pulumi-tf-provider-boilerplate/.github/workflows/main.yml at 85aac536034afb1b8a5cca2eef25852c2f45ab81 · pulumi/pulumi-tf-provider-boilerplate · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt

env:
  PULUMI_API: https://api.pulumi-staging.io
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
  PULUMI_PULUMI_ENABLE_JOURNALING: "true"
  TF_APPEND_USER_AGENT: pulumi

jobs:
  prerequisites:
    permissions:
      contents: read
      pull-requests: write
      id-token: write # For ESC secrets.
    uses: ./.github/workflows/prerequisites.yml
    secrets: inherit
    with:
      default_branch: ${{ github.event.repository.default_branch }}
      is_pr: ${{ github.event_name == 'pull_request' }}
      is_automated: ${{ github.actor == 'dependabot[bot]' }}

  build_provider:
    uses: ./.github/workflows/build_provider.yml
    needs: prerequisites
    secrets: inherit
    permissions:
      contents: read
      id-token: write # For ESC secrets.
    with:
      version: ${{ needs.prerequisites.outputs.version }}

  build_sdk:
    name: build_sdk
    needs: prerequisites
    uses: ./.github/workflows/build_sdk.yml
    secrets: inherit
    permissions:
      contents: write # For Renovate SDKs.
      id-token: write # For ESC secrets.
    with:
      version: ${{ needs.prerequisites.outputs.version }}

  post_build:
    name: post_build
    needs: prerequisites
    uses: ./.github/workflows/main-post-build.yml
    secrets: inherit
    permissions:
      contents: write # For Renovate SDKs.
      id-token: write # For ESC secrets.
    with:
      version: ${{ needs.prerequisites.outputs.version }}

  lint:
    name: lint
    uses: ./.github/workflows/lint.yml
    secrets: inherit
  license_check:
    name: License Check
    uses: ./.github/workflows/license.yml
    secrets: inherit

  publish:
    name: publish
    permissions:
      contents: write
      id-token: write
    needs:
      - prerequisites
      - build_provider
      - test
      - license_check
    uses: ./.github/workflows/publish.yml
    secrets: inherit
    with:
      version: ${{ needs.prerequisites.outputs.version }}
      isPrerelease: true
      setLatestRelease: false
      skipGoSdk: true
      skipJavaSdk: true

  tag_release_if_labeled_needs_release:
    name: Tag release if labeled as needs-release
    needs: publish
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write # For ESC secrets.
    steps:
    - name: Checkout Repo
      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      with:
        persist-credentials: false
    - env:
        ESC_ACTION_ENVIRONMENT: imports/github-secrets
        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
        ESC_ACTION_OIDC_AUTH: "true"
        ESC_ACTION_OIDC_ORGANIZATION: pulumi
        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
      id: esc-secrets
      name: Fetch secrets from ESC
      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
    - name: check if this commit needs release
      if: ${{ env.RELEASE_BOT_ENDPOINT != '' }}
      uses: pulumi/action-release-by-pr-label@main
      with:
        command: "release-if-needed"
        repo: ${{ github.repository }}
        commit: ${{ github.sha }}
        slack_channel: C02MGR8JVST
      env:
        RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }}
        RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }}
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  test:
    uses: ./.github/workflows/test.yml
    needs:
      - prerequisites
      - build_provider
      - build_sdk
    permissions:
      contents: read
      id-token: write
    secrets: inherit
    with:
      version: ${{ needs.prerequisites.outputs.version }}

name: main
on:
  workflow_dispatch: {}
  push:
    branches:
    - main
    paths-ignore:
    - "**.md"
    tags-ignore:
    - v*
    - sdk/*
    - "**"