Allow users to apply labels and annotations to internal resources by nikola-jokic · Pull Request #4400 · actions/actions-runner-controller

nikola-jokic · 2026-03-09T20:01:32Z

github-actions · 2026-03-09T20:01:47Z

Hello! Thank you for your contribution.

Please review our contribution guidelines to understand the project's testing and code conventions.

Copilot

Pull request overview

Adds support for specifying per-internal-resource labels/annotations via new ResourceMeta fields on AutoscalingRunnerSet / AutoscalingListener / EphemeralRunner(Set) APIs, and wires that metadata into the controller’s resource builder (with accompanying CRD updates).

Changes:

Introduce ResourceMeta API type and new spec fields to carry labels/annotations for internal resources.
Apply the new metadata in ResourceBuilder when creating listener/runner internal resources.
Regenerate/update CRDs (repo config + Helm chart packaged CRDs) and expand unit tests for propagation.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
controllers/actions.github.com/resourcebuilder.go	Applies metadata to listener/runner internal resources; adds new merge helpers
controllers/actions.github.com/resourcebuilder_test.go	Expands propagation test to cover new metadata fields
apis/actions.github.com/v1alpha1/common.go	Adds `ResourceMeta` type
apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go	Adds new metadata fields to AutoscalingRunnerSetSpec
apis/actions.github.com/v1alpha1/autoscalinglistener_types.go	Adds new metadata fields to AutoscalingListenerSpec
apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go	Adds EphemeralRunner metadata field
apis/actions.github.com/v1alpha1/ephemeralrunner_types.go	Adds EphemeralRunner JIT secret metadata field
apis/actions.github.com/v1alpha1/zz_generated.deepcopy.go	Updates deepcopy generation for new fields/types
config/crd/bases/actions.github.com_autoscalingrunnersets.yaml	CRD schema update for new fields
config/crd/bases/actions.github.com_autoscalinglisteners.yaml	CRD schema update for new fields
config/crd/bases/actions.github.com_ephemeralrunnersets.yaml	CRD schema update for new fields
config/crd/bases/actions.github.com_ephemeralrunners.yaml	CRD schema update for new fields
charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml	Packaged chart CRD schema update
charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml	Packaged chart CRD schema update
charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml	Packaged chart CRD schema update
charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml	Packaged chart CRD schema update

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-09T20:06:09Z

config/crd/bases/actions.github.com_autoscalinglisteners.yaml

+                required:
+                - annotations
+                - labels
+                type: object


This ResourceMeta schema requires both annotations and labels. If the intent is to allow users to set only one of them, the schema should not list them under required: (adjust ResourceMeta fields to be optional and regenerate CRDs).

Copilot · 2026-03-09T20:06:10Z

charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalinglisteners.yaml

+                required:
+                - annotations
+                - labels
+                type: object


This ResourceMeta schema in the chart CRD requires both annotations and labels. If only one should be needed, adjust the Go type to use optional fields and regenerate the CRDs included in the chart to drop these required: entries.

Copilot · 2026-03-09T20:06:10Z

charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunners.yaml

+                  required:
+                    - annotations
+                    - labels
+                  type: object


This chart CRD requires both annotations and labels for ephemeralRunnerConfigSecretMetadata. If the intent is to allow setting just annotations (common for IAM role bindings), remove these from required: by making the Go fields optional and regenerating the CRDs.

Copilot · 2026-03-09T20:06:10Z

controllers/actions.github.com/resourcebuilder.go

+			ServiceAccountMetadata:        autoscalingRunnerSet.Spec.ListenerServiceAccountMetadata,
+			RoleMetadata:                  autoscalingRunnerSet.Spec.ListenerRoleMetadata,
+			RoleBindingMetadata:           autoscalingRunnerSet.Spec.ListenerRoleMetadata,
+			ListenerConfigSecretMetadata:  autoscalingRunnerSet.Spec.ListenerConfigSecretMetadata,


RoleBindingMetadata is being populated from ListenerRoleMetadata, so any role-binding-specific labels/annotations provided via ListenerRoleBindingMetadata are ignored. This also makes the listener RoleBinding pick up the Role metadata instead.

Copilot · 2026-03-09T20:06:11Z

controllers/actions.github.com/resourcebuilder.go

+	var annotations map[string]string
+
+	for autoscalingListener.Spec.RoleBindingMetadata != nil {
+		labels = b.filterAndMergeLabels(autoscalingListener.Spec.RoleBindingMetadata.Labels, labels)
+		annotations = autoscalingListener.Spec.RoleBindingMetadata.Annotations
+	}


This uses a for autoscalingListener.Spec.RoleBindingMetadata != nil { ... } loop, which will never terminate when metadata is non-nil and will hang the controller/tests. This should be an if (or a loop that breaks) to apply metadata once.

Copilot · 2026-03-09T20:06:12Z

charts/gha-runner-scale-set-controller/crds/actions.github.com_autoscalingrunnersets.yaml

+                  required:
+                    - annotations
+                    - labels


These ResourceMeta schema blocks require both annotations and labels, which forces users to set empty maps when they only need one. Consider making ResourceMeta fields optional in the Go API and regenerating the vendored chart CRDs so required: does not include them.

Copilot · 2026-03-09T20:06:12Z

charts/gha-runner-scale-set-controller/crds/actions.github.com_ephemeralrunnersets.yaml

+                  required:
+                    - annotations
+                    - labels
+                  type: object


ResourceMeta is defined here with both annotations and labels in required:, which forces users to provide an empty map for the unused field. Consider making these properties optional by updating the API type and regenerating this chart CRD.

Copilot · 2026-03-09T20:06:13Z

controllers/actions.github.com/resourcebuilder.go

+func (b *ResourceBuilder) filterAndMergeLabels(base, overwrite map[string]string) map[string]string {
+	if base == nil && overwrite == nil {
+		return nil
+	}
+	if len(overwrite) == 0 {
+		return maps.Clone(base)
+	}


filterAndMergeLabels returns maps.Clone(base) when overwrite is empty, which skips the prefix filtering logic entirely. Call sites like filterAndMergeLabels(customLabels, nil) will therefore allow excluded/reserved label prefixes to pass through unfiltered; consider always running the filter even when not merging.

Copilot · 2026-03-09T20:06:13Z

apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go

+	// +optional
+	AutoscalingListenerMetadata *ResourceMeta `json:"autoscalingListener,omitempty"`
+
 	// +optional
 	ListenerMetrics *MetricsConfig `json:"listenerMetrics,omitempty"`

 	// +optional
 	ListenerTemplate *corev1.PodTemplateSpec `json:"listenerTemplate,omitempty"`

+	// +optional
+	ListenerServiceAccountMetadata *ResourceMeta `json:"listener_service_account_metadata,omitempty"`
+
+	// +optional
+	ListenerRoleMetadata *ResourceMeta `json:"listener_role_metadata,omitempty"`
+
+	// +optional
+	ListenerRoleBindingMetadata *ResourceMeta `json:"listener_role_binding_metadata,omitempty"`
+
+	// +optional
+	ListenerConfigSecretMetadata *ResourceMeta `json:"listener_config_secret_metadata,omitempty"`
+
+	// +optional
+	EphemeralRunnerSetMetadata *ResourceMeta `json:"ephemeralRunnerSetMetadata,omitempty"`
+
+	// +optional
+	EphemeralRunnerMetadata *ResourceMeta `json:"ephemeralRunnerMetadata,omitempty"`
+
+	// +optional
+	EphemeralRunnerConfigSecretMetadata *ResourceMeta `json:"ephemeralRunnerConfigSecretMetadata,omitempty"`
+


The new JSON field names mix lowerCamelCase (e.g. autoscalingListener, ephemeralRunnerSetMetadata) with snake_case (e.g. listener_service_account_metadata). This is inconsistent with the existing API fields in this spec (which are lowerCamelCase) and is likely to be surprising for CR authors/Helm values; consider renaming these to lowerCamelCase and regenerating CRDs accordingly.

Copilot · 2026-03-09T20:06:13Z

config/crd/bases/actions.github.com_autoscalingrunnersets.yaml

+                  required:
+                    - annotations
+                    - labels


These ResourceMeta schema blocks mark both annotations and labels as required. That forces users to provide (at least) an empty map for the unused field, which makes it harder to set only annotations (the reported use case). Consider making labels/annotations optional in the Go type (omitempty/+optional) and regenerating CRDs so these required: entries are removed.

nikola-jokic added 3 commits February 17, 2026 15:49

Allow controlled customizations to internal resources

b3b6df3

Modify propagation

5470a7c

test

1db8869

Copilot AI review requested due to automatic review settings March 9, 2026 20:01

nikola-jokic requested review from a team, mumoshu, rentziass and toast-gear as code owners March 9, 2026 20:01

nikola-jokic added the gha-runner-scale-set Related to the gha-runner-scale-set mode label Mar 9, 2026

Copilot started reviewing on behalf of nikola-jokic March 9, 2026 20:02 View session

Copilot AI reviewed Mar 9, 2026

View reviewed changes

nikola-jokic added 2 commits March 9, 2026 22:53

Merge branch 'master' into nikola-jokic/internal-resource-customizations

f8ee96f

fix tests

e501b44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow users to apply labels and annotations to internal resources#4400

Allow users to apply labels and annotations to internal resources#4400
nikola-jokic wants to merge 5 commits intomasterfrom
nikola-jokic/internal-resource-customizations

nikola-jokic commented Mar 9, 2026

Uh oh!

github-actions bot commented Mar 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Copilot AI Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nikola-jokic commented Mar 9, 2026

Uh oh!

github-actions bot commented Mar 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants