ci: bump ec2-github-runner pin to v4.0.2 (#68/#69)

[kurok]

What

Bumps the pinned namecheap/ec2-github-runner SHA from 65fbe4f (v4.0.1) to 54ee3e4 (v4.0.2, newly cut) in all four pin sites: ci.yml's start-runner and stop-runner steps, and both passes in cleanup-ec2-runners.yml.

Why now

v4.0.1 predates two merged fixes on the action repo that neither had a release tag yet:

• Terraform import record with nameservers incorrectly setting mode to "IMPORT" #68 — the start step now requires the runner to report online on multiple consecutive polls (3 warm / 2 cold) before declaring success. Previously a warm-restart runner could flap online-then-offline on the very first poll, the start step would exit green, and the leaked instance would sit running (holding its whitelisted EIP) while the dependent job stayed queued forever.
• Nameserver array missing trailing dot #69 — mode: stop now waits for the instance to actually reach stopped before returning (StopInstances alone only moves it to stopping). This is the action-side half of the stopping-state race ci: wait out the stopping-state warm-pool race; move nightly drain to 23:07 UTC #290 fixed workflow-side in this repo on 2026-07-10 (a tightly-queued run saw an empty warm pool and cold-launched a duplicate instance).

Since v4.0.1 had no tag covering either fix, I cut and pushed v4.0.2 on the action repo at 54ee3e4 (both fixes included) rather than pinning to a bare main commit — release notes.

Validation

• actionlint clean on both workflow files.
• Diff is exactly the four pin-line replacements — no other content touched.
• Next CI run on this repo exercises the new pin directly (start-runner + stop-runner); next scheduled cleanup run exercises it for both cleanup passes.

[github-actions]

🔐 Security scan summary

Commit b3a8e455 · branch ci/bump-ec2-runner-pin-69 · generated 2026-07-10 17:37 UTC

Scan	Gate	Findings
Trivy — vulnerabilities (SCA)	✅	🔴 0 critical · 🟠 0 high · 🟡 0 medium · ⚪ 0 low · 1 unknown
Trivy — IaC misconfig	✅	0 failing
Trivy — secrets	✅	0 detected
Trivy — licenses	✅	0 policy finding(s)
govulncheck (reachability)	✅	0 reachable · 0 imported-only
CodeQL (code scanning, open)	—	0 open · 🔴 0 critical · 🟠 0 high

Gate (blocks merge): HIGH/CRITICAL fixable CVEs · reachable Go vulnerabilities · forbidden licenses · committed secrets. Counts above are the full picture (incl. medium/low and unfixed), so they can exceed what actually gates. CodeQL is informational here. ✅ = gate job passed, ❌ = failed, ⚪ = skipped.

📦 Dependencies

• SBOM components (CycloneDX): 64
• Go modules in go.mod: 6 direct · 56 indirect

Vulnerabilities (Trivy, top 50)

Severity	ID	Package	Installed	Fixed
UNKNOWN	GO-2026-5932	golang.org/x/crypto	v0.53.0	—

---

📎 Full machine-readable reports are attached to this run as artifacts: security-summary, trivy-json, govulncheck-json, sbom-cyclonedx.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.22%. Comparing base (de8a8e9) to head (b3a8e45).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #291   +/-   ##
=======================================
  Coverage   89.22%   89.22%           
=======================================
  Files          15       15           
  Lines        1643     1643           
=======================================
  Hits         1466     1466           
  Misses        111      111           
  Partials       66       66           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.