Fix userdata size limit by using compact template

The userdata script exceeded AWS's 16KB limit. Created a highly optimized
compact template that:

- Reduces from 18KB to 4.7KB
- Uses minimal variable names (H for homedir, RT for runner token, etc.)
- Removes verbose logging and comments
- Consolidates multi-line scripts into single lines
- Abbreviates file paths (/var/run/github-runner-* -> /var/run/ghr-*)
- Simplifies job tracking to minimal JSON

The compact template maintains all essential functionality:
- Home directory auto-detection
- Failsafe termination on errors
- Registration timeout watchdog
- CloudWatch logging
- SSH key setup
- Job hooks for termination logic

Author: ryan-williams

src/ec2_gha/start.py

@@ -208,7 +208,8 @@ def _build_user_data(self, **kwargs) -> str:
             The user data script as a string.
 
         """
-        template = importlib.resources.files("ec2_gha").joinpath("templates/user-script.sh.templ")
+        # Use compact template to stay under 16KB userdata limit
+        template = importlib.resources.files("ec2_gha").joinpath("templates/user-script-compact.sh.templ")
         with template.open() as f:
             template_content = f.read()
 

src/ec2_gha/templates/user-script-compact.sh.templ

@@ -0,0 +1,103 @@
+#!/bin/bash
+set -e
+INSTANCE_ID=$$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
+terminate_instance() {
+    echo "FATAL: $$1" | tee -a /var/log/runner-setup.log
+    [ -f "$$H/config.sh" ] && cd "$$H" && ./config.sh remove --token "$${RT}" 2>/dev/null || true
+    shutdown -h now
+}
+trap 'terminate_instance "Error line $$LINENO"' ERR
+(sleep $${runner_registration_timeout:-300}; [ ! -f /var/run/ghr-reg ] && terminate_instance "Registration timeout") &
+RWP=$$!
+$userdata
+H="$homedir"
+[ -z "$$H" -o "$$H" = "AUTO" ] && for u in ubuntu ec2-user centos admin debian fedora; do
+    id $$u &>/dev/null && H="/home/$$u" && break
+done
+[ -z "$$H" -o "$$H" = "AUTO" ] && H=$$(getent passwd|awk -F: '$$3>=1000&&$$3<65534&&$$6~/^\/home\//{print $$6;exit}')
+[ -z "$$H" ] && H="/home/ec2-user"
+cd "$$H"
+nohup bash -c "sleep $${max_instance_lifetime}m && shutdown -h now" &>/dev/null &
+if [ "$cloudwatch_logs_group" != "" ]; then
+    apt-get update && apt-get install -y amazon-cloudwatch-agent || yum install -y amazon-cloudwatch-agent
+    cat>/opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json<<EOF
+{"logs":{"logs_collected":{"files":{"collect_list":[
+{"file_path":"/var/log/runner-setup.log","log_group_name":"$cloudwatch_logs_group","log_stream_name":"$${INSTANCE_ID}/runner-setup"},
+{"file_path":"/tmp/job-started-hook.log","log_group_name":"$cloudwatch_logs_group","log_stream_name":"$${INSTANCE_ID}/job-started"},
+{"file_path":"/tmp/job-completed-hook.log","log_group_name":"$cloudwatch_logs_group","log_stream_name":"$${INSTANCE_ID}/job-completed"},
+{"file_path":"/tmp/termination-check.log","log_group_name":"$cloudwatch_logs_group","log_stream_name":"$${INSTANCE_ID}/termination"},
