazbsDnZygzACA=",
+    "h1:tJwgm2BS4xCGlElCDQEFXQoefY9Y4t0JdSKTtsPBbBo=",
+    "zh:13ef7ecd1e397ec5b20ea588508dd3e3b8d6c50d809ae76b079abf9dd8d02e4b",
+    "zh:2190c9325980076489ce02b0f5dd2c0b91fc8711cefa99e714d8619a32827ad1",
+    "zh:2a0cfc5600730093705071707e4a4e4e953e7d9091859e0f66b46daa1060dd5d",
+    "zh:2ff53eac1af43ab9a2248a0e53c963d46e19cf04bc4c3f323591cfcebb218252",
+    "zh:4ebc3dee700f60af9da29970052fd02fa947813162b224716862dc9d7f1f7542",
+    "zh:5fe6dab84ceeaa8eb3f1567c5f05578333370c472240ca5c5bfc25e92d4d5586",
+    "zh:66bbec16367bbf440045502c9779b11f4ac5b022c8d8d17afe12d431950838b5",
+    "zh:7641e5c2e4b529e869cde29ab5b1de2fd1091489eb745b19ac2709bd7f4dfd84",
+    "zh:855bfba0756d17ce07595ff57d7cf664443d1495127cb88fb063362734b8b22a",
+    "zh:aaec10f237921d60c581d1b7a66f0a8a8019d9802dc04af11b5b981f6682e01d",
+    "zh:e460835a38ffa1e74f6929904bfd14ef473d217fd537b7ce834abe5ce5e2ce07",
+    "zh:ecc4295215db0e4aea3c9329611c31e09a853e1ae207d56742403bd4f5516703",
+    "zh:ee6d9fae63a612072e00402894e14826af7a3351c235b9c5b423b7629a77ca29",
+    "zh:f2b5c8db74aa7ebcf7cd423672358437d42401675069ef67b01ff910054e49d5",
+    "zh:f5aff74d3eb96d4592c7bca5cd3ea89b469e84efbf382944bd0f844a57059c09",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/null" {
+  version     = "3.3.1"
+  constraints = "~> 3.0, ~> 3.2"
+  hashes = [
+    "h1:2wld81FnmHW0WVgy081sIfokCr2+NuatS8yjeLEet7Y=",
+    "h1:AClQjJ6X22V4qcRgcYSxiXCMmp2pz0G8WVQC7wAx66o=",
+    "h1:AY3XQbuviNd2X5VhHYEbhNta1m/CG3JD2BKFKhCt1Y4=",
+    "h1:CUOZUd7H11lsU+4tISlnYIiP5BqnX8IDwFCVqfLJyAg=",
+    "h1:JIfV0nA/pLWnIFGscvTfuavQCn2NeHxJBeb6UUg/joA=",
+    "h1:RejAh+nyCwqDGExGln2Kb4Ro5LyHak0eJe0P9g8CHPc=",
+    "h1:SHOuTZjYymsmy4asuRq6NC3yW+zdVZOOt4f5nrb+EPM=",
+    "h1:WwPat/gT4gO8GvvKNdSkkXWVD65JppLJfqKOt9HhOqQ=",
+    "h1:Z3hXVLrOyaRiiLmmL5UCOdcRMguwjN1x5TYNdmBDgls=",
+    "h1:dd78Ad5HdfPzPts7A9qIxfitXhAriV/qza38fr2ukjk=",
+    "h1:dyVb++KwDdybzLTE6bf7GZiVQ31iWsgKPWmhTQ8G42k=",
+    "h1:gD8ZH6WWe+5gg5+y8SpLWGPUDzSxcQ3HKP8IDM/wW3I=",
+    "h1:juXCww0zRQKFTDZoKqYR0+Sn1lu99oeL6pr0Jh6LWx0=",
+    "h1:kFAySmtsshyNV7IhIrEdASzVcvwy68eeZCVC66P7yNk=",
+    "h1:nS5azDopRisB2NInwDx3Hrfg2FdVt8Gw0gTQzC0rd70=",
+    "zh:164eb061d84e01759f391265865fb31828083d0a06b25f7af7e094cbdb18c799",
+    "zh:1bb9b669a82b52c0cba2860c71e9ee6699ef302f28cb8ed06f572d39bc6c7c4f",
+    "zh:1ea9b31a8f29302122c1e8d673693f3ac270336dae560af803cd1117265a469a",
