Skip to content

Commit b078334

Browse files
pulumi-botpulumi-bot
committed
[internal] Update GitHub Actions workflow files
1 parent 51c1ff8 commit b078334

File tree

16 files changed

+149
-160
lines changed

16 files changed

+149
-160
lines changed

‎.config/mise.lock‎

Lines changed: 0 additions & 87 deletions
This file was deleted.

‎.config/mise.toml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ PULUMI_HOME = "{{config_root}}/.pulumi"
88
[tools]
99

1010
# Runtimes
11-
# TODO: we may not need `get_env` once https://github.com/jdx/mise/discussions/6339 is fixed
11+
# TODO: we may not need 'get_env' once https://github.com/jdx/mise/discussions/6339 is fixed
1212
go = "{{ get_env(name='GO_VERSION_MISE', default='latest') }}"
1313
node = '20.19.5'
1414
python = '3.11.8'
@@ -18,12 +18,12 @@ java = 'corretto-11'
1818

1919
# Executable tools
2020
pulumi = "{{ get_env(name='PULUMI_VERSION_MISE', default='latest') }}"
21-
"github:pulumi/pulumictl" = 'latest'
22-
"github:pulumi/schema-tools" = "latest"
23-
gradle = '7.6'
21+
"github:pulumi/pulumictl" = '0.0.50'
22+
"github:pulumi/schema-tools" = "0.6.0"
23+
"aqua:gradle/gradle-distributions" = '7.6.6'
2424
golangci-lint = "1.64.8" # See note about about overrides if you need to customize this.
2525
"npm:yarn" = "1.22.22"
2626

2727
[settings]
2828
experimental = true # Required for Go binaries (e.g. pulumictl).
29-
lockfile = true
29+
lockfile = false

‎.devcontainer/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM jetpackio/devbox:latest
1+
FROM jetpackio/devbox:latest@sha256:293d6d0a33205e88550198835e68bcff65a2e33d143857ad92c6c888e6a75ad7
22

33
# Installing your devbox project
44
WORKDIR /code

‎.github/workflows/build_provider.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -39,24 +39,24 @@ jobs:
3939
id-token: write # For ESC secrets.
4040
steps:
4141
- name: Checkout Repo
42-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
42+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
4343
with:
4444
persist-credentials: false
4545
- id: esc-secrets
4646
name: Map environment to ESC outputs
4747
uses: ./.github/actions/esc-action
4848
# Without ldid cross-compiling Node binaries on a Linux worker intended to work on darwin-arm64 fails to sign the
4949
# binaries properly and they do not work as expected. See https://github.com/pulumi/pulumi-awsx/issues/1490
50-
- uses: MOZGIII/install-ldid-action@v1
50+
- uses: MOZGIII/install-ldid-action@d5ab465f3a66a4d60a59882b935eb30e18e8d043 # v1
5151
with:
5252
tag: v2.1.5-procursus2
5353
- name: Setup mise
54-
uses: jdx/mise-action@v3
54+
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
55+
env:
56+
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
5557
with:
56-
# Latest working version. See https://github.com/jdx/mise/discussions/6781
57-
version: 2025.10.16
58-
github_token: ${{ secrets.GITHUB_TOKEN }}
59-
cache_key: "mise-{{platform}}-{{file_hash}}"
58+
version: 2025.11.6
59+
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
6060
# only saving the cache in the prerequisites job
6161
cache_save: false
6262
# Based on https://github.com/actions/cache/blob/main/examples.md#go---modules
@@ -71,7 +71,7 @@ jobs:
7171
run: |
7272
echo "path=$(go env GOMODCACHE)" >> "${GITHUB_OUTPUT}"
7373
- name: Go Cache
74-
uses: actions/cache@v4
74+
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
7575
with:
7676
path: |
7777
${{ steps.gocache.outputs.path }}

‎.github/workflows/license.yml‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ env:
1616
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
1717
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
1818
PULUMI_PROVIDER_AUTOMATION_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN }}
19+
PULUMI_PULUMI_ENABLE_JOURNALING: "true"
1920
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
2021
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
2122
S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }}
@@ -26,18 +27,25 @@ jobs:
2627
license_check:
2728
name: License Check
2829
runs-on: ubuntu-latest
30+
permissions:
31+
contents: read
32+
pull-requests: write
33+
id-token: write # For ESC secrets.
2934
steps:
3035
- name: Checkout Repo
31-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
36+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
3237
with:
33-
persist-credentials: false
38+
persist-credentials: false
39+
- id: esc-secrets
40+
name: Map environment to ESC outputs
41+
uses: ./.github/actions/esc-action
3442
- name: Setup mise
35-
uses: jdx/mise-action@v3
43+
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
44+
env:
45+
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
3646
with:
37-
# Latest working version. See https://github.com/jdx/mise/discussions/6781
38-
version: 2025.10.16
39-
github_token: ${{ secrets.GITHUB_TOKEN }}
40-
cache_key: "mise-{{platform}}-{{file_hash}}"
47+
version: 2025.11.6
48+
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
4149
# only saving the cache in the prerequisites job
4250
cache_save: false
4351
- run: make prepare_local_workspace

