From 18a7ea5d85c955756d5e0e8b38b5dd3c9bf3dfb1 Mon Sep 17 00:00:00 2001 From: Bryce Lampe Date: Wed, 15 Oct 2025 13:54:54 -0700 Subject: [PATCH] Fix `/run-acceptance-tests` for bridged providers --- .../base/.github/workflows/build_provider.yml | 4 ++ .../base/.github/workflows/build_sdk.yml | 4 ++ .../base/.github/workflows/license.yml | 6 +- .../templates/base/.github/workflows/lint.yml | 6 +- .../base/.github/workflows/prerequisites.yml | 7 +++ .../workflows/run-acceptance-tests.yml | 57 ++++++++++++++++++- .../templates/base/.github/workflows/test.yml | 8 +-- .../.github/workflows/command-dispatch.yml | 16 +++--- .../acme/.github/workflows/build_provider.yml | 4 ++ .../acme/.github/workflows/build_sdk.yml | 4 ++ .../acme/.github/workflows/license.yml | 6 +- .../acme/.github/workflows/lint.yml | 6 +- .../acme/.github/workflows/prerequisites.yml | 5 ++ .../workflows/run-acceptance-tests.yml | 57 ++++++++++++++++++- .../acme/.github/workflows/test.yml | 8 +-- .../.github/workflows/command-dispatch.yml | 16 +++--- .../aws/.github/workflows/build_provider.yml | 4 ++ .../aws/.github/workflows/build_sdk.yml | 4 ++ .../.github/workflows/command-dispatch.yml | 16 +++--- .../aws/.github/workflows/license.yml | 6 +- .../aws/.github/workflows/lint.yml | 6 +- .../aws/.github/workflows/prerequisites.yml | 5 ++ .../workflows/run-acceptance-tests.yml | 55 +++++++++++++++++- .../aws/.github/workflows/test.yml | 8 +-- .../.github/workflows/build_provider.yml | 4 ++ .../.github/workflows/build_sdk.yml | 4 ++ .../.github/workflows/command-dispatch.yml | 16 +++--- .../cloudflare/.github/workflows/license.yml | 6 +- .../cloudflare/.github/workflows/lint.yml | 6 +- .../.github/workflows/prerequisites.yml | 5 ++ .../workflows/run-acceptance-tests.yml | 57 ++++++++++++++++++- .../cloudflare/.github/workflows/test.yml | 8 +-- .../.github/workflows/command-dispatch.yml | 16 +++--- .../.github/workflows/command-dispatch.yml | 16 +++--- .../.github/workflows/build_provider.yml | 4 ++ .../docker/.github/workflows/build_sdk.yml | 4 ++ .../.github/workflows/command-dispatch.yml | 16 +++--- .../docker/.github/workflows/license.yml | 6 +- .../docker/.github/workflows/lint.yml | 6 +- .../.github/workflows/prerequisites.yml | 5 ++ .../workflows/run-acceptance-tests.yml | 57 ++++++++++++++++++- .../docker/.github/workflows/test.yml | 8 +-- .../eks/.github/workflows/build_provider.yml | 4 ++ .../eks/.github/workflows/build_sdk.yml | 4 ++ .../.github/workflows/command-dispatch.yml | 16 +++--- .../eks/.github/workflows/license.yml | 6 +- .../eks/.github/workflows/lint.yml | 6 +- .../eks/.github/workflows/prerequisites.yml | 5 ++ .../workflows/run-acceptance-tests.yml | 57 ++++++++++++++++++- .../eks/.github/workflows/test.yml | 8 +-- .../.github/workflows/command-dispatch.yml | 16 +++--- .../.github/workflows/command-dispatch.yml | 16 +++--- .../.github/workflows/command-dispatch.yml | 16 +++--- .../.github/workflows/command-dispatch.yml | 16 +++--- .../.github/workflows/command-dispatch.yml | 16 +++--- .../.github/workflows/build_provider.yml | 4 ++ .../.github/workflows/license.yml | 6 +- .../.github/workflows/lint.yml | 6 +- .../.github/workflows/prerequisites.yml | 5 ++ .../workflows/run-acceptance-tests.yml | 56 +++++++++++++++++- .../.github/workflows/test.yml | 8 +-- .../xyz/.github/workflows/build_provider.yml | 4 ++ .../xyz/.github/workflows/build_sdk.yml | 4 ++ .../.github/workflows/command-dispatch.yml | 16 +++--- .../xyz/.github/workflows/license.yml | 6 +- .../xyz/.github/workflows/lint.yml | 6 +- .../xyz/.github/workflows/prerequisites.yml | 5 ++ .../workflows/run-acceptance-tests.yml | 57 ++++++++++++++++++- .../xyz/.github/workflows/test.yml | 8 +-- 69 files changed, 785 insertions(+), 154 deletions(-) diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml index c724887a98..b4f26eaef8 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -51,6 +54,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml index c7484f959f..9b08498de1 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml @@ -9,6 +9,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: #{{ .Config | renderGlobalEnv | indent 2 }}# @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/license.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/license.yml index 3ae5c8e72e..ea7920f93f 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/license.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: #{{ .Config | renderGlobalEnv | indent 2 }}# @@ -17,6 +20,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml index 4268976910..80e49e0ea0 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: #{{ .Config | renderGlobalEnv | indent 2 }}# @@ -17,6 +20,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml index 3b5b93e0a5..bf04f779ee 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -33,6 +37,7 @@ jobs: outputs: version: ${{ steps.provider-version.outputs.version }} steps: + #{{- if .Config.FreeDiskSpaceBeforeBuild }}# # Run as first step so we don't delete things that have just been installed - name: Free Disk Space (Ubuntu) @@ -45,10 +50,12 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# persist-credentials: false + #{{- .Config | renderEscStep | indent 4 }}# - uses: #{{ .Config.ActionVersions.ProviderVersionAction }}# id: provider-version diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml index 3ea151baea..cb8be681fc 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} #{{ .Config | renderGlobalEnv | indent 2 }}# # This should cancel any previous runs of the same workflow on the same branch which are still running. @@ -27,9 +27,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -42,6 +44,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -63,6 +66,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} #{{- end }}# @@ -94,6 +98,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} #{{ end -}}# sentinel: @@ -123,6 +129,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -139,9 +191,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/internal/pkg/templates/base/.github/workflows/test.yml b/provider-ci/internal/pkg/templates/base/.github/workflows/test.yml index 0010a5e800..44161ddfcf 100644 --- a/provider-ci/internal/pkg/templates/base/.github/workflows/test.yml +++ b/provider-ci/internal/pkg/templates/base/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - #{{ .Config | renderGlobalEnv | indent 2 }}# jobs: @@ -37,7 +37,7 @@ jobs: - name: Checkout Repo uses: #{{ .Config.ActionVersions.Checkout }}# with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} #{{- if .Config.CheckoutSubmodules }}# submodules: #{{ .Config.CheckoutSubmodules }}# #{{- end }}# diff --git a/provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml b/provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml index f451f57ec7..ba7decc66d 100644 --- a/provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml +++ b/provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: #{{ .Config | renderGlobalEnv | indent 2 }}# @@ -9,6 +16,7 @@ jobs: runs-on: #{{ .Config.Runner.Default }}# permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -19,19 +27,13 @@ jobs: #{{- end }}# persist-credentials: false #{{- .Config | renderEscStep | indent 4 }}# + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: #{{ .Repository }}# token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/acme/.github/workflows/build_provider.yml b/provider-ci/test-providers/acme/.github/workflows/build_provider.yml index dde46894f5..835cdb8083 100644 --- a/provider-ci/test-providers/acme/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/acme/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/acme/.github/workflows/build_sdk.yml b/provider-ci/test-providers/acme/.github/workflows/build_sdk.yml index 547186274d..08b5a8ec01 100644 --- a/provider-ci/test-providers/acme/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/acme/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -38,6 +41,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/acme/.github/workflows/license.yml b/provider-ci/test-providers/acme/.github/workflows/license.yml index bba9853e90..3f6cb51f98 100644 --- a/provider-ci/test-providers/acme/.github/workflows/license.yml +++ b/provider-ci/test-providers/acme/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -21,6 +24,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/acme/.github/workflows/lint.yml b/provider-ci/test-providers/acme/.github/workflows/lint.yml index 57395eab8a..e7b004707a 100644 --- a/provider-ci/test-providers/acme/.github/workflows/lint.yml +++ b/provider-ci/test-providers/acme/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -21,6 +24,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/acme/.github/workflows/prerequisites.yml b/provider-ci/test-providers/acme/.github/workflows/prerequisites.yml index 57e677335b..010fc581b8 100644 --- a/provider-ci/test-providers/acme/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/acme/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -40,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml index 669bc194c9..fe8e6478f9 100644 --- a/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/acme/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -31,9 +31,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -46,6 +48,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -66,6 +69,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -95,6 +99,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -120,6 +126,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -134,9 +186,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/acme/.github/workflows/test.yml b/provider-ci/test-providers/acme/.github/workflows/test.yml index ee42b98040..a8db2bd149 100644 --- a/provider-ci/test-providers/acme/.github/workflows/test.yml +++ b/provider-ci/test-providers/acme/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -32,7 +32,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/aws-native/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/aws-native/.github/workflows/command-dispatch.yml index 550049d702..abd3896fa0 100644 --- a/provider-ci/test-providers/aws-native/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/aws-native/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io @@ -10,6 +17,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -26,19 +34,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-aws-native token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/aws/.github/workflows/build_provider.yml