Repository navigation
feat: make runner AMIs private and single-region (us-east-2) - #89
Conversation
Drop the public "community AMI" distribution and the us-east-1 copy. jit-runners is single-tenant (only we use it), so publishing public AMIs and maintaining a second distribution region only added EBS-snapshot cost and Packer/CI complexity for no benefit. - packer: ami_groups now defaults to [] (private); ami_regions stays [] - ami-build.yml: remove `distribute` input, AMI_DISTRIBUTION_REGIONS, block-public-access toggling, and the us-east-1 copy+publish steps; post-build prune now targets us-east-2 only - ami-prune.sh: prune private AMIs (drop the is-public filter) - Makefile: drop ami.build-distribute and ami.copy; ami.build is now private; ami.prune targets us-east-2 only - docs: document the private, single-region-by-design model Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
github-actions
Bot
added
documentation
|
Warning Review limit reached
Next review available in: 35 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR removes public AMI distribution across regions, switching to a private, single-region (us-east-2) AMI build model. The ChangesPrivate-only AMI build and prune
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Trigger
participant AmiBuildWorkflow
participant Packer
participant PruneJob
Trigger->>AmiBuildWorkflow: push/pull_request/workflow_dispatch
AmiBuildWorkflow->>Packer: build AMI (private, ami_name_prefix=jit-runner-pr for PRs)
Packer-->>AmiBuildWorkflow: AMI ID (private, us-east-2)
AmiBuildWorkflow->>PruneJob: prune --regions us-east-2 (self-owned AMIs, no is-public filter)
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
OpenSSF Scorecard — 8.3/10 ✅
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/ami-prebaked.md`:
- Line 31: The AMI sharing note is incorrect: `ami_groups` only accepts
`["all"]`, while cross-account AWS account IDs should be specified via
`ami_users`. Update the wording in the AMI documentation to use the correct
field, and in the relevant guidance about `ami_groups`/`ami_users` either state
cross-account sharing with `ami_users` if intended or remove the aside about
account IDs.
In `@docs/getting-started-aws.md`:
- Line 153: The AMI guidance in getting-started-aws.md incorrectly mentions
AWS_DEFAULT_REGION for make ami.build, which does not control the build. Update
the AMI region note to either state that the pre-baked AMI/build flow is tied to
us-east-2 by default or explain that the Packer source region is controlled by
var.aws_region; refer to the DefaultAMI and make ami.build guidance when
revising the text.
In `@infra/scripts/ami-prune.sh`:
- Around line 62-65: The AMI pruning logic in ami-prune.sh is currently matching
both release and PR test images because the NAME_PREFIX filter is too broad.
Update the image selection used by the prune flow so the list built in the AWS
describe-images call excludes jit-runner-pr-* AMIs, and ensure the filtering
logic in ami.prune only counts release AMIs when determining the newest-2 set.
Keep DefaultAMI protection intact while preventing PR test AMIs from affecting
deletion decisions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ac9d80ba-2022-49a9-8bb5-23096d7baf2a
📒 Files selected for processing (9)
.github/workflows/ami-build.ymlCLAUDE.mdMakefileREADME.mddocs/ami-prebaked.mddocs/getting-started-aws.mddocs/troubleshooting.mdinfra/packer/variables.pkr.hclinfra/scripts/ami-prune.sh
|
CI status note (automated babysitter):
No code in this PR affects GCE provisioning behavior in a way that would cause this. It can be re-run later (or the Packer GCE zone adjusted) as separate infra housekeeping, independent of this PR. Treating this PR as ready-for-review — the only remaining gate is human review approval / branch protection ( |
- ami-prune.sh: exclude jit-runner-pr* test AMIs from the prune set so transient PR-build AMIs never count toward release retention (regression from dropping the is-public filter, which previously excluded them) - docs/ami-prebaked.md: correct cross-account sharing note (account IDs use ami_users / modify-image-attribute, not ami_groups) - docs/getting-started-aws.md: region is Packer's var.aws_region, not AWS_DEFAULT_REGION Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Kaio Fellipe <kaio6fellipe@gmail.com>
1 participant
Summary
jit-runners is single-tenant (only we use it), so the public "community AMI" distribution and the second distribution region (us-east-1) added EBS-snapshot cost and Packer/CI complexity for no benefit. This makes runner AMIs private and built in us-east-2 only.
Changes
infra/packer/variables.pkr.hcl):ami_groupsdefault["all"]→[](private).ami_regionsstays[]..github/workflows/ami-build.yml): removed thedistributeinput,AMI_DISTRIBUTION_REGIONS, the block-public-access toggling, and the us-east-1 copy+publish steps. Non-PR builds now produce a private us-east-2 AMI; the post-build prune targets us-east-2 only. PR builds unchanged.infra/scripts/ami-prune.sh): drop theis-publicfilter so it prunes the now-private AMIs by name prefix (the legacy--ensure-free/--quotapublic-quota options are retained but no longer used by CI).ami.build-distributeandami.copy;ami.buildis now private;ami.prunetargets us-east-2 only. (GCPimage.*targets untouched.)docs/ami-prebaked.md,CLAUDE.md,README.md,docs/getting-started-aws.md,docs/troubleshooting.mdupdated to the private, single-region-by-design model.Companion one-time AWS cleanup (already applied)
Converged the live account to match: 13 AMIs / 16 snapshots across us-east-1+us-east-2 → 2 private AMIs / 2 snapshots in us-east-2 (kept
ami-03771658b57568961live DefaultAMI + latest rollback). us-east-1 fully evacuated; block-public-access enabled in both regions as a guard. Live DefaultAMI verified intact.Cost
Removes ongoing multi-region public-AMI snapshot retention and simplifies the build pipeline. Complements the broader jit-runners FinOps pass (t3 credit mode, spot diversification, instance-family right-sizing).
🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
us-east-2instead of being copied and published across regions.us-east-2.Documentation