Renovate postUpgradeTasks fail on untrusted mise config, leaving generated artifacts stale

[eon-pulumi-agent]

Summary

Provider repos that use mise + Renovate postUpgradeTasks (e.g. make renovate → make generate_sdks) to regenerate checked-in artifacts after a dependency bump are silently failing that hook because mise refuses to load the generated .config/mise.toml (it is not in mise's trust store in Renovate's runner). Renovate then posts an "Artifact update problem" warning and opens the PR anyway with stale generated artifacts, which breaks the provider build in CI.

This has recurred multiple times on pulumi/pulumi-awsx for @pulumi/aws bumps.

Symptom

On the Renovate PR, the renovate/artifacts check fails with:

mise ERROR error parsing config file: .../.config/mise.toml
mise ERROR Config files in .../.config/mise.toml are not trusted.
make[1]: *** [Makefile:76: mise_env] Error 1
make: *** [Makefile:339: renovate] Error 2

Because make generate_sdks depends on the mise_env / .make/mise_install targets, the whole postUpgradeTasks command aborts before regenerating anything. The PR is opened with the dependency bumped in package.json but the checked-in schema/SDK artifacts left pinned to the old version.

Downstream impact

In pulumi-awsx, provider/cmd/pulumi-resource-awsx/schema.json keeps referencing the old @pulumi/aws type version (e.g. /aws/v7.34.0/). During the provider build, yarn --cwd awsx gen-types cannot resolve those refs against the newly installed package, falls back to unknown types, and the provider TypeScript build fails with a wall of Object is of type 'unknown' / Property ... does not exist on type 'never' errors. The failure is opaque — nothing points the PR assignee at "regenerate the artifacts."

Concrete example: the build_provider / Build windows-amd64 job on the @pulumi/aws v7.38.0 bump PR failed for exactly this reason, and the fix was to manually run make generate and commit the regenerated schema.json + SDK metadata. The same class of failure happened on earlier AWS bumps (pulumi-awsx #1842 → #1919).

Root cause

The mechanism to prevent this already exists — renovate.json5 runs make renovate as a postUpgradeTasks hook for the relevant datasources. It fails only because mise does not trust the ci-mgmt-generated .config/mise.toml in Renovate'''s execution environment. .config/mise.toml, the Makefile mise_* targets, and the renovate wiring are all generated by ci-mgmt, so the fix belongs here rather than in individual provider repos.

Suggested fixes (in ci-mgmt)

1. Trust the mise config before running the hook. Ensure mise trust runs against the generated .config/mise.toml in the Renovate runner (e.g. mise trust --yes, or set MISE_TRUSTED_CONFIG_PATHS / MISE_YES=1) before make generate_sdks executes. This is the direct cause of the abort.

2. Make the generated renovate hook mise-trust aware. The renovate command template (surfaced in provider repos as scripts/renovate.sh via renovateCmd) could mise trust the config first so the hook works regardless of whether the runner has pre-trusted it.

3. Add a stale-artifacts CI guard. A generated check that runs make generate (or at least schema + gen-types) and git diff --exit-code on the committed schema/SDK outputs, failing with a clear "artifacts out of date — run make generate" message. Today the staleness only surfaces as an opaque type-check failure in the provider build; a dedicated check would make the required action obvious even when the Renovate hook fails.

Fixes 1/2 stop the artifacts from going stale in the first place; fix 3 is a backstop that turns any future silent hook failure into an actionable, self-explanatory CI error.

[corymhall]

@pulumi-eon can you work on a PR using the first suggested fix

[eon-pulumi]

Done

I opened PR #2414 implementing the first suggested fix from the issue.

What I changed: In the generated Makefile templates (base/Makefile for bridged providers, parameterized-go/Makefile), the mise_env and .make/mise_install targets now run mise trust --yes -q immediately before mise env -q / mise install -q. These two targets sit on the critical path for essentially every mise-dependent make target (build, generate_*, schema, renovate via generate_sdks, etc.), so this fixes the abort regardless of which target runs first in a given invocation. mise trust is a no-op when the config is already trusted, so it has no effect on normal CI (which uses the jdx/mise-action GitHub Action and already trusts the config) — it only helps in untrusted environments like Renovate's postUpgradeTasks runner.

Validation: cd provider-ci && make all regenerated all 15 test providers deterministically and passed actionlint/golangci-lint; make test-go passes. Only the intended files changed — the two edited templates plus the generated Makefiles for the bridged/parameterized-go test providers (aws, cloudflare, docker, eks, pulumiservice, terraform-module, xyz).

Note: this PR only covers suggested fix 1 (trust before running). Fixes 2 (mise-trust-aware renovate.sh) and 3 (a stale-artifacts CI guard) from the issue are left as potential follow-ups. If you'd like a review verdict on the PR, run /review on it — I didn't submit an approval since this session is scoped to issue work.

Created:

• PR #2414

---

View session