Remove CodeBuild runner infrastructure

[whi-tw]

What problem does this pull request solve?

Trello card: https://trello.com/c/UIEQ97bl/792-stop-using-self-hosted-runners-on-github

Remove the CodeBuild-hosted GitHub Actions runner infrastructure now that review apps use GitHub-hosted runners with OIDC authentication.

The gha-runner module and CodeBuild resources are no longer needed. The service-linked role for app autoscaling has been shifted to iam.tf.

This should not be merged until we've migrated all the app repos, and rebased WIP branches (or at least informed developers of the change so they can rebase)

Things to consider when reviewing

• Ensure that you consider the wider context.
• Does it work when run on your machine?
• Is it clear what the code is doing?
• Do the commit messages explain why the changes were made?
• Are there all the unit tests needed?
• Has all relevant documentation been updated?

Reminders

If you've made changes to the deployer role (files in modules/deployer-access):

• Remember to run make <environment> forms/account apply on the relevant environments (dev, staging, user-research, and/or prod)
• Check the #govuk-forms-deployment-notifications Slack channel to ensure the apply-forms-terraform-<environment> pipelines have run successfully

[sarahseewhy]

Thank you!

[Copilot]

Pull request overview

Removes the CodeBuild-hosted GitHub Actions runner setup for review apps and updates the integration review environment to use GitHub-hosted runners with OIDC, triggering dedicated CodeBuild projects for deploy/destroy actions and storing deploy outputs as short-lived artifacts.

Changes:

• Deleted the gha-runner module and its wiring (github_actions_runner.tf) that previously provided self-hosted runner infrastructure.
• Added a new review-app-codebuild module (CodeBuild project + IAM + logging + buildspecs) to run review app deploy/destroy via Terraform.
• Updated github_actions_oidc.tf to create an artifacts bucket, provision per-app deploy/destroy CodeBuild projects, and tighten GitHub Actions role permissions to CodeBuild/ECR/artifacts.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
infra/deployments/integration/review/review-app-codebuild/main.tf	New CodeBuild project + IAM policy to run Terraform deploy/destroy for review apps
infra/deployments/integration/review/review-app-codebuild/inputs.tf	Inputs for the new CodeBuild module (app, action, ARNs, cluster details)
infra/deployments/integration/review/review-app-codebuild/outputs.tf	Outputs used by the review environment (project/log group identifiers)
infra/deployments/integration/review/review-app-codebuild/logging.tf	Creates a dedicated CloudWatch log group for CodeBuild
infra/deployments/integration/review/review-app-codebuild/buildspec-deploy.yml	Buildspec to terraform apply and publish outputs.json as an artifact
infra/deployments/integration/review/review-app-codebuild/buildspec-destroy.yml	Buildspec to terraform destroy review app resources
infra/deployments/integration/review/github_actions_oidc.tf	Provisions artifact bucket + CodeBuild projects and updates OIDC role permissions accordingly
infra/deployments/integration/review/iam.tf	Adds/retains the ECS application autoscaling service-linked role in the review env
infra/deployments/integration/review/github_actions_runner.tf	Removed old CodeBuild runner wiring and CodeBuild source credential resource
infra/deployments/integration/review/gha-runner/runner.tf	Removed the deprecated runner CodeBuild project + IAM permissions
infra/deployments/integration/review/gha-runner/inputs.tf	Removed inputs for the deprecated runner module

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

The base branch was changed.

[Copilot]

Pull request overview

Removes the now-obsolete CodeBuild-hosted GitHub Actions runner infrastructure for the integration review environment, following the move to GitHub-hosted runners using OIDC, while keeping the ECS application autoscaling service-linked role needed for review app deployments.

Changes:

• Delete the gha-runner module (IAM + CodeBuild project + webhook) previously used to host self-managed runners.
• Remove the root github_actions_runner.tf that instantiated runner modules for each app.
• Relocate/retain the ECS application autoscaling service-linked role and add aws_caller_identity data needed by remaining IAM policy generation.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
infra/deployments/integration/review/iam.tf	Retains the ECS application autoscaling service-linked role in the review root module.
infra/deployments/integration/review/github_actions_runner.tf	Removes legacy runner infrastructure definitions and per-app gha-runner module usage.
infra/deployments/integration/review/github_actions_codebuild.tf	Adds aws_caller_identity data source required for IAM policy ARN construction.
infra/deployments/integration/review/gha-runner/runner.tf	Deletes the gha-runner module implementation (IAM + CodeBuild runner + webhook).
infra/deployments/integration/review/gha-runner/inputs.tf	Deletes the gha-runner module inputs (module no longer used).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Removes the legacy CodeBuild-hosted GitHub Actions runner infrastructure for review apps (now using GitHub-hosted runners + OIDC), and updates Terraform inputs to support multiple CodeStar/CodeConnections ARNs keyed by GitHub org.