+    "zh:238bd463cb0154fb935dc331da40c0a9cbe5db9cee615ae5f35ccad5eed7dc41",
+    "zh:30ef2b7384cf7e20f33fe75754b54cf669d59816f3ad4fc73bfb2b26fb6735e9",
+    "zh:35b5cded16e4b57c207d03ee0979b14baf486fa520e6edb7a2eecf18f1b85471",
+    "zh:3dc840d13a50cd215c7540573f27e2b61f739ba90aee5b7c3846079aa0ab5534",
+    "zh:3f9309a18db608f975d5691fcb47a6e14d77199156a52e9c39dcafe3737f2b07",
+    "zh:44263a219f7dbd1848b545d080110b4f7d0495e77b71cd3c7a0b5ec52a09accb",
+    "zh:4dec54aa5f445eeea035bbd4839bcded5e47ecd07cba0e70c5a09e9272cb592f",
+    "zh:5e8fb319d7c6d6c4566a18b9d0c91580b4901a96acd7fdc476bfc79f074368e2",
+    "zh:b0e8b6d41834b57fcfbb5ca00da52ccb757e1a95b6a2d546c0dae8bfbeca1cdf",
+    "zh:bbde4c3a1dcc1718027a61a4cdf661619d17af1b58df1038fe27bcf43c3dc29b",
+    "zh:c4140fff9f692baf29236557f706f9515f93229413438527d764023a82301da3",
+    "zh:f8e9d83184e4bbeb97c6f0d569833007c48ba5a7ff334def201df4991d03a962",
+  ]
+}
+
+provider "registry.opentofu.org/hashicorp/random" {
+  version     = "3.9.0"
+  constraints = "~> 3.0"
+  hashes = [
+    "h1:8EQU5KSxezcjo/phRSe69rDOI0lk4pSaggj7FsskYp8=",
+    "h1:Lw9im2VBBJQ3RyAbHPQ0rcvcmmcZWm3x+kIOpN+Tv9s=",
+    "h1:U8KXqGCoNI9/guYbTvzgdtVk3fRthoG0UXwm1JoEpIs=",
+    "h1:YXaVd4p6qXPPVaxIBaIDNXmBwT02ZqDn0qD+tYpw8sA=",
+    "h1:cOpc03fphEt/G9Rfc4jLL/fW0D7tgvlXqiDKPF4vuww=",
+    "h1:g09RR7T1xWkeGrZwWvWMT9ncJrFGr1k3CBD585UmO7w=",
+    "h1:gGDdPPibmw2EWROx+sh1RGLjR5+nPwZyrf6/N9jXfeM=",
+    "h1:haE7/nXCOhXKP4oXeEnER3t5CaVQWqujz4nBnpeTUv4=",
+    "h1:ieSVpfZS2lKuMr05ph0QsOVpCzg7uk3cgKBaXR+Ikug=",
+    "h1:ig2s1IS9IzehorRjvVAnKIsUUj8fkgyxct1L/kswcc4=",
+    "h1:j3lS+ZEERFnoab8t1ppDrScGVP/cgWbzlCrEYKTCXYw=",
+    "h1:lxezrKmOiQIySHAM+os8qLVq7hqufDr8h3Hpzvsk+78=",
+    "h1:lzRqBJAG+NETxHbEZUJ/YP3RMEjZBinTX7VmgH3lw60=",
+    "h1:tdSNWK5ApqUsgbdYieyeYLTu6nIZUV3hR1oFqUfAuGo=",
+    "h1:xedet8yH/zI2CfdxsGlK0nlFWc/Bp61yrWsEa3fHB8g=",
+    "zh:03f1114cc20b8913523735ab76e0f0a2b16ce13c92923a53304bf85f07fc0dbc",
+    "zh:105b678ee72322a3067f105d7e05e940f6143238f377f6e87ff4ec909246ac2a",
+    "zh:55f3bbf13ea18cbace61a706566a80f25f33fe2b1780b6f3d7b582af2a05b6d2",
+    "zh:63adf996db48f082f7a6351eb485e219cd88795fc71e6ec60a837263ab0d2cb1",
+    "zh:7e99550738a4e3cc68b8a467714b0d69371025fe95e3326d5323d026d55653e9",
+    "zh:8342b54af3a18a37e075eeae61be57f4de2ba71b35d95c5075d402dd2c1f289d",
+    "zh:83ee18e32ac9dd5fc91298554b7c4cfa4c3a1db50f4c797945637cc93c0844ae",
+    "zh:993ecc0adbf6bd535a59fbc9b735d8c33950e6f6eb5e621d750da9b71d65d80a",
+    "zh:ad722bc59d4edbf1415e827fc007c0efe6e0e9462d5568bae20b34be1058a261",
+    "zh:ae9448e1f87b2f9a6c5197a0e9862162ec6b137cb3a3835e11522995d8939e7c",
+    "zh:bc9cdd3aac784f759125c6627f6f6416e8726a1c184eb9cf3e55b9edbc94c627",
+    "zh:c8e35b89572ba1c40a9b20022e033a3395fb8d42e7604d50c900f193ba10382e",
+    "zh:e2deaa8a9975ef81d9f62baed12c41286918b0a10908e0e031f13f69a3b730a1",
+    "zh:ee39707557210a0ab1098aa357d2cdfe502e5a312d0dbdffb09d08facc4d3fc5",
+    "zh:f81afe4eb63e8aa9e0ea71be6c990f0dc69cb360e7191c0742a991f4a5081b64",
+  ]
+}
diff --git a/examples/multi-runner-scale-set/README.md b/examples/multi-runner-scale-set/README.md
new file mode 100644
index 0000000000..d7119a30be
--- /dev/null
+++ b/examples/multi-runner-scale-set/README.md
@@ -0,0 +1,84 @@
+# Multi-runner scale-set example
+
+This example demonstrates the experimental multi-runner v2 interface. Shared
+defaults are configured with `global_config*` variables, while
+each runner lane uses `multi_runner_config` for its matcher,
+runner lifecycle, and compute-provider settings.
+
+The example creates four lanes from one deployment:
+
+- Linux ARM64 Amazon Linux runners.
+- Ephemeral Linux x64 Amazon Linux runners with job retry enabled.
+- Linux x64 runners managed by a GitHub Actions scale set.
+- Windows x64 Server Core 2022 runners.
+
+The v2 interface keeps provider-owned settings inside the selected provider
+configuration. For example, VPC and subnet settings are under
+`global_config_compute_provider.aws.ec2`, while the per-lane
+instance types and AMI filter are under each lane's compute provider block.
+
+The scale-set lane uses `orchestration_provider.scale_set`. Its controller
+network is configured under the global scale-set block and its GitHub
+installation ID is provided by `var.github_app`.
+
+Configure the GitHub App variables before applying:
+
+```bash
+terraform init
+terraform apply \
+  -var='github_app={id="123456",key_base64="...",installation_id="123456789"}' \
+  -var='scale_set={name="linux-scale-set",container={image="ghcr.io/github-aws-runners/terraform-aws-github-runner-scale-set-service@sha256:<release-digest>"}}'
+```
+
+The `github_app` value is sensitive and should be supplied through a secure
+variable source in real deployments rather than committed to configuration.
+The GitHub App must be installed for the configured GitHub account.
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+| Name | Version |
+|------|---------|
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
+| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
+| <a name="requirement_local"></a> [local](#requirement\_local) | ~> 2.0 |
+| <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.0 |
+
+## Providers
+
+| Name | Version |
+|------|---------|
+| <a name="provider_random"></a> [random](#provider\_random) | 3.9.0 |
+
+## Modules
+
+| Name | Source | Version |
+|------|--------|---------|
+| <a name="module_base"></a> [base](#module\_base) | ../base | n/a |
+| <a name="module_runners"></a> [runners](#module\_runners) | ../../modules/multi-runner | n/a |
+| <a name="module_webhook_github_app"></a> [webhook\_github\_app](#module\_webhook\_github\_app) | ../../modules/webhook-github-app | n/a |
+
+## Resources
+
+| Name | Type |
+|------|------|
+| [random_id.random](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/id) | resource |
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| <a name="input_ami"></a> [ami](#input\_ami) | Optional AMI configuration keyed by runner lane. | <pre>map(object({<br/>    filter = optional(map(list(string)), { state = ["available"] })<br/>    owners = optional(list(string), ["amazon"])<br/>    id_ssm_parameter = optional(object({<br/>      arn = string<br/>    }), null)<br/>    kms_key = optional(object({<br/>      arn = string<br/>    }), null)<br/>  }))</pre> | `{}` | no |
+| <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | AWS region to deploy to. | `string` | `"eu-west-1"` | no |
+| <a name="input_environment"></a> [environment](#input\_environment) | Environment name, used as prefix. | `string` | `null` | no |
+| <a name="input_github_app"></a> [github\_app](#input\_github\_app) | GitHub App ID, base64-encoded private key, and installation ID. | <pre>object({<br/>    id              = string<br/>    key_base64      = string<br/>    installation_id = optional(string, null)<br/>  })</pre> | n/a | yes |
+| <a name="input_runner_binaries_enabled"></a> [runner\_binaries\_enabled](#input\_runner\_binaries\_enabled) | Whether runner binary synchronization is enabled. | `bool` | `true` | no |
+| <a name="input_scale_set"></a> [scale\_set](#input\_scale\_set) | GitHub Actions scale-set configuration. | <pre>object({<br/>    name = string<br/>    container = optional(object({<br/>      image = optional(string, null)<br/>    }), {})<br/>  })</pre> | n/a | yes |
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| <a name="output_webhook_endpoint"></a> [webhook\_endpoint](#output\_webhook\_endpoint) | n/a |
+| <a name="output_webhook_secret"></a> [webhook\_secret](#output\_webhook\_secret) | n/a |
+<!-- END_TF_DOCS -->
diff --git a/examples/multi-runner-scale-set/main.tf b/examples/multi-runner-scale-set/main.tf
new file mode 100644
index 0000000000..3bf1fd02a4
--- /dev/null
+++ b/examples/multi-runner-scale-set/main.tf
@@ -0,0 +1,208 @@
+locals {
+  environment = var.environment != null ? var.environment : "multi-runner-v2"
+  aws_region  = var.aws_region
+}
+
+resource "random_id" "random" {
+  byte_length = 20
+}
+
+module "base" {
+  source = "../base"
+
+  prefix     = local.environment
+  aws_region = local.aws_region
+}
+
+module "runners" {
+  source = "../../modules/multi-runner"
+
+  prefix     = local.environment
+  aws_region = local.aws_region
+
+  experimental_features = ["multi-runner-v2"]
+
+  global_config = {
+    tags = {
+      Example = local.environment
+      Project = "ProjectX"
+    }
+    runner = {
+      os           = "linux"
+      architecture = "x64"
+      extra_labels = ["v2"]
+    }
+  }
+
+  global_config_github = {
+    app = {
+      key_base64      = var.github_app.key_base64
+      id              = var.github_app.id
+      installation_id = var.github_app.installation_id
+      webhook_secret  = random_id.random.hex
+    }
+  }
+
+  global_config_lambda = {
+    architecture = "arm64"
+  }
+
+  global_config_orchestration_provider = {
+    webhook = {
+      eventbridge = {
+        enabled       = true
+        accept_events = ["workflow_job"]
+      }
+    }
+    scale_set = {
+      grouping = {
+        strategy = "runner_config"
+      }
+      container = var.scale_set.container
+      network = {
+        vpc_id     = module.base.vpc.vpc_id
+        subnet_ids = module.base.vpc.private_subnets
+      }
+    }
+  }
+
+  global_config_compute_provider = {
+    aws = {
+      ec2 = {
