v3.0.0 - Changelog

Breaking change, due to the AppRunner deprecation for new accounts. You must spin a new stack, not upgrade from v2.

RunsOn v3 replaces the App Runner control plane with the new runtime on ECS/Fargate, using API Gateway/Lambda ingress and a simpler runtime service model.
Added an integrated managed WAF option for public webhook ingress, with GitHub setup callback protection and admin route gating.
Added support for fully disabling public admin routes when setup and dashboard access should not be exposed through public ingress.
Simplified app sizing with shared small, medium, high, and xhigh presets instead of separate CPU, memory, queue, and worker-count knobs.
Improved runner lifecycle behavior with faster completed-job cleanup, staged launch retry backoff, safer manual reruns, and better protection for active pool instances.
Added optional Bedrock permissions for runner instances so Bedrock-compatible AI agents can run on GitHub Actions jobs when explicitly enabled.
Improved inline OTEL job summaries, including clearer disk/network rate charts and clearer no-metrics reporting for short jobs.

Reworked the v3 template around the new control plane, managed public ingress, built-in dashboard creation, and a fixed embedded networking shape.
Removed deprecated App Runner, external networking, default admin, debug, runner disk default, queue alarm, and dashboard toggle parameters.
Replaced daily minutes alarms with AppBudgetDailyUsd, defaulting to $10/day.
Added EnableBedrock for opt-in Bedrock permissions on runner instances.
Switched ephemeral ECR repositories to CloudFormation-generated physical names so stacks with uppercase names can enable the ephemeral registry.

Moved the classic RunsOn product, Flex, to terraform/flex in preparation for a new product line, Fleet. V3 module consumers should use runs-on/runs-on/aws//flex.
Replaced legacy app CPU, memory, queue-size, alarm, dashboard, debug, storage logging, and disk defaults with the v3 app-size model.
Added enable_bedrock for opt-in Bedrock permissions on runner instances.
Added custom app and runner policy inputs.
Improved WAF support, including plan-safe handling for managed and custom public ingress ACLs.

Improved GitHub discovery, stale repo config refresh, runner cache refresh, and GitHub secondary-rate-limit configuration.