feat(scale-set): add service controller

[edersonbrilhante]

Description

Adds the scale-set service controller, GitHub scale-set client library, EC2 scale-set provider capability, and the container build and release workflow.

Builds on the shared EC2 runner boundary from #5301. The provider creates one durable shared runner client, then binds each reconciliation request's abort signal before launching, tagging, or terminating runners. It extends RunnerSource with scale-set-service and supplies each caller's source explicitly.

Uses one neutral EC2 runner creation contract for every orchestration context: created instance IDs, a failed-instance count, and bounded AWS failure signals. The control-plane adapter alone maps those signals and scaleErrors into webhook retry counts. Scale-set reconciliation uses only the neutral failed-instance count and does not inherit the webhook/SQS retry policy.

Applies orchestrationTags at the control-plane creation boundary and uses the same mechanism for EC2 inventory filters. Pool, webhook scale-up, and scale-down share an inventory fenced by environment and both existing control-plane ghr:created_by values, preserving shared capacity accounting and cleanup while excluding scale-set-service instances.

Splits the EC2 scale-set provider into configuration, inventory, reconciliation, scale-up, and scale-down contexts while retaining provider.ts as the public facade. The provider test suite follows the same contexts, with shared AWS mocks and fixtures in dedicated test-support modules.

Aligns message handling with the upstream actions/scaleset listener: acknowledge the message before job acquisition and compute reconciliation, treat provider failures as fatal for that reconciler after acknowledgement, and keep transport and session recovery separate.

Normalizes GitHub and Actions service URL paths with linear scans, avoiding regular-expression denial-of-service risks on uncontrolled input while preserving invalid-path rejection.

Test Plan

• The compute-provider suite passed: 21 files, 344 tests.
• The control-plane suite passed: 14 files, 348 tests.
• The GitHub scale-set client suite passed: 4 files, 40 tests.
• The scale-set service suite passed: 9 files, 67 tests.
• TypeScript type-checks passed for the compute-provider, control-plane, and scale-set service projects.
• ESLint and Prettier checks passed for all changed TypeScript files.
• The scale-set service NCC bundle completed successfully.
• git diff --check and pre-commit checks passed.

Related Issues

Depends on #5301.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 3 package(s) with unknown licenses.

See the Details below.

License Issues

lambdas/services/scale-set/package.json

Package	Version	License	Issue Type
@aws-github-runner/aws-ssm-util		Null	Unknown License
@aws-github-runner/compute-providers		Null	Unknown License
@aws-github-runner/github-actions-scale-set		Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
actions/actions/attest	1e69f48acb82d1966a394da916b4c1698aa569d6	Unknown	Unknown
actions/docker/build-push-action	53b7df96c91f9c12dcc8a07bcb9ccacbed38856a	🟢 7.5	Details Check Score Reason Security-Policy 🟢 9 security policy file detected Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Packaging 🟢 10 packaging workflow detected SAST 🟢 9 SAST tool detected but not run on all commits Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7
actions/docker/login-action	dbcb813823bdd20940b903addbd779551569679f	🟢 8.6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 9 security policy file detected Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 10 SAST tool is run on all commits
actions/docker/setup-buildx-action	37fe631027851001ddb9b187196cc803df7f5f0e	🟢 8.6	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 9 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected Pinned-Dependencies 🟢 7 dependency not pinned by hash detected -- score normalized to 7 SAST 🟢 10 SAST tool is run on all commits
actions/docker/setup-qemu-action	96fe6ef7f33517b61c61be40b68a1882f3264fb8	🟢 8.4	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 9 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 SAST 🟢 10 SAST tool is run on all commits
npm/@aws-sdk/client-ssm	^3.1009.0	Unknown	Unknown
npm/@types/node	^22.19.3	Unknown	Unknown
npm/typescript	^5.9.3	Unknown	Unknown
npm/@aws-github-runner/aws-ssm-util		Unknown	Unknown
npm/@aws-github-runner/compute-providers		Unknown	Unknown
npm/@aws-github-runner/github-actions-scale-set		Unknown	Unknown
npm/@aws-sdk/client-ssm	^3.1009.0	Unknown	Unknown
npm/@octokit/auth-app	8.2.0	🟢 6.8	Details Check Score Reason Maintained 🟢 5 7 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5 Security-Policy 🟢 9 security policy file detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits
npm/@octokit/request	^9.2.2	Unknown	Unknown
npm/@types/node	^22.19.3	Unknown	Unknown
npm/@vercel/ncc	0.38.4	🟢 7.4	Details Check Score Reason Maintained 🟢 10 17 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/typescript	^5.9.3	Unknown	Unknown
npm/undici	^6.19.2	Unknown	Unknown
npm/undici	6.28.0	🟢 7.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 8 binaries present in source code Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Vulnerabilities ⚠️ 0 11 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found SAST 🟢 10 SAST tool is run on all commits Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 63 contributing companies or organizations

Scanned Files

• .github/workflows/release.yml
• lambdas/libs/compute-providers/package.json
• lambdas/libs/github-actions-scale-set/package.json
• lambdas/services/scale-set/package.json
• lambdas/yarn.lock