Fix /run-acceptance-tests for bridged providers

provider-ci/internal/pkg/templates/base/.github/workflows/build_provider.yml

@@ -9,6 +9,9 @@ on:
         required: true
         type: string
         description: Version of the provider to build
+      sha:
+        type: string
+        description: The commit to build, primarily for community PRs.
       matrix:
         required: false
         type: string
@@ -51,6 +54,7 @@ jobs:
       - name: Checkout Repo
         uses: #{{ .Config.ActionVersions.Checkout }}#
         with:
+          ref: ${{ inputs.sha }}
           #{{- if .Config.CheckoutSubmodules }}#
           submodules: #{{ .Config.CheckoutSubmodules }}#
           #{{- end }}#

provider-ci/internal/pkg/templates/base/.github/workflows/build_sdk.yml

@@ -9,6 +9,9 @@ on:
       version:
         required: true
         type: string
+      sha:
+        type: string
+        description: The commit to build, primarily for community PRs.
 
 env:
 #{{ .Config | renderGlobalEnv | indent 2 }}#
@@ -41,6 +44,7 @@ jobs:
       - name: Checkout Repo
         uses: #{{ .Config.ActionVersions.Checkout }}#
         with:
+          ref: ${{ inputs.sha }}
           #{{- if .Config.CheckoutSubmodules }}#
           submodules: #{{ .Config.CheckoutSubmodules }}#
           #{{- end }}#

provider-ci/internal/pkg/templates/base/.github/workflows/license.yml

@@ -4,7 +4,10 @@ name: license_check
 
 on:
   workflow_call:
-    inputs: {}
+    inputs:
+      sha:
+        type: string
+        description: The commit to build, primarily for community PRs.
 
 env:
 #{{ .Config | renderGlobalEnv | indent 2 }}#
@@ -21,6 +24,7 @@ jobs:
       - name: Checkout Repo
         uses: #{{ .Config.ActionVersions.Checkout }}#
         with:
+          ref: ${{ inputs.sha }}
           persist-credentials: false
     #{{- .Config | renderEscStep | indent 6 }}#
 #{{- if .Config.GitHubApp.Enabled }}#

provider-ci/internal/pkg/templates/base/.github/workflows/lint.yml

@@ -4,7 +4,10 @@ name: lint
 
 on:
   workflow_call:
-    inputs: {}
+    inputs:
+      sha:
+        type: string
+        description: The commit to build, primarily for community PRs.
 
 env:
 #{{ .Config | renderGlobalEnv | indent 2 }}#
@@ -30,6 +33,7 @@ jobs:
     - name: Checkout Repo
       uses: #{{ .Config.ActionVersions.Checkout }}#
       with:
+        ref: ${{ inputs.sha }}
         #{{- if .Config.CheckoutSubmodules }}#
         submodules: #{{ .Config.CheckoutSubmodules }}#
         #{{- end }}#

provider-ci/internal/pkg/templates/base/.github/workflows/prerequisites.yml

@@ -14,6 +14,10 @@ on:
       default_branch:
         type: string
         required: true
+      sha:
+        type: string
+        required: false
+        description: The commit to build, primarily for community PRs.
     outputs:
       version:
         description: "Provider version being built"
@@ -33,6 +37,7 @@ jobs:
     outputs:
       version: ${{ steps.provider-version.outputs.version }}
     steps:
+
 #{{- if .Config.FreeDiskSpaceBeforeBuild }}#
     # Run as first step so we don't delete things that have just been installed
     - name: Free Disk Space (Ubuntu)
@@ -45,10 +50,12 @@ jobs:
     - name: Checkout Repo
       uses: #{{ .Config.ActionVersions.Checkout }}#
       with:
+        ref: ${{ inputs.sha }}
         #{{- if .Config.CheckoutSubmodules }}#
         submodules: #{{ .Config.CheckoutSubmodules }}#
         #{{- end }}#
         persist-credentials: false
+
     #{{- .Config | renderEscStep | indent 4 }}#
 #{{- if .Config.GitHubApp.Enabled }}#
     - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1

provider-ci/internal/pkg/templates/base/.github/workflows/run-acceptance-tests.yml

@@ -9,9 +9,9 @@ on:
   repository_dispatch:
     types:
     - run-acceptance-tests-command
+  workflow_dispatch: {}
 
 env:
-  PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
 #{{ .Config | renderGlobalEnv | indent 2 }}#
 
 # This should cancel any previous runs of the same workflow on the same branch which are still running.
@@ -27,9 +27,11 @@ jobs:
       contents: read
       pull-requests: write
       id-token: write # For ESC secrets.
+      checks: write # For community PRs.
     uses: ./.github/workflows/prerequisites.yml
     secrets: inherit
     with:
+      sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }}
       default_branch: ${{ github.event.pull_request.base.ref }}
       is_pr: ${{ github.event_name == 'pull_request' }}
       is_automated: ${{ github.actor == 'dependabot[bot]' }}
@@ -42,6 +44,7 @@ jobs:
       contents: read
       id-token: write # For ESC secrets.
     with:
+      sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }}
       version: ${{ needs.prerequisites.outputs.version }}
       matrix: |
         {
@@ -63,6 +66,7 @@ jobs:
       contents: write # For Renovate SDKs.
       id-token: write # For ESC secrets.
     with:
+      sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }}
       version: ${{ needs.prerequisites.outputs.version }}
   #{{- end }}#
 
@@ -94,6 +98,8 @@ jobs:
     name: lint
     uses: ./.github/workflows/lint.yml
     secrets: inherit
+    with:
+      sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }}
   #{{ end -}}#
 
   sentinel:
@@ -123,6 +129,52 @@ jobs:
         # otherwise use the current SHA for any other type of build.
         sha: ${{ github.event.pull_request.head.sha || github.sha }}
 
+  start-community-pr:
+    if: github.event_name == 'repository_dispatch'
+    runs-on: ubuntu-latest
+    outputs:
+      check_id: ${{ steps.create_check.outputs.check_id }}
+    permissions:
+      checks: write
+    steps:
+    - name: Create pending check run for community PR
+      id: create_check
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        script: |
+          const { data: check } = await github.rest.checks.create({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            name: "Sentinel",
+            head_sha: "${{ github.event.client_payload.pull_request.merge_commit_sha }}",
+            status: "in_progress",
+            details_url: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          });
+          core.setOutput("check_id", check.id);
+
+  finish-community-pr:
+    permissions:
+      checks: write
+    runs-on: ubuntu-latest
+    needs:
+      - start-community-pr
+      - sentinel
+    steps:
+    - name: Report success on community PR
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        script: |
+          await github.rest.checks.update({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            check_run_id: ${{ needs.start-community-pr.outputs.check_id }},
+            conclusion: "success",
+            status: "completed",
+            completed_at: new Date().toISOString(),
+          });
+
   test:
     # Don't run tests on PRs from forks.
     if: github.event_name == 'repository_dispatch' ||
@@ -139,9 +191,12 @@ jobs:
       id-token: write
     secrets: inherit
     with:
+      sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }}
       version: ${{ needs.prerequisites.outputs.version }}
 
   license_check:
     name: License Check
     uses: ./.github/workflows/license.yml
     secrets: inherit
+    with:
+      sha: ${{ github.event.client_payload.pull_request.merge_commit_sha }}

provider-ci/internal/pkg/templates/base/.github/workflows/test.yml

@@ -5,15 +5,15 @@ name: "Test Provider"
 on:
    workflow_call:
      inputs:
+       sha:
+         type: string
+         description: The commit to build, primarily for community PRs.
        version:
          required: true
          type: string
          description: Version of the provider to test
 
 env:
-  PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
-  MISE_ENV: test
-
 #{{ .Config | renderGlobalEnv | indent 2 }}#
 
 jobs:
@@ -37,7 +37,7 @@ jobs:
     - name: Checkout Repo
       uses: #{{ .Config.ActionVersions.Checkout }}#
       with:
-        ref: ${{ env.PR_COMMIT_SHA }}
+        ref: ${{ inputs.sha }}
         #{{- if .Config.CheckoutSubmodules }}#
         submodules: #{{ .Config.CheckoutSubmodules }}#
         #{{- end }}#

provider-ci/internal/pkg/templates/internal/.github/workflows/command-dispatch.yml

