pulumi-policy-sdk-python-docs.yml

permissions: write-all # Equivalent to default permissions + id-token: write
env:
  ESC_ACTION_OIDC_AUTH: true
  ESC_ACTION_OIDC_ORGANIZATION: pulumi
  ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
  ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-docs
  ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: GITHUB_TOKEN=PULUMI_BOT_TOKEN

name: Pulumi Policy SDK docs - Python
on:
  workflow_dispatch:
    inputs:
      version:
        description: "pulumi_policy version (e.g. 1.16.0, without leading 'v')"
        required: true
      skip_auto_merge:
        description: "Skip enabling auto-merge on the generated PR (for testing)"
        type: boolean
        default: false
      publish_only:
        description: "Generate + publish the versioned snapshot only; skip the latest-docs PR (for backfill)"
        type: boolean
        default: false
      target_env:
        description: "Versioned-docs publish target (when publishing)"
        type: choice
        options:
          - production
          - testing
        default: production

jobs:
  pull-request:
    runs-on: ubuntu-latest
    needs: build-pulumi-policy-sdk-python-docs
    if: needs.build-pulumi-policy-sdk-python-docs.outputs.has_changes == 'true' && github.event.inputs.publish_only != 'true'
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3
      - name: checkout docs repo
        uses: actions/checkout@v7
      - name: set the policy sdk version
        run: |
          echo "POLICY_SDK_VERSION=${{ github.event.inputs.version || github.event.client_payload.ref }}" >> $GITHUB_ENV
      - name: pull-request
        id: create-pr
        uses: repo-sync/pull-request@v2
        with:
          source_branch: "pulumi-policy-sdk-python-docs/${{ github.run_id }}-${{ github.run_number }}"
          destination_branch: "master"
          pr_title: "Generate Pulumi Policy SDK docs - Python @v${{ env.POLICY_SDK_VERSION }}"
          pr_body: |
            Automated PR generated by the [Pulumi Policy SDK docs - Python](https://github.com/${{ github.repository }}/blob/master/.github/workflows/pulumi-policy-sdk-python-docs.yml) workflow (`.github/workflows/pulumi-policy-sdk-python-docs.yml`).

            Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          pr_label: "automation/pulumi-policy-sdk-python-docs,automation/merge"
          github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
      - name: Enable auto-merge
        if: steps.create-pr.outputs.pr_created == 'true' && github.event.inputs.skip_auto_merge != 'true'
        run: gh pr merge ${{ steps.create-pr.outputs.pr_number }} --auto --squash
        env:
          GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
  build-pulumi-policy-sdk-python-docs:
    runs-on: ubuntu-latest
    outputs:
      has_changes: ${{ steps.commit.outputs.has_changes }}
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3
      - name: set the policy sdk version
        run: |
          echo "POLICY_SDK_VERSION=${{ github.event.inputs.version || github.event.client_payload.ref }}" >> $GITHUB_ENV
      - name: checkout docs repo
        uses: actions/checkout@v7
      - name: Install Hugo
        uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: '0.157.0'
          extended: true
      - name: Install node
        uses: actions/setup-node@v7
        with:
          node-version: '24.x'
          cache: 'yarn'
          cache-dependency-path: |
            yarn.lock
            infrastructure/yarn.lock
            theme/yarn.lock
            theme/stencil/yarn.lock
      - name: Install python
        uses: actions/setup-python@v7
        with:
          python-version: "3.13"
      - name: Install Pipenv
        run: pip3 install pipenv
      - name: Install Vale (required by scripts/ensure.sh)
        run: |
          VALE_VERSION="3.14.1"
          VALE_SHA256="ff2b49ffaa9dcd246fd5008f03ff67746d2790b75bf4d3657e2fb9530fb96db3"
          curl -fsSL -o /tmp/vale.tar.gz "https://github.com/errata-ai/vale/releases/download/v${VALE_VERSION}/vale_${VALE_VERSION}_Linux_64-bit.tar.gz"
          echo "${VALE_SHA256}  /tmp/vale.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin vale -f /tmp/vale.tar.gz
          rm /tmp/vale.tar.gz
      - run: make ensure
      - name: Generate Pulumi Policy SDK Python docs
        env:
          PACKAGE: pulumi_policy
          VERSION: ${{ env.POLICY_SDK_VERSION }}
        run: ./scripts/generate_python_docs.sh
      - name: git status
        run: git status && git diff
      - name: commit changes
        id: commit
        run: |
          git config --local user.email "bot@pulumi.com"
          git config --local user.name "pulumi-bot"
          git checkout -b pulumi-policy-sdk-python-docs/${{ github.run_id }}-${{ github.run_number }}
          git add static-prebuilt/
          if git diff --cached --quiet; then
            echo "No changes to commit"
            echo "has_changes=false" >> $GITHUB_OUTPUT
          else
            git commit -m "Regenerating Pulumi Policy SDK Python docs for pulumi_policy@${{ env.POLICY_SDK_VERSION }}"
            if [ "${{ github.event.inputs.publish_only }}" != "true" ]; then
              git push origin pulumi-policy-sdk-python-docs/${{ github.run_id }}-${{ github.run_number }}
            fi
            echo "has_changes=true" >> $GITHUB_OUTPUT
          fi
      # --- Versioned docs: archive this SDK release as an immutable snapshot. ---------
      # No enable flag: the publish turns itself on once the versioned-docs storage stack
      # exists - the resolve step reads the bucket/role/distribution from stack outputs and
      # every step below no-ops while they are absent. Runs after commit, continue-on-error,
      # so a publish hiccup never blocks the docs PR.
      - name: Resolve versioned-docs publish target
        id: vdocs
        env:
          PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
        run: |
          TARGET="${{ github.event.inputs.target_env || 'production' }}"
          if [ "$TARGET" = "testing" ]; then
            STORAGE_STACK="pulumi/pulumi-docs-versioned/testing"
            WWW_STACK="pulumi/www.pulumi.com/www-testing"
            SITE="https://www.pulumi-test.io"
          else
            STORAGE_STACK="pulumi/pulumi-docs-versioned/production"
            WWW_STACK="pulumi/www.pulumi.com/www-production"
            SITE="https://www.pulumi.com"
          fi
          # Resolve EVERYTHING from the IaC that owns it - no hardcoded names, no enable flag.
          # The bucket + publisher role come from the versioned-docs storage stack; the
          # CloudFront distribution (for the post-publish invalidation) from the www stack.
          # An empty bucket means versioned docs are not stood up for this env yet: every step
          # below is gated on bucket != '' and simply no-ops, so the feature turns itself on
          # the moment the storage stack exists. Mirrors how scripts/run-pulumi.sh and the
          # registry repo read these values from stack outputs instead of copying them.
          BUCKET="$(pulumi stack output bucketNameOutput --stack "$STORAGE_STACK" 2>/dev/null || true)"
          ROLE_ARN="$(pulumi stack output publisherRoleArn --stack "$STORAGE_STACK" 2>/dev/null || true)"
          DIST_ID="$(pulumi stack output cloudFrontDistributionId --stack "$WWW_STACK" 2>/dev/null || true)"
          if [ -z "$BUCKET" ]; then
            echo "::notice::versioned-docs: storage stack $STORAGE_STACK has no bucket output - versioned docs are not stood up for '$TARGET'; skipping the archive publish."
          elif [ -z "$DIST_ID" ]; then
            echo "::warning::versioned-docs: could not read cloudFrontDistributionId from $WWW_STACK; publishing without a CloudFront invalidation (staleness bounded by the 300s manifest TTL)."
          fi
          {
            echo "role_arn=$ROLE_ARN"
            echo "bucket=$BUCKET"
            echo "distribution_id=$DIST_ID"
            echo "site=$SITE"
          } >> "$GITHUB_OUTPUT"
      - name: Configure AWS credentials (versioned-docs publisher)
        if: ${{ steps.vdocs.outputs.bucket != '' }}
        continue-on-error: true
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ steps.vdocs.outputs.role_arn }}
          role-session-name: versioned-docs-sdk-publish
          aws-region: us-west-2
      - name: Publish versioned snapshot
        if: ${{ steps.vdocs.outputs.bucket != '' }}
        continue-on-error: true
        run: |
          # Backfill (publish_only) archives an OLD release: do not mark it "latest".
          EXTRA=()
          [ "${{ github.event.inputs.publish_only }}" = "true" ] && EXTRA+=(--no-mark-latest)
          ./scripts/versioned-docs/publish-version.sh --tool python-policy \
            --version "v${{ env.POLICY_SDK_VERSION }}" \
            --src static-prebuilt/docs/reference/pkg/python/pulumi_policy \
            --live-root /docs/reference/pkg/python/pulumi_policy/ \
            --bucket "${{ steps.vdocs.outputs.bucket }}" --label "Policy SDK (Python)" \
            --distribution-id "${{ steps.vdocs.outputs.distribution_id }}" \
            --site "${{ steps.vdocs.outputs.site }}" \
            "${EXTRA[@]}"
  notify:
    if: failure() && github.event.inputs.publish_only != 'true'
    name: Send slack notification
    runs-on: ubuntu-latest
    needs: [pull-request, build-pulumi-policy-sdk-python-docs]
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3
      - name: Slack Notification
        uses: docker://sholung/action-slack-notify:v2.3.0
        env:
          SLACK_CHANNEL: docs-ops
          SLACK_COLOR: "#F54242"
          SLACK_MESSAGE: "Pulumi Policy SDK docs - Python build failure in pulumi/docs repo"
          SLACK_USERNAME: docsbot
          SLACK_WEBHOOK: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
          SLACK_ICON: https://www.pulumi.com/logos/brand/avatar-on-white.png