pr.yml

permissions: write-all # Equivalent to default permissions plus id-token: write
name: Build and test

on:
  merge_group: null
  pull_request: null
  push:
    branches:
      - main

env:
  AWS_REGION: us-west-2
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  PULUMI_TEST_OWNER: "moolumi"
  ESC_ACTION_OIDC_AUTH: true
  ESC_ACTION_OIDC_ORGANIZATION: pulumi
  ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
  ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-pulumi-dotnet
  ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: PULUMI_ACCESS_TOKEN=PULUMI_ACCESS_TOKEN_PRODUCTION
  # Pin the mise binary to 2026.6.9: the latest (2026.6.10) regressed the
  # vfox:dotnet plugin install on Windows ("Illegal characters in path" running
  # dotnet-install.ps1). 2026.6.9 installs the plugin cleanly; the dotnet
  # `postinstall` hook in .mise.toml is fixed alongside this to run correctly
  # under Git Bash on Windows. Remove this pin (and the `version:` inputs below)
  # once the plugin regression is fixed upstream.
  # See https://github.com/jdx/mise/releases
  PINNED_MISE_VERSION: 2026.6.9

jobs:
  setup_matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - id: set-matrix
        run: |
          os="${{ contains(github.event.pull_request.labels.*.name, 'ci/test') && 'ubuntu-latest macos-latest windows-latest' || 'ubuntu-latest' }}"
          echo "matrix={\"os\": $(echo $os | jq -cR 'split(" ")')}" >> $GITHUB_OUTPUT

  format:
    runs-on: ubuntu-latest
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: 'recursive'
      - name: Setup mise and install tools
        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        with:
          version: ${{ env.PINNED_MISE_VERSION }}
      - name: Run `make format_check`
        run: make format_check

  lint:
    name: Lint Go
    runs-on: ubuntu-22.04
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - uses: actions/checkout@v6
      - name: Setup mise and install tools
        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        with:
          version: ${{ env.PINNED_MISE_VERSION }}
      - name: Run `make lint_language_host`
        run: make lint_language_host GOLANGCI_LINT_ARGS=--output.text.path=stdout
      - name: Run `make lint_integration_tests`
        run: make lint_integration_tests GOLANGCI_LINT_ARGS=--output.text.path=stdout

  lint-changelog:
    name: Lint Changelog
    runs-on: ubuntu-22.04
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - uses: actions/checkout@v6
      - name: Setup mise and install tools
        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        with:
          version: ${{ env.PINNED_MISE_VERSION }}
      - name: Check if folder is empty
        id: folder_check
        run: |
          if [ -z "$(ls .changes/unreleased)" ]; then
            echo "empty=true" >> $GITHUB_OUTPUT
          else
            echo "empty=false" >> $GITHUB_OUTPUT
          fi
      - name: Check the changelog is batchable
        # There are changes so check changie will batch them
        if: steps.folder_check.outputs.empty == 'false'
        run: changie batch auto --dry-run

  build:
    needs: setup_matrix
    strategy:
      matrix:
        os: ${{ fromJson(needs.setup_matrix.outputs.matrix).os }}
        dotnet-version: ["8.0", "9.0", "10.0.103"]

