feat!: Organise SSM paramamters by path (github-aws-runners#2569)

Migration is only required when using pre-build AMI with your tailored start-runner script. Before all parameters were based on convetion. We have update them to be predictable with still similar conventions as default.

We set the tag ghr:ssm_config_path as EC2 instance tag to the path used for the configuration. In the config path we store the same values as before (run_as, enable_cloudwatch, agent_mode). The tokens are stored in a separate location which can be retrieved by looking up the value token_path in the config.

For a more details example check-out the following diffs:

Linux start script // TODO UPDATE AFTER MERGE
Windows start script // TODO UPDATE AFTER MERGE

Author: npalm

Diff for: .github/lint/tflint.tfvars

@@ -0,0 +1,8 @@
+aws_region = null
+github_app = {
+  id             = "0"
+  key_base64     = "0"
+  webhook_secret = "0"
+}
+subnet_ids = []
+vpc_id     = null

Diff for: .github/workflows/terraform.yml

@@ -7,6 +7,10 @@ on:
     paths-ignore:
       - "modules/*/lambdas/**"
 
+permissions:
+  contents: read
+  pull-requests: write
+
 env:
   AWS_REGION: eu-west-1
 jobs:
@@ -37,6 +41,14 @@ jobs:
         continue-on-error: true
       - name: validate terraform
         run: terraform validate
+      - if: contains(matrix.terraform, '1.3.')
+        name: Setup TFLint
+        uses: terraform-linters/setup-tflint@v2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - if: contains(matrix.terraform, '1.3.')
+        name: Run TFLint
+        run: tflint -f compact
 
   verify_examples:
     name: Verify examples
@@ -92,3 +104,4 @@ jobs:
         continue-on-error: true
       - name: validate terraform
         run: terraform validate
+