Menggunakan AWS Spot Instance sebagai CI/CD Runner

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSelfTerminate",
      "Effect": "Allow",
      "Action": "ec2:TerminateInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Purpose": "ci-runner"
        }
      }
    },
    {
      "Sid": "AllowDescribeForSelfIdentification",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeTags"
      ],
      "Resource": "*"
    }
  ]
}

#!/bin/bash
set -euo pipefail

# Redirect output ke log untuk debugging
exec > >(tee /var/log/runner-bootstrap.log) 2>&1
echo "Bootstrap dimulai: $(date)"

# --- Variabel dari environment atau SSM Parameter Store ---
GITHUB_ORG="${GITHUB_ORG}"
GITHUB_REPO="${GITHUB_REPO}"
RUNNER_TOKEN="${RUNNER_TOKEN}"   # Sebaiknya ambil dari AWS SSM, bukan inject langsung
RUNNER_VERSION="2.316.0"
RUNNER_LABELS="spot,large,ci"
AWS_REGION="ap-southeast-1"

# --- Install dependencies ---
yum update -y -q
yum install -y -q docker git jq curl unzip

# Install AWS CLI v2 jika belum ada
if ! command -v aws &> /dev/null; then
    curl -sL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
    unzip -q /tmp/awscliv2.zip -d /tmp
    /tmp/aws/install
fi

# Start Docker
systemctl enable docker
systemctl start docker
usermod -aG docker ec2-user

# --- Install dan konfigurasi GitHub Actions Runner ---
RUNNER_DIR="/opt/actions-runner"
mkdir -p ${RUNNER_DIR}
cd ${RUNNER_DIR}

curl -sL -o runner.tar.gz \
    "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz"

tar xzf runner.tar.gz
rm runner.tar.gz

# Ambil runner token dari SSM Parameter Store (lebih aman dari inject langsung)
# RUNNER_TOKEN=$(aws ssm get-parameter \
#     --name "/ci/github-runner-token" \
#     --with-decryption \
#     --region ${AWS_REGION} \
#     --query "Parameter.Value" \
#     --output text)

# Register runner ke GitHub
# --ephemeral: runner hanya menerima satu job lalu unregister otomatis
./config.sh \
    --url "https://github.com/${GITHUB_ORG}/${GITHUB_REPO}" \
    --token "${RUNNER_TOKEN}" \
    --name "spot-runner-$(hostname)-$(date +%s)" \
    --labels "${RUNNER_LABELS}" \
    --unattended \
    --ephemeral

echo "Runner berhasil terdaftar: $(date)"

# --- Jalankan runner ---
# Jalankan sebagai service agar bisa di-manage dengan systemd
./svc.sh install
./svc.sh start

# Tunggu sampai runner selesai menerima dan menjalankan job
# Polling: cek apakah runner process masih berjalan
while systemctl is-active --quiet actions.runner.*; do
    sleep 10
done

echo "Job selesai, mulai self-terminate: $(date)"

# --- Self-terminate ---
INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
aws ec2 terminate-instances \
    --instance-ids "${INSTANCE_ID}" \
    --region "${AWS_REGION}"

# Script untuk membangun custom AMI (jalankan di EC2 yang akan di-snapshot)
#!/bin/bash
set -euo pipefail

# Java 21 (untuk Gradle/Maven build)
yum install -y java-21-amazon-corretto-headless

# Gradle
GRADLE_VERSION="8.7"
curl -sL "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" -o /tmp/gradle.zip
unzip -q /tmp/gradle.zip -d /opt
ln -s /opt/gradle-${GRADLE_VERSION}/bin/gradle /usr/local/bin/gradle

# Terraform
TERRAFORM_VERSION="1.8.4"
curl -sL "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
    -o /tmp/terraform.zip
unzip -q /tmp/terraform.zip -d /usr/local/bin
chmod +x /usr/local/bin/terraform

# SonarQube Scanner
SONAR_VERSION="6.1.0.4477"
curl -sL "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SONAR_VERSION}-linux-x64.zip" \
    -o /tmp/sonar.zip
unzip -q /tmp/sonar.zip -d /opt
ln -s /opt/sonar-scanner-${SONAR_VERSION}-linux-x64/bin/sonar-scanner /usr/local/bin/sonar-scanner

# Docker (sudah terinstall, pastikan update ke versi terbaru)
yum update -y docker
systemctl enable docker

# GitHub Actions Runner (preinstall tapi jangan register dulu)
RUNNER_VERSION="2.316.0"
mkdir -p /opt/actions-runner
cd /opt/actions-runner
curl -sL -o runner.tar.gz \
    "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz"
tar xzf runner.tar.gz && rm runner.tar.gz

