diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml index c44cc5b584..2563581b52 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -51,6 +54,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml index 3995f06956..ace2a954eb 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml @@ -9,6 +9,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: #{{ .Config | renderGlobalEnv | indent 2 }}# @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/license.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/license.yml index 14f2520357..1b4ce68757 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/license.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: #{{ .Config | renderGlobalEnv | indent 2 }}# @@ -21,6 +24,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} persist-credentials: false #{{- .Config | renderEscStep | indent 6 }}# #{{- if .Config.GitHubApp.Enabled }}# diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml index b0370f5401..1f8eb6fcb7 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: #{{ .Config | renderGlobalEnv | indent 2 }}# @@ -30,6 +33,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml index 046779f44c..32f5a85d8a 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -33,6 +37,7 @@ jobs: outputs: version: ${{ steps.provider-version.outputs.version }} steps: + #{{- if .Config.FreeDiskSpaceBeforeBuild }}# # Run as first step so we don't delete things that have just been installed - name: Free Disk Space (Ubuntu) @@ -45,10 +50,12 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# persist-credentials: false + #{{- .Config | renderEscStep | indent 4 }}# #{{- if .Config.GitHubApp.Enabled }}# - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml index 4b2a0d06e7..f9a6b2232f 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} #{{ .Config | renderGlobalEnv | indent 2 }}# # This should cancel any previous runs of the same workflow on the same branch which are still running. @@ -27,9 +27,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -42,6 +44,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -63,6 +66,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} #{{- end }}# @@ -94,6 +98,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} #{{ end -}}# sentinel: @@ -123,6 +129,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -139,9 +191,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/test.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/test.yml index 5bf95d6a92..6ebe73a332 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/test.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - #{{ .Config | renderGlobalEnv | indent 2 }}# jobs: @@ -37,7 +37,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# diff --git a/provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml b/provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml index 21eeace9e3..885eff4ba1 100644 --- a/provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml +++ b/provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: #{{ .Config | renderGlobalEnv | indent 2 }}# @@ -9,6 +16,7 @@ jobs: runs-on: #{{ .Config.Runner.Default }}# permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -23,15 +31,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: #{{ .Repository }}# token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/acme/.github/workflows/build_provider.yml b/provider-ci/test-providers/acme/.github/workflows/build_provider.yml index 065daa1460..5e747de70e 100644 --- a/provider-ci/test-providers/acme/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/acme/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/acme/.github/workflows/build_sdk.yml b/provider-ci/test-providers/acme/.github/workflows/build_sdk.yml index b06c7f3dc5..21117c9089 100644 --- a/provider-ci/test-providers/acme/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/acme/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -39,6 +42,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/acme/.github/workflows/license.yml b/provider-ci/test-providers/acme/.github/workflows/license.yml index af290445df..4926fb0c9e 100644 --- a/provider-ci/test-providers/acme/.github/workflows/license.yml +++ b/provider-ci/test-providers/acme/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -26,6 +29,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/acme/.github/workflows/lint.yml b/provider-ci/test-providers/acme/.github/workflows/lint.yml index d1fb91c3c9..6fa9d9189c 100644 --- a/provider-ci/test-providers/acme/.github/workflows/lint.yml +++ b/provider-ci/test-providers/acme/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -26,6 +29,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/acme/.github/workflows/prerequisites.yml b/provider-ci/test-providers/acme/.github/workflows/prerequisites.yml index b5567d1aab..ef918eabf4 100644 --- a/provider-ci/test-providers/acme/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/acme/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -41,6 +45,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml index 86e3ad0c51..658b5f636e 100644 --- a/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -32,9 +32,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -47,6 +49,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -67,6 +70,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -96,6 +100,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -121,6 +127,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -135,9 +187,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/acme/.github/workflows/test.yml b/provider-ci/test-providers/acme/.github/workflows/test.yml index d2794ab8a3..ee00a3eabe 100644 --- a/provider-ci/test-providers/acme/.github/workflows/test.yml +++ b/provider-ci/test-providers/acme/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -33,7 +33,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/aws-native/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/aws-native/.github/workflows/command-dispatch.yml index b590e3f8b9..cdea304c8a 100644 --- a/provider-ci/test-providers/aws-native/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/aws-native/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io @@ -11,6 +18,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -31,15 +39,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-aws-native token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/aws/.github/workflows/build_provider.yml b/provider-ci/test-providers/aws/.github/workflows/build_provider.yml index 3c76bcb1ef..eca25ad764 100644 --- a/provider-ci/test-providers/aws/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/aws/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -49,6 +52,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/aws/.github/workflows/build_sdk.yml b/provider-ci/test-providers/aws/.github/workflows/build_sdk.yml index 7f01d15bc1..f759d02ac6 100644 --- a/provider-ci/test-providers/aws/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/aws/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -48,6 +51,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/aws/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/aws/.github/workflows/command-dispatch.yml index a146d763d8..9cec9b2a75 100644 --- a/provider-ci/test-providers/aws/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/aws/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io @@ -15,6 +22,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -35,15 +43,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-aws token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/aws/.github/workflows/license.yml b/provider-ci/test-providers/aws/.github/workflows/license.yml index 730da08959..6a56955ed4 100644 --- a/provider-ci/test-providers/aws/.github/workflows/license.yml +++ b/provider-ci/test-providers/aws/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -27,6 +30,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/aws/.github/workflows/lint.yml b/provider-ci/test-providers/aws/.github/workflows/lint.yml index 6001f97a21..46bbbf87dd 100644 --- a/provider-ci/test-providers/aws/.github/workflows/lint.yml +++ b/provider-ci/test-providers/aws/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -34,6 +37,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/aws/.github/workflows/prerequisites.yml b/provider-ci/test-providers/aws/.github/workflows/prerequisites.yml index 716f5cd120..85f8f7eb77 100644 --- a/provider-ci/test-providers/aws/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/aws/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -49,6 +53,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml index d536c0a90b..f0b4781127 100644 --- a/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. @@ -33,9 +33,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -48,6 +50,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -68,6 +71,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -115,6 +119,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -129,9 +179,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/aws/.github/workflows/test.yml b/provider-ci/test-providers/aws/.github/workflows/test.yml index ef77dc9961..1d9e86cde8 100644 --- a/provider-ci/test-providers/aws/.github/workflows/test.yml +++ b/provider-ci/test-providers/aws/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. @@ -41,7 +41,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/build_provider.yml b/provider-ci/test-providers/cloudflare/.github/workflows/build_provider.yml index 016e0b11ef..3af4834cf7 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -49,6 +52,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/build_sdk.yml b/provider-ci/test-providers/cloudflare/.github/workflows/build_sdk.yml index 5e1d73ff08..66924772c2 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -46,6 +49,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/cloudflare/.github/workflows/command-dispatch.yml index ded6eb79a0..4239e8962d 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. @@ -13,6 +20,7 @@ jobs: runs-on: pulumi-ubuntu-8core permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -32,15 +40,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-cloudflare token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/license.yml b/provider-ci/test-providers/cloudflare/.github/workflows/license.yml index dc59626dd1..e83dd46099 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/license.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -25,6 +28,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/lint.yml b/provider-ci/test-providers/cloudflare/.github/workflows/lint.yml index db58bb5e70..a095c8309d 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/lint.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -32,6 +35,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/prerequisites.yml b/provider-ci/test-providers/cloudflare/.github/workflows/prerequisites.yml index fab1c1879b..48994b4a6e 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -47,6 +51,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml index cbc61a2056..379f501e98 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -31,9 +31,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -46,6 +48,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -66,6 +69,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -95,6 +99,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -120,6 +126,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -134,9 +186,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/test.yml b/provider-ci/test-providers/cloudflare/.github/workflows/test.yml index ad7b79456e..689268ad6a 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/test.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -39,7 +39,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/command/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/command/.github/workflows/command-dispatch.yml index 1dc3c75fce..8a2487e0ff 100644 --- a/provider-ci/test-providers/command/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/command/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io @@ -11,6 +18,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -30,15 +38,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-command token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/docker-build/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/docker-build/.github/workflows/command-dispatch.yml index f3c6ec542c..768c55ab46 100644 --- a/provider-ci/test-providers/docker-build/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/docker-build/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1 @@ -22,6 +29,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -41,15 +49,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-docker-build token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/docker/.github/workflows/build_provider.yml b/provider-ci/test-providers/docker/.github/workflows/build_provider.yml index e71eabd7c1..5e271e9823 100644 --- a/provider-ci/test-providers/docker/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/docker/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/docker/.github/workflows/build_sdk.yml b/provider-ci/test-providers/docker/.github/workflows/build_sdk.yml index 804c43badb..31277617de 100644 --- a/provider-ci/test-providers/docker/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/docker/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e @@ -51,6 +54,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/docker/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/docker/.github/workflows/command-dispatch.yml index d21c80078f..cbdb26e74d 100644 --- a/provider-ci/test-providers/docker/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/docker/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1 @@ -25,6 +32,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -44,15 +52,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-docker token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/docker/.github/workflows/license.yml b/provider-ci/test-providers/docker/.github/workflows/license.yml index 406418bb24..2be73298e5 100644 --- a/provider-ci/test-providers/docker/.github/workflows/license.yml +++ b/provider-ci/test-providers/docker/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e @@ -37,6 +40,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/docker/.github/workflows/lint.yml b/provider-ci/test-providers/docker/.github/workflows/lint.yml index b1d605a965..07731814f7 100644 --- a/provider-ci/test-providers/docker/.github/workflows/lint.yml +++ b/provider-ci/test-providers/docker/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e @@ -37,6 +40,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/docker/.github/workflows/prerequisites.yml b/provider-ci/test-providers/docker/.github/workflows/prerequisites.yml index aa208da040..873ebb5791 100644 --- a/provider-ci/test-providers/docker/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/docker/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -52,6 +56,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml index f7e3c5a400..a1492bafcd 100644 --- a/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1 ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7 @@ -43,9 +43,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -58,6 +60,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -78,6 +81,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -107,6 +111,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -132,6 +138,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -146,9 +198,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/docker/.github/workflows/test.yml b/provider-ci/test-providers/docker/.github/workflows/test.yml index 1615390a5f..8630b1224f 100644 --- a/provider-ci/test-providers/docker/.github/workflows/test.yml +++ b/provider-ci/test-providers/docker/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1 ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7 @@ -44,7 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/build_provider.yml b/provider-ci/test-providers/eks/.github/workflows/build_provider.yml index c194d12d0c..6f12a081d4 100644 --- a/provider-ci/test-providers/eks/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/eks/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/build_sdk.yml b/provider-ci/test-providers/eks/.github/workflows/build_sdk.yml index 22a87877e9..88f1a78397 100644 --- a/provider-ci/test-providers/eks/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/eks/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -48,6 +51,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/eks/.github/workflows/command-dispatch.yml index 3db3478d71..0e9b6ab421 100644 --- a/provider-ci/test-providers/eks/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/eks/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 DOTNET_VERSION: 6.x @@ -22,6 +29,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -41,15 +49,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-eks token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/eks/.github/workflows/license.yml b/provider-ci/test-providers/eks/.github/workflows/license.yml index fd9ea35bb7..8684804f1f 100644 --- a/provider-ci/test-providers/eks/.github/workflows/license.yml +++ b/provider-ci/test-providers/eks/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -34,6 +37,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/lint.yml b/provider-ci/test-providers/eks/.github/workflows/lint.yml index 6be0c4f34c..4b1522517c 100644 --- a/provider-ci/test-providers/eks/.github/workflows/lint.yml +++ b/provider-ci/test-providers/eks/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -34,6 +37,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/prerequisites.yml b/provider-ci/test-providers/eks/.github/workflows/prerequisites.yml index b5fbc3630e..cdb0881a65 100644 --- a/provider-ci/test-providers/eks/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/eks/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -49,6 +53,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/eks/.github/workflows/run-acceptance-tests.yml index 80a1b28f24..4920f00844 100644 --- a/provider-ci/test-providers/eks/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/eks/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} AWS_REGION: us-west-2 DOTNET_VERSION: 6.x GO_VERSION: 1.21.x @@ -40,9 +40,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -55,6 +57,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -75,6 +78,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -104,6 +108,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -129,6 +135,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -143,9 +195,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/eks/.github/workflows/test.yml b/provider-ci/test-providers/eks/.github/workflows/test.yml index a3ff689bb4..605d7debae 100644 --- a/provider-ci/test-providers/eks/.github/workflows/test.yml +++ b/provider-ci/test-providers/eks/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - AWS_REGION: us-west-2 DOTNET_VERSION: 6.x GO_VERSION: 1.21.x @@ -41,7 +41,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/kubernetes-cert-manager/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/kubernetes-cert-manager/.github/workflows/command-dispatch.yml index 8c762437a9..3dd637c904 100644 --- a/provider-ci/test-providers/kubernetes-cert-manager/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/kubernetes-cert-manager/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 GOLANGCI_LINT_VERSION: v1.61.0 @@ -16,6 +23,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -35,15 +43,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-kubernetes-cert-manager