Skip to content

Commit b57481f

Browse files
pulumi-provider-automation[bot]pulumi-bot
pulumi-provider-automation[bot]
and
pulumi-bot
authored
[internal] Update GitHub Actions workflow files (#410)
Co-authored-by: Pulumi Bot <[email protected]>
1 parent 39853ea commit b57481f

File tree

11 files changed

+93
-15
lines changed

11 files changed

+93
-15
lines changed

‎.github/workflows/build_provider.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@ jobs:
5151
id: esc-secrets
5252
name: Fetch secrets from ESC
5353
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
54+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
55+
id: app-auth
56+
with:
57+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
58+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
59+
owner: ${{ github.repository_owner }}
5460
# Without ldid cross-compiling Node binaries on a Linux worker intended to work on darwin-arm64 fails to sign the
5561
# binaries properly and they do not work as expected. See https://github.com/pulumi/pulumi-awsx/issues/1490
5662
- uses: MOZGIII/install-ldid-action@d5ab465f3a66a4d60a59882b935eb30e18e8d043 # v1
@@ -62,7 +68,7 @@ jobs:
6268
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
6369
with:
6470
version: 2025.11.6
65-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
71+
github_token: ${{ steps.app-auth.outputs.token }}
6672
# only saving the cache in the prerequisites job
6773
cache_save: false
6874
# Based on https://github.com/actions/cache/blob/main/examples.md#go---modules

‎.github/workflows/build_sdk.yml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,12 @@ jobs:
4949
id: esc-secrets
5050
name: Fetch secrets from ESC
5151
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
52+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
53+
id: app-auth
54+
with:
55+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
56+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
57+
owner: ${{ github.repository_owner }}
5258
- name: Cache examples generation
5359
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
5460
with:
@@ -61,7 +67,7 @@ jobs:
6167
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
6268
with:
6369
version: 2025.11.6
64-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
70+
github_token: ${{ steps.app-auth.outputs.token }}
6571
# only saving the cache in the prerequisites job
6672
cache_save: false
6773
- name: Setup Go Cache
@@ -77,7 +83,7 @@ jobs:
7783
- name: Prepare local workspace
7884
run: make prepare_local_workspace
7985
env:
80-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
86+
GITHUB_TOKEN: ${{ steps.app-auth.outputs.token }}
8187
- name: Download prerequisites
8288
uses: ./.github/actions/download-prerequisites
8389
- name: Update path
@@ -107,7 +113,7 @@ jobs:
107113
# If the worktree is dirty and this is a Renovate PR to bump
108114
# dependencies, commit the updated SDK and push it back to the PR. The
109115
# job will still be marked as a failure.
110-
if: failure() && steps.worktreeClean.outcome == 'failure' && contains(github.actor, 'renovate') && github.event_name == 'pull_request'
116+
if: steps.worktreeClean.outcome == 'failure' && contains(github.actor, 'renovate') && github.event_name == 'pull_request'
111117
shell: bash
112118
run: |
113119
git diff --quiet -- sdk && echo "no changes to sdk" && exit
@@ -123,7 +129,7 @@ jobs:
123129
# Apply and add our changes, but don't commit any files we expect to
124130
# always change due to versioning.
125131
git stash pop
126-
git add sdk
132+
git add sdk provider/cmd/scm/schema.json
127133
git reset \
128134
sdk/python/*/pulumi-plugin.json \
129135
sdk/python/pyproject.toml \

‎.github/workflows/license.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,19 @@ jobs:
3535
id: esc-secrets
3636
name: Fetch secrets from ESC
3737
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
38+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
39+
id: app-auth
40+
with:
41+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
42+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
43+
owner: ${{ github.repository_owner }}
3844
- name: Setup mise
3945
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
4046
env:
4147
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
4248
with:
4349
version: 2025.11.6
44-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
50+
github_token: ${{ steps.app-auth.outputs.token }}
4551
# only saving the cache in the prerequisites job
4652
cache_save: false
4753
- run: make prepare_local_workspace

‎.github/workflows/lint.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,19 @@ jobs:
3535
id: esc-secrets
3636
name: Fetch secrets from ESC
3737
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
38+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
39+
id: app-auth
40+
with:
41+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
42+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
43+
owner: ${{ github.repository_owner }}
3844
- name: Setup mise
3945
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
4046
env:
4147
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
4248
with:
4349
version: 2025.11.6
44-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
50+
github_token: ${{ steps.app-auth.outputs.token }}
4551
cache_save: false # A different job handles caching our tools.
4652
- name: disarm go:embed directives to enable lint
4753
continue-on-error: true # this fails if there are no go:embed directives