Changes:

• Deleted the integration review “gha-runner” module and the per-app runner provisioning.
• Moved the ECS Application Auto Scaling service-linked role definition into iam.tf.
• Changed codestar_connection_arn from a single string to an object (alphagov, govuk-forms) and updated callers/tfvars accordingly.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
infra/deployments/integration/tfvars/integration.tfvars	Removes codestar_connection_arn from integration tfvars.
infra/deployments/integration/review/iam.tf	Adds the ECS Application Auto Scaling service-linked role resource.
infra/deployments/integration/review/github_actions_runner.tf	Removes CodeBuild runner modules and related resources (file deleted).
infra/deployments/integration/review/github_actions_codebuild.tf	Adds aws_caller_identity data source for ARN construction.
infra/deployments/integration/review/gha-runner/runner.tf	Removes the old gha-runner implementation (file deleted).
infra/deployments/integration/review/gha-runner/inputs.tf	Removes gha-runner inputs (file deleted).
infra/deployments/integration/inputs.tf	Updates codestar_connection_arn variable type to an object.
infra/deployments/forms/tfvars/dev.tfvars	Converts codestar_connection_arn to an object with per-org keys.
infra/deployments/forms/tfvars/staging.tfvars	Converts codestar_connection_arn to an object with per-org keys.
infra/deployments/forms/tfvars/user-research.tfvars	Converts codestar_connection_arn to an object with per-org keys.
infra/deployments/forms/tfvars/production.tfvars	Converts codestar_connection_arn to an object with per-org keys.
infra/deployments/forms/pipelines/deploy-forms-runner-container.tf	Switches pipeline/module usage to codestar_connection_arn.alphagov.
infra/deployments/forms/pipelines/deploy-forms-product-page-container.tf	Switches pipeline/module usage to codestar_connection_arn.alphagov.
infra/deployments/forms/pipelines/deploy-forms-admin-container.tf	Switches pipeline/module usage to codestar_connection_arn.alphagov.
infra/deployments/forms/pipelines/apply-terraform.tf	Switches pipeline/module usage to codestar_connection_arn.alphagov.
infra/deployments/forms/inputs.tf	Updates codestar_connection_arn variable type to an object.
infra/deployments/forms/account/tfvars/dev.tfvars	Converts codestar_connection_arn to an object with per-org keys.
infra/deployments/forms/account/tfvars/staging.tfvars	Converts codestar_connection_arn to an object with per-org keys.
infra/deployments/forms/account/tfvars/user-research.tfvars	Converts codestar_connection_arn to an object with per-org keys.
infra/deployments/forms/account/tfvars/production.tfvars	Converts codestar_connection_arn to an object with per-org keys.
infra/deployments/forms/account/inputs.tf	Updates codestar_connection_arn variable type to an object.
infra/deployments/forms/account/engineer-access.tf	Passes codestar_connection_arn.alphagov into engineer-access module.
infra/deployments/forms/account/deployer-access.tf	Passes codestar_connection_arn.alphagov into deployer-access module.
infra/deployments/deploy/tools/pipeline-visualiser-pipeline.tf	Updates CodeConnections references to per-org ARNs in policy/pipeline config.
infra/deployments/deploy/inputs.tf	Updates deploy codestar_connection_arn variable to an object + defaults.
infra/deployments/deploy/image-builders/main.tf	Selects per-org CodeConnections ARN for product-page image builds.
infra/deployments/deploy/engineer-access/roles.tf	Passes codestar_connection_arn.alphagov into engineer-access module.
infra/deployments/deploy/e2e-tests-image-builder/main.tf	Passes codestar_connection_arn.alphagov into e2e image pipeline module.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Removes the now-unused CodeBuild-hosted GitHub Actions runner (the gha-runner module + per-app runner resources) from the integration review-app infrastructure, reflecting the migration to GitHub-hosted runners with OIDC.

Changes:

• Removes the gha-runner module and the github_actions_runner.tf resources that provisioned CodeBuild-hosted runners.
• Moves/retains the ECS application autoscaling service-linked role in iam.tf.
• Updates integration tfvars and review CodeBuild config in line with the new runner approach.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
infra/deployments/integration/tfvars/integration.tfvars	Removes CodeStar connection input from integration tfvars.
infra/deployments/integration/review/iam.tf	Adds the ECS application autoscaling service-linked role resource.
infra/deployments/integration/review/github_actions_runner.tf	Deletes the old CodeBuild-hosted runner modules/resources.
infra/deployments/integration/review/github_actions_codebuild.tf	Adds caller identity data source (for IAM policy ARN construction).
infra/deployments/integration/review/gha-runner/runner.tf	Deletes the legacy runner implementation (IAM + CodeBuild project/webhook).
infra/deployments/integration/review/gha-runner/inputs.tf	Deletes legacy runner module inputs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Removes the now-obsolete CodeBuild-hosted GitHub Actions runner infrastructure for review apps, following the migration to GitHub-hosted runners using OIDC, and keeps only the supporting IAM/service-linked role needed by the remaining review app deployment flow.

Changes:

• Removes the per-app gha-runner module and its CodeBuild runner resources from the integration review deployment.
• Removes the codestar_connection_arn variable wiring from the integration deployment and its tfvars.
• Moves the ECS application autoscaling service-linked role definition into iam.tf and adds aws_caller_identity data for IAM policy generation.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
infra/deployments/integration/tfvars/integration.tfvars	Removes codestar_connection_arn from integration tfvars.
infra/deployments/integration/review/iam.tf	Defines the app autoscaling service-linked role in the review deployment IAM file.
infra/deployments/integration/review/github_actions_runner.tf	Deletes the old CodeBuild-hosted runner + gha-runner module instantiations.
infra/deployments/integration/review/github_actions_codebuild.tf	Adds data.aws_caller_identity.current used for IAM policy ARNs.
infra/deployments/integration/review/gha-runner/runner.tf	Deletes the gha-runner module implementation (IAM + CodeBuild runner project/webhook).
infra/deployments/integration/review/gha-runner/inputs.tf	Deletes inputs for the removed gha-runner module.
infra/deployments/integration/inputs.tf	Removes the codestar_connection_arn variable from integration deployment inputs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.