# Setelah script ini selesai:
# 1. Buat AMI dari instance ini via AWS Console atau CLI
# 2. Gunakan AMI ID ini di workflow GitHub Actions
# aws ec2 create-image --instance-id i-xxxx --name "ci-runner-v1.0" --no-reboot

name: Heavy CI Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:

env:
  AWS_REGION: ap-southeast-1
  INSTANCE_TYPE: c6i.4xlarge
  AMI_ID: ami-0abcdef1234567890  # Custom AMI

jobs:
  # Job 1: Launch Spot Instance
  # Job ini berjalan di runner GitHub standard (murah, cepat)
  launch-runner:
    runs-on: ubuntu-latest
    outputs:
      instance-id: ${{ steps.launch.outputs.instance-id }}
      runner-label: ${{ steps.launch.outputs.runner-label }}
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-launcher
          aws-region: ${{ env.AWS_REGION }}

      - name: Get GitHub Runner Token
        id: get-token
        run: |
          TOKEN=$(curl -sX POST \
            -H "Authorization: Bearer ${{ secrets.GH_PAT }}" \
            -H "Accept: application/vnd.github+json" \
            "https://api.github.com/repos/${{ github.repository }}/actions/runners/registration-token" \
            | jq -r .token)
          echo "::add-mask::${TOKEN}"
          echo "token=${TOKEN}" >> $GITHUB_OUTPUT          

      - name: Launch Spot Instance
        id: launch
        run: |
          RUNNER_LABEL="spot-$(echo ${{ github.run_id }}-${{ github.run_attempt }})"

          # Encode user data sebagai base64
          USER_DATA=$(cat <<EOF | base64 -w 0
          #!/bin/bash
          export GITHUB_ORG="${{ github.repository_owner }}"
          export GITHUB_REPO="${{ github.event.repository.name }}"
          export RUNNER_TOKEN="${{ steps.get-token.outputs.token }}"
          export RUNNER_LABELS="${RUNNER_LABEL},spot,large"
          export AWS_REGION="${{ env.AWS_REGION }}"
          bash /opt/bootstrap-runner.sh
          EOF
          )

          INSTANCE_ID=$(aws ec2 run-instances \
            --image-id ${{ env.AMI_ID }} \
            --instance-type ${{ env.INSTANCE_TYPE }} \
            --iam-instance-profile Name=ci-runner-instance-profile \
            --instance-market-options '{"MarketType":"spot","SpotOptions":{"SpotInstanceType":"one-time","InstanceInterruptionBehavior":"terminate"}}' \
            --user-data "${USER_DATA}" \
            --tag-specifications 'ResourceType=instance,Tags=[{Key=Purpose,Value=ci-runner},{Key=RunID,Value=${{ github.run_id }}}]' \
            --metadata-options '{"HttpTokens":"required","HttpEndpoint":"enabled"}' \
            --region ${{ env.AWS_REGION }} \
            --query 'Instances[0].InstanceId' \
            --output text)

          echo "instance-id=${INSTANCE_ID}" >> $GITHUB_OUTPUT
          echo "runner-label=${RUNNER_LABEL}" >> $GITHUB_OUTPUT
          echo "Instance ${INSTANCE_ID} diluncurkan, menunggu runner siap..."          

      - name: Wait for runner to be ready
        run: |
          # Tunggu sampai runner terdaftar di GitHub (max 3 menit)
          TIMEOUT=180
          ELAPSED=0
          RUNNER_LABEL="${{ steps.launch.outputs.runner-label }}"

          while [ $ELAPSED -lt $TIMEOUT ]; do
            RUNNER_COUNT=$(curl -s \
              -H "Authorization: Bearer ${{ secrets.GH_PAT }}" \
              -H "Accept: application/vnd.github+json" \
              "https://api.github.com/repos/${{ github.repository }}/actions/runners" \
              | jq "[.runners[] | select(.labels[].name == \"${RUNNER_LABEL}\")] | length")

            if [ "${RUNNER_COUNT}" -gt "0" ]; then
              echo "Runner siap setelah ${ELAPSED} detik"
              exit 0
            fi

            sleep 10
            ELAPSED=$((ELAPSED + 10))
          done

          echo "Timeout: runner tidak terdaftar dalam ${TIMEOUT} detik"
          exit 1          

  # Job 2: CI berat yang berjalan di Spot Instance
  build-and-test:
    needs: launch-runner
    runs-on: [self-hosted, "${{ needs.launch-runner.outputs.runner-label }}"]
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4