‎.github/workflows/main-post-build.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,12 @@ jobs:
4343
id: esc-secrets
4444
name: Fetch secrets from ESC
4545
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
46+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
47+
id: app-auth
48+
with:
49+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
50+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
51+
owner: ${{ github.repository_owner }}
4652
- name: Configure AWS Credentials
4753
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
4854
with:
@@ -55,7 +61,7 @@ jobs:
5561
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
5662
with:
5763
version: 2025.11.6
58-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
64+
github_token: ${{ steps.app-auth.outputs.token }}
5965
# only saving the cache in the prerequisites job
6066
cache_save: false
6167
- name: Setup Go Cache

‎.github/workflows/prerequisites.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@ jobs:
5050
id: esc-secrets
5151
name: Fetch secrets from ESC
5252
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
53+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
54+
id: app-auth
55+
with:
56+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
57+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
58+
owner: ${{ github.repository_owner }}
5359
- uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
5460
id: provider-version
5561
with:
@@ -67,7 +73,7 @@ jobs:
6773
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
6874
with:
6975
version: 2025.11.6
70-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
76+
github_token: ${{ steps.app-auth.outputs.token }}
7177
# only saving the cache in the prerequisites job
7278
cache_save: true
7379
- name: Setup Go Cache

‎.github/workflows/publish.yml‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,13 +53,19 @@ jobs:
5353
id: esc-secrets
5454
name: Fetch secrets from ESC
5555
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
56+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
57+
id: app-auth
58+
with:
59+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
60+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
61+
owner: ${{ github.repository_owner }}
5662
- name: Setup mise
5763
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
5864
env:
5965
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
6066
with:
6167
version: 2025.11.6
62-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
68+
github_token: ${{ steps.app-auth.outputs.token }}
6369
cache_save: false
6470
- name: Configure AWS Credentials
6571
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
@@ -143,13 +149,19 @@ jobs:
143149
id: esc-secrets
144150
name: Fetch secrets from ESC
145151
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
152+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
153+
id: app-auth
154+
with:
155+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
156+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
157+
owner: ${{ github.repository_owner }}
146158
- name: Setup mise
147159
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
148160
env:
149161
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
150162
with:
151163
version: 2025.11.6
152-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
164+
github_token: ${{ steps.app-auth.outputs.token }}
153165
# only saving the cache in the prerequisites job
154166
cache_save: false
155167
- name: Setup Node
@@ -233,6 +245,12 @@ jobs:
233245
id: esc-secrets
234246
name: Fetch secrets from ESC
235247
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
248+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
249+
id: app-auth
250+
with:
251+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
252+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
253+
owner: ${{ github.repository_owner }}
236254
- name: Dispatch Metadata build
237255
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4
238256
with:
@@ -267,6 +285,12 @@ jobs:
267285
id: esc-secrets
268286
name: Fetch secrets from ESC
269287
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
288+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
289+
id: app-auth
290+
with:
291+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
292+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
293+
owner: ${{ github.repository_owner }}
270294
- name: Clean up release labels
271295
uses: pulumi/action-release-by-pr-label@main
272296
with:

‎.github/workflows/test.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,12 @@ jobs:
4343
id: esc-secrets
4444
name: Fetch secrets from ESC
4545
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
46+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
47+
id: app-auth
48+
with:
49+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
50+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
51+
owner: ${{ github.repository_owner }}
4652
- name: Checkout p/examples
4753
if: matrix.testTarget == 'pulumiExamples'
4854
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
@@ -56,7 +62,7 @@ jobs:
5662
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
5763
with:
5864
version: 2025.11.6
59-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
65+
github_token: ${{ steps.app-auth.outputs.token }}
6066
# also save this cache since we are using a different mise env.
6167
cache_save: true
6268
- name: Prepare local workspace

‎.github/workflows/upgrade-bridge.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,13 +86,19 @@ jobs:
8686
id: esc-secrets
8787
name: Fetch secrets from ESC
8888
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
89+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
90+
id: app-auth
91+
with:
92+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
93+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
94+
owner: ${{ github.repository_owner }}
8995
- name: Setup mise
9096
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
9197
env:
9298
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
9399
with:
94100
version: 2025.11.6
95-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
101+
github_token: ${{ steps.app-auth.outputs.token }}
96102
# only saving the cache in the prerequisites job
97103
cache_save: false
98104
- name: Call upgrade provider action

‎.github/workflows/upgrade-provider.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,13 +54,19 @@ jobs:
5454
id: esc-secrets
5555
name: Fetch secrets from ESC
5656
uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
57+
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
58+
id: app-auth
59+
with:
60+
app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
61+
private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
62+
owner: ${{ github.repository_owner }}
5763
- name: Setup mise
5864
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
5965
env:
6066
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
6167
with:
6268
version: 2025.11.6
63-
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
69+
github_token: ${{ steps.app-auth.outputs.token }}
6470
# only saving the cache in the prerequisites job
6571
cache_save: false
6672
- name: Install upgrade-provider

0 commit comments

Comments
 (0)