Reapplied pulumi/ci-mgmt

Signed-off-by: Ringo De Smet <[email protected]>
pulumiverse · Feb 8, 2025 · f006f7f · f006f7f
1 parent 11c2c92
commit f006f7f
Show file tree

Hide file tree

Showing 18 changed files with 148 additions and 129 deletions.
diff --git a/.github/actions/download-codegen/action.yml b/.github/actions/download-codegen/action.yml
diff --git a/.github/actions/download-prerequisites/action.yml b/.github/actions/download-prerequisites/action.yml
@@ -0,0 +1,28 @@
+name: Download the code generator binary
+description: Downloads the code generator binary to `bin/`.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Download the prerequisites bin
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      with:
+        name: prerequisites-bin
+        path: bin
+
+    - name: Restore executable permissions
+      shell: bash
+      run: chmod +x $(< bin/executables.txt)
+
+    - name: Remove executables list
+      shell: bash
+      run: rm bin/executables.txt
+
+    - name: Download schema-embed.json
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      with:
+        # Use a pattern to avoid failing if the artifact doesn't exist
+        pattern: schema-embed.*
+        # Avoid creating directories for each artifact
+        merge-multiple: true
+        path: provider/cmd/pulumi-resource-configcat
diff --git a/.github/actions/download-bin/action.yml → .github/actions/download-provider/action.yml b/.github/actions/download-bin/action.yml → .github/actions/download-provider/action.yml
diff --git a/.github/actions/setup-tools/action.yml b/.github/actions/setup-tools/action.yml
@@ -66,19 +66,19 @@ runs:
 
     - name: Setup DotNet
       if: inputs.tools == 'all' || contains(inputs.tools, 'dotnet')
-      uses: actions/setup-dotnet@87b7050bc53ea08284295505d98d2aa94301e852 # v4.2.0
+      uses: actions/setup-dotnet@3951f0dfe7a07e2313ec93c75700083e2005cbab # v4.3.0
       with:
         dotnet-version: 6.0.x
 
     - name: Setup Python
       if: inputs.tools == 'all' || contains(inputs.tools, 'python')
-      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: 3.11.8
 
     - name: Setup Java
       if: inputs.tools == 'all' || contains(inputs.tools, 'java')
-      uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
+      uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
       with:
         cache: gradle
         distribution: temurin

diff --git a/.github/actions/upload-prerequisites/action.yml b/.github/actions/upload-prerequisites/action.yml
@@ -0,0 +1,23 @@
+name: Upload SDK asset
+description: Upload the SDK for a specific language as an asset for the workflow.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Capture executable permissions
+      shell: bash
+      run: find bin -type f -executable > bin/executables.txt
+
+    - name: Upload prerequisites bin
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      with:
+        name: prerequisites-bin
+        path: bin/*
+        retention-days: 30
+
+    - name: Upload schema-embed.json
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+      with:
+        name: schema-embed.json
+        path: provider/cmd/pulumi-resource-configcat/schema-embed.json
+        retention-days: 30
diff --git a/.github/workflows/build_provider.yml b/.github/workflows/build_provider.yml
@@ -47,15 +47,10 @@ jobs:
           tools: pulumictl, go
       - name: Prepare local workspace before restoring previously built
         run: make prepare_local_workspace
-      - name: Download schema-embed.json
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          # Use a pattern to avoid failing if the artifact doesn't exist
-          pattern: schema-embed.*
-          # Avoid creating directories for each artifact
-          merge-multiple: true
-          path: provider/cmd/pulumi-resource-configcat
+      - name: Restore prerequisites
+        uses: ./.github/actions/download-prerequisites
       - name: Restore makefile progress
+        # This mirrors the targets completed in the prerequisites job
         run: make --touch provider schema
 
       - name: Build provider

diff --git a/.github/workflows/build_sdk.yml b/.github/workflows/build_sdk.yml
@@ -59,18 +59,10 @@ jobs:
           tools: pulumictl, pulumicli, ${{ matrix.language }}
       - name: Prepare local workspace
         run: make prepare_local_workspace
-      - name: Download codegen
-        uses: ./.github/actions/download-codegen
+      - name: Download prerequisites
+        uses: ./.github/actions/download-prerequisites
       - name: Update path
         run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
-      - name: Download schema-embed.json
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          # Use a pattern to avoid failing if the artifact doesn't exist
-          pattern: schema-embed.*
-          # Avoid creating directories for each artifact
-          merge-multiple: true
-          path: provider/cmd/pulumi-resource-configcat
       - name: Restore makefile progress
         run: make --touch provider schema
       - name: Build SDK

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -48,7 +48,7 @@ jobs:
       continue-on-error: true
       run: make prepare_local_workspace
     - name: golangci-lint
-      uses: golangci/golangci-lint-action@ec5d18412c0aeab7936cb16880d708ba2a64e1ae # v6
+      uses: golangci/golangci-lint-action@e60da84bfae8c7920a47be973d75e15710aa8bd7 # v6
       with:
         version: v1.60
         working-directory: provider
diff --git a/.github/workflows/main-post-build.yml b/.github/workflows/main-post-build.yml
@@ -0,0 +1,20 @@
+# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+
+name: "Main post-build"
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        type: string
+        required: true
+
+jobs:
+  post_build:
+    name: post_build
+    runs-on: ubuntu-latest
+    if: false
+    steps:
+      - name: Placeholder
+        shell: bash
+        run: echo "This is a placeholder job to ensure that the post_build job is always present"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -41,46 +41,14 @@ jobs:
     with:
       version: ${{ needs.prerequisites.outputs.version }}
 