      - name: Gradle Build
        run: ./gradlew build --no-daemon --parallel

      - name: Run Tests
        run: ./gradlew test --no-daemon

      - name: SonarQube Scan
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
        run: |
          sonar-scanner \
            -Dsonar.projectKey=${{ github.event.repository.name }} \
            -Dsonar.sources=src \
            -Dsonar.java.binaries=build/classes          

      - name: Upload build artifacts
        uses: actions/upload-artifact@v4
        with:
          name: build-output
          path: build/libs/

  # Job 3: Cleanup — pastikan instance dihapus meski job gagal
  cleanup:
    needs: [launch-runner, build-and-test]
    runs-on: ubuntu-latest
    if: always()  # Jalankan selalu, bahkan jika build gagal
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-launcher
          aws-region: ${{ env.AWS_REGION }}

      - name: Terminate instance if still running
        run: |
          INSTANCE_ID="${{ needs.launch-runner.outputs.instance-id }}"
          STATE=$(aws ec2 describe-instances \
            --instance-ids ${INSTANCE_ID} \
            --query 'Reservations[0].Instances[0].State.Name' \
            --output text \
            --region ${{ env.AWS_REGION }} 2>/dev/null || echo "terminated")

          if [ "${STATE}" != "terminated" ] && [ "${STATE}" != "shutting-down" ]; then
            echo "Instance masih berjalan, melakukan terminate..."
            aws ec2 terminate-instances \
              --instance-ids ${INSTANCE_ID} \
              --region ${{ env.AWS_REGION }}
          else
            echo "Instance sudah tidak berjalan: ${STATE}"
          fi          

# Script untuk handle Spot Interruption Notice
# Tambahkan di user data atau jalankan sebagai background service

#!/bin/bash
# spot-interruption-handler.sh

while true; do
    # Cek Spot Interruption Notice dari metadata endpoint
    HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
        -H "X-aws-ec2-metadata-token: $(curl -s -X PUT \
            -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' \
            http://169.254.169.254/latest/api/token)" \
        http://169.254.169.254/latest/meta-data/spot/termination-time)

    if [ "${HTTP_CODE}" == "200" ]; then
        echo "SPOT INTERRUPTION NOTICE diterima! Melakukan graceful shutdown..."

        # Kirim sinyal ke GitHub Actions runner agar bisa cleanup
        pkill -SIGTERM -f "Runner.Listener"

        # Tunggu sebentar lalu terminate
        sleep 30
        INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
        aws ec2 terminate-instances --instance-ids "${INSTANCE_ID}" --region ap-southeast-1
        exit 0
    fi

    sleep 5
done

# Gunakan EC2 Fleet untuk permintaan multi-AZ dan multi-instance-type
- name: Launch Spot via EC2 Fleet
  run: |
    aws ec2 create-fleet \
      --launch-template-configs '[
        {"LaunchTemplateSpecification":{"LaunchTemplateName":"ci-runner-template","Version":"$Latest"}},
      ]' \
      --target-capacity-specification '{
        "TotalTargetCapacity": 1,
        "SpotTargetCapacity": 1,
        "DefaultTargetCapacityType": "spot"
      }' \
      --spot-options '{
        "AllocationStrategy": "price-capacity-optimized",
        "InstanceInterruptionBehavior": "terminate"
      }' \
      --overrides '[
        {"InstanceType":"c6i.4xlarge","SubnetId":"subnet-aaa","WeightedCapacity":1},
        {"InstanceType":"c5.4xlarge","SubnetId":"subnet-aaa","WeightedCapacity":1},
        {"InstanceType":"c6i.4xlarge","SubnetId":"subnet-bbb","WeightedCapacity":1},
        {"InstanceType":"c5a.4xlarge","SubnetId":"subnet-bbb","WeightedCapacity":1}
      ]'    

# /etc/gitlab-runner/config.toml
[[runners]]
  name = "spot-runner"
  url = "https://gitlab.com"
  token = "RUNNER_TOKEN"
  executor = "docker+machine"

  [runners.docker]
    image = "docker:latest"

  [runners.machine]
    IdleCount = 0          # Tidak ada instance standby
    IdleTime = 300         # Terminate setelah 5 menit idle
    MaxBuilds = 1          # Terminate setelah 1 job (ephemeral)
    MachineDriver = "amazonec2"
    MachineName = "gitlab-runner-%s"

    MachineOptions = [
      "amazonec2-instance-type=c6i.4xlarge",
      "amazonec2-region=ap-southeast-1",
      "amazonec2-request-spot-instance=true",
      "amazonec2-spot-price=0.30",
      "amazonec2-ami=ami-xxxx",
      "amazonec2-iam-instance-profile=ci-runner-instance-profile",
      "amazonec2-tags=Purpose,ci-runner",
    ]