Example suggestion for config middleware

.github/workflows/build.yml

@@ -64,11 +64,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -118,14 +121,7 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      uses: pulumi/git-status-check-action@v1
+      run: ./ci-scripts/ci/check-worktree-is-clean
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/Pulumi.*.csproj
-          sdk/go/*/internal/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
@@ -167,11 +163,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -222,14 +221,7 @@ jobs:
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      uses: pulumi/git-status-check-action@v1
+      run: ./ci-scripts/ci/check-worktree-is-clean
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/Pulumi.*.csproj
-          sdk/go/*/internal/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
@@ -268,11 +260,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -384,11 +379,8 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Unshallow clone for tags
-      name: Set Provider Version
+      run: git fetch --prune --unshallow --tags
-      uses: pulumi/provider-version-action@v1
-      with:
-        set-env: PROVIDER_VERSION
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -419,10 +411,11 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
+    - name: Set PreRelease Version
+      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
+        >> $GITHUB_ENV
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v5
-      env:
-        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
       with:
         args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
         version: latest
@@ -442,17 +435,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@v1
-      with:
-        set-env: PROVIDER_VERSION
     - name: Checkout Scripts Repo
       uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -525,11 +515,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -559,10 +552,11 @@ jobs:
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
+    - name: Set PACKAGE_VERSION to Env
+      run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
+        $GITHUB_ENV
     - name: Publish Java SDK
       uses: gradle/gradle-build-action@v3
-      env:
-        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
       with:
         arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
         build-root-directory: ./sdk/java

.github/workflows/prerelease.yml

@@ -56,11 +56,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -110,14 +113,7 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      uses: pulumi/git-status-check-action@v1
+      run: ./ci-scripts/ci/check-worktree-is-clean
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/Pulumi.*.csproj
-          sdk/go/*/internal/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
@@ -159,11 +155,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -214,14 +213,7 @@ jobs:
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      uses: pulumi/git-status-check-action@v1
+      run: ./ci-scripts/ci/check-worktree-is-clean
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/Pulumi.*.csproj
-          sdk/go/*/internal/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
@@ -259,11 +251,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -375,11 +370,8 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Unshallow clone for tags
-      name: Set Provider Version
+      run: git fetch --prune --unshallow --tags
-      uses: pulumi/provider-version-action@v1
-      with:
-        set-env: PROVIDER_VERSION
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -410,10 +402,11 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
+    - name: Set PreRelease Version
+      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
+        >> $GITHUB_ENV
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v5
-      env:
-        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
       with:
         args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
         version: latest
@@ -433,17 +426,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@v1
-      with:
-        set-env: PROVIDER_VERSION
     - name: Checkout Scripts Repo
       uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -516,11 +506,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -550,46 +543,12 @@ jobs:
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
+    - name: Set PACKAGE_VERSION to Env
+      run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
+        $GITHUB_ENV
     - name: Publish Java SDK
       uses: gradle/gradle-build-action@v3
-      env:
-        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
       with:
         arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
         build-root-directory: ./sdk/java
         gradle-version: 7.4.1
-  publish_go_sdk:
-    runs-on: ubuntu-latest
-    name: publish-go-sdk
-    needs: publish_sdk
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@v4
-      with:
-        lfs: true
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@v1
-      with:
-        set-env: PROVIDER_VERSION
-    - name: Download go SDK
-      uses: actions/download-artifact@v4
-      with:
-        name: go-sdk.tar.gz
-        path: ${{ github.workspace}}/sdk/
-    - name: Uncompress go SDK
-      run: tar -zxf ${{github.workspace}}/sdk/go.tar.gz -C
-        ${{github.workspace}}/sdk/go
-    - name: Publish Go SDK
-      uses: pulumi/publish-go-sdk-action@v1
-      with:
-        repository: ${{ github.repository }}
-        base-ref: ${{ github.sha }}
-        source: sdk
-        path: sdk
-        version: ${{ steps.version.outputs.version }}
-        additive: false
-        files: |-
-          go.*
-          go/**
-          !*.tar.gz

