build_sdk.yml

# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt

name: "Build SDK"

on:
  workflow_call:
    inputs:
      version:
        required: true
        type: string

env:
  PULUMI_API: https://api.pulumi-staging.io
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
  PULUMI_PULUMI_ENABLE_JOURNALING: "true"
  TF_APPEND_USER_AGENT: pulumi
  PROVIDER_VERSION: ${{ inputs.version }}

jobs:
  build_sdk:
    name: build_sdk
    runs-on: ubuntu-latest
    strategy:
      # We normally fail fast unless this is a PR from Renovate in which case
      # we'll always build all SDKs in case there are any changes to commit.
      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
      matrix:
        language:
        - dotnet
        - go
        - nodejs
        - python
    permissions:
      contents: write # For Renovate SDKs.
      id-token: write # For ESC secrets.
    steps:
      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false      
      - env:
          ESC_ACTION_ENVIRONMENT: imports/github-secrets
          ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
          ESC_ACTION_OIDC_AUTH: "true"
          ESC_ACTION_OIDC_ORGANIZATION: pulumi
          ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
        id: esc-secrets
        name: Fetch secrets from ESC
        uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-auth
        with:
          app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
          private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
      - name: Cache examples generation
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: |
            .pulumi/examples-cache
          key: ${{ runner.os }}-${{ hashFiles('provider/go.sum') }}
      - name: Setup mise
        uses: jdx/mise-action@8d3b0ba20a9cea7b883d922ea958553c941ab082
        env:
          MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
        with:
          version: 2026.3.7
          github_token: ${{ steps.app-auth.outputs.token }}
          # only saving the cache in the prerequisites job
          cache_save: false
      - name: Setup Go Cache
        if: matrix.language == 'go' || contains(matrix.language, 'go')
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          cache-dependency-path: |
            provider/*.sum
            upstream/*.sum
            sdk/go/*.sum
            sdk/*.sum
            *.sum
      - name: Prepare local workspace
        run: make prepare_local_workspace
        env:
          GITHUB_TOKEN: ${{ steps.app-auth.outputs.token }}
      - name: Download prerequisites
        uses: ./.github/actions/download-prerequisites
      - name: Update path
        run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
      - name: Restore makefile progress
        run: make --touch provider schema
      - name: Build SDK
        run: make build_${{ matrix.language }}

      - name: Check worktree clean
        id: worktreeClean
        uses: pulumi/git-status-check-action@0d90c81496aa8d6a31d9c6a0d6297feea2f54057 # v2.0.0
        with:
          # Keep these in sync with the Renovate step below to avoid them getting checked in.
          allowed-changes: |
            sdk/**/pulumi-plugin.json
            sdk/dotnet/*.csproj
            sdk/go/**/pulumiUtilities.go
            sdk/nodejs/package.json
            sdk/python/pyproject.toml
            sdk/java/build.gradle
        # This worktree check is a safeguard against someone forgetting to
        # re-build and commit locally, but we handle that commit automatically
        # in the case of dependency bumps.
        continue-on-error: ${{ contains(github.actor, 'renovate') }}
      - name: Commit ${{ matrix.language }} SDK changes for Renovate
        # If the worktree is dirty and this is a Renovate PR to bump
        # dependencies, commit the updated SDK and push it back to the PR. The
        # job will still be marked as a failure.
        if: steps.worktreeClean.outcome == 'failure' && contains(github.actor, 'renovate') && github.event_name == 'pull_request'
        shell: bash
        run: |
          git config --global user.email "bot@pulumi.com"
          git config --global user.name "pulumi-bot"

          # Stash local changes and check out the PR's branch directly. Fetch
          # only that ref: a bare fetch pulls every branch in the repo, and
          # on-demand submodule recursion then tries to resolve the submodule
          # gitlink of every commit it pulls, including long-dead branches
          # pointing at commits the submodule's remote no longer serves.
          git stash
          git fetch --no-recurse-submodules origin "+refs/heads/$HEAD_REF:refs/remotes/origin/$HEAD_REF"
          git checkout "origin/$HEAD_REF"

          # Apply and add our changes, but don't commit any files we expect to
          # always change due to versioning.
          git stash pop
          git add sdk provider/cmd/pulumi-resource-xyz/schema.json
          git reset \
              sdk/python/*/pulumi-plugin.json \
              sdk/python/pyproject.toml \
              sdk/dotnet/pulumi-plugin.json \
              sdk/dotnet/Pulumi.*.csproj \
              sdk/go/*/pulumi-plugin.json \
              sdk/go/*/internal/pulumiUtilities.go \
              sdk/nodejs/package.json
          git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'

          # Push with pulumi-bot credentials to trigger a re-run of the
          # workflow. https://github.com/orgs/community/discussions/25702
          git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} \
              "HEAD:$HEAD_REF"
        env:
          # head_ref is untrusted so it's recommended to pass via env var to
          # avoid injections.
          HEAD_REF: ${{ github.head_ref }}

      - name: Upload SDK
        uses: ./.github/actions/upload-sdk
        with:
          language: ${{ matrix.language }}