+{"file_path":"$$H/_diag/Runner_**.log","log_group_name":"$cloudwatch_logs_group","log_stream_name":"$${INSTANCE_ID}/runner-diag"},
+{"file_path":"$$H/_diag/Worker_**.log","log_group_name":"$cloudwatch_logs_group","log_stream_name":"$${INSTANCE_ID}/worker-diag"}
+]}}}}
+EOF
+    systemctl start amazon-cloudwatch-agent
+fi
+[ "$ssh_pubkey" != "" ] && mkdir -p $$H/.ssh && echo "$ssh_pubkey">>$$H/.ssh/authorized_keys && chmod 700 $$H/.ssh && chmod 600 $$H/.ssh/authorized_keys
+exec &>/var/log/runner-setup.log
+echo "$script" > pre-runner-script.sh && source pre-runner-script.sh
+export RUNNER_ALLOW_RUNASROOT=1
+curl -L $runner_release -o runner.tar.gz && tar --no-overwrite-dir -xzf runner.tar.gz
+cat>/usr/local/bin/job-started-hook.sh<<'E'
+#!/bin/bash
+exec>>/tmp/job-started-hook.log 2>&1
+echo "[$$(date)] Job started: $$GITHUB_JOB"
+touch /var/run/ghr-act
+mkdir -p /var/run/ghr-jobs
+echo '{"s":"r"}' > /var/run/ghr-jobs/$$GITHUB_RUN_ID-$$GITHUB_JOB.job
+E
+cat>/usr/local/bin/job-completed-hook.sh<<'E'
+#!/bin/bash
+exec>>/tmp/job-completed-hook.log 2>&1
+echo "[$$(date)] Job completed: $$GITHUB_JOB"
+rm -f /var/run/ghr-jobs/$$GITHUB_RUN_ID-$$GITHUB_JOB.job
+touch /var/run/ghr-act
+E
+cat>/usr/local/bin/check-runner-termination.sh<<'E'
+#!/bin/bash
+exec>>/tmp/termination-check.log 2>&1
+[ ! -f /var/run/ghr-act ] && exit 0
+L=$$(stat -c %Y /var/run/ghr-act 2>/dev/null || stat -f %m /var/run/ghr-act)
+I=$$(($$(date +%s)-L))
+G=$${RUNNER_GRACE_PERIOD:-60}
+[ ! -f /var/run/ghr-started ] && G=$${RUNNER_INITIAL_GRACE_PERIOD:-180}
+R=$$(ls /var/run/ghr-jobs/*.job 2>/dev/null|wc -l)
+[ $$R -eq 0 -a $$I -gt $$G ] && { [ -f $$H/config.sh ] && cd $$H && RUNNER_ALLOW_RUNASROOT=1 ./config.sh remove --token $${RT} || true; shutdown -h now; }
+E
+chmod +x /usr/local/bin/*-hook.sh
+cat>/etc/systemd/system/ghr-term.service<<EOF
+[Unit]
+Description=Check Runner Term
+[Service]
+Type=oneshot
+Environment="RUNNER_GRACE_PERIOD=$runner_grace_period"
+Environment="RUNNER_INITIAL_GRACE_PERIOD=$runner_initial_grace_period"
+Environment="RT=$token"
+Environment="H=$$H"
+ExecStart=/usr/local/bin/check-runner-termination.sh
+EOF
+cat>/etc/systemd/system/ghr-term.timer<<EOF
+[Unit]
+Description=Runner Term Timer
+[Timer]
+OnBootSec=60s
+OnUnitActiveSec=$${runner_poll_interval}s
+[Install]
+WantedBy=timers.target
+EOF
+systemctl daemon-reload && systemctl enable --now ghr-term.timer
+IT=$$(curl -s http://169.254.169.254/latest/meta-data/instance-type)
+RN="i-$${INSTANCE_ID:2}"
+ML=",instance-id:$${INSTANCE_ID},instance-type:$${IT},workflow:$github_workflow,run-id:$github_run_id,run-number:$github_run_number"
+AL="$labels$${ML}"
+export RT="$token"
+./config.sh --url https://github.com/$repo --token $token --labels "$$AL" --name "$$RN" --disableupdate
+touch /var/run/ghr-reg
+[ -n "$$RWP" ] && kill $$RWP 2>/dev/null || true
+touch /var/run/ghr-started
+mkdir -p $$H/_diag && chmod 755 $$H/_diag && chmod o+x $$H
+cat>.env<<EOF
+RUNNER_HOME=$$H
+ACTIONS_RUNNER_HOOK_JOB_STARTED=/usr/local/bin/job-started-hook.sh
+ACTIONS_RUNNER_HOOK_JOB_COMPLETED=/usr/local/bin/job-completed-hook.sh
+EOF
+./run.sh

src/ec2_gha/templates/user-script.sh.templ

@@ -31,7 +31,7 @@ REGISTRATION_TIMEOUT=$${runner_registration_timeout:-300}
     fi
 ) &
 REGISTRATION_WATCHDOG_PID=$$!
-echo "[$$(date '+%Y-%m-%d %H:%M:%S')] Started registration watchdog (PID: $$REGISTRATION_WATCHDOG_PID, timeout: $${REGISTRATION_TIMEOUT}s)"
+echo "[$$( date '+%Y-%m-%d %H:%M:%S')] Watchdog PID: $$REGISTRATION_WATCHDOG_PID"
 
 $userdata
 
@@ -45,7 +45,7 @@ if [ -z "$$homedir" ] || [ "$$homedir" = "AUTO" ]; then
     for user in ubuntu ec2-user centos admin debian fedora alpine arch; do
         if id "$$user" &>/dev/null; then
             homedir="/home/$$user"
-            echo "[$$(date '+%Y-%m-%d %H:%M:%S')] Auto-detected home directory for user $$user: $$homedir"
+            echo "[$$( date '+%Y-%m-%d %H:%M:%S')] Auto-detected: $$homedir"
             break
         fi
     done
@@ -62,20 +62,20 @@ if [ -z "$$homedir" ] || [ "$$homedir" = "AUTO" ]; then
 
         if [ -z "$$homedir" ]; then
             homedir="/home/ec2-user"  # Ultimate fallback
-            echo "[$$(date '+%Y-%m-%d %H:%M:%S')] No suitable user found, using fallback: $$homedir"
+            echo "[$$( date '+%Y-%m-%d %H:%M:%S')] Using fallback: $$homedir"
         else
             # Use stat to get the actual owner of the directory
             owner=$$(stat -c "%U" "$$homedir" 2>/dev/null || stat -f "%Su" "$$homedir" 2>/dev/null)
-            echo "[$$(date '+%Y-%m-%d %H:%M:%S')] Detected home directory for user $$owner: $$homedir"
+            echo "[$$( date '+%Y-%m-%d %H:%M:%S')] Detected: $$homedir ($$owner)"
         fi
     fi
 else
-    echo "[$$(date '+%Y-%m-%d %H:%M:%S')] Using specified home directory: $$homedir"
+    echo "[$$( date '+%Y-%m-%d %H:%M:%S')] Using: $$homedir"
 fi
 
 # Set up maximum lifetime timeout - do this early to ensure cleanup
 MAX_LIFETIME_MINUTES=$max_instance_lifetime
-echo "[$$(date '+%Y-%m-%d %H:%M:%S')] Setting up maximum lifetime timeout: $${MAX_LIFETIME_MINUTES} minutes"
+echo "[$$( date '+%Y-%m-%d %H:%M:%S')] Max lifetime: $${MAX_LIFETIME_MINUTES}m"
 nohup bash -c "sleep $${MAX_LIFETIME_MINUTES}m && echo '[$$(date)] Maximum lifetime reached' && shutdown -h now" > /var/log/max-lifetime.log 2>&1 &
 
 # Configure CloudWatch Logs if enabled
@@ -191,7 +191,7 @@ fi
 
 # Redirect runner setup logs to a file for CloudWatch
 exec >> /var/log/runner-setup.log 2>&1
-echo "[$$(date '+%Y-%m-%d %H:%M:%S')] GitHub runner setup starting"
+echo "[$$( date '+%Y-%m-%d %H:%M:%S')] Starting runner setup"
 
 # Log instance metadata for later analysis
 INSTANCE_TYPE=$$(curl -s http://169.254.169.254/latest/meta-data/instance-type 2>/dev/null || echo "unknown")