.github/workflows/release.yml

@@ -56,11 +56,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -110,14 +113,7 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      uses: pulumi/git-status-check-action@v1
+      run: ./ci-scripts/ci/check-worktree-is-clean
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/Pulumi.*.csproj
-          sdk/go/*/internal/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
@@ -159,11 +155,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -214,14 +213,7 @@ jobs:
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      uses: pulumi/git-status-check-action@v1
+      run: ./ci-scripts/ci/check-worktree-is-clean
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/Pulumi.*.csproj
-          sdk/go/*/internal/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
@@ -259,11 +251,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -375,11 +370,8 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Unshallow clone for tags
-      name: Set Provider Version
+      run: git fetch --prune --unshallow --tags
-      uses: pulumi/provider-version-action@v1
-      with:
-        set-env: PROVIDER_VERSION
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -410,10 +402,11 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
+    - name: Set PreRelease Version
+      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
+        >> $GITHUB_ENV
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v5
-      env:
-        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
       with:
         args: -p 3 release --clean --timeout 60m0s
         version: latest
@@ -433,17 +426,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@v1
-      with:
-        set-env: PROVIDER_VERSION
     - name: Checkout Scripts Repo
       uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -516,11 +506,14 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -550,52 +543,34 @@ jobs:
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
+    - name: Set PACKAGE_VERSION to Env
+      run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
+        $GITHUB_ENV
     - name: Publish Java SDK
       uses: gradle/gradle-build-action@v3
-      env:
-        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
       with:
         arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
         build-root-directory: ./sdk/java
         gradle-version: 7.4.1
-  publish_go_sdk:
+  tag_sdk:
     runs-on: ubuntu-latest
-    name: publish-go-sdk
     needs: publish_sdk
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Install pulumictl
-      name: Set Provider Version
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        repo: pulumi/pulumictl
-    - name: Download go SDK
+    - name: Add SDK version tag
-      uses: actions/download-artifact@v4
+      run: git tag sdk/v$(pulumictl get version --language generic) && git push origin
-      with:
+        sdk/v$(pulumictl get version --language generic)
-        name: go-sdk.tar.gz
+    name: tag_sdk
-        path: ${{ github.workspace}}/sdk/
-    - name: Uncompress go SDK
-      run: tar -zxf ${{github.workspace}}/sdk/go.tar.gz -C
-        ${{github.workspace}}/sdk/go
-    - name: Publish Go SDK
-      uses: pulumi/publish-go-sdk-action@v1
-      with:
-        repository: ${{ github.repository }}
-        base-ref: ${{ github.sha }}
-        source: sdk
-        path: sdk
-        version: ${{ steps.version.outputs.version }}
-        additive: false
-        files: |-
-          go.*
-          go/**
-          !*.tar.gz
   dispatch_docs_build:
     runs-on: ubuntu-latest
-    needs: publish_go_sdk
+    needs: tag_sdk
     steps:
     - name: Install pulumictl
       uses: jaxxstorm/action-install-gh-release@v1.11.0

.github/workflows/run-acceptance-tests.yml

@@ -81,11 +81,14 @@ jobs:
       with:
         lfs: true
         ref: ${{ env.PR_COMMIT_SHA }}
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -135,14 +138,7 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      uses: pulumi/git-status-check-action@v1
+      run: ./ci-scripts/ci/check-worktree-is-clean
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/Pulumi.*.csproj
-          sdk/go/*/internal/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
@@ -187,11 +183,14 @@ jobs:
       with:
         lfs: true
         ref: ${{ env.PR_COMMIT_SHA }}
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -242,14 +241,7 @@ jobs:
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      uses: pulumi/git-status-check-action@v1
+      run: ./ci-scripts/ci/check-worktree-is-clean
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/Pulumi.*.csproj
-          sdk/go/*/internal/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
@@ -291,11 +283,14 @@ jobs:
       with:
         lfs: true
         ref: ${{ env.PR_COMMIT_SHA }}
-    - id: version
+    - name: Checkout Scripts Repo
-      name: Set Provider Version
+      uses: actions/checkout@v4
-      uses: pulumi/provider-version-action@v1
       with:
-        set-env: PROVIDER_VERSION
+        path: ci-scripts
+        repository: pulumi/scripts
+    - run: echo "ci-scripts" >> .git/info/exclude
+    - name: Unshallow clone for tags
+      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:

