pulumi-cdk/.github/workflows/main.yml at main · pulumi/pulumi-cdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
permissions: write-all # Equivalent to default permissions plus id-token: write
env:
  AWS_REGION: us-east-2
  PULUMI_API: https://api.pulumi-staging.io
jobs:
  lint:
    name: Run lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
      - name: lint
        uses: ./.github/actions/lint

  build:
    name: Build and Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
      - name: build
        uses: ./.github/actions/build

  test:
    # Only run tests on the schedule event
    # On 'push' we've just merged a PR that ran the tests
    if: github.event_name == 'schedule'
    name: acceptance-test
    uses: ./.github/workflows/acceptance-tests.yml
    secrets: inherit
    with:
      folder: examples

  integration-test:
    # Only run tests on the schedule event
    # On 'push' we've just merged a PR that ran the tests
    if: github.event_name == 'schedule'
    name: integration-test
    uses: ./.github/workflows/acceptance-tests.yml
    secrets: inherit
    with:
      folder: integration

  release:
    if: github.event_name == 'push'
    name: Release
    runs-on: ubuntu-latest
    needs:
      - build
      - lint
    concurrency:
      group: release
      cancel-in-progress: false
    steps:
      - env:
          ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
          ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
          ESC_ACTION_OIDC_AUTH: "true"
          ESC_ACTION_OIDC_ORGANIZATION: pulumi
          ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
        id: esc-secrets
        name: Fetch secrets from ESC
        uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
        id: app-auth
        with:
          app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
          private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
      - name: Checkout Repo
        uses: actions/checkout@v4
      - name: Unshallow clone for tags
        run: git fetch --prune --unshallow --tags
      - name: Setup mise
        uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
        env:
          MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
        with:
          version: 2026.3.6
          github_token: ${{ steps.app-auth.outputs.token }}
          # only saving the cache in the prerequisites job
          cache_save: false
      - name: Install packages
        run: yarn install --frozen-lockfile
      - name: Run build
        run: yarn run set-version && yarn run build:ci
      - if: github.event_name == 'push'
        name: Publish Dev Package
        uses: JS-DevTools/npm-publish@v1
        with:
          access: "public"
          token: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
          package: ${{github.workspace}}/package.json
          tag: dev
          check-version: true

name: main
"on":
  schedule:
    - cron: '0 3 * * *'
  push:
    branches:
      - main
    paths-ignore:
      - CHANGELOG.md
    tags-ignore:
      - v*
      - sdk/*
      - '**'