From db413377629ae975b8fc01de98181efcd9194b94 Mon Sep 17 00:00:00 2001 From: Pulumi Bot Date: Sat, 13 Sep 2025 00:35:51 +0000 Subject: [PATCH] [internal] Update GitHub Actions workflow files --- .github/workflows/build_provider.yml | 1 + .github/workflows/build_sdk.yml | 1 + .github/workflows/command-dispatch.yml | 1 + .github/workflows/main-post-build.yml | 1 + .github/workflows/master.yml | 1 + .github/workflows/prerequisites.yml | 3 +++ .github/workflows/publish.yml | 4 ++++ .github/workflows/pull-request.yml | 1 + .github/workflows/release_command.yml | 1 + .github/workflows/test.yml | 1 + .github/workflows/upgrade-bridge.yml | 4 ++++ .github/workflows/upgrade-java.yml | 2 ++ .github/workflows/upgrade-provider.yml | 9 ++++++++- .github/workflows/verify-release.yml | 1 + 14 files changed, 30 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build_provider.yml b/.github/workflows/build_provider.yml index f7fc842..d940606 100644 --- a/.github/workflows/build_provider.yml +++ b/.github/workflows/build_provider.yml @@ -44,6 +44,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/build_sdk.yml b/.github/workflows/build_sdk.yml index d50a83a..a33bc47 100644 --- a/.github/workflows/build_sdk.yml +++ b/.github/workflows/build_sdk.yml @@ -41,6 +41,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/command-dispatch.yml b/.github/workflows/command-dispatch.yml index 9c1320a..dce235f 100644 --- a/.github/workflows/command-dispatch.yml +++ b/.github/workflows/command-dispatch.yml @@ -20,6 +20,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/main-post-build.yml b/.github/workflows/main-post-build.yml index 713dbeb..5b5fc67 100644 --- a/.github/workflows/main-post-build.yml +++ b/.github/workflows/main-post-build.yml @@ -35,6 +35,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index c47e51b..a2c3c6a 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -92,6 +92,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml index 4368ee8..3e83101 100644 --- a/.github/workflows/prerequisites.yml +++ b/.github/workflows/prerequisites.yml @@ -42,6 +42,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization @@ -65,6 +66,8 @@ jobs: tools: go, pulumictl, pulumicli, schema-tools - name: Prepare local workspace before restoring previously built files run: make prepare_local_workspace + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Generate schema run: make schema - name: Build registry docs diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c211ff8..f47956e 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -43,6 +43,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization @@ -127,6 +128,7 @@ jobs: persist-credentials: true - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization @@ -206,6 +208,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization @@ -239,6 +242,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index 0e6795f..acd430d 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -18,6 +18,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/release_command.yml b/.github/workflows/release_command.yml index 4c455e9..1a6ba6c 100644 --- a/.github/workflows/release_command.yml +++ b/.github/workflows/release_command.yml @@ -16,6 +16,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 90c6e65..2fbf32a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -33,6 +33,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/upgrade-bridge.yml b/.github/workflows/upgrade-bridge.yml index b010f0a..21b09e1 100644 --- a/.github/workflows/upgrade-bridge.yml +++ b/.github/workflows/upgrade-bridge.yml @@ -59,6 +59,7 @@ permissions: contents: write issues: write pull-requests: write + id-token: write # For ESC secrets. env: PULUMI_API: https://api.pulumi-staging.io @@ -77,6 +78,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization @@ -101,6 +103,8 @@ jobs: pr-description: ${{ inputs.pr-description }} pr-title-prefix: ${{ inputs.pr-title-prefix }} patch-release: ${{ github.event.client_payload.patch-release }} + env: + GH_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_TOKEN || steps.esc-secrets.outputs.PULUMI_BOT_TOKEN || secrets.GITHUB_TOKEN }} - name: Call upgrade provider action if: github.event_name == 'repository_dispatch' uses: pulumi/pulumi-upgrade-provider-action@3c670a7cb92732324c8ccc17f7f9ef9dfca126d0 # v0.0.17 diff --git a/.github/workflows/upgrade-java.yml b/.github/workflows/upgrade-java.yml index da1c4cb..193f924 100644 --- a/.github/workflows/upgrade-java.yml +++ b/.github/workflows/upgrade-java.yml @@ -21,6 +21,7 @@ permissions: contents: write issues: write pull-requests: write + id-token: write # For ESC secrets. jobs: upgrade_java: @@ -35,6 +36,7 @@ jobs: persist-credentials: true - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/upgrade-provider.yml b/.github/workflows/upgrade-provider.yml index 525f101..9f64cd8 100644 --- a/.github/workflows/upgrade-provider.yml +++ b/.github/workflows/upgrade-provider.yml @@ -22,16 +22,22 @@ on: # 3 AM UTC ~ 8 PM PDT / 7 PM PST daily. Time chosen to run during off hours. - cron: 0 3 * * * +env: + PULUMI_API: https://api.pulumi-staging.io + PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. + PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget + TF_APPEND_USER_AGENT: pulumi + permissions: contents: write issues: write pull-requests: write + id-token: write # For ESC secrets. jobs: upgrade_provider: name: upgrade-provider runs-on: ubuntu-latest - permissions: write-all steps: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 @@ -40,6 +46,7 @@ jobs: persist-credentials: true - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml index 6c6cf07..df864c1 100644 --- a/.github/workflows/verify-release.yml +++ b/.github/workflows/verify-release.yml @@ -67,6 +67,7 @@ jobs: persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: imports/github-secrets + ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false" ESC_ACTION_OIDC_AUTH: "true" ESC_ACTION_OIDC_ORGANIZATION: pulumi ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization