Use ActionableRevision and observed generation to track update propagation

apis/actions.github.com/v1alpha1/autoscalingrunnerset_types.go

@@ -319,6 +319,10 @@ type HistogramMetric struct {
 type AutoscalingRunnerSetStatus struct {
 	// +optional
 	Phase AutoscalingRunnerSetPhase `json:"phase"`
+	// ObservedGeneration tracks the metadata.generation of this ARS at observation time,
+	// enabling detection of Pending phase when generation differs. Unset defaults to 0.
+	// +optional
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
 }
 
 type AutoscalingRunnerSetPhase string

apis/actions.github.com/v1alpha1/ephemeralrunnerset_types.go

@@ -36,12 +36,28 @@ type EphemeralRunnerSetSpec struct {
 	// but does not apply to existing ephemeral runners.
 	// +optional
 	EphemeralRunnerMetadata *ResourceMeta `json:"ephemeralRunnerMetadata,omitempty"`
+	// ActionableRevision is a restart-safe applied marker that increments whenever
+	// Spec.EphemeralRunnerSpec changes, enabling detection of spec updates.
+	// Unset defaults to 0.
+	// +optional
+	ActionableRevision int64 `json:"actionableRevision,omitempty"`
 }
 
 // EphemeralRunnerSetStatus defines the observed state of EphemeralRunnerSet
 type EphemeralRunnerSetStatus struct {
 	// +optional
 	Phase EphemeralRunnerSetPhase `json:"phase"`
+	// AppliedActionableRevision is a restart-safe applied marker tracking the last successfully
+	// applied ActionableRevision value. Advances only after spec cleanup succeeds.
+	// Unset defaults to 0.
+	// +optional
+	AppliedActionableRevision int64 `json:"appliedActionableRevision,omitempty"`
+	// FinishedRunnerCleanupPatchID records the listener patch ID for which finished
+	// ephemeral runners were cleaned up. Scale-up is suppressed for the same patch ID
+	// until the listener publishes a fresh desired-state patch.
+	// Unset defaults to 0.
+	// +optional
+	FinishedRunnerCleanupPatchID int `json:"finishedRunnerCleanupPatchID,omitempty"`
 }
 
 // EphemeralRunnerSetPhase is the phase of the ephemeral runner set resource

controllers/actions.github.com/autoscalinglistener_controller.go

@@ -105,6 +105,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 		}
 
 		log.Info("Successfully removed finalizer after cleanup")
+		r.ResourceCache.Delete(&autoscalingListener)
 		return ctrl.Result{}, nil
 	}
 
@@ -462,7 +463,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 			return ctrl.Result{}, err
 		}
 
-		shouldReCreate := desiredPod.Annotations[annotationKeyIntegrityHash] != listenerPod.Annotations[annotationKeyIntegrityHash]
+		shouldReCreate := listenerPodSpecRequiresRecreation(&listenerPod, desiredPod)
 		if shouldReCreate {
 			log.Info("Listener pod dependency changed, recreating listener pod")
 			if err := r.deleteListenerPod(ctx, &autoscalingListener, &listenerPod, log); err != nil {
@@ -500,6 +501,7 @@ func (r *AutoscalingListenerReconciler) Reconcile(ctx context.Context, req ctrl.
 			return ctrl.Result{}, nil
 		}
 
+		r.ResourceCache.listenerPod.Delete(&autoscalingListener)
 		desiredPod, err := r.newScaleSetListenerPod(
 			&autoscalingListener,
 			&listenerConfigSecret,
@@ -685,6 +687,7 @@ func (r *AutoscalingListenerReconciler) cleanupResources(ctx context.Context, au
 }
 
 func (r *AutoscalingListenerReconciler) createServiceAccountForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (ctrl.Result, error) {
+	r.ResourceCache.listenerServiceAccount.Delete(autoscalingListener)
 	newServiceAccount, err := r.newScaleSetListenerServiceAccount(autoscalingListener)
 	if err != nil {
 		return ctrl.Result{}, err
@@ -768,6 +771,7 @@ func (r *AutoscalingListenerReconciler) createProxySecret(ctx context.Context, a
 }
 
 func (r *AutoscalingListenerReconciler) createRoleForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, logger logr.Logger) (ctrl.Result, error) {
+	r.ResourceCache.listenerRole.Delete(autoscalingListener)
 	newRole := r.newScaleSetListenerRole(autoscalingListener)
 
 	logger.Info("Creating listener role", "namespace", newRole.Namespace, "name", newRole.Name, "rules", newRole.Rules)
@@ -781,6 +785,7 @@ func (r *AutoscalingListenerReconciler) createRoleForListener(ctx context.Contex
 }
 
 func (r *AutoscalingListenerReconciler) createRoleBindingForListener(ctx context.Context, autoscalingListener *v1alpha1.AutoscalingListener, listenerRole *rbacv1.Role, serviceAccount *corev1.ServiceAccount, logger logr.Logger) (ctrl.Result, error) {
+	r.ResourceCache.listenerRoleBinding.Delete(autoscalingListener)
 	newRoleBinding := r.newScaleSetListenerRoleBinding(autoscalingListener, listenerRole, serviceAccount)
 
 	logger.Info("Creating listener role binding",

controllers/actions.github.com/autoscalinglistener_controller_test.go

@@ -38,6 +38,7 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 	var autoscalingRunnerSet *v1alpha1.AutoscalingRunnerSet
 	var configSecret *corev1.Secret
 	var autoscalingListener *v1alpha1.AutoscalingListener
+	var resourceCache *ResourceCache
 