+        vpc_id      = module.base.vpc.vpc_id
+        subnet_ids  = module.base.vpc.private_subnets
+        ssm_enabled = true
+        runner_binaries = {
+          enabled = var.runner_binaries_enabled
+        }
+      }
+    }
+  }
+
+  multi_runner_config = {
+    linux-arm64 = {
+      runner = {
+        architecture = "arm64"
+        name_prefix  = "amazon-arm64-"
+        extra_labels = ["amazon"]
+      }
+      orchestration_provider = {
+        webhook = {
+          runner = {
+            maximum_count = 1
+          }
+          matcherConfig = {
+            exactMatch    = true
+            labelMatchers = [["self-hosted", "linux", "arm64", "amazon"]]
+          }
+        }
+      }
+      compute_provider = {
+        aws = {
+          ec2 = {
+            instance_types = ["t4g.large", "c6g.large"]
+            ami            = lookup(var.ami, "linux-arm64", null)
+          }
+        }
+      }
+    }
+
+    linux-x64 = {
+      runner = {
+        name_prefix  = "amazon-x64-"
+        extra_labels = ["amazon"]
+      }
+      orchestration_provider = {
+        webhook = {
+          runner = {
+            ephemeral     = true
+            maximum_count = 1
+          }
+          matcherConfig = {
+            labelMatchers = [["self-hosted", "linux", "x64", "amazon"]]
+            exactMatch    = false
+            priority      = 1
+          }
+          queue = {
+            delay_webhook_event = 0
+          }
+          job_retry = {
+            enabled = true
+          }
+        }
+      }
+      compute_provider = {
+        aws = {
+          ec2 = {
+            instance_types = ["m5a.large", "m5ad.large"]
+            ami            = lookup(var.ami, "linux-x64", null)
+          }
+        }
+      }
+    }
+
+    linux-scale-set = {
+      runner = {
+        name_prefix  = "scale-set-"
+        extra_labels = ["scale-set"]
+      }
+      orchestration_provider = {
+        scale_set = {
+          name = var.scale_set.name
+          runner = {
+            min_runners          = 0
+            max_runners          = 10
+            boot_time_in_minutes = 10
+          }
+        }
+      }
+      compute_provider = {
+        aws = {
+          ec2 = {
+            instance_types = ["m5.large"]
+            ami            = lookup(var.ami, "linux-scale-set", null)
+          }
+        }
+      }
+    }
+
+    windows-x64 = {
+      runner = {
+        os          = "windows"
+        name_prefix = "windows-x64-"
+      }
+      orchestration_provider = {
+        webhook = {
+          runner = {
+            boot_time_in_minutes = 20
+            maximum_count        = 1
+          }
+          matcherConfig = {
+            exactMatch    = true
+            labelMatchers = [["self-hosted", "windows", "x64", "servercore-2022"]]
+          }
+        }
+      }
+      compute_provider = {
+        aws = {
+          ec2 = {
+            instance_types = ["m5.large", "c5.large"]
+            ami            = lookup(var.ami, "windows-x64", null)
+          }
+        }
+      }
+    }
+  }
+}
+
+module "webhook_github_app" {
+  source     = "../../modules/webhook-github-app"
+  depends_on = [module.runners]
+
+  github_app = {
+    key_base64     = var.github_app.key_base64
+    id             = var.github_app.id
+    webhook_secret = random_id.random.hex
+  }
+  webhook_endpoint = module.runners.webhook.endpoint
+}
diff --git a/examples/multi-runner-scale-set/outputs.tf b/examples/multi-runner-scale-set/outputs.tf
new file mode 100644
index 0000000000..1feaf2e671
--- /dev/null
+++ b/examples/multi-runner-scale-set/outputs.tf
@@ -0,0 +1,8 @@
+output "webhook_endpoint" {
+  value = module.runners.webhook.endpoint
+}
+
+output "webhook_secret" {
+  sensitive = true
+  value     = random_id.random.hex
+}
diff --git a/examples/multi-runner-scale-set/providers.tf b/examples/multi-runner-scale-set/providers.tf
new file mode 100644
index 0000000000..eca2fe96a7
--- /dev/null
+++ b/examples/multi-runner-scale-set/providers.tf
@@ -0,0 +1,9 @@
+provider "aws" {
+  region = local.aws_region
+
+  default_tags {
+    tags = {
+      Example = local.environment
+    }
+  }
+}
diff --git a/examples/multi-runner-scale-set/variables.tf b/examples/multi-runner-scale-set/variables.tf
new file mode 100644
index 0000000000..c41fea1186
--- /dev/null
+++ b/examples/multi-runner-scale-set/variables.tf
@@ -0,0 +1,58 @@
+variable "github_app" {
+  description = "GitHub App ID, base64-encoded private key, and installation ID."