.github/workflows/weekly-pulumi-update.yml

@@ -54,11 +54,8 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - id: version
+    - name: Unshallow clone for tags
-      name: Set Provider Version
+      run: git fetch --prune --unshallow --tags
-      uses: pulumi/provider-version-action@v1
-      with:
-        set-env: PROVIDER_VERSION
     - name: Install Go
       uses: actions/setup-go@v5
       with:

CHANGELOG.md

@@ -1,12 +0,0 @@
-## Unreleased
-
-## 0.0.2 (2024-04-25)
-
-### Fixed
-
-- Upgraded pulumi-go-provider to fix a panic during cancellation.
-
-## 0.0.1 (2024-04-23)
-
-Initial release.
-

Makefile

@@ -7,6 +7,7 @@ NODE_MODULE_NAME := @pulumi/docker-build
 NUGET_PKG_NAME   := Pulumi.DockerBuild
 
 PROVIDER         := pulumi-resource-${PACK}
+VERSION          ?= $(shell pulumictl get version)
 PROVIDER_PATH    := provider
 VERSION_PATH     := ${PROVIDER_PATH}.Version
 SCHEMA_PATH      := ${PROVIDER_PATH}/cmd/pulumi-resource-${PACK}/schema.json
@@ -20,12 +21,6 @@ TESTPARALLELISM  := 4
 PULUMI           := bin/pulumi
 GOGLANGCILINT    := bin/golangci-lint
 
-# Override during CI using `make [TARGET] PROVIDER_VERSION=""` or by setting a PROVIDER_VERSION environment variable
-# Local & branch builds will just used this fixed default version unless specified
-PROVIDER_VERSION ?= 1.0.0-alpha.0+dev
-# Use this normalised version everywhere rather than the raw input to ensure consistency.
-VERSION_GENERIC = $(shell pulumictl convert-version --language generic --version "$(PROVIDER_VERSION)")
-
 .PHONY: ensure
 ensure:: tidy lint test_provider examples
 
@@ -40,7 +35,7 @@ provider: bin/${PROVIDER} bin/pulumi-gen-${PACK} # Required by CI
 local_generate: sdk # Required by CI
 
 provider_debug::
-	(cd provider && go build -o $(WORKING_DIR)/bin/${PROVIDER} -gcflags="all=-N -l" -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
+	(cd provider && go build -o $(WORKING_DIR)/bin/${PROVIDER} -gcflags="all=-N -l" -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
 
 test_provider:: # Required by CI
 	go test -short -v -coverprofile="coverage.txt" -coverpkg=./provider/... -timeout 2h -parallel ${TESTPARALLELISM} ./provider/...
@@ -181,7 +176,7 @@ ${SCHEMA_PATH}: bin/${PROVIDER}
 	pulumi package get-schema bin/${PROVIDER} > $(SCHEMA_PATH)
 
 bin/${PROVIDER}: $(shell find ./provider -name '*.go') go.mod
-	(cd provider && go build -o ../bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
+	(cd provider && go build -o ../bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
 
 bin/pulumi-gen-${PACK}: # Required by CI
 	touch bin/pulumi-gen-${PACK}
@@ -192,7 +187,7 @@ go.sum: go.mod
 sdk: $(shell mkdir -p sdk)
 sdk: sdk/python sdk/nodejs sdk/java sdk/python sdk/go sdk/dotnet
 
-sdk/python: PYPI_VERSION := $(shell pulumictl convert-version --language python -v "$(VERSION_GENERIC)")
+sdk/python: PYPI_VERSION := $(shell pulumictl get version --language python)
 sdk/python: TMPDIR := $(shell mktemp -d)
 sdk/python: $(PULUMI) bin/${PROVIDER}
 	rm -rf sdk/python
@@ -208,7 +203,7 @@ sdk/python: $(PULUMI) bin/${PROVIDER}
 		../venv/bin/python -m build .
 	mv -f ${TMPDIR}/python ${WORKING_DIR}/sdk/.
 