@@ -1,5 +1,12 @@
 # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
 
+name: command-dispatch
+on:
+  issue_comment:
+    types:
+    - created
+    - edited
+
 env:
 #{{ .Config | renderGlobalEnv | indent 2 }}#
 
@@ -9,6 +16,7 @@ jobs:
     runs-on: #{{ .Config.Runner.Default }}#
     permissions:
       contents: read
+      pull-requests: write # For comment reactions.
       id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
@@ -23,15 +31,8 @@ jobs:
       with:
         commands: |
           run-acceptance-tests
-          release
         issue-type: pull-request
         permission: write
         reaction-token: ${{ secrets.GITHUB_TOKEN }}
         repository: #{{ .Repository }}#
         token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-name: command-dispatch
-on:
-  issue_comment:
-    types:
-    - created
-    - edited

provider-ci/test-providers/acme/.github/workflows/build_provider.yml

@@ -9,6 +9,9 @@ on:
         required: true
         type: string
         description: Version of the provider to build
+      sha:
+        type: string
+        description: The commit to build, primarily for community PRs.
       matrix:
         required: false
         type: string
@@ -41,6 +44,7 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
+          ref: ${{ inputs.sha }}
           persist-credentials: false      
       - id: esc-secrets
         name: Map environment to ESC outputs

provider-ci/test-providers/acme/.github/workflows/build_sdk.yml

@@ -8,6 +8,9 @@ on:
       version:
         required: true
         type: string
+      sha:
+        type: string
+        description: The commit to build, primarily for community PRs.
 
 env:
   PULUMI_API: https://api.pulumi-staging.io
@@ -39,6 +42,7 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
+          ref: ${{ inputs.sha }}
           persist-credentials: false      
       - id: esc-secrets
         name: Map environment to ESC outputs

provider-ci/test-providers/acme/.github/workflows/license.yml

@@ -4,7 +4,10 @@ name: license_check
 
 on:
   workflow_call:
-    inputs: {}
+    inputs:
+      sha:
+        type: string
+        description: The commit to build, primarily for community PRs.
 
 env:
   PULUMI_API: https://api.pulumi-staging.io
@@ -26,6 +29,7 @@ jobs:
       - name: Checkout Repo
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
+          ref: ${{ inputs.sha }}
           persist-credentials: false      
       - id: esc-secrets
         name: Map environment to ESC outputs

provider-ci/test-providers/acme/.github/workflows/lint.yml

@@ -4,7 +4,10 @@ name: lint
 
 on:
   workflow_call:
-    inputs: {}
+    inputs:
+      sha:
+        type: string
+        description: The commit to build, primarily for community PRs.
 
 env:
   PULUMI_API: https://api.pulumi-staging.io
@@ -26,6 +29,7 @@ jobs:
     - name: Checkout Repo
       uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
+        ref: ${{ inputs.sha }}
         persist-credentials: false    
     - id: esc-secrets
       name: Map environment to ESC outputs

provider-ci/test-providers/acme/.github/workflows/prerequisites.yml

@@ -14,6 +14,10 @@ on:
       default_branch:
         type: string
         required: true
+      sha:
+        type: string
+        required: false
+        description: The commit to build, primarily for community PRs.
     outputs:
       version:
         description: "Provider version being built"
@@ -41,6 +45,7 @@ jobs:
     - name: Checkout Repo
       uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
+        ref: ${{ inputs.sha }}
         persist-credentials: false    
     - id: esc-secrets
       name: Map environment to ESC outputs