+
+  type = object({
+    id              = string
+    key_base64      = string
+    installation_id = optional(string, null)
+  })
+  sensitive = true
+}
+
+variable "scale_set" {
+  description = "GitHub Actions scale-set configuration."
+
+  type = object({
+    name = string
+    container = optional(object({
+      image = optional(string, null)
+    }), {})
+  })
+}
+
+variable "environment" {
+  description = "Environment name, used as prefix."
+
+  type    = string
+  default = null
+}
+
+variable "aws_region" {
+  description = "AWS region to deploy to."
+
+  type    = string
+  default = "eu-west-1"
+}
+
+variable "runner_binaries_enabled" {
+  description = "Whether runner binary synchronization is enabled."
+
+  type    = bool
+  default = true
+}
+
+variable "ami" {
+  description = "Optional AMI configuration keyed by runner lane."
+
+  type = map(object({
+    filter = optional(map(list(string)), { state = ["available"] })
+    owners = optional(list(string), ["amazon"])
+    id_ssm_parameter = optional(object({
+      arn = string
+    }), null)
+    kms_key = optional(object({
+      arn = string
+    }), null)
+  }))
+  default = {}
+}
diff --git a/examples/multi-runner-scale-set/versions.tf b/examples/multi-runner-scale-set/versions.tf
new file mode 100644
index 0000000000..1dfb3e5774
--- /dev/null
+++ b/examples/multi-runner-scale-set/versions.tf
@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 6.33"
+    }
+    local = {
+      source  = "hashicorp/local"
+      version = "~> 2.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
+  }
+  required_version = ">= 1.4.0"
+}

From 38b1f7eb21a5649903926d7571394c8c32b2d3d2 Mon Sep 17 00:00:00 2001
From: Ederson Brilhante <contato@edersonbrilhante.com.br>
Date: Thu, 17 Sep 2026 17:21:39 +0200
Subject: [PATCH 50/52] fix(examples): require Terraform 1.5.6

---
 examples/multi-runner-scale-set/versions.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/multi-runner-scale-set/versions.tf b/examples/multi-runner-scale-set/versions.tf
index 1dfb3e5774..6af69ab915 100644
--- a/examples/multi-runner-scale-set/versions.tf
+++ b/examples/multi-runner-scale-set/versions.tf
@@ -13,5 +13,5 @@ terraform {
       version = "~> 3.0"
     }
   }
-  required_version = ">= 1.4.0"
+  required_version = ">= 1.5.6"
 }

From 6b419fbd6aaef34e5687e2b4a2a52ab44bceb112 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 16:03:49 +0000
Subject: [PATCH 51/52] docs: auto update terraform docs

---
 examples/multi-runner-scale-set/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/multi-runner-scale-set/README.md b/examples/multi-runner-scale-set/README.md
index d7119a30be..6c0a4e686c 100644
--- a/examples/multi-runner-scale-set/README.md
+++ b/examples/multi-runner-scale-set/README.md
@@ -39,7 +39,7 @@ The GitHub App must be installed for the configured GitHub account.
