What's the best way to get environment variables and secrets to the runner?

[4dahalibut]

I'm currently using the codebuild runner and it seems like there is no access to the build environment or for passing in secrets, because these properties are not surfaced through the runner properties.

[kichik]

Usually environments variables and secrets would be coming from the GitHub Actions side as configuration. AWS specific secrets should ideally be accessed with the configure-aws-credentials action.

Can you please share a little bit more about your use case so I can understand why you'd want it to come from the runner side?

I also think you should already be able to use runner hooks to accomplish this. Something like:

const builder = FargateRunnerProvider.imageBuilder(stack, 'builder');
builder.addComponent(RunnerImageComponent.custom({
  dockerCommands: [
    'ENV ACTIONS_RUNNER_HOOK_JOB_STARTED=/home/runner/job-started.sh',
  ],
  commands: [
    'echo "echo Job started" > /home/runner/job-started.sh',
    'echo "MY_RUNNER_ENV_VAR=hello >> $GITHUB_ENV" >> /home/runner/job-started.sh',
    'chmod +x /home/runner/job-started.sh',
  ],
}));

const runners = new GitHubRunners(stack, 'runners', {
  providers: [
    new FargateRunnerProvider(stack, 'Fargate', {
      imageBuilder: builder,
    }),
  ],
});

But something a bit more streamlined might be in order.

[kichik]

It's actually easier than I thought.

const builder = FargateRunnerProvider.imageBuilder(stack, 'builder');
builder.addComponent(RunnerImageComponent.custom({
  commands: [
    'echo HELLO=WORLD >> /home/runner/.env',
  ],
}));

I'll probably add it as a method to RunnerImageComponent so you don't have to be aware of the internal information of the home directory.

Source: https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/using-a-proxy-server-with-self-hosted-runners#using-a-env-file-to-set-the-proxy-configuration

[kichik]

const builder = FargateRunnerProvider.imageBuilder(stack, 'builder');
builder.addComponent(RunnerImageComponent.environmentVariables({
  HELLO: 'WORLD',
});

[pkaeding]

Adding the variables to the image builder works, but it is equivalent to setting the variables in the Dockerfile, right?

I found that I could set them like this:

fargateProvider.Task().DefaultContainer().AddEnvironment(jsii.String("key"), jsii.String("value"))

And they would be set in the task definition. In the end, it may not matter much. But if your needs involve creating multiple runners that use the same image, and differ only in the base environment variables, this approach may make more sense, as it allows you to only have one image in ECR to scan, manage, etc.