feat: add bidirectionalLabelMatch option and deprecate exactMatch

[Brend-Smits]

Summary

Introduce a new bidirectionalLabelMatch option that performs strict two-way label matching (runner labels must equal workflow labels as a set). This preserves the existing exactMatch behavior (unidirectional subset check) to avoid breaking changes.

Problem

The bidirectionalLabelMatch option for runner label matching requires labels to be identical in both directions. Previously, a runner with labels [A, B, C, D] would match a job requesting [A, B, C] when exactMatch was true. Now, bidirectionalLabelMatch=true requires the labels to be exactly identical — the runner will only match if the job requests exactly [A, B, C, D].

This change affects users who have runners with extra labels (e.g., on-demand) that were previously matching jobs not explicitly requesting those labels. After this change, such runners will only be used when jobs explicitly request all of the runner's labels.

Before: Job [A,B,C] + Runner [A,B,C,D] + exactMatch=true       → Match
After:  Job [A,B,C] + Runner [A,B,C,D] + bidirectionalLabelMatch=true → No Match

exactMatch was supposed to have this behavior, but to avoid breaking changes, the variable will be deprecated to give users time to migrate.

Changes

• Add bidirectionalLabelMatch to MatcherConfig interface (optional, defaults to false)
• Update canRunJob to support bidirectional matching when enabled
• Deprecate exactMatch in Terraform variables with migration guidance
• Add bidirectionalLabelMatch to multi-runner and webhook variable types
• Add new root variable enable_runner_bidirectional_label_match
• Add comprehensive test coverage for bidirectional matching

Migration

To migrate, use bidirectionalLabelMatch instead of exactMatch in your runner configs. Then either:

1. Remove extra labels from runner configurations, or
2. Add the extra labels to your workflow job runs-on

Co-authored-by: Stuart Pearson stuart.pearson@philips.com

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 91aaf17.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None