v4.0.1

Patch: warm-pool reuse:stop registration fixes (#62/#64/#65/#66); #66 fixes the double-base64 user-data bug that broke every warm restart. Pin consumers to 65fbe4f.

v4.0.0

A capability wave across cost, reliability, reach, and toil — 10 features, each shipped as its own PR (#50–#59).

⚠️ Breaking changes

• ec2:CreateTags is now always required. Every launched instance is stamped with the action's signature tags (used by the cleanup reaper). Grant ec2:CreateTags with condition ec2:CreateAction = RunInstances, or RunInstances will be denied. Previously only needed with aws-resource-tags. (#42, #45)
• cleanup-on-start-failure defaults to true. A runner that fails to bootstrap/register now has its console captured and is terminated instead of left running after a registration timeout. Set false to keep the old behavior. (#41)
• The root EBS volume for encrypt-ebs / volume-* now always sets DeleteOnTermination: true. (#44)

Highlights

Reliability

• Bootstrap diagnostics: per-phase phone-home tags, fast-fail naming the failing step, console-output capture (token redacted), cleanup-on-start-failure. (#41)
• Orphan protection: max-lifetime-minutes TTL self-destruct + a mode: cleanup reaper (max-age-minutes, dry-run). (#42)
• Capacity resilience: comma-separated ec2-instance-type / subnet-id fallback across AZs and types; outputs instance-type-used, subnet-id-used. (#40)

Cost

• Spot instances: market-type: spot with spot-fallback / spot-max-price; output market-type-used. (#39)
• ARM64/Graviton: architecture: arm64 with AMI-arch fail-fast validation. (#43)
• Warm pools: reuse: stop reuses stopped instances for much faster starts (reuse-pool-tag, reuse-max-cycles). ⚠️ carries disk state between jobs — unsafe for public/untrusted-PR repos. (#48)

Reach & toil

• Root volume config: volume-size / volume-type / volume-iops / volume-throughput. (#44)
• Multi-runner batches: count (+ allow-partial) for matrix builds; output ec2-instance-ids. (#45)
• Pluggable bootstrap: pre-runner-script + user-data-template (Ubuntu example included) — no more forking for other distros. (#46)
• Automated runner-version bumps: scripts/bump-runner.js + a weekly PR workflow. (#47)

IAM additions

Base policy also needs ec2:DescribeTags and ec2:GetConsoleOutput. The runner's own instance role may optionally get self-scoped ec2:CreateTags for bootstrap phone-home.

---

Pin namecheap/ec2-github-runner@v4 for the latest v4 release, or @v4.0.0 to pin exactly. See CHANGELOG.md and the README.

Full changelog: v3.0.2...v4.0.0

v3.0.2

What's Changed

• fix: bump default actions/runner to 2.335.1 (#36) — GitHub stops allowing the previous default v2.333.1 to run jobs on 2026-06-23. Replaces the pinned SHA-256 checksum table with the v2.335.1 x64/arm64 hashes, bumps the runner-version default + src/config.js fallback, updates tests/docs, and rebuilds dist/.
• docs: refresh README for v3 and animate the workflow graph (#35)

The v3 major tag has been moved to this release.

Full Changelog: v3.0.1...v3.0.2

v3.0.1

Patch release — refreshes bundled dependencies and rebuilds dist/. No functional or API changes.

Dependency updates

• @actions/core 1.11.1 → 2.0.3
• @aws-sdk/client-ec2 3.1033.0 → 3.1064.0
• dev tooling: eslint 9 → 10 (plus explicit @eslint/js), dotenv 8 → 17, globals 15 → 17

@actions/core and @actions/github are held at their latest CommonJS majors (2.x / 8.x); 3.x / 9.x are ESM-only and cannot be bundled by ncc.

Security

npm audit reports 0 vulnerabilities (production + dev trees).

Full changelog: v3.0.0...v3.0.1

v3.0.0

First Namecheap release of ec2-github-runner, superseding v2.2.1 with a large set of features, hardening, and a runtime modernization. This is a major release — review the upgrade notes before bumping.

⚠️ Breaking changes & new defaults

• Action runtime is now Node 24 (runs.using: node24). Use GitHub-hosted runners, or self-hosted runners new enough to execute node24 actions.
• Runner host base is Amazon Linux 2023 (was AL2). The bootstrap is yum-based and installs libicu; only yum-based Linux is supported.
• IMDSv2 is enforced by default (http-tokens: required). If a workload on the runner still needs IMDSv1, set http-tokens: optional.
• Runners are now ephemeral and non-root — registered with --ephemeral under a dedicated runner user; GitHub auto-deregisters the runner after a single job.
• AWS SDK migrated to v3 (@aws-sdk/client-ec2). Internal change; IAM permissions are unchanged.
• actions/runner pinned to v2.333.1 and its tarball verified against a hardcoded SHA-256 table (src/runner-checksums.js). The runner-version input may only select versions present in that table.

✨ Features

• New inputs: ec2-image-filters, ec2-image-owner, eip-allocation-id, iam-role-name, runner-version, http-tokens, encrypt-ebs, aws-resource-tags, debug.
• AMI selection by filters/owner in addition to an explicit ec2-image-id.
• Opt-in EBS root-volume encryption (encrypt-ebs: true).
• Elastic IP association for the runner instance (eip-allocation-id).
• Structured JSON logging with secret redaction, plus an opt-in debug mode.
• Retries with backoff on AWS/GitHub calls; stop mode terminates the instance and removes the runner independently, so one failure can't strand the other.

🐛 Fixes

• Write outputs to $GITHUB_OUTPUT instead of the deprecated ::set-output.
• Silence the DEP0169 (url.parse()) deprecation warning.
• Remove the lodash dependency in favor of native JS.

🔧 CI / internal

• verify-dist (dist/src sync) and pinned-runner + checksum-table verification jobs.
• Build-provenance attestation for dist/index.js.
• Jest unit tests (config, utils, logging, retry, EBS mapping, checksums).
• ESLint flat config; refreshed .env.example.

Full changelog: v2.2.1...v3.0.0