From 7b058f29289f10503e35c2c02d9b8c27c8a349e2 Mon Sep 17 00:00:00 2001 From: Pulumi Bot Date: Thu, 11 Sep 2025 06:26:46 +0000 Subject: [PATCH] [internal] Update GitHub Actions workflow files --- .github/actions/esc-action/index.js | 2 +- .github/actions/setup-tools/action.yml | 6 +- .github/copilot-instructions.md | 144 +++++++++++++++++++++ .github/workflows/build_provider.yml | 15 ++- .github/workflows/build_sdk.yml | 15 ++- .github/workflows/command-dispatch.yml | 16 ++- .github/workflows/community-moderation.yml | 7 +- .github/workflows/copilot-setup-steps.yml | 42 ++++++ .github/workflows/export-repo-secrets.yml | 2 +- .github/workflows/license.yml | 8 ++ .github/workflows/lint.yml | 8 ++ .github/workflows/main-post-build.yml | 21 ++- .github/workflows/master.yml | 22 +++- .github/workflows/prerelease.yml | 9 ++ .github/workflows/prerequisites.yml | 17 ++- .github/workflows/publish.yml | 77 +++++++---- .github/workflows/pull-request.yml | 14 +- .github/workflows/release.yml | 9 ++ .github/workflows/release_command.yml | 11 +- .github/workflows/run-acceptance-tests.yml | 17 ++- .github/workflows/test.yml | 13 +- .github/workflows/upgrade-bridge.yml | 18 ++- .github/workflows/upgrade-java.yml | 7 +- .github/workflows/upgrade-provider.yml | 11 +- .github/workflows/verify-release.yml | 20 ++- 25 files changed, 463 insertions(+), 68 deletions(-) create mode 100644 .github/copilot-instructions.md create mode 100644 .github/workflows/copilot-setup-steps.yml diff --git a/.github/actions/esc-action/index.js b/.github/actions/esc-action/index.js index bb9fbb4..2299fdc 100644 --- a/.github/actions/esc-action/index.js +++ b/.github/actions/esc-action/index.js @@ -5,7 +5,7 @@ var stream = fs.createWriteStream(file, { flags: "a" }); for (const [name, value] of Object.entries(process.env)) { try { - stream.write(`${name}=${value}\n`); + stream.write(`${name}<- summaryName="${PROVIDER}_summary_$(date +"%Y-%m-%d_%H-%M-%S").json" - s3FullURI="s3://${{ secrets.S3_COVERAGE_BUCKET_NAME }}/summaries/${summaryName}" + s3FullURI="s3://${{ steps.esc-secrets.outputs.S3_COVERAGE_BUCKET_NAME }}/summaries/${summaryName}" aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control env: diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 16c0130..beb66b7 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -1,10 +1,19 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt env: + AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} + AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }} + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} TF_APPEND_USER_AGENT: pulumi + jobs: prerequisites: permissions: @@ -72,6 +81,13 @@ jobs: needs: publish runs-on: ubuntu-latest steps: + - name: Checkout Repo + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: check if this commit needs release if: ${{ env.RELEASE_BOT_ENDPOINT != '' }} uses: pulumi/action-release-by-pr-label@main @@ -79,10 +95,10 @@ jobs: command: "release-if-needed" repo: ${{ github.repository }} commit: ${{ github.sha }} - slack_channel: ${{ secrets.RELEASE_OPS_SLACK_CHANNEL }} + slack_channel: C02MGR8JVST env: - RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} - RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} test: diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml index 8d37ff0..1b13c0b 100644 --- a/.github/workflows/prerelease.yml +++ b/.github/workflows/prerelease.yml @@ -2,10 +2,19 @@ env: IS_PRERELEASE: true + AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} + AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }} + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} TF_APPEND_USER_AGENT: pulumi + jobs: prerequisites: permissions: diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml index 99d06b2..5eb9ac2 100644 --- a/.github/workflows/prerequisites.yml +++ b/.github/workflows/prerequisites.yml @@ -20,9 +20,17 @@ on: value: ${{ jobs.prerequisites.outputs.version }} env: + AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} + AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }} + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} TF_APPEND_USER_AGENT: pulumi jobs: @@ -38,7 +46,10 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - persist-credentials: false + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0 id: provider-version with: @@ -64,10 +75,12 @@ jobs: run: make provider - name: Unit-test provider code run: make test_provider + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Upload coverage reports to Codecov uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0 env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} + CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }} - if: inputs.is_pr name: Check Schema is Valid run: | diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 82b4b66..2b0bbf5 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -21,9 +21,24 @@ on: env: IS_PRERELEASE: ${{ inputs.isPrerelease }} + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + AWS_UPLOAD_ROLE_ARN: ${{ secrets.AWS_UPLOAD_ROLE_ARN }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} + JAVA_SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }} + JAVA_SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }} + JAVA_SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }} + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }} + OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }} + OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }} + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} TF_APPEND_USER_AGENT: pulumi jobs: @@ -40,22 +55,25 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - persist-credentials: false + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Setup tools uses: ./.github/actions/setup-tools with: tools: pulumictl, pulumicli, go, schema-tools cache-go: false - name: Configure AWS Credentials - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 + uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0 with: - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }} aws-region: us-east-2 - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }} role-duration-seconds: 7200 role-external-id: upload-pulumi-release role-session-name: postgresql@githubActions - role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }} + role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }} - name: Create dist directory run: mkdir -p dist - name: Download provider