-  generate_coverage_data:
-    continue-on-error: true
-    env:
-      COVERAGE_OUTPUT_DIR: ${{ secrets.COVERAGE_OUTPUT_DIR }}
-    name: generate_coverage_data
+  post_build:
+    name: post_build
     needs: prerequisites
-    runs-on: ubuntu-latest
-    steps:
-    - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
-      with:
-        tool-cache: false
-        swap-storage: false
-    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        persist-credentials: false
-    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
-      with:
-        aws-access-key-id: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }}
-        aws-region: us-west-2
-        aws-secret-access-key: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }}
-    - name: Setup tools
-      uses: ./.github/actions/setup-tools
-      with:
-        tools: pulumictl, pulumicli, go, schema-tools
-    - name: Echo Coverage Output Dir
-      run: 'echo "Coverage output directory: ${{ env.COVERAGE_OUTPUT_DIR }}"'
-    - name: Generate Coverage Data
-      run: PULUMI_MISSING_DOCS_ERROR=true make tfgen
-    - name: Summarize Provider Coverage Results
-      run: cat ${{ env.COVERAGE_OUTPUT_DIR }}/shortSummary.txt
-    - name: Upload coverage data to S3
-      run: >-
-        summaryName="${PROVIDER}_summary_$(date +"%Y-%m-%d_%H-%M-%S").json"
-
-        s3FullURI="s3://${{ secrets.S3_COVERAGE_BUCKET_NAME }}/summaries/${summaryName}"
+    uses: ./.github/workflows/main-post-build.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
 
-        aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control
   lint:
     name: lint
     uses: ./.github/workflows/lint.yml
@@ -94,6 +62,7 @@ jobs:
     name: publish
     permissions:
       contents: write
+      id-token: write
     needs:
       - prerequisites
       - build_provider

diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
@@ -55,6 +55,7 @@ jobs:
     name: publish
     permissions:
       contents: write
+      id-token: write
     needs:
       - prerequisites
       - build_provider

diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml
@@ -51,6 +51,7 @@ jobs:
     - uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
       id: provider-version
       with:
+        major-version: 5
         set-env: 'PROVIDER_VERSION'
     - name: Cache examples generation
       uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4
@@ -71,7 +72,7 @@ jobs:
     - name: Unit-test provider code
       run: make test_provider
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
+      uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
       env:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - if: inputs.is_pr
@@ -95,16 +96,5 @@ jobs:
 
           Maintainer note: consult the [runbook](https://github.com/pulumi/platform-providers-team/blob/main/playbooks/tf-provider-updating.md) for dealing with any breaking changes.
 
-    - name: Upload codegen binary for configcat
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
-      with:
-        name: pulumi-tfgen-configcat
-        path: ${{ github.workspace }}/bin/pulumi-tfgen-configcat
-        retention-days: 30
-
-    - name: Upload schema-embed.json
-      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
-      with:
-        name: schema-embed.json
-        path: provider/cmd/pulumi-resource-configcat/schema-embed.json
-        retention-days: 30
+    - name: Upload artifacts
+      uses: ./.github/actions/upload-prerequisites
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -66,6 +66,14 @@ jobs:
         path: dist
         # Don't create a directory for each artifact
         merge-multiple: true
+    - name: Download schema
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+      with:
+        # Use a pattern to avoid failing if the artifact doesn't exist
+        pattern: schema-embed.*
+        # Avoid creating directories for each artifact
+        merge-multiple: true
+        path: dist
     - name: Calculate checksums
       working-directory: dist
       run: shasum ./*.tar.gz > "pulumi-configcat_${{ inputs.version }}_checksums.txt"
@@ -174,6 +182,9 @@ jobs:
   verify_release:
     name: verify_release
     needs: publish_sdk
+    permissions:
+      contents: write
+      id-token: write
     uses: ./.github/workflows/verify-release.yml
     secrets: inherit
     with:

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -61,6 +61,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
     needs:
       - prerequisites
       - build_provider

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -56,7 +56,7 @@ jobs:
     - name: Prepare local workspace
       run: make prepare_local_workspace
     - name: Download bin
-      uses: ./.github/actions/download-bin
+      uses: ./.github/actions/download-provider
     - name: Download SDK
       uses: ./.github/actions/download-sdk
       with:

diff --git a/.github/workflows/upgrade-provider.yml b/.github/workflows/upgrade-provider.yml
@@ -67,14 +67,18 @@ jobs:
         # upstream_version will be empty if the provider is up-to-date
         run: echo "version=${{ github.event.inputs.version || steps.upstream_version.outputs.latest_version }}" >> "$GITHUB_OUTPUT"
         shell: bash
-      - name: Attempt provider upgrade
+      - name: Call upgrade provider action
         id: upgrade_provider
-        # Only attempt the upgrade if we have a target version
         if: steps.target_version.outputs.version != ''
-        # Don't mark the build as failed if we can't auto-open a PR as we've already opened the upgrade issue for tracking
         continue-on-error: true
-        run: upgrade-provider "${{ github.repository }}" --kind="all" --target-version="${{ steps.target_version.outputs.version }}" 
-        shell: bash
+        uses: pulumi/pulumi-upgrade-provider-action@a1d9f03fbfd923f787427c1d9e99c2356711d483 # v0.0.13
+        with:
+          kind: all
+          email: [email protected]
+          username: pulumi-bot
+          automerge: false
+          target-version: ${{ steps.target_version.outputs.version }}
+          allow-missing-docs: false
       - name: Comment on upgrade issue if automated PR failed
         if: steps.upgrade_provider.outcome == 'failure'
         shell: bash