// the find
machulav/ec2-github-runner
On-demand self-hosted AWS EC2 runner for GitHub Actions
A GitHub Action that spins up an EC2 instance as a self-hosted runner at the start of a workflow job and terminates it at the end. The core use case is getting access to beefier hardware than GitHub's hosted runners, or running jobs inside a private VPC. It handles the full lifecycle: register runner token, launch instance via user-data script, wait for registration, then terminate and deregister on stop.
The three-job pattern (start/work/stop with `if: always()`) is well thought out and prevents orphaned instances even when the main job fails. JIT runner support using GitHub's `generate-jitconfig` API is a cleaner approach than registration tokens — single-use runners that self-destruct avoid the stale runner problem entirely. Multi-AZ failover for spot instances is genuinely useful; spot capacity varies by AZ and this saves a lot of manual retry logic. The IAM policy examples are minimal and correct, with separate blocks for optional features rather than one overly-permissive blob.
It requires a GitHub Personal Access Token with `repo` scope, which is a broad credential — fine-grained PATs with only runner management permissions would be safer but aren't supported. The stop job still runs on `ubuntu-latest`, meaning you're paying for a GitHub-hosted runner just to terminate an EC2 instance; there's no lightweight alternative. Pre-baked AMIs with stale runner binaries will silently fail until runner version skew becomes too large — there's no automatic runner version check or fallback download. The dist/ directory contains pre-compiled chunks committed to the repo, which is standard for GitHub Actions but means you're running code you haven't read.