pull-request.yml

name: Pull Request
on:
  pull_request:
    branches:
      - master
      - 'release/**'

# Only the newest commit on a PR is worth building. Without this, pushing three
# commits in quick succession runs three full builds to completion, and the two
# superseded ones just burn a runner and hold up the queue. Each run publishes to
# a bucket keyed by PR number *and* head sha, so a cancelled run can only orphan
# its own preview bucket -- pr-closed.yml deletes every *-pr-<num>-* bucket when
# the PR closes, and bucket-cleanup.yml sweeps daily.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
      id-token: write # This is required for requesting the JWT
      contents: read # This is required for actions/checkout
jobs:
  buildSite:
    # Only run this job for events that originate on this repository.
    if: github.event.pull_request.head.repo.full_name == github.repository
    env:
      GOPATH: ${{ github.workspace }}/go
    name: Install deps and build site
    runs-on: ubuntu-latest
    environment: testing
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3

      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          cache: 'yarn'
          cache-dependency-path: |
            yarn.lock
            infrastructure/yarn.lock
            theme/yarn.lock
            theme/stencil/yarn.lock

      - uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: '0.157.0'
          extended: true

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::571684982431:role/ContinuousDelivery
          role-session-name: docs-deploy
          role-duration-seconds: 7200
          aws-region: us-west-2

      - name: Install s5cmd v2.3.0 for fast S3 uploads
        run: |
          S5CMD_VERSION="2.3.0"
          S5CMD_SHA256="de0fdbfa3aceae55e069ba81a0fc17b2026567637603734a387b2fca06c299b4"
          curl -fsSL -o /tmp/s5cmd.tar.gz "https://github.com/peak/s5cmd/releases/download/v${S5CMD_VERSION}/s5cmd_${S5CMD_VERSION}_Linux-64bit.tar.gz"
          echo "${S5CMD_SHA256}  /tmp/s5cmd.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin s5cmd -f /tmp/s5cmd.tar.gz
          rm /tmp/s5cmd.tar.gz

      - name: Install Vale (required by scripts/ensure.sh)
        run: |
          VALE_VERSION="3.14.1"
          VALE_SHA256="ff2b49ffaa9dcd246fd5008f03ff67746d2790b75bf4d3657e2fb9530fb96db3"
          curl -fsSL -o /tmp/vale.tar.gz "https://github.com/errata-ai/vale/releases/download/v${VALE_VERSION}/vale_${VALE_VERSION}_Linux_64-bit.tar.gz"
          echo "${VALE_SHA256}  /tmp/vale.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin vale -f /tmp/vale.tar.gz
          rm /tmp/vale.tar.gz

      - name: Install Pulumi CLI
        uses: pulumi/actions@v7

      # Restore previously generated OpenGraph cards so the build-time generator
      # only re-renders pages that changed (manifest content-hash skip). The
      # cards are gitignored; this cache is their only persistence across runs.
      - name: Cache generated meta images
        uses: actions/cache@v6
        with:
          path: assets/images/generated
          key: meta-images-${{ github.sha }}
          restore-keys: |
            meta-images-

      # Persist Hugo's processed-image cache (resources/_gen). Blog templates
      # process feature images to WebP at several sizes via .Process; without
      # this cache every CI run re-encodes ~2,400 images from scratch (~4-5
      # minutes of the build). With a warm cache, .Process is a lookup.
      - name: Cache Hugo processed images
        uses: actions/cache@v6
        with:
          path: resources
          key: hugo-resources-${{ github.sha }}
          restore-keys: |
            hugo-resources-

      # PR runs don't wait on await-in-progress.js the way master deploys do, so
      # the elapsed time here is build time with no queue wait to subtract.
      - name: Record build start time
        run: echo "CI_BUILD_START_EPOCH=$(date +%s)" >> "$GITHUB_ENV"

      - name: Build and deploy
        run: make ci_pull_request
        env:
          CDN_PULUMI_URN: ${{ vars.CDN_PULUMI_URN }}
          PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
          PULUMI_STACK_NAME: ${{ vars.PULUMI_STACK_NAME }}
          DEPLOYMENT_ENVIRONMENT: ${{ vars.DEPLOYMENT_ENVIRONMENT }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PULUMI_BOT_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
          ALGOLIA_APP_ID: ${{ vars.ALGOLIA_APP_ID }}
          ALGOLIA_APP_SEARCH_KEY: ${{ vars.ALGOLIA_APP_SEARCH_KEY }}
          ALGOLIA_APP_ADMIN_KEY: ${{  steps.esc-secrets.outputs.ALGOLIA_APP_ADMIN_KEY }}
          NODE_OPTIONS: "--max_old_space_size=8192"

      # The same guardrail build-and-deploy.yml has. PR builds had none, which is
      # how they drifted to ~17 minutes without anyone being told. 15 minutes
      # sits a few minutes above the post-fix baseline, so it should stay quiet
      # unless the build genuinely regresses; tighten it once that baseline settles.
      - name: Alert on slow build
        if: success()
        env:
          SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
          BUILD_DURATION_THRESHOLD_MINUTES: '15'
        run: ./scripts/ci-build-duration-alert.sh

      - name: Archive test results
        uses: actions/upload-artifact@v7
        with:
          name: browser-test-results
          path: cypress/videos

      - name: Archive bucket metadata
        uses: actions/upload-artifact@v7
        with:
          name: origin-bucket-metadata
          path: origin-bucket-metadata.json
  notify:
    if: (startsWith(github.ref, 'refs/heads/release/') || github.ref == 'refs/heads/master' || (github.event_name == 'pull_request' && github.event.pull_request.user.login == 'pulumi-bot')) && failure()
    name: Send slack notification
    runs-on: ubuntu-latest
    needs: [buildSite]
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3
      - name: Slack Notification
        uses: docker://sholung/action-slack-notify:v2.3.0
        env:
          SLACK_CHANNEL: docs-ops
          SLACK_COLOR: "#F54242"
          SLACK_MESSAGE: "build and deploy failure in pulumi/docs repo :meow_sad:"
          SLACK_USERNAME: docsbot
          SLACK_WEBHOOK: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
          SLACK_ICON: https://www.pulumi.com/logos/brand/avatar-on-white.png
env:
  ESC_ACTION_OIDC_AUTH: true
  ESC_ACTION_OIDC_ORGANIZATION: pulumi
  ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
  ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-docs
  ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: false