    runs-on: ${{ matrix.os }}
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Setup dotnet SDK
        id: setup-dotnet
        uses: actions/setup-dotnet@v5
        with:
          dotnet-version: |
            8.0
            ${{ matrix.dotnet-version }}
      - name: Create global.json
        # This ensures that we use the matrix version instead of the runner's default version
        # https://github.com/actions/setup-dotnet?tab=readme-ov-file#matrix-testing
        run: |
          echo '{"sdk":{"version": "${{ steps.setup-dotnet.outputs.dotnet-version }}"}}' > ./global.json
      - name: Dotnet version
        run: dotnet --version
      - name: Install Pulumi CLI
        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d # v7
        with:
          pulumi-version: dev
      - name: Build Pulumi SDK
        run: make build_sdk
      - name: Workspace clean (are xml doc and generated file updates committed?)
        uses: pulumi/git-status-check-action@0d90c81496aa8d6a31d9c6a0d6297feea2f54057 # v2
        with:
          allowed-changes: ./global.json
      - name: Test Pulumi SDK
        run: make test_sdk_coverage
      - name: Test Pulumi Automation SDK
        run: make test_sdk_automation_coverage
      - name: Upload coverage data
        uses: codecov/codecov-action@v5
        with:
          directory: coverage
          files: "*"
          fail_ci_if_error: false
          verbose: true
          token: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
  integration-tests:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        dotnet-version: ["8.0", "9.0", "10.0.103"]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - name: Set TARGET_FRAMEWORK
        shell: bash
        run: |
          # Extract major.minor for TARGET_FRAMEWORK (e.g. "10.0.103" → "net10.0")
          major_minor=$(echo "${{ matrix.dotnet-version }}" | cut -d. -f1,2)
          echo "TARGET_FRAMEWORK=net${major_minor}" >> $GITHUB_ENV
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Setup mise and install tools
        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        with:
          version: ${{ env.PINNED_MISE_VERSION }}
      - name: Set dotnet version from matrix
        run: mise use vfox:dotnet@${{ matrix.dotnet-version }}
      - name: Create global.json
        run: |
          echo '{"sdk":{"version": "${{ matrix.dotnet-version }}"}}' > ./global.json
      - name: Dotnet version
        run: dotnet --version
      - name: Integration tests
        run: make test_integration
  conformance-tests:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        dotnet-version: [8.0]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - name: Set TARGET_FRAMEWORK
        run: echo "TARGET_FRAMEWORK=net${{ matrix.dotnet-version }}" >> $GITHUB_ENV
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Setup mise and install tools
        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        with:
          version: ${{ env.PINNED_MISE_VERSION }}
      - name: Set dotnet version from matrix
        run: mise use vfox:dotnet@${{ matrix.dotnet-version }}
      - name: Install Pulumi CLI
        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d # v7
        with:
          pulumi-version: dev
      - name: Dotnet version
        run: dotnet --version
      - name: Conformance tests
        run: make test_conformance

  codegen-tests:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        dotnet-version: [8.0]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - name: Set TARGET_FRAMEWORK
        run: echo "TARGET_FRAMEWORK=net${{ matrix.dotnet-version }}" >> $GITHUB_ENV
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Setup mise and install tools
        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        with:
          version: ${{ env.PINNED_MISE_VERSION }}
      - name: Set dotnet version from matrix
        run: mise use vfox:dotnet@${{ matrix.dotnet-version }}
      - name: Install Pulumi CLI
        uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d # v7
        with:
          pulumi-version: dev
      - name: Dotnet version
        run: dotnet --version
      - name: Codegen tests
        run: make test_codegen

  info:
    name: gather
    runs-on: ubuntu-latest
    outputs:
      version: "${{ steps.version.outputs.version }}"
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - name: Checkout code
        uses: actions/checkout@v6
      - name: Setup mise and install tools
        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
        with:
          version: ${{ env.PINNED_MISE_VERSION }}
      - name: Get version info
        id: version
        run: |
          if [ -n "$(ls .changes/unreleased 2>/dev/null)" ]; then
            TAG="$(changie next auto)"
          else
            TAG="$(changie next patch)"
          fi
          TAG="${TAG#v}" # remove prefix
          OID="$(git rev-parse --short HEAD)"
          PULUMI_VERSION="$TAG-alpha.$OID"
          echo "version=${PULUMI_VERSION}" >> $GITHUB_OUTPUT

  release-dev-sdk:
    name: release-dev-sdk
    needs: [build, integration-tests, conformance-tests, codegen-tests, info]
    uses: ./.github/workflows/release-sdk.yml
    if: ${{ github.event_name == 'merge_group' }}
    with:
      ref: ${{ github.event.release.tag_name }}
      version: ${{ needs.info.outputs.version }}
      release-notes: ${{ github.event.release.body }}
    secrets: inherit

  check-pr:
    needs: ["build", "integration-tests", "format", "conformance-tests", "codegen-tests"]
    runs-on: ubuntu-latest
    if: always() # always report a status
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        continue-on-error: true
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3
      - name: Build failed
        if: ${{ needs.build.result != 'success' }}
        run: exit 1
      - name: Integration tests failed
        if: ${{ needs.integration-tests.result != 'success' }}
        run: exit 1
      - name: Format failed
        if: ${{ needs.format.result != 'success' }}
        run: exit 1
      - name: Conformance tests failed
        if: ${{ needs.conformance-tests.result != 'success' }}
        run: exit 1
      - name: Codegen tests failed
        if: ${{ needs.codegen-tests.result != 'success' }}
        run: exit 1
      - name: CI succeeded
        run: exit 0