feat(scale-set): add scale set orchestration in Terraform

[edersonbrilhante]

Description

Adds Terraform support for experimental GitHub Actions runner scale-set orchestration in the multi-runner v2 interface.

This PR includes:

• A standalone modules/orchestration-providers/scale-set module that deploys one ECS Fargate controller service per resolved controller group, including the ECS cluster/service/task definition, private networking, security groups, CloudWatch logging, health checks, deployment rollback, and hardened task settings.
• Plan-known grouping by compute-provider type (the default), runner configuration, or explicit custom membership. Grouping keeps each GitHub scale set and message session independent while packing multiple reconcilers into one controller task.
• Versioned non-secret reconciler configuration delivery through SSM Parameter Store and the controller manifest. GitHub App credentials remain SSM parameter references, with task and compute-role permissions restricted to the configured resources.
• Validation for GitHub scope and scale-set name ownership, grouping coverage, plan-time for_each inputs, provider contracts, configuration and task-definition size limits, reserved environment variables, wildcard IAM actions, and AWS inline-policy quotas.
• A compute-provider capability boundary that carries provider-owned runtime configuration, environment variables, and IAM statements. The EC2 adapter supplies scale-set launch, tagging, termination, JIT-configuration storage, AMI, and related permissions with ownership conditions.
• Multi-runner and runner-config wiring, the examples/multi-runner-scale-set example, MiniStack fixtures, and CI updates for the new Terraform path.

The module adopts scale sets that exist in GitHub by name; it does not create or delete GitHub scale-set resources. The TypeScript controller that consumes this Terraform contract is implemented in #5300.

Test Plan

• Added focused Terraform tests for the scale-set module, computed-input fixtures, grouping, ownership validation, configuration delivery, IAM policy construction, and quota checks.
• Added the multi-runner scale-set example and MiniStack variables/runner coverage.
• Terraform formatting, validation/TFLint, and the repository CI workflows cover the updated modules and example paths.

Related Issues

• Builds on the multi-runner v2 interface from feat(examples): add multi-runner-v2 example #5367.
• Provides the Terraform foundation consumed by feat(scale-set): add service controller #5300.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[guicaulada]

Nice work on this! The overall approach looks good to me, but we should address the enterprise scope configuration and IAM role-name limits before merging. I’ve added details inline.