Update GitHub Actions workflows. #22404
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt | |
| name: run-acceptance-tests | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - CHANGELOG.md | |
| repository_dispatch: | |
| types: | |
| - run-acceptance-tests-command | |
| env: | |
| PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} | |
| AWS_REGION: us-west-2 | |
| DOTNET_VERSION: 6.x | |
| GO_VERSION: 1.21.x | |
| GOLANGCI_LINT_VERSION: v1.64.8 | |
| JAVA_VERSION: "11" | |
| NODE_VERSION: 20.x | |
| PROVIDER: eks | |
| PULUMI_API: https://api.pulumi-staging.io | |
| PULUMI_ENABLE_RESOURCE_REFERENCES: "1" | |
| PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. | |
| PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget | |
| PULUMI_PULUMI_ENABLE_JOURNALING: "true" | |
| PYTHON_VERSION: "3.9" | |
| TF_APPEND_USER_AGENT: pulumi | |
| # This should cancel any previous runs of the same workflow on the same branch which are still running. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| prerequisites: | |
| if: github.event_name == 'repository_dispatch' || | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| id-token: write # For ESC secrets. | |
| uses: ./.github/workflows/prerequisites.yml | |
| secrets: inherit | |
| with: | |
| default_branch: ${{ github.event.pull_request.base.ref }} | |
| is_pr: ${{ github.event_name == 'pull_request' }} | |
| is_automated: ${{ github.actor == 'dependabot[bot]' }} | |
| acceptance_fanout: true | |
| build_provider: | |
| uses: ./.github/workflows/build_provider.yml | |
| needs: prerequisites | |
| secrets: inherit | |
| permissions: | |
| contents: read | |
| id-token: write # For ESC secrets. | |
| with: | |
| version: ${{ needs.prerequisites.outputs.version }} | |
| matrix: | | |
| { | |
| "platform": [ | |
| {"os": "linux", "arch": "amd64"}, | |
| {"os": "windows", "arch": "amd64"} | |
| ] | |
| } | |
| test_provider: | |
| if: github.event_name == 'repository_dispatch' || | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| needs: prerequisites | |
| permissions: | |
| contents: read | |
| id-token: write # For ESC secrets. | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - env: | |
| ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} | |
| ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" | |
| ESC_ACTION_OIDC_AUTH: "true" | |
| ESC_ACTION_OIDC_ORGANIZATION: pulumi | |
| ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization | |
| id: esc-secrets | |
| name: Fetch secrets from ESC | |
| uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b | |
| - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 | |
| id: app-auth | |
| with: | |
| app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }} | |
| private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| - name: Setup mise | |
| uses: jdx/mise-action@8d3b0ba20a9cea7b883d922ea958553c941ab082 | |
| env: | |
| MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s | |
| with: | |
| version: 2026.3.7 | |
| github_token: ${{ steps.app-auth.outputs.token }} | |
| cache_save: false | |
| - name: Restore Go Cache | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 | |
| with: | |
| path: | | |
| ~/go/pkg/mod | |
| ~/.cache/go-build | |
| key: ${{ runner.os }}-go-prerequisites-${{ hashFiles('provider/*.sum', 'upstream/*.sum', 'sdk/go/*.sum', 'sdk/*.sum', '*.sum') }} | |
| - name: Prepare local workspace | |
| run: make prepare_local_workspace | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-auth.outputs.token }} | |
| - name: Restore prerequisites | |
| uses: ./.github/actions/download-prerequisites | |
| - name: Unit-test provider code | |
| run: make test_provider | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }} | |
| PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }} | |
| PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }} | |
| PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }} | |
| SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }} | |
| SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }} | |
| SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }} | |
| SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }} | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| env: | |
| CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }} | |
| build_schema: | |
| if: github.event_name == 'repository_dispatch' || | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| needs: prerequisites | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| id-token: write # For ESC secrets. | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - env: | |
| ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} | |
| ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" | |
| ESC_ACTION_OIDC_AUTH: "true" | |
| ESC_ACTION_OIDC_ORGANIZATION: pulumi | |
| ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization | |
| id: esc-secrets | |
| name: Fetch secrets from ESC | |
| uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b | |
| - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1 | |
| id: app-auth | |
| with: | |
| app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }} | |
| private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| - name: Cache examples generation | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 | |
| with: | |
| path: | | |
| .pulumi/examples-cache | |
| key: ${{ runner.os }}-${{ hashFiles('provider/go.sum') }} | |
| - name: Setup mise | |
| uses: jdx/mise-action@8d3b0ba20a9cea7b883d922ea958553c941ab082 | |
| env: | |
| MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s | |
| with: | |
| version: 2026.3.7 | |
| github_token: ${{ steps.app-auth.outputs.token }} | |
| cache_save: false | |
| - name: Restore Go Cache | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 | |