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
+| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.6 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.33 |
 | <a name="requirement_local"></a> [local](#requirement\_local) | ~> 2.0 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.0 |

From 238c0bc4cee633952f59709fc39116f4853239b2 Mon Sep 17 00:00:00 2001
From: edersonbrilhante <elealcar@isovalent.com>
Date: Thu, 17 Sep 2026 19:36:12 +0200
Subject: [PATCH 52/52] test(ministack): move scale-set fixtures to example PR

---
 .github/workflows/ministack.yml               |  1 +
 tests/ministack/README.md                     | 13 +++--
 tests/ministack/multi-runner-scale-set.tfvars | 50 +++++++++++++++++++
 tests/ministack/multi-runner-v2.tfvars        |  2 +
 tests/ministack/run-example.sh                | 11 ++--
 5 files changed, 69 insertions(+), 8 deletions(-)
 create mode 100644 tests/ministack/multi-runner-scale-set.tfvars

diff --git a/.github/workflows/ministack.yml b/.github/workflows/ministack.yml
index 80af872e42..aa6e2b505d 100644
--- a/.github/workflows/ministack.yml
+++ b/.github/workflows/ministack.yml
@@ -72,6 +72,7 @@ jobs:
           - ephemeral
           - multi-runner
           - multi-runner-v2
+          - multi-runner-scale-set
           - migration-test
           - termination-watcher
     services:
diff --git a/tests/ministack/README.md b/tests/ministack/README.md
index 3e6cdc82fa..706b5157a2 100644
--- a/tests/ministack/README.md
+++ b/tests/ministack/README.md
@@ -1,7 +1,8 @@
 # MiniStack example tests
 
 The MiniStack workflow runs the `base`, `prebuilt`, `default`, `ephemeral`,
-`multi-runner`, `multi-runner-v2`, and `termination-watcher` examples directly
+`multi-runner`, `multi-runner-v2`, `multi-runner-scale-set`, and
+`termination-watcher` examples directly
 with Terraform 1.5.6 and the latest Terraform release, and with OpenTofu 1.11
 and the latest OpenTofu release.
 The examples with input variables get their inputs from their own tfvars files
@@ -10,8 +11,8 @@ and uses the configuration checked into the example itself. No override files,
 setup module, or Terraform fixture configuration is checked in. The helper
 creates and removes a temporary AMI override for `default` and
 `ephemeral`, temporary SSM parameters for `multi-runner`, and temporary AMI
-fixtures for `multi-runner-v2`. The migration test uses its dedicated
-`run-migration-test.sh` lifecycle script.
+fixtures for `multi-runner-v2` and `multi-runner-scale-set`. The migration test
+uses its dedicated `run-migration-test.sh` lifecycle script.
 
 Start MiniStack, set the AWS endpoint and test credentials, then run:
 
@@ -28,6 +29,8 @@ tests/ministack/run-example.sh apply multi-runner
 # or
 tests/ministack/run-example.sh apply multi-runner-v2
 # or
+tests/ministack/run-example.sh apply multi-runner-scale-set
+# or
 tests/ministack/run-example.sh apply termination-watcher
 ```
 
@@ -36,8 +39,8 @@ ZIP fixtures in the paths expected by the modules when they are absent, and
 removes only the files it created. For `prebuilt`, it seeds AMI metadata through
 MiniStack's AWS-compatible EC2 API, then removes only the resources it created
 during cleanup. MiniStack v1.5.11 provides the EC2 image behavior needed by the
-`default`, `ephemeral`, and `multi-runner` examples, so they are included in
-the same lifecycle matrix.
+`default`, `ephemeral`, `multi-runner`, and `multi-runner-scale-set` examples,
+so they are included in the same lifecycle matrix.