token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/kubernetes-coredns/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/kubernetes-coredns/.github/workflows/command-dispatch.yml index 6ef44dfe4d..8cf63bd4ac 100644 --- a/provider-ci/test-providers/kubernetes-coredns/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/kubernetes-coredns/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 GOLANGCI_LINT_VERSION: v1.61.0 @@ -16,6 +23,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -35,15 +43,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-kubernetes-coredns token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/kubernetes-ingress-nginx/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/kubernetes-ingress-nginx/.github/workflows/command-dispatch.yml index 9a30a127d3..07472d3ecb 100644 --- a/provider-ci/test-providers/kubernetes-ingress-nginx/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/kubernetes-ingress-nginx/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 GOLANGCI_LINT_VERSION: v1.61.0 @@ -16,6 +23,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -35,15 +43,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-kubernetes-ingress-nginx token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/kubernetes/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/kubernetes/.github/workflows/command-dispatch.yml index 1f3991c051..99d6a5cfef 100644 --- a/provider-ci/test-providers/kubernetes/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/kubernetes/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 GOLANGCI_LINT_VERSION: v1.64.8 @@ -17,6 +24,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -36,15 +44,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-kubernetes token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/pulumi-provider-boilerplate/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/pulumi-provider-boilerplate/.github/workflows/command-dispatch.yml index c725216bd1..03dbca29dc 100644 --- a/provider-ci/test-providers/pulumi-provider-boilerplate/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/pulumi-provider-boilerplate/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: FOO: BAR PULUMI_PULUMI_ENABLE_JOURNALING: "true" @@ -10,6 +17,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -29,15 +37,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-provider-boilerplate token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/build_provider.yml b/provider-ci/test-providers/terraform-module/.github/workflows/build_provider.yml index fce18e171e..f68e4fada1 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/license.yml b/provider-ci/test-providers/terraform-module/.github/workflows/license.yml index f922f9e862..cb96d6c95d 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/license.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} @@ -35,6 +38,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/lint.yml b/provider-ci/test-providers/terraform-module/.github/workflows/lint.yml index 54da803489..b6a4e887e6 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/lint.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} @@ -35,6 +38,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/prerequisites.yml b/provider-ci/test-providers/terraform-module/.github/workflows/prerequisites.yml index 62aa15c34a..7d5a63dbc4 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -50,6 +54,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/terraform-module/.github/workflows/run-acceptance-tests.yml index 7a8b2e2a08..e74bca5c5b 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} AWS_REGION: us-west-2 @@ -41,9 +41,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -56,6 +58,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -94,6 +97,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -119,6 +124,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -132,9 +183,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/test.yml b/provider-ci/test-providers/terraform-module/.github/workflows/test.yml index 5e2acd5585..89283ea31c 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/test.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} AWS_REGION: us-west-2 @@ -42,7 +42,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/xyz/.github/workflows/build_provider.yml b/provider-ci/test-providers/xyz/.github/workflows/build_provider.yml index 916e2e957b..a21ba0a35f 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/build_sdk.yml b/provider-ci/test-providers/xyz/.github/workflows/build_sdk.yml index b2a6a33453..f0c380bb6d 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/xyz/.github/workflows/command-dispatch.yml index 10594c970a..d791bb54bc 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. @@ -15,6 +22,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -34,15 +42,8 @@ jobs: with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-xyz token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/xyz/.github/workflows/license.yml b/provider-ci/test-providers/xyz/.github/workflows/license.yml index 877db518b9..f47f743f3e 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/license.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -27,6 +30,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/lint.yml b/provider-ci/test-providers/xyz/.github/workflows/lint.yml index 564cef4148..0d7a72bed2 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/lint.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -27,6 +30,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/prerequisites.yml b/provider-ci/test-providers/xyz/.github/workflows/prerequisites.yml index 033c80c4fe..2fa32e31c5 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -42,6 +46,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/xyz/.github/workflows/run-acceptance-tests.yml index b9ba6e0c12..df2daaa218 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -33,9 +33,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -48,6 +50,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -68,6 +71,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -97,6 +101,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -122,6 +128,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -136,9 +188,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/test.yml b/provider-ci/test-providers/xyz/.github/workflows/test.yml index e1125b9620..861612c9bb 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/test.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -34,7 +34,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}