 	BeforeEach(func() {
 		ctx = context.Background()
@@ -49,7 +50,9 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 			scalefake.NewMultiClient(),
 		)
 
+		resourceCache = newTestResourceCache()
 		rb := ResourceBuilder{
+			ResourceCache:  resourceCache,
 			SecretResolver: secretResolver,
 		}
 
@@ -230,6 +233,17 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 				autoscalingListenerTestTimeout,
 				autoscalingListenerTestInterval,
 			).Should(BeEquivalentTo(autoscalingListener.Name), "Pod should be created")
+
+			Eventually(
+				func() bool {
+					return resourceCacheStateHasMainObjectEntries(resourceCache.listenerServiceAccount, created) &&
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerRole, created) &&
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerRoleBinding, created) &&
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerPod, created)
+				},
+				autoscalingListenerTestTimeout,
+				autoscalingListenerTestInterval,
+			).Should(BeTrue(), "AutoScalingListener service account, role, role binding, and pod resources should be cached after reconciliation")
 		})
 	})
 
@@ -250,8 +264,22 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 				autoscalingListenerTestInterval,
 			).Should(BeEquivalentTo(autoscalingListener.Name), "Pod should be created")
 
+			created := new(v1alpha1.AutoscalingListener)
+			err := k8sClient.Get(ctx, client.ObjectKey{Name: autoscalingListener.Name, Namespace: autoscalingListener.Namespace}, created)
+			Expect(err).NotTo(HaveOccurred(), "failed to get AutoScalingListener")
+			Eventually(
+				func() bool {
+					return resourceCacheStateHasMainObjectEntries(resourceCache.listenerServiceAccount, created) &&
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerRole, created) &&
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerRoleBinding, created) &&
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerPod, created)
+				},
+				autoscalingListenerTestTimeout,
+				autoscalingListenerTestInterval,
+			).Should(BeTrue(), "AutoScalingListener service account, role, role binding, and pod resources should be cached before deletion")
+
 			// Delete the AutoScalingListener
-			err := k8sClient.Delete(ctx, autoscalingListener)
+			err = k8sClient.Delete(ctx, autoscalingListener)
 			Expect(err).NotTo(HaveOccurred(), "failed to delete test AutoScalingListener")
 
 			// Cleanup the listener pod
@@ -342,6 +370,17 @@ var _ = Describe("Test AutoScalingListener controller", func() {
 				autoscalingListenerTestTimeout,
 				autoscalingListenerTestInterval,
 			).ShouldNot(Succeed(), "failed to delete AutoScalingListener")
+
+			Eventually(
+				func() bool {
+					return resourceCacheStateHasMainObjectEntries(resourceCache.listenerServiceAccount, created) ||
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerRole, created) ||
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerRoleBinding, created) ||
+						resourceCacheStateHasMainObjectEntries(resourceCache.listenerPod, created)
+				},
+				autoscalingListenerTestTimeout,
+				autoscalingListenerTestInterval,
+			).Should(BeFalse(), "AutoScalingListener service account, role, role binding, and pod resources should be removed from cache after deletion")
 		})
 	})
 
@@ -593,6 +632,7 @@ var _ = Describe("Test AutoScalingListener customization", func() {
 		secretResolver := secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient())
 
 		rb := ResourceBuilder{
+			ResourceCache:  newTestResourceCache(),
 			SecretResolver: secretResolver,
 		}
 
@@ -922,6 +962,7 @@ var _ = Describe("Test AutoScalingListener controller with proxy", func() {
 		secretResolver := secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient())
 
 		rb := ResourceBuilder{
+			ResourceCache:  newTestResourceCache(),
 			SecretResolver: secretResolver,
 		}
 
@@ -1127,6 +1168,7 @@ var _ = Describe("Test AutoScalingListener controller with template modification
 		secretResolver := secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient())
 
 		rb := ResourceBuilder{
+			ResourceCache:  newTestResourceCache(),
 			SecretResolver: secretResolver,
 		}
 
@@ -1232,6 +1274,7 @@ var _ = Describe("Test GitHub Server TLS configuration", func() {
 		secretResolver := secretresolver.New(mgr.GetClient(), scalefake.NewMultiClient())
 
 		rb := ResourceBuilder{
+			ResourceCache:  newTestResourceCache(),
 			SecretResolver: secretResolver,
 		}