-sdk/nodejs: NODE_VERSION := $(shell pulumictl convert-version --language javascript -v "$(VERSION_GENERIC)")
+sdk/nodejs: NODE_VERSION := $(shell pulumictl get version --language javascript)
 sdk/nodejs: TMPDIR := $(shell mktemp -d)
 sdk/nodejs: $(PULUMI) bin/${PROVIDER}
 	rm -rf sdk/nodejs
@@ -233,7 +228,7 @@ sdk/go: $(PULUMI) bin/${PROVIDER}
 		go mod tidy
 	mv -f ${TMPDIR}/go ${WORKING_DIR}/sdk/go
 
-sdk/dotnet: DOTNET_VERSION  := $(shell pulumictl convert-version --language dotnet -v "$(VERSION_GENERIC)")
+sdk/dotnet: DOTNET_VERSION  := $(shell pulumictl get version --language dotnet)
 sdk/dotnet: TMPDIR := $(shell mktemp -d)
 sdk/dotnet: $(PULUMI) bin/${PROVIDER}
 	rm -rf sdk/dotnet
@@ -243,7 +238,7 @@ sdk/dotnet: $(PULUMI) bin/${PROVIDER}
 		dotnet build /p:Version=${DOTNET_VERSION}
 	mv -f ${TMPDIR}/dotnet ${WORKING_DIR}/sdk/.
 
-sdk/java: PACKAGE_VERSION := $(shell pulumictl convert-version --language generic -v "$(VERSION_GENERIC)")
+sdk/java: PACKAGE_VERSION := $(shell pulumictl get version --language generic)
 sdk/java: TMPDIR := $(shell mktemp -d)
 sdk/java: $(PULUMI) bin/${PROVIDER}
 	rm -rf sdk/java

provider/internal/cache.go

@@ -17,7 +17,6 @@ package internal
 import (
 	"errors"
 	"fmt"
-	"reflect"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
@@ -461,23 +460,6 @@ func (c CacheFrom) String() string {
 	return join(c.Local, c.Registry, c.GHA, c.AZBlob, c.S3, c.Raw)
 }
 
-// Diff returns false if both cache entries are identical enough to ignore
-// changes during diff. Differences to tokens are allowed.
-func (c CacheFrom) Diff(other CacheFrom) bool {
-	if c.GHA != nil && other.GHA != nil {
-		other.GHA.Token = c.GHA.Token
-	}
-	if c.S3 != nil && other.S3 != nil {
-		other.S3.AccessKeyID = c.S3.AccessKeyID
-		other.S3.SecretAccessKey = c.S3.SecretAccessKey
-		other.S3.SessionToken = c.S3.SessionToken
-	}
-	if c.AZBlob != nil && other.AZBlob != nil {
-		other.AZBlob.SecretAccessKey = c.AZBlob.SecretAccessKey
-	}
-	return reflect.DeepEqual(c, other)
-}
-
 func (c CacheFrom) validate(preview bool) (*controllerapi.CacheOptionsEntry, error) {
 	if strings.Count(c.String(), "type=") > 1 {
 		return nil, errors.New("cacheFrom should only specify one cache type")
@@ -688,23 +670,6 @@ func (c CacheTo) String() string {
 	return join(c.Inline, c.Local, c.Registry, c.GHA, c.AZBlob, c.S3, c.Raw)
 }
 
-// Diff returns false if both cache entries are identical enough to ignore
-// changes during diff. Differences to tokens are allowed.
-func (c CacheTo) Diff(other CacheTo) bool {
-	if c.GHA != nil && other.GHA != nil {
-		other.GHA.Token = c.GHA.Token
-	}
-	if c.S3 != nil && other.S3 != nil {
-		other.S3.AccessKeyID = c.S3.AccessKeyID
-		other.S3.SecretAccessKey = c.S3.SecretAccessKey
-		other.S3.SessionToken = c.S3.SessionToken
-	}
-	if c.AZBlob != nil && other.AZBlob != nil {
-		other.AZBlob.SecretAccessKey = c.AZBlob.SecretAccessKey
-	}
-	return reflect.DeepEqual(c, other)
-}
-
 func (c CacheTo) validate(preview bool) (*controllerapi.CacheOptionsEntry, error) {
 	if strings.Count(c.String(), "type=") > 1 {
 		return nil, errors.New("cacheTo should only specify one cache type")

provider/internal/client_test.go

@@ -80,7 +80,7 @@ func TestBuild(t *testing.T) {
 	t.Parallel()
 
 	tmpdir := t.TempDir()
-	Max := Max
+	max := Max
 
 	exampleContext := &BuildContext{Context: Context{Location: "../../examples/app"}}
 
@@ -122,7 +122,7 @@ func TestBuild(t *testing.T) {
 				Tags:    []string{"cached"},
 				CacheTo: []CacheTo{{Local: &CacheToLocal{
 					Dest:          filepath.Join(tmpdir, "cache"),
-					CacheWithMode: CacheWithMode{Mode: &Max},
+					CacheWithMode: CacheWithMode{Mode: &max},
 				}}},
 				CacheFrom: []CacheFrom{{Local: &CacheFromLocal{
 					Src: filepath.Join(tmpdir, "cache"),

provider/internal/deprecated/configencoding.go

@@ -110,7 +110,6 @@ func (enc *ConfigEncoding) unmarshalOpts() plugin.MarshalOptions {
 	return plugin.MarshalOptions{
 		Label:        "config",
 		KeepUnknowns: true,
-		KeepSecrets:  true,
 		SkipNulls:    true,
 		RejectAssets: true,
 	}
@@ -180,11 +179,12 @@ func (enc *ConfigEncoding) UnmarshalProperties(
 
 	// And now unmarshal every field it into the map.
 	for _, key := range keys {
-		v, err := enc.unmarshalPropertyValue(key, props[key])
+		pk := resource.PropertyKey(key)
+		v, err := enc.unmarshalPropertyValue(pk, props[key])
 		if err != nil {
-			return resource.PropertyMap{}, err
+			return nil, err
 		}
-		result[key] = v
+		result[pk] = v
 	}
 
 	return result, nil

provider/internal/deprecated/configencoding_test.go

@@ -16,23 +16,23 @@ package deprecated
 
 import (
 	"fmt"
-	"strconv"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	structpb "google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
 )
 
 func TestConfigEncoding(t *testing.T) {
 	t.Parallel()
 
 	type testCase struct {
-		ty    schema.TypeSpec
+		ty schema.TypeSpec
-		given resource.PropertyValue
+		v  *structpb.Value
-		want  resource.PropertyValue
+		pv resource.PropertyValue
 	}
 
 	knownKey := "mykey"
@@ -49,64 +49,69 @@ func TestConfigEncoding(t *testing.T) {
 		)
 	}
 
+	makeValue := func(x any) *structpb.Value {
+		vv, err := structpb.NewValue(x)
+		assert.NoErrorf(t, err, "structpb.NewValue failed")
+		return vv
+	}
+
 	checkUnmarshal := func(t *testing.T, tc testCase) {
 		enc := makeEnc(tc.ty)
-		key := resource.PropertyKey(knownKey)
+		pv, err := enc.unmarshalPropertyValue(resource.PropertyKey(knownKey), tc.v)
-
+		assert.NoError(t, err)
-		actual, err := enc.unmarshalPropertyValue(key, tc.given)
+		assert.NotNil(t, pv)
-		require.NoError(t, err)
+		assert.Equal(t, tc.pv, *pv)
-		assert.Equal(t, tc.want, actual)
 	}
 
 	turnaroundTestCases := []testCase{
 		{
 			schema.TypeSpec{Type: "boolean"},
-			resource.NewPropertyValue(`true`),
+			makeValue(`true`),
 			resource.NewBoolProperty(true),
 		},
 		{
 			schema.TypeSpec{Type: "boolean"},
-			resource.NewPropertyValue(`false`),
+			makeValue(`false`),
 			resource.NewBoolProperty(false),
 		},
 		{
 			schema.TypeSpec{Type: "integer"},
-			resource.NewPropertyValue(`0`),
+			makeValue(`0`),
 			resource.NewNumberProperty(0),
 		},
 		{
 			schema.TypeSpec{Type: "integer"},
-			resource.NewPropertyValue(`42`),
+			makeValue(`42`),
 			resource.NewNumberProperty(42),
 		},
 		{
 			schema.TypeSpec{Type: "number"},
-			resource.NewPropertyValue(`0`),
+			makeValue(`0`),
 			resource.NewNumberProperty(0.0),
 