 
 ## Webhook and runner lifecycle smoke test
 
diff --git a/tests/ministack/multi-runner-scale-set.tfvars b/tests/ministack/multi-runner-scale-set.tfvars
new file mode 100644
index 0000000000..67bc39ea7a
--- /dev/null
+++ b/tests/ministack/multi-runner-scale-set.tfvars
@@ -0,0 +1,50 @@
+environment = "ministack-scale-set"
+aws_region  = "eu-west-1"
+
+github_app = {
+  id              = "0"
+  key_base64      = "ministack-invalid-key"
+  installation_id = "1"
+}
+
+runner_binaries_enabled = false
+
+ami = {
+  "linux-arm64" = {
+    filter = {
+      name  = ["ministack-scale-set-linux-arm64"]
+      state = ["available"]
+    }
+    owners = ["self"]
+  }
+  "linux-x64" = {
+    filter = {
+      name  = ["ministack-scale-set-linux-x64"]
+      state = ["available"]
+    }
+    owners = ["self"]
+  }
+  "linux-scale-set" = {
+    filter = {
+      name  = ["ministack-scale-set-linux-x64"]
+      state = ["available"]
+    }
+    owners = ["self"]
+  }
+  "windows-x64" = {
+    filter = {
+      name  = ["ministack-scale-set-windows-x64"]
+      state = ["available"]
+    }
+    owners = ["self"]
+  }
+}
+
+scale_set = {
+  config_url                = "https://github.com/example"
+  name                      = "ministack-scale-set"
+  id                        = 1
+  runner_group_id           = 1
+  runner_owner              = "example"
+  runner_registration_level = "organization"
+}
diff --git a/tests/ministack/multi-runner-v2.tfvars b/tests/ministack/multi-runner-v2.tfvars
index 0f9c6073fc..de54e291cf 100644
--- a/tests/ministack/multi-runner-v2.tfvars
+++ b/tests/ministack/multi-runner-v2.tfvars
@@ -6,6 +6,8 @@ github_app = {
   key_base64 = "ministack-invalid-key"
 }
 
+runner_binaries_enabled = false
+
 ami = {
   "linux-arm64" = {
     filter = {
diff --git a/tests/ministack/run-example.sh b/tests/ministack/run-example.sh
index 961b3a8cab..ab16343d95 100755
--- a/tests/ministack/run-example.sh
+++ b/tests/ministack/run-example.sh
@@ -23,7 +23,7 @@ case "$iac_binary" in
 esac
 
 case "$example" in
-  base | prebuilt | default | ephemeral | multi-runner | multi-runner-v2)
+  base | prebuilt | default | ephemeral | multi-runner | multi-runner-v2 | multi-runner-scale-set)
     use_tfvars=true
     ;;
   migration-test)
@@ -33,7 +33,7 @@ case "$example" in
     use_tfvars=false
     ;;
   *)
-  echo "Supported examples for the runner are: base, prebuilt, default, ephemeral, multi-runner, multi-runner-v2, migration-test, termination-watcher" >&2
+  echo "Supported examples for the runner are: base, prebuilt, default, ephemeral, multi-runner, multi-runner-v2, multi-runner-scale-set, migration-test, termination-watcher" >&2
   exit 64
   ;;
 esac
@@ -41,7 +41,7 @@ esac
 case "$action" in
   init | plan | apply | destroy) ;;
   *)
-    echo "Usage: $0 {init|plan|apply|destroy} {base|prebuilt|default|ephemeral|multi-runner|multi-runner-v2|migration-test|termination-watcher} [TFVARS_FILE]" >&2
+    echo "Usage: $0 {init|plan|apply|destroy} {base|prebuilt|default|ephemeral|multi-runner|multi-runner-v2|multi-runner-scale-set|migration-test|termination-watcher} [TFVARS_FILE]" >&2
     exit 64
     ;;
 esac
@@ -325,6 +325,11 @@ $lambda_zip"
       create_ami_fixture "ministack-v2-linux-x64" x86_64 >/dev/null
       create_ami_fixture "ministack-v2-windows-x64" x86_64 >/dev/null
       ;;
+    multi-runner-scale-set)
+      create_ami_fixture "ministack-scale-set-linux-x64" x86_64 >/dev/null
+      create_ami_fixture "ministack-scale-set-linux-arm64" arm64 >/dev/null
+      create_ami_fixture "ministack-scale-set-windows-x64" x86_64 >/dev/null
+      ;;
   esac
 }