[8.8] [MOD-18346] Backport CI runner fixes and Debian Trixie

.github/workflows/arm.yml

@@ -3,56 +3,7 @@ name: arm flow
 on: [workflow_call, workflow_dispatch]
 
 jobs:
-  start-runner:
-    name: Start self-hosted EC2 runner
-    runs-on: ubuntu-latest
-    outputs:
-      label: ${{ steps.start-ec2-runner.outputs.label }}
-      ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
-    steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION }}
-      - name: Start EC2 runner
-        id: start-ec2-runner
-        uses: machulav/ec2-github-runner@v2.6.1
-        with:
-          mode: start
-          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
-          # Ubuntu 22.04 region AMI for ARM
-          ec2-image-id: ami-062b37d89f25c958f
-          ec2-instance-type: r8g.xlarge
-          subnet-id: ${{ secrets.AWS_EC2_SUBNET_ID }}
-          security-group-id: ${{ secrets.AWS_EC2_SG_ID }}
-          ec2-volume-size: 30
-
   arm:
-    needs: start-runner # required to start the main job when the runner is ready
     uses: ./.github/workflows/task-unit-test.yml
     with:
-      env: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
-
-  stop-runner:
-    name: Stop self-hosted EC2 runner
-    needs:
-      - start-runner # required to get output from the start-runner job
-      - arm # required to wait when the main job is done
-    runs-on: ubuntu-latest
-    if: ${{ always() }} # required to stop the runner even if the error happened in the previous jobs
-    steps:
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: ${{ secrets.AWS_REGION }}
-      - name: Stop EC2 runner
-        uses: machulav/ec2-github-runner@v2.6.1
-        with:
-          mode: stop
-          github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
-          label: ${{ needs.start-runner.outputs.label }}
-          ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}
+      env: ubuntu-22.04-arm

.github/workflows/benchmark-runner.yml

@@ -29,11 +29,36 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ secrets.AWS_REGION_BENCHMARK }}
+      - name: Prepare EC2 owner tag
+        id: ec2-tags
+        # Keep the original workflow actor as owner, including on reruns.
+        env:
+          OWNER_HANDLE: ${{ github.actor }}
+        shell: python
+        run: |
+          import os
+          import re
+
+          # Allow only lowercase ASCII letters, digits, and underscores.
+          owner = os.environ["OWNER_HANDLE"].lower()
+          owner = re.sub(r"[^a-z0-9_]", "_", owner)
+          # Collapse repeated separators, cap at 63 characters, and trim edges.
+          owner = re.sub(r"_+", "_", owner)[:63].strip("_")
+          if not owner:
+              raise SystemExit("Cannot derive an EC2 owner tag from github.actor")
+
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              output.write(f"owner={owner}\n")
       - name: Start EC2 runner
         id: start-ec2-runner
         uses: machulav/ec2-github-runner@v2.6.1
         with:
           mode: start
+          aws-resource-tags: >-
+            [
+              {"Key": "team", "Value": "ai_and_search"},
+              {"Key": "owner", "Value": "${{ steps.ec2-tags.outputs.owner }}"}
+            ]
           github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
           ec2-image-id: ${{ inputs.ami-id }}
           ec2-instance-type: ${{ inputs.instance-type }}

.github/workflows/coverage.yml

@@ -14,11 +14,36 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws-region: ${{ secrets.AWS_REGION_BENCHMARK }}
+      - name: Prepare EC2 owner tag
+        id: ec2-tags
+        # Keep the original workflow actor as owner, including on reruns.
+        env:
+          OWNER_HANDLE: ${{ github.actor }}
+        shell: python
+        run: |
+          import os
+          import re
+
+          # Allow only lowercase ASCII letters, digits, and underscores.
+          owner = os.environ["OWNER_HANDLE"].lower()
+          owner = re.sub(r"[^a-z0-9_]", "_", owner)
+          # Collapse repeated separators, cap at 63 characters, and trim edges.
+          owner = re.sub(r"_+", "_", owner)[:63].strip("_")
+          if not owner:
+              raise SystemExit("Cannot derive an EC2 owner tag from github.actor")
+
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              output.write(f"owner={owner}\n")
       - name: Start EC2 runner
         id: start-ec2-runner
         uses: machulav/ec2-github-runner@v2.6.1
         with:
           mode: start
+          aws-resource-tags: >-
+            [
+              {"Key": "team", "Value": "ai_and_search"},
+              {"Key": "owner", "Value": "${{ steps.ec2-tags.outputs.owner }}"}
+            ]
           github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
           # Ubuntu 22.04 AMI
           ec2-image-id: ami-09fabd03bb09b3704

.github/workflows/debian11.yml → .github/workflows/debian13.yml

@@ -1,11 +1,10 @@
-name: debian bullseye flow
+name: debian trixie flow
 
 on: [workflow_dispatch, workflow_call]
 
 jobs:
-  bullseye:
+  trixie:
     uses: ./.github/workflows/task-unit-test.yml
     with:
-      container: gcc:11-bullseye
+      container: gcc:14-trixie
       pre-checkout-script: apt-get update && apt-get -y install git
-

.github/workflows/event-merge-to-queue.yml

@@ -20,8 +20,8 @@ jobs:
 #    uses: ./.github/workflows/task-unit-test.yml
 #    with:
 #      container: ubuntu:bionic
-  bullseye:
-    uses: ./.github/workflows/debian11.yml
+  trixie:
+    uses: ./.github/workflows/debian13.yml
 #  amazonlinux2:
 #    needs: [check-if-docs-only]
 #    if: ${{ needs.check-if-docs-only.outputs.only-docs-changed == 'false' }}
@@ -38,7 +38,6 @@ jobs:
     uses: ./.github/workflows/macos.yml
   arm:
     uses: ./.github/workflows/arm.yml
-    secrets: inherit
 
   coverage:
     uses: ./.github/workflows/coverage.yml
@@ -49,7 +48,7 @@ jobs:
       - jammy
 #      - focal
 #      - bionic
-      - bullseye
+      - trixie
 #      - amazonlinux2
       - mariner2
       - rocky8

.github/workflows/event-nightly.yml

@@ -23,8 +23,8 @@ jobs:
   #    uses: ./.github/workflows/task-unit-test.yml
   #    with:
   #      container: ubuntu:bionic
-  bullseye:
-    uses: ./.github/workflows/debian11.yml
+  trixie:
+    uses: ./.github/workflows/debian13.yml
   #  amazonlinux2:
   #    needs: [check-if-docs-only]
   #    if: ${{ needs.check-if-docs-only.outputs.only-docs-changed == 'false' }}
@@ -41,7 +41,6 @@ jobs:
     uses: ./.github/workflows/macos.yml
   arm:
     uses: ./.github/workflows/arm.yml
-    secrets: inherit
   coverage:
     uses: ./.github/workflows/coverage.yml
     secrets: inherit
@@ -56,7 +55,7 @@ jobs:
       - jammy
 #      - focal
 #      - bionic
-      - bullseye
+      - trixie
 #      - amazonlinux2
       - mariner2
       - rocky8