Update GitHub Actions workflows. #2338
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: run-upstream-tests | |
| description: | | |
| Run upstream tests against the patched version of the upstream (terraform-provider-aws) provider. | |
| This job will run acceptance tests that do provision actual AWS resources. See also: | |
| ./upstream/docs/running-and-writing-acceptance-tests.md | |
| One notable problem is that tag-related tests do not currently pass for the patched provider, since the Pulumi bridged | |
| provider handles tagging at a higher level. These tests are currently skipped. | |
| The job matrix is organized by service, corresponding to `ls ./upstream/internal/service` folders. | |
| Note that adding new services needs to be done with care because test failures may leave unsupervised resources in the | |
| test account causing an increase in burn rate, so that account cleaners need to be extended for each new service. | |
| The primary goal for additional coverage is testing services that have Pulumi patches that may accidentally regress | |
| desired upstream behavior. | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - CHANGELOG.md | |
| env: | |
| PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} | |
| AWS_REGION: us-west-2 | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| TF_APPEND_USER_AGENT: pulumi | |
| # This should cancel any previous runs of the same workflow on the same branch which are still running. This exacerbates | |
| # the problem of leaked resources but results in better utilization of limited CI runner time in the case of rapid-fire | |
| # pushes, and currently is the preferred trade-off. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| upstream_tests: | |
| name: upstream_tests | |
| runs-on: pulumi-ubuntu-8core | |
| permissions: | |
| contents: read | |
| id-token: write # For ESC secrets. | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| service: | |
| - ec2 | |
| - cognitoidp | |
| - rds | |
| include: | |
| - service: ec2 | |
| tests: 'TestAccEC2KeyPair_publicKey|TestAccVPCRoute_timeoutsOnlyChange' | |
| - service: rds | |
| tests: TestAccRDSCluster_storageTypeUpdateNonAurora | |
| - service: cognitoidp | |
| tests: 'TestAccCognitoIDPIdentityProvider_(defaultProviderDetails|samlDefaultProviderDetails)' | |
| # TODO[pulumi/pulumi-aws#5388] route53resolver tests flaky | |
| # - service: route53resolver | |
| # tests: TestAccRoute53Resolver | |
| steps: | |
| # Run as first step so we don't delete things that have just been installed | |
| - name: Free Disk Space (Ubuntu) | |
| uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 | |
| with: | |
| tool-cache: false | |
| swap-storage: false | |
| dotnet: false | |
| - name: Checkout Repo | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ env.PR_COMMIT_SHA }} | |
| submodules: true | |
| - env: | |
| ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} | |
| ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" | |
| ESC_ACTION_OIDC_AUTH: "true" | |
| ESC_ACTION_OIDC_ORGANIZATION: pulumi | |
| ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization | |
| id: esc-secrets | |
| name: Fetch secrets from ESC | |
| uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b | |
| - name: make upstream | |
| run: make upstream | |
| - name: Install Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: 1.22.x | |
| cache-dependency-path: | | |
| upstream/go.sum | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }} | |
| role-duration-seconds: 7200 | |
| role-session-name: aws@githubActions | |
| role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }} | |
| - if: ${{ matrix.tests }} | |
| name: Test ${{ matrix.service }} | |
| # TODO[pulumi/pulumi-aws#6115]: reenable TestAccSQSQueue_List_basic | |
| # TODO[pulumi/pulumi-aws#6517]: reenable TestAccSQSQueue_managedEncryption | |
| run: | | |
| cd upstream | |
| TF_ACC=1 make testacc GO_VER=go PKG=${{ matrix.service }} ACCTEST_PARALLELISM=6 TESTS="${{ matrix.tests }}" TESTARGS="-skip 'tags|TestAccSQSQueue_List_basic|TestAccSQSQueue_managedEncryption|.*/.*/Tags'" |