[Terraform] GitHub 1ES Runner

gh_1es_runner.tf

terraform {
  required_version = ">= 1.9.6, < 2.0.0"

  required_providers {
    azapi = {
      source  = "Azure/azapi"
      version = "2.4.0"
    }
  }
}

provider "azapi" {}

resource "azapi_resource" "resource_group" {
  type     = "Microsoft.Resources/resourceGroups@2025-04-01"
  body     = {}
  location = var.location
  name     = var.resource_group_name
}

resource "azapi_resource" "resource_group_lock" {
  type                      = "Microsoft.Authorization/locks@2020-05-01"
  name                      = "NoDelete"
  parent_id                 = azapi_resource.resource_group.id
  schema_validation_enabled = true

  body = {
    properties = {
      level = "CanNotDelete"
      notes = "This resource group is used for GitHub Runners and should not be deleted."
    }
  }
}

resource "azapi_resource" "image" {
  type                      = "Microsoft.CloudTest/images@2024-07-05-preview" # 2020-05-07
  name                      = var.image_name
  location                  = azapi_resource.resource_group.location
  parent_id                 = azapi_resource.resource_group.id
  schema_validation_enabled = false

  body = {
    properties = {
      imageType  = "SharedImageGallery"
      contacts   = [var.contact_email]
      resourceId = var.image_resource_id
    }
  }
}

resource "azapi_resource" "build_cache" {
  type                      = "Microsoft.CloudTest/buildcaches@2024-07-05-preview"
  name                      = var.build_cache_name
  location                  = azapi_resource.resource_group.location
  parent_id                 = azapi_resource.resource_group.id
  schema_validation_enabled = false

  body = {
    properties = {
      contacts = [var.contact_email]
    }
  }
}

# 1ES Hosted Pool for GitHub Runners
resource "azapi_resource" "hosted_pool" {
  type                      = "Microsoft.CloudTest/hostedpools@2024-07-05-preview"
  name                      = var.hosted_pool_name
  location                  = azapi_resource.resource_group.location
  parent_id                 = azapi_resource.resource_group.id
  schema_validation_enabled = false

  body = {
    properties = {
      organizationProfile = {
        organizationName = var.github_organization
        level            = "Organization"
        type             = "GitHub"
        url              = "https://github.com/${var.github_organization}"
      }
      sku = {
        tier = "StandardSSD"
        name = "Standard_D2ads_v5"
        type = "AzureSku"
      }
      buildCaches = [
        azapi_resource.build_cache.name
      ]
      images = [
        {
          imageName            = azapi_resource.image.name
          poolBufferPercentage = "100"
          subscriptionId       = var.subscription_id
          isEphemeral          = true
          ephemeralType        = "Automatic"
          enableTrustedLaunch  = "Disabled"
        }
      ]
      maxPoolSize = 2
      networkProfile = {
        natGatewayIpAddressCount = 1
        # subnetId                 = null
        firewallProfile = {
          policyName = "1ES-Base-Github"
        }
      }
      vmProviderProperties = {
        VssAdminPermissions = "CreatorOnly"
      }
      contacts = [var.contact_email]
      agentProfile = {
        type = "Stateless"
        kind = "Stateless"
      }
      vmProvider = "Azure"
      debugProfile = {
        maxResourcesForLease  = 1
        maxLeaseLifetimeHours = 1
      }
    }
  }

  depends_on = [azapi_resource.build_cache, azapi_resource.image]
}