b/provider-ci/test-providers/aws/.github/workflows/build_provider.yml index c325f97c88..75261b0a43 100644 --- a/provider-ci/test-providers/aws/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/aws/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -49,6 +52,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/aws/.github/workflows/build_sdk.yml b/provider-ci/test-providers/aws/.github/workflows/build_sdk.yml index 6ea98fe33f..0c6ebe0118 100644 --- a/provider-ci/test-providers/aws/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/aws/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -47,6 +50,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/aws/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/aws/.github/workflows/command-dispatch.yml index f69497aaab..f7e64c4391 100644 --- a/provider-ci/test-providers/aws/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/aws/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io @@ -14,6 +21,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -30,19 +38,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-aws token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/aws/.github/workflows/license.yml b/provider-ci/test-providers/aws/.github/workflows/license.yml index 42ad3b57d9..f03217cbb6 100644 --- a/provider-ci/test-providers/aws/.github/workflows/license.yml +++ b/provider-ci/test-providers/aws/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -22,6 +25,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/aws/.github/workflows/lint.yml b/provider-ci/test-providers/aws/.github/workflows/lint.yml index a4f90cfde7..3428452644 100644 --- a/provider-ci/test-providers/aws/.github/workflows/lint.yml +++ b/provider-ci/test-providers/aws/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -22,6 +25,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - name: Setup mise diff --git a/provider-ci/test-providers/aws/.github/workflows/prerequisites.yml b/provider-ci/test-providers/aws/.github/workflows/prerequisites.yml index 3b668f7b5f..20c8f96ca8 100644 --- a/provider-ci/test-providers/aws/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/aws/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -48,6 +52,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml index 8c3b28158a..aeb3183dab 100644 --- a/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/aws/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. @@ -32,9 +32,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -47,6 +49,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -67,6 +70,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -114,6 +118,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -128,9 +178,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/aws/.github/workflows/test.yml b/provider-ci/test-providers/aws/.github/workflows/test.yml index 46e9ff7dc9..094de40792 100644 --- a/provider-ci/test-providers/aws/.github/workflows/test.yml +++ b/provider-ci/test-providers/aws/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. @@ -40,7 +40,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} submodules: true persist-credentials: false - env: diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/build_provider.yml b/provider-ci/test-providers/cloudflare/.github/workflows/build_provider.yml index 36580dad2c..9af4fafb3b 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -49,6 +52,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/build_sdk.yml b/provider-ci/test-providers/cloudflare/.github/workflows/build_sdk.yml index 92afa0c122..1007060b62 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -45,6 +48,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/cloudflare/.github/workflows/command-dispatch.yml index 4b78c652c7..fe5c42fdf2 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. @@ -12,6 +19,7 @@ jobs: runs-on: pulumi-ubuntu-8core permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -27,19 +35,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-cloudflare token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/license.yml b/provider-ci/test-providers/cloudflare/.github/workflows/license.yml index 9b2976142c..6596833da8 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/license.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -20,6 +23,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/lint.yml b/provider-ci/test-providers/cloudflare/.github/workflows/lint.yml index ea267ba594..89dbc1101d 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/lint.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -20,6 +23,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/prerequisites.yml b/provider-ci/test-providers/cloudflare/.github/workflows/prerequisites.yml index e0e426ec7c..001ad98886 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -46,6 +50,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml index a30b3b211c..3d8e3499e7 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -30,9 +30,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -45,6 +47,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -65,6 +68,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -94,6 +98,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -119,6 +125,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -133,9 +185,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/cloudflare/.github/workflows/test.yml b/provider-ci/test-providers/cloudflare/.github/workflows/test.yml index 648312f933..f5409aaf0e 100644 --- a/provider-ci/test-providers/cloudflare/.github/workflows/test.yml +++ b/provider-ci/test-providers/cloudflare/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -38,7 +38,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/command/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/command/.github/workflows/command-dispatch.yml index 88e21e929a..543244597f 100644 --- a/provider-ci/test-providers/command/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/command/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 PULUMI_API: https://api.pulumi-staging.io @@ -10,6 +17,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -25,19 +33,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-command token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/docker-build/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/docker-build/.github/workflows/command-dispatch.yml index b317d246d6..3afdf57967 100644 --- a/provider-ci/test-providers/docker-build/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/docker-build/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1 @@ -21,6 +28,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -36,19 +44,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-docker-build token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/docker/.github/workflows/build_provider.yml b/provider-ci/test-providers/docker/.github/workflows/build_provider.yml index d71230065c..ac5a4dc149 100644 --- a/provider-ci/test-providers/docker/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/docker/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/docker/.github/workflows/build_sdk.yml b/provider-ci/test-providers/docker/.github/workflows/build_sdk.yml index 1f6b2fca2b..68f896414a 100644 --- a/provider-ci/test-providers/docker/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/docker/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e @@ -50,6 +53,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/docker/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/docker/.github/workflows/command-dispatch.yml index 8f8856313d..219f43c3ed 100644 --- a/provider-ci/test-providers/docker/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/docker/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1 @@ -24,6 +31,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -39,19 +47,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-docker token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/docker/.github/workflows/license.yml b/provider-ci/test-providers/docker/.github/workflows/license.yml index 6289642809..1253a4273d 100644 --- a/provider-ci/test-providers/docker/.github/workflows/license.yml +++ b/provider-ci/test-providers/docker/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e @@ -32,6 +35,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/docker/.github/workflows/lint.yml b/provider-ci/test-providers/docker/.github/workflows/lint.yml index 0085d0c194..e3dc78f68b 100644 --- a/provider-ci/test-providers/docker/.github/workflows/lint.yml +++ b/provider-ci/test-providers/docker/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e @@ -32,6 +35,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/docker/.github/workflows/prerequisites.yml b/provider-ci/test-providers/docker/.github/workflows/prerequisites.yml index 07ba48dba4..f26c2f738a 100644 --- a/provider-ci/test-providers/docker/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/docker/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -51,6 +55,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml index a611ddd3bd..3f15e60c4f 100644 --- a/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/docker/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1 ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7 @@ -42,9 +42,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -57,6 +59,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -77,6 +80,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -106,6 +110,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -131,6 +137,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -145,9 +197,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/docker/.github/workflows/test.yml b/provider-ci/test-providers/docker/.github/workflows/test.yml index ba85b71b29..7fd51d0f3f 100644 --- a/provider-ci/test-providers/docker/.github/workflows/test.yml +++ b/provider-ci/test-providers/docker/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1 ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7 @@ -43,7 +43,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/build_provider.yml b/provider-ci/test-providers/eks/.github/workflows/build_provider.yml index 05316e5097..f7707be44f 100644 --- a/provider-ci/test-providers/eks/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/eks/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/build_sdk.yml b/provider-ci/test-providers/eks/.github/workflows/build_sdk.yml index ac805f1e34..aa8a8fce2a 100644 --- a/provider-ci/test-providers/eks/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/eks/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -47,6 +50,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/eks/.github/workflows/command-dispatch.yml index 191565ebc8..634da0b41f 100644 --- a/provider-ci/test-providers/eks/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/eks/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 DOTNET_VERSION: 6.x @@ -21,6 +28,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -36,19 +44,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-eks token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/eks/.github/workflows/license.yml b/provider-ci/test-providers/eks/.github/workflows/license.yml index 96a251d07e..58dd52892d 100644 --- a/provider-ci/test-providers/eks/.github/workflows/license.yml +++ b/provider-ci/test-providers/eks/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -29,6 +32,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/eks/.github/workflows/lint.yml b/provider-ci/test-providers/eks/.github/workflows/lint.yml index 86444a294f..efbd3d958f 100644 --- a/provider-ci/test-providers/eks/.github/workflows/lint.yml +++ b/provider-ci/test-providers/eks/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_REGION: us-west-2 @@ -29,6 +32,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/eks/.github/workflows/prerequisites.yml b/provider-ci/test-providers/eks/.github/workflows/prerequisites.yml index 9f7e6e05cd..3311e55030 100644 --- a/provider-ci/test-providers/eks/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/eks/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -48,6 +52,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/eks/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/eks/.github/workflows/run-acceptance-tests.yml index ba5e5dc4c9..4c9e0b74f8 100644 --- a/provider-ci/test-providers/eks/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/eks/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} AWS_REGION: us-west-2 DOTNET_VERSION: 6.x GO_VERSION: 1.21.x @@ -39,9 +39,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -54,6 +56,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -74,6 +77,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -103,6 +107,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -128,6 +134,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -142,9 +194,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/eks/.github/workflows/test.yml b/provider-ci/test-providers/eks/.github/workflows/test.yml index 689f14a7bd..4648559136 100644 --- a/provider-ci/test-providers/eks/.github/workflows/test.yml +++ b/provider-ci/test-providers/eks/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - AWS_REGION: us-west-2 DOTNET_VERSION: 6.x GO_VERSION: 1.21.x @@ -40,7 +40,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/kubernetes-cert-manager/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/kubernetes-cert-manager/.github/workflows/command-dispatch.yml index 2a885562d9..30c2dd262c 100644 --- a/provider-ci/test-providers/kubernetes-cert-manager/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/kubernetes-cert-manager/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 GOLANGCI_LINT_VERSION: v1.61.0 @@ -15,6 +22,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -30,19 +38,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-kubernetes-cert-manager token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/kubernetes-coredns/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/kubernetes-coredns/.github/workflows/command-dispatch.yml index 8a0613136b..c8a53ff68c 100644 --- a/provider-ci/test-providers/kubernetes-coredns/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/kubernetes-coredns/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 GOLANGCI_LINT_VERSION: v1.61.0 @@ -15,6 +22,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -30,19 +38,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-kubernetes-coredns token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/kubernetes-ingress-nginx/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/kubernetes-ingress-nginx/.github/workflows/command-dispatch.yml index 4bccd7a913..de2674e15b 100644 --- a/provider-ci/test-providers/kubernetes-ingress-nginx/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/kubernetes-ingress-nginx/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 GOLANGCI_LINT_VERSION: v1.61.0 @@ -15,6 +22,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -30,19 +38,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-kubernetes-ingress-nginx token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/kubernetes/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/kubernetes/.github/workflows/command-dispatch.yml index 848739af57..1fde58f800 100644 --- a/provider-ci/test-providers/kubernetes/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/kubernetes/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: AWS_REGION: us-west-2 GOLANGCI_LINT_VERSION: v1.64.8 @@ -16,6 +23,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -31,19 +39,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-kubernetes