feat(github-app): use ssm manifest for extra apps - #5282
Merged
Conversation
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
guicaulada
force-pushed
the
gc/feat/github-apps-manifest
branch
from
September 8, 2026 13:11
70c81ad to
19b8130
Compare
Brend-Smits
previously approved these changes
Sep 8, 2026
Brend-Smits
left a comment
Brend-Smits
left a comment
Contributor
There was a problem hiding this comment.
Reviewed and dev-deployed on a sandbox multi-runner stack. The env→manifest transport works end-to-end: scale-up/scale-down load credentials via the new gh-auth path with no errors, a runner scaled up and self-terminated cleanly.
The branch is behind main and needs a rebase, the only conflicts are in modules/multi-runner/{main.tf,termination-watcher.tf} from the effective_config refactor (#5342), resolved by keeping the effective-config wiring and swapping github_app_parameters.id[0]/key_base64[0] → the new scalar shape.
LGTM once rebased.
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
## Description Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. ## Test Plan - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. ## Related Issues Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
## Description Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. ## Test Plan - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. ## Related Issues Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
force-pushed
the
gc/feat/github-apps-manifest
branch
2 times, most recently
from
September 8, 2026 18:46
3c4f41b to
4e0f829
Compare
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
## Description Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. ## Test Plan - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. ## Related Issues Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
force-pushed
the
gc/feat/github-apps-manifest
branch
from
September 8, 2026 18:51
4e0f829 to
3d6681b
Compare
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
## Description Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. ## Test Plan - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. ## Related Issues Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
force-pushed
the
gc/feat/github-apps-manifest
branch
from
September 8, 2026 19:53
3d6681b to
47da986
Compare
This was referenced Sep 8, 2026
Deliver additional GitHub App credentials to the lambdas through a manifest SSM parameter listing the per-app credential parameter names, instead of colon-joined parameter names in the environment. The lambda environment size stays constant regardless of app count, avoiding the 4 KB Lambda environment limit (roughly 15-20 apps with typical paths). The manifest also removes the positional alignment between the id, key, and installation-id lists, which could silently shift installation ids across apps if the lists drifted. The rate-limit metric now reads app ids from the credentials already loaded by the auth module instead of re-reading SSM per app index. Document that additional apps must be installed on the same organizations or repositories as the primary app.
guicaulada
force-pushed
the
gc/feat/github-apps-manifest
branch
from
September 8, 2026 20:02
47da986 to
56f938b
Compare
Brend-Smits
approved these changes
Sep 8, 2026
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
Follow-up to #5269, item 2 of the [#5038 review](#5038 (review)). Stacked on #5282 (manifest transport); review that first. Replaces uniform random GitHub App selection with budget-aware selection, ported from our production fork: - The auth module tracks the last observed `x-ratelimit-remaining` per app, fed by `metricGitHubAppRateLimit` headers and the throttling plugin callbacks. - Selection picks the app with the most budget remaining; apps with no observed state are assumed full. - Apps that hit a secondary rate limit are skipped for 60 seconds; if every app is cooling down, the one with the most budget is used anyway. - Iteration starts at a random offset so concurrent cold-started lambdas do not converge on the same app. Uniform random kept sending ~1/N of traffic to apps that were already exhausted. Selection state is per warm container and converges within a few invocations; a cold container starts as before. - control-plane: 353 tests passed, including six new selection tests (budget preference, unobserved-assumed-full, cooldown skip, all-cooling fallback, single-app short-circuit, explicit appIndex) and a selector-feed test for the rate-limit headers. - ESLint + Prettier clean. Follow-up to #5269 / #5038. Depends on #5282.
guicaulada
added a commit
that referenced
this pull request
Sep 8, 2026
Replaces uniform random GitHub App selection with selection based on the last observed rate-limit budget. Apps under a secondary rate-limit cooldown are temporarily skipped, and randomized starting points spread cold-start traffic across apps. Uses the credential storage interface introduced on main and preserves the selected app index throughout each operation. Includes a regression test verifying selection from an injected credentials store without reading SSM. This PR targets `main` and contains only the rate-limit selection change. The manifest prerequisite was merged separately in #5282. Replaces #5283, which was originally merged into the parent feature branch. Validation: 350 control-plane tests passed; TypeScript, ESLint, and diff whitespace checks passed. The commit is signed and verified. Follow-up to #5269 / #5038.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #5269, as promised in the #5038 review (items 1, 3, 4, and 5). We run this design in production.
getLoadedAppId) instead of re-reading SSM per app index; out-of-range indexes no longer throw inside the swallowed catch.Internal contract only: Terraform and the lambdas deploy together, so the env transport change is invisible to module users.
additional_github_appsis unchanged.Test Plan
terraform fmt/validateclean on root, runners, multi-runner, ssm;terraform testinmodules/runnerspasses.Related Issues
Follow-up to #5269 / #5038.