weekly-pulumi-update #233
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| permissions: write-all # Equivalent to default permissions plus id-token: write | |
| name: weekly-pulumi-update | |
| on: | |
| schedule: | |
| - cron: 35 12 * * 4 | |
| workflow_dispatch: {} | |
| env: | |
| ESC_ACTION_OIDC_AUTH: true | |
| ESC_ACTION_OIDC_ORGANIZATION: pulumi | |
| ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization | |
| ESC_ACTION_ENVIRONMENT: imports/github-secrets | |
| ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: GITHUB_TOKEN=PULUMI_BOT_TOKEN | |
| jobs: | |
| weekly-pulumi-update: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Fetch secrets from ESC | |
| id: esc-secrets | |
| uses: pulumi/esc-action@f3cfbabf37488463817366338165b92b5f99117e # v2 | |
| - name: Checkout Repo | |
| uses: actions/checkout@v3 | |
| with: | |
| lfs: true | |
| - name: Unshallow clone for tags | |
| run: git fetch --prune --unshallow --tags | |
| - name: Setup mise | |
| uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310 | |
| env: | |
| MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s | |
| with: | |
| version: 2026.2.20 | |
| github_token: ${{ env.GITHUB_TOKEN }} | |
| - name: Update Pulumi/Pulumi | |
| id: gomod | |
| run: >- | |
| git config --local user.email 'bot@pulumi.com' | |
| git config --local user.name 'pulumi-bot' | |
| PULUMI_VERSION=$(go run scripts/build.go latest-pulumi-version) | |
| echo "Latest Pulumi version is $PULUMI_VERSION" | |
| git checkout -b update-pulumi/${{ github.run_id }}-${{ github.run_number }} | |
| echo "Update Pulumi dependencies to $PULUMI_VERSION" | |
| go run scripts/build.go update-pulumi-deps "$PULUMI_VERSION" | |
| make tidy | |
| git update-index -q --refresh | |
| if ! git diff-files --quiet; then | |
| echo changes=1 >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Bridge Pulumi Upgrade | |
| if: steps.gomod.outputs.changes != 0 | |
| run: >- | |
| make build | |
| git add . | |
| git commit -m "Updated modules" | |
| git push origin update-pulumi/${{ github.run_id }}-${{ github.run_number }} | |
| - name: Create PR | |
| id: create-pr | |
| if: steps.gomod.outputs.changes != 0 | |
| uses: repo-sync/pull-request@v2.6.2 | |
| with: | |
| source_branch: update-pulumi/${{ github.run_id }}-${{ github.run_number }} | |
| destination_branch: main | |
| pr_title: Automated Pulumi/Pulumi upgrade | |
| github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} | |
| env: | |
| GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} | |
| - name: "Set PR to auto-merge" | |
| if: steps.gomod.outputs.changes != 0 | |
| run: "gh pr merge --auto --squash ${{ steps.create-pr.outputs.pr_url }}" | |
| name: weekly-pulumi-update |