token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/pulumi-provider-boilerplate/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/pulumi-provider-boilerplate/.github/workflows/command-dispatch.yml index 0da4141981..b24dcda3e6 100644 --- a/provider-ci/test-providers/pulumi-provider-boilerplate/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/pulumi-provider-boilerplate/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: FOO: BAR @@ -9,6 +16,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -24,19 +32,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-provider-boilerplate token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/build_provider.yml b/provider-ci/test-providers/terraform-module/.github/workflows/build_provider.yml index e03fa8b95a..84a8235df8 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/license.yml b/provider-ci/test-providers/terraform-module/.github/workflows/license.yml index 1679c3d91b..eb5e78b70f 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/license.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} @@ -30,6 +33,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/lint.yml b/provider-ci/test-providers/terraform-module/.github/workflows/lint.yml index 581c40f4eb..0dbc9d8111 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/lint.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} @@ -30,6 +33,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/prerequisites.yml b/provider-ci/test-providers/terraform-module/.github/workflows/prerequisites.yml index 647c2d6b95..37506c3a26 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -49,6 +53,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/terraform-module/.github/workflows/run-acceptance-tests.yml index e91c56577a..512293470e 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} AWS_REGION: us-west-2 @@ -40,9 +40,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -55,6 +57,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -93,6 +96,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -118,6 +123,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -131,9 +182,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/terraform-module/.github/workflows/test.yml b/provider-ci/test-providers/terraform-module/.github/workflows/test.yml index 991f4a65ca..d95c9c68ab 100644 --- a/provider-ci/test-providers/terraform-module/.github/workflows/test.yml +++ b/provider-ci/test-providers/terraform-module/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }} AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }} AWS_REGION: us-west-2 @@ -41,7 +41,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - id: esc-secrets name: Map environment to ESC outputs diff --git a/provider-ci/test-providers/xyz/.github/workflows/build_provider.yml b/provider-ci/test-providers/xyz/.github/workflows/build_provider.yml index 5b7206f588..9133d1564d 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/build_provider.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/build_provider.yml @@ -9,6 +9,9 @@ on: required: true type: string description: Version of the provider to build + sha: + type: string + description: The commit to build, primarily for community PRs. matrix: required: false type: string @@ -41,6 +44,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/build_sdk.yml b/provider-ci/test-providers/xyz/.github/workflows/build_sdk.yml index bb06818121..c040cca4e0 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/build_sdk.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/build_sdk.yml @@ -8,6 +8,9 @@ on: version: required: true type: string + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -40,6 +43,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/command-dispatch.yml b/provider-ci/test-providers/xyz/.github/workflows/command-dispatch.yml index 04d2fe98bb..772533d346 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/command-dispatch.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/command-dispatch.yml @@ -1,5 +1,12 @@ # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt +name: command-dispatch +on: + issue_comment: + types: + - created + - edited + env: PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. @@ -14,6 +21,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read + pull-requests: write # For comment reactions. id-token: write # For ESC secrets. steps: - name: Checkout Repo @@ -29,19 +37,13 @@ jobs: id: esc-secrets name: Fetch secrets from ESC uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b + - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4 with: commands: | run-acceptance-tests - release issue-type: pull-request permission: write reaction-token: ${{ secrets.GITHUB_TOKEN }} repository: pulumi/pulumi-xyz token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }} -name: command-dispatch -on: - issue_comment: - types: - - created - - edited diff --git a/provider-ci/test-providers/xyz/.github/workflows/license.yml b/provider-ci/test-providers/xyz/.github/workflows/license.yml index ae8a9149bc..476fca8843 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/license.