v3.3.0 - Changelog

Spot interrupted jobs now report failure, and Flex and Fleet can retry after workflow attempts 1 and 2; attempt 3 is final.

We are also releasing an example reusable workflow that can be used in merge queues, to detect whether a job has failed due to a spot interruption. This will keep a pull request in GitHub's merge queue while RunsOn retries a job after an EC2 Spot interruption.
Flex and Fleet now support cop, short for capacity-optimized-prioritized: AWS chooses capacity with a lower interruption risk while considering your preferred instance types. Set spot: cop in the runner definition and list exact types in preference order, for example family: [c8a.large, c8i.large]. Flex also accepts the spot=cop job label. Preferences are best effort: AWS can select a later type even when the first has capacity. Family names and wildcards are not supported with this strategy.
Organizations using GitHub Enterprise Cloud with data residency (*.ghe.com) can now use Flex and Fleet, including app setup, authentication, caching, and diagnostics.

Runner SSM permissions granted unnecessary account-wide Parameter Store reads. The default policy now omits those reads, and SSMAllowed=false disables the managed SSM policy. SSM access remains enabled by default.
Identifying the installed RunsOn version required looking beyond the stack description. The description now includes the deployed version.

Valid Fleet catalogs failed with all map elements must have the same type when entries used different optional fields. Mixed entries now work without empty placeholder values, and supported fields are documented. Fixes terraform-aws-runs-on#56.
Flex upgrades from v3.1.0 could fail with a dependency cycle involving diagnostics and API Gateway. Upgrades now preserve the required resource ordering without manual state removal or resource deletion.
Configured permission boundaries were missing from some control-plane IAM roles. Flex and Fleet now apply permission_boundary_arn consistently.
Runner SSM permissions granted unnecessary account-wide Parameter Store reads. The default policy now omits those reads; set ssm_allowed=false to disable the managed SSM policy.

Repeated EC2 capacity failures could leave a Flex job queued for hours without showing the launch error. Flex now reserves its final launch attempt for the fallback error runner so it can report the failure in GitHub. Fixes runs-on#543.
Fleet on-demand runners could all land in one Availability Zone despite multiple configured subnets. Single-runner launches using exact instance types now vary subnet preference, including on-demand fallback after a Spot capacity shortage. Addresses terraform-aws-runs-on#66.
Large deployment-approval backlogs could delay unrelated queued Flex jobs. Queued jobs now receive reserved processing capacity.
Long deployment approvals and out-of-order GitHub events could disrupt runner activation. Flex now retains the existing runner across approval and checks whether it can be reused before launching a replacement.
Job diagnostics could include unrelated jobs or miss relevant events. roc logs now filters workflow-run logs to the selected job, and full archives keep job and run logs separate.