‎.github/workflows/lint.yml‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ env:
1616
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
1717
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
1818
PULUMI_PROVIDER_AUTOMATION_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN }}
19+
PULUMI_PULUMI_ENABLE_JOURNALING: "true"
1920
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
2021
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
2122
S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }}
@@ -26,17 +27,25 @@ jobs:
2627
lint:
2728
name: lint
2829
runs-on: ubuntu-latest
30+
permissions:
31+
contents: read
32+
pull-requests: write
33+
id-token: write # For ESC secrets.
2934
steps:
3035
- name: Checkout Repo
31-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
36+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
3237
with:
33-
persist-credentials: false
38+
persist-credentials: false
39+
- id: esc-secrets
40+
name: Map environment to ESC outputs
41+
uses: ./.github/actions/esc-action
3442
- name: Setup mise
35-
uses: jdx/mise-action@v3
43+
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
44+
env:
45+
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
3646
with:
37-
# Latest working version. See https://github.com/jdx/mise/discussions/6781
38-
version: 2025.10.16
39-
github_token: ${{ secrets.GITHUB_TOKEN }}
47+
version: 2025.11.6
48+
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
4049
cache_save: false # A different job handles caching our tools.
4150
- name: disarm go:embed directives to enable lint
4251
continue-on-error: true # this fails if there are no go:embed directives

‎.github/workflows/main.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ env:
1010
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
1111
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
1212
PULUMI_PROVIDER_AUTOMATION_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN }}
13+
PULUMI_PULUMI_ENABLE_JOURNALING: "true"
1314
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
1415
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
1516
S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }}
@@ -89,7 +90,7 @@ jobs:
8990
id-token: write # For ESC secrets.
9091
steps:
9192
- name: Checkout Repo
92-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
93+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
9394
with:
9495
persist-credentials: false
9596
- id: esc-secrets

‎.github/workflows/prerelease.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ env:
1111
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
1212
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
1313
PULUMI_PROVIDER_AUTOMATION_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN }}
14+
PULUMI_PULUMI_ENABLE_JOURNALING: "true"
1415
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
1516
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
1617
S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }}
@@ -22,6 +23,7 @@ jobs:
2223
permissions:
2324
contents: read
2425
pull-requests: write
26+
id-token: write # For ESC secrets.
2527
uses: ./.github/workflows/prerequisites.yml
2628
secrets: inherit
2729
with:
@@ -30,6 +32,9 @@ jobs:
3032
is_automated: ${{ github.actor == 'dependabot[bot]' }}
3133

3234
build_provider:
35+
permissions:
36+
contents: read
37+
id-token: write # For ESC secrets.
3338
uses: ./.github/workflows/build_provider.yml
3439
needs: prerequisites
3540
secrets: inherit
@@ -51,6 +56,7 @@ jobs:
5156
name: publish
5257
permissions:
5358
contents: write
59+
pull-requests: write
5460
id-token: write
5561
needs:
5662
- prerequisites

‎.github/workflows/prerequisites.yml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ env:
2929
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
3030
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
3131
PULUMI_PROVIDER_AUTOMATION_TOKEN: ${{ secrets.PULUMI_PROVIDER_AUTOMATION_TOKEN }}
32+
PULUMI_PULUMI_ENABLE_JOURNALING: "true"
3233
RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
3334
RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
3435
S3_COVERAGE_BUCKET_NAME: ${{ secrets.S3_COVERAGE_BUCKET_NAME }}
@@ -47,28 +48,28 @@ jobs:
4748
version: ${{ steps.provider-version.outputs.version }}
4849
steps:
4950
- name: Checkout Repo
50-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
51+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
5152
with:
5253
persist-credentials: false
5354
- id: esc-secrets
5455
name: Map environment to ESC outputs
5556
uses: ./.github/actions/esc-action
56-
- uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
57+
- uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
5758
id: provider-version
5859
with:
5960
major-version: 0
6061
set-env: 'PROVIDER_VERSION'
6162
- name: Setup mise
62-
uses: jdx/mise-action@v3
63+
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
64+
env:
65+
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
6366
with:
64-
# Latest working version. See https://github.com/jdx/mise/discussions/6781
65-
version: 2025.10.16
66-
github_token: ${{ secrets.GITHUB_TOKEN }}
67-
cache_key: "mise-{{platform}}-{{file_hash}}"
67+
version: 2025.11.6
68+
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
6869
# only saving the cache in the prerequisites job
6970
cache_save: true
7071
- name: Setup Go Cache
71-
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
72+
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
7273
with:
7374
cache-dependency-path: |
7475
provider/*.sum

‎.github/workflows/publish.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -57,22 +57,22 @@ jobs:
5757
if: inputs.skipGoSdk && inputs.isPrerelease == false
5858
run: echo "Can't skip Go SDK for stable releases. This is likely a bug in the calling workflow." && exit 1
5959
- name: Checkout Repo
60-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
60+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
6161
with:
6262
persist-credentials: false
6363
- id: esc-secrets
6464
name: Map environment to ESC outputs
6565
uses: ./.github/actions/esc-action
6666
- name: Setup mise
67-
uses: jdx/mise-action@v3
67+
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
68+
env:
69+
MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
6870
with:
69-
# Latest working version. See https://github.com/jdx/mise/discussions/6781
70-
version: 2025.10.16
71-
github_token: ${{ secrets.GITHUB_TOKEN }}
72-
cache_key: "mise-{{platform}}-${{ hashFiles('mise.lock') }}"
71+
version: 2025.11.6
72+
github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
7373
cache_save: false
7474
- name: Configure AWS Credentials
75-
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
75+
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1
7676
with:
7777
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
7878
aws-region: us-east-2
@@ -96,7 +96,7 @@ jobs:
9696
- name: Upload Provider Binaries
9797
run: aws s3 cp dist s3://get.pulumi.com/releases/plugins/ --recursive
9898
- name: Create GH Release
99-
uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2
99+
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
100100
if: inputs.isPrerelease == false
101101
with:
102102
tag_name: v${{ inputs.version }}
@@ -122,7 +122,7 @@ jobs:
122122
runs-on: ubuntu-latest
123123
steps:
124124
- name: Checkout Repo
125-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
125+
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
126126
with:
127127
persist-credentials: false
128128
- id: esc-secrets

0 commit comments

Comments
 (0)