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/license.yml @@ -4,7 +4,10 @@ name: license_check on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -22,6 +25,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/xyz/.github/workflows/lint.yml b/provider-ci/test-providers/xyz/.github/workflows/lint.yml index 3db25ec1fb..19bdba5721 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/lint.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/lint.yml @@ -4,7 +4,10 @@ name: lint on: workflow_call: - inputs: {} + inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. env: PULUMI_API: https://api.pulumi-staging.io @@ -22,6 +25,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - name: Setup mise uses: jdx/mise-action@v3 diff --git a/provider-ci/test-providers/xyz/.github/workflows/prerequisites.yml b/provider-ci/test-providers/xyz/.github/workflows/prerequisites.yml index 1d193a1e1e..7a0b2d5ea3 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/prerequisites.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/prerequisites.yml @@ -14,6 +14,10 @@ on: default_branch: type: string required: true + sha: + type: string + required: false + description: The commit to build, primarily for community PRs. outputs: version: description: "Provider version being built" @@ -41,6 +45,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/run-acceptance-tests.yml b/provider-ci/test-providers/xyz/.github/workflows/run-acceptance-tests.yml index 03885d88fe..f09e97e79a 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/run-acceptance-tests.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/run-acceptance-tests.yml @@ -9,9 +9,9 @@ on: repository_dispatch: types: - run-acceptance-tests-command + workflow_dispatch: {} env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -32,9 +32,11 @@ jobs: contents: read pull-requests: write id-token: write # For ESC secrets. + checks: write # For community PRs. uses: ./.github/workflows/prerequisites.yml secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} default_branch: ${{ github.event.pull_request.base.ref }} is_pr: ${{ github.event_name == 'pull_request' }} is_automated: ${{ github.actor == 'dependabot[bot]' }} @@ -47,6 +49,7 @@ jobs: contents: read id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} matrix: | { @@ -67,6 +70,7 @@ jobs: contents: write # For Renovate SDKs. id-token: write # For ESC secrets. with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} comment-notification: @@ -96,6 +100,8 @@ jobs: name: lint uses: ./.github/workflows/lint.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} sentinel: name: sentinel if: github.event_name == 'repository_dispatch' || @@ -121,6 +127,52 @@ jobs: # otherwise use the current SHA for any other type of build. sha: ${{ github.event.pull_request.head.sha || github.sha }} + start-community-pr: + if: github.event_name == 'repository_dispatch' + runs-on: ubuntu-latest + outputs: + check_id: ${{ steps.create_check.outputs.check_id }} + permissions: + checks: write + steps: + - name: Create pending check run for community PR + id: create_check + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + const { data: check } = await github.rest.checks.create({ + owner: context.repo.owner, + repo: context.repo.repo, + name: "Sentinel", + head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}", + status: "in_progress", + details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" + }); + core.setOutput("check_id", check.id); + + finish-community-pr: + permissions: + checks: write + runs-on: ubuntu-latest + needs: + - start-community-pr + - sentinel + steps: + - name: Report success on community PR + uses: actions/github-script@v7 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + await github.rest.checks.update({ + owner: context.repo.owner, + repo: context.repo.repo, + check_run_id: ${{ needs.start-community-pr.outputs.check_id }}, + conclusion: "success", + status: "completed", + completed_at: new Date().toISOString(), + }); + test: # Don't run tests on PRs from forks. if: github.event_name == 'repository_dispatch' || @@ -135,9 +187,12 @@ jobs: id-token: write secrets: inherit with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} version: ${{ needs.prerequisites.outputs.version }} license_check: name: License Check uses: ./.github/workflows/license.yml secrets: inherit + with: + sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }} diff --git a/provider-ci/test-providers/xyz/.github/workflows/test.yml b/provider-ci/test-providers/xyz/.github/workflows/test.yml index 8e5e057936..a9bbe36bb9 100644 --- a/provider-ci/test-providers/xyz/.github/workflows/test.yml +++ b/provider-ci/test-providers/xyz/.github/workflows/test.yml @@ -5,15 +5,15 @@ name: "Test Provider" on: workflow_call: inputs: + sha: + type: string + description: The commit to build, primarily for community PRs. version: required: true type: string description: Version of the provider to test env: - PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }} - MISE_ENV: test - PULUMI_API: https://api.pulumi-staging.io PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/.. PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget @@ -33,7 +33,7 @@ jobs: - name: Checkout Repo uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: - ref: ${{ env.PR_COMMIT_SHA }} + ref: ${{ inputs.sha }} persist-credentials: false - env: ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}