| with: | |
| path: | | |
| ~/go/pkg/mod | |
| ~/.cache/go-build | |
| key: ${{ runner.os }}-go-prerequisites-${{ hashFiles('provider/*.sum', 'upstream/*.sum', 'sdk/go/*.sum', 'sdk/*.sum', '*.sum') }} | |
| - name: Prepare local workspace before restoring previously built files | |
| run: make prepare_local_workspace | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-auth.outputs.token }} | |
| - name: Restore prerequisites | |
| uses: ./.github/actions/download-prerequisites | |
| - name: Restore makefile progress | |
| run: make --touch provider | |
| - name: Generate schema | |
| run: make schema | |
| env: | |
| PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }} | |
| - name: Check worktree clean | |
| id: worktreeClean | |
| uses: pulumi/git-status-check-action@0d90c81496aa8d6a31d9c6a0d6297feea2f54057 # v2.0.0 | |
| - if: github.event_name == 'pull_request' | |
| name: Check Schema is Valid | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| schema-tools compare -r github://api.github.com/pulumi -p eks -o "${{ github.event.pull_request.base.ref }}" -n --local-path=provider/cmd/pulumi-resource-eks/schema.json > "$RUNNER_TEMP/schema-check-report.md" | |
| cat >> "$RUNNER_TEMP/schema-check-report.md" <<'EOF' | |
| Maintainer note: consult the [runbook](https://github.com/pulumi/platform-providers-team/blob/main/playbooks/tf-provider-updating.md) for dealing with any breaking changes. | |
| <!-- "schemaCheck" --> | |
| EOF | |
| - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' | |
| name: Find schema check comment | |
| id: find-schema-check-comment | |
| uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| issue-number: ${{ github.event.pull_request.number }} | |
| body-includes: '"schemaCheck" -->' | |
| - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' | |
| name: Comment on PR with Details of Schema Check | |
| uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| issue-number: ${{ github.event.pull_request.number }} | |
| comment-id: ${{ steps.find-schema-check-comment.outputs.comment-id }} | |
| edit-mode: replace | |
| body-path: ${{ runner.temp }}/schema-check-report.md | |
| build_sdk: | |
| if: github.event_name == 'repository_dispatch' || | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| name: build_sdk | |
| needs: prerequisites | |
| uses: ./.github/workflows/build_sdk.yml | |
| secrets: inherit | |
| permissions: | |
| contents: write # For Renovate SDKs. | |
| id-token: write # For ESC secrets. | |
| with: | |
| version: ${{ needs.prerequisites.outputs.version }} | |
| # Shadow-gen diff: informational, non-blocking comparison of legacy codegen vs | |
| # `pulumi package gen-sdk`. The logic lives centrally in pulumi/ci-mgmt; this is | |
| # only a thin reference. TEMPORARY - removed once the migration is verified | |
| # (pulumi/ci-mgmt#2291). | |
| compare_sdk: | |
| if: github.event_name == 'repository_dispatch' || | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| name: compare_sdk | |
| needs: prerequisites | |
| uses: pulumi/ci-mgmt/.github/workflows/compare_sdk.yml@master | |
| permissions: | |
| contents: read | |
| with: | |
| version: ${{ needs.prerequisites.outputs.version }} | |
| languages: '["nodejs","python","dotnet","go","java"]' | |
| runs-on: ubuntu-latest | |
| mise-version: 2026.3.7 | |
| checkout-submodules: 'false' | |
| comment-notification: | |
| if: github.event_name == 'repository_dispatch' | |
| name: comment-notification | |
| permissions: | |
| pull-requests: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - id: run-url | |
| name: Create URL to the run output | |
| run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT" | |
| - name: Update with Result | |
| uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0 | |
| with: | |
| body: "Please view the PR build: ${{ steps.run-url.outputs.run-url }}" | |
| issue-number: ${{ github.event.client_payload.github.payload.issue.number }} | |
| repository: ${{ github.event.client_payload.github.payload.repository.full_name }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| lint: | |
| if: github.event_name == 'repository_dispatch' || | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| name: lint | |
| uses: ./.github/workflows/lint.yml | |
| secrets: inherit | |
| sentinel: | |
| name: sentinel | |
| if: github.event_name == 'repository_dispatch' || | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| permissions: | |
| statuses: write | |
| needs: | |
| - test | |
| - build_provider | |
| - build_schema | |
| - test_provider | |
| - license_check | |
| - lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: guibranco/github-status-action-v2@77639353504055053524efa7a3719aaf0b731ce9 # v1.2.4 | |
| with: | |
| authToken: ${{ secrets.GITHUB_TOKEN }} | |
| # Write an explicit status check called "Sentinel" which will only pass if this code really runs. | |
| # This should always be a required check for PRs. | |
| context: 'Sentinel' | |
| description: 'All required checks passed' | |
| state: 'success' | |
| # Write to the PR commit SHA if it's available as we don't want the merge commit sha, | |
| # otherwise use the current SHA for any other type of build. | |
| sha: ${{ github.event.pull_request.head.sha || github.sha }} | |
| test: | |
| # Don't run tests on PRs from forks. | |
| if: github.event_name == 'repository_dispatch' || | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| uses: ./.github/workflows/test.yml | |
| needs: | |
| - prerequisites | |
| - build_provider | |
| - build_sdk | |
| permissions: | |
| contents: read | |
| id-token: write | |
| secrets: inherit | |
| with: | |
| version: ${{ needs.prerequisites.outputs.version }} | |
| license_check: | |
| name: License Check | |
| uses: ./.github/workflows/license.yml | |
| secrets: inherit |