assets @@ -92,7 +110,7 @@ jobs: - name: Upload Provider Binaries run: aws s3 cp dist s3://get.pulumi.com/releases/plugins/ --recursive - name: Create GH Release - uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2 + uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836 # v2 if: inputs.isPrerelease == false with: tag_name: v${{ inputs.version }} @@ -116,7 +134,10 @@ jobs: uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: # Persist credentials so we can push back to the repo - persist-credentials: true + persist-credentials: true + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Setup tools uses: ./.github/actions/setup-tools with: @@ -130,14 +151,14 @@ jobs: version: ${{ inputs.version }} env: PYPI_USERNAME: __token__ - PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }} - SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }} - SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }} - PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }} - PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }} - NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }} + PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }} + NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }} + SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }} + SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }} + SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }} + PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }} + PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }} + NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }} - name: Publish SDKs (except Java) if: inputs.skipJavaSdk == true uses: pulumi/pulumi-package-publisher@c1672c7928591d563dccb12729e05e315c21f8c2 # v0.0.22 @@ -146,12 +167,12 @@ jobs: version: ${{ inputs.version }} env: PYPI_USERNAME: __token__ - PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }} - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }} - SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }} - SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }} - NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }} + PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }} + NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }} + SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }} + SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }} + SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }} + NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }} - name: Download Go SDK uses: ./.github/actions/download-sdk with: @@ -184,10 +205,17 @@ jobs: if: inputs.isPrerelease == false runs-on: ubuntu-latest steps: + - name: Checkout Repo + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Dispatch Metadata build uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3 with: - token: ${{ secrets.PULUMI_BOT_TOKEN }} + token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} repository: pulumi/registry event-type: resource-provider client-payload: |- @@ -208,7 +236,10 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - persist-credentials: false + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Clean up release labels uses: pulumi/action-release-by-pr-label@main with: diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 108f812..096190c 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -1,10 +1,19 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt env: + AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} + AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }} + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} TF_APPEND_USER_AGENT: pulumi + jobs: comment-on-pr: if: github.event.pull_request.head.repo.full_name != github.repository @@ -14,7 +23,10 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - persist-credentials: false + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Comment PR uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ab02ef3..a800dc9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,10 +7,19 @@ on: - "!v*.*.*-**" env: + AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} + AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }} + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} TF_APPEND_USER_AGENT: pulumi + jobs: prerequisites: permissions: diff --git a/.github/workflows/release_command.yml b/.github/workflows/release_command.yml index 5c4413d..aab7724 100644 --- a/.github/workflows/release_command.yml +++ b/.github/workflows/release_command.yml @@ -13,7 +13,10 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - persist-credentials: false + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Should release PR uses: pulumi/action-release-by-pr-label@main with: @@ -21,10 +24,10 @@ jobs: repo: ${{ github.repository }} pr: ${{ github.event.client_payload.pull_request.number }} version: ${{ github.event.client_payload.slash_command.args.all }} - slack_channel: ${{ secrets.RELEASE_OPS_STAGING_SLACK_CHANNEL }} + slack_channel: ${{ steps.esc-secrets.outputs.RELEASE_OPS_STAGING_SLACK_CHANNEL }} env: - RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} - RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - if: failure() name: Notify failure diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml index 9768847..e909a94 100644 --- a/.github/workflows/run-acceptance-tests.yml +++ b/.github/workflows/run-acceptance-tests.yml @@ -12,9 +12,17 @@ on: env: PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} + AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} + AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }} + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} TF_APPEND_USER_AGENT: pulumi # This should cancel any previous runs of the same workflow on the same branch which are still running. @@ -67,6 +75,13 @@ jobs: pull-requests: write runs-on: ubuntu-latest steps: + - name: Checkout Repo + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - id: run-url name: Create URL to the run output run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT" @@ -98,7 +113,7 @@ jobs: steps: - uses: guibranco/github-status-action-v2@0849440ec82c5fa69b2377725b9b7852a3977e76 # v1.1.13 with: - authToken: ${{secrets.GITHUB_TOKEN}} + authToken: ${{ secrets.GITHUB_TOKEN }} # Write an explicit status check called "Sentinel" which will only pass if this code really runs. # This should always be a required check for PRs. context: 'Sentinel' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index aa59094..950de0e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,9 +12,17 @@ on: env: PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} + AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} + AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }} + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} TF_APPEND_USER_AGENT: pulumi jobs: @@ -30,7 +38,10 @@ jobs: uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: ref: ${{ env.PR_COMMIT_SHA }} - persist-credentials: false + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Checkout p/examples if: matrix.testTarget == 'pulumiExamples' uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 diff --git a/.github/workflows/upgrade-bridge.yml b/.github/workflows/upgrade-bridge.yml index b737a74..c3500ee 100644 --- a/.github/workflows/upgrade-bridge.yml +++ b/.github/workflows/upgrade-bridge.yml @@ -61,10 +61,17 @@ permissions: pull-requests: write env: - GH_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN || secrets.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} + AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} + AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} + S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }} + SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} TF_APPEND_USER_AGENT: pulumi jobs: @@ -75,7 +82,10 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - persist-credentials: false + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Setup tools uses: ./.github/actions/setup-tools with: @@ -107,4 +117,6 @@ jobs: pr-reviewers: ${{ github.event.client_payload.pr-reviewers }} pr-description: ${{ github.event.client_payload.pr-description }} pr-title-prefix: ${{ github.event.client_payload.pr-title-prefix }} - patch-release: ${{ github.event.client_payload.patch-release }} \ No newline at end of file + patch-release: ${{ github.event.client_payload.patch-release }} + env: + GH_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_TOKEN || steps.esc-secrets.outputs.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/upgrade-java.yml b/.github/workflows/upgrade-java.yml index 341d7aa..bb2fee6 100644 --- a/.github/workflows/upgrade-java.yml +++ b/.github/workflows/upgrade-java.yml @@ -32,7 +32,10 @@ jobs: uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: # Persist credentials so upgrade-provider can push a new branch. - persist-credentials: true + persist-credentials: true + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Setup tools uses: ./.github/actions/setup-tools @@ -57,6 +60,6 @@ jobs: REPO: ${{github.repository}} # upgrade-provider calls into gh CLI tool to open PRs that uses GH_TOKEN env var, which is not obivous. # setting this correctly makes sure the PR has the correct owner and permissions work as expected. - GH_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN || secrets.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_TOKEN || steps.esc-secrets.outputs.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} run: | upgrade-provider "$REPO" --kind=java --java-version="$V" diff --git a/.github/workflows/upgrade-provider.yml b/.github/workflows/upgrade-provider.yml index d6f27ca..d0018d9 100644 --- a/.github/workflows/upgrade-provider.yml +++ b/.github/workflows/upgrade-provider.yml @@ -36,7 +36,10 @@ jobs: uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: # Persist credentials so upgrade-provider can push a new branch. - persist-credentials: true + persist-credentials: true + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Setup tools uses: ./.github/actions/setup-tools with: @@ -56,7 +59,7 @@ jobs: run: upgrade-provider "$REPO" --kind=check-upstream-version env: REPO: ${{ github.repository }} - GH_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN || secrets.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_TOKEN || steps.esc-secrets.outputs.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} shell: bash - name: Calculate target version id: target_version @@ -77,7 +80,7 @@ jobs: target-version: ${{ steps.target_version.outputs.version }} allow-missing-docs: true env: - GH_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN || secrets.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_TOKEN || steps.esc-secrets.outputs.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} - name: Comment on upgrade issue if automated PR failed if: steps.upgrade_provider.outcome == 'failure' shell: bash @@ -85,5 +88,5 @@ jobs: issue_number=$(gh issue list --search "pulumiupgradeproviderissue" --repo "${{ github.repository }}" --json=number --jq=".[0].number") gh issue comment "${issue_number}" --repo "${{ github.repository }}" --body "Failed to create automatic PR: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}/" env: - GH_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN || secrets.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_TOKEN || steps.esc-secrets.outputs.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml index f0dc9de..feff58a 100644 --- a/.github/workflows/verify-release.yml +++ b/.github/workflows/verify-release.yml @@ -37,9 +37,24 @@ on: required: false env: + AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} + AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + AWS_UPLOAD_ROLE_ARN: ${{ secrets.AWS_UPLOAD_ROLE_ARN }} + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} + JAVA_SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }} + JAVA_SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }} + JAVA_SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }} + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} + NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }} + OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }} + OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }} PULUMI_API: https://api.pulumi-staging.io + PULUMI_BOT_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }} PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }} + RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }} + RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }} TF_APPEND_USER_AGENT: pulumi jobs: @@ -64,7 +79,10 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - persist-credentials: false + persist-credentials: false + - id: esc-secrets + name: Map environment to ESC outputs + uses: ./.github/actions/esc-action - name: Setup tools uses: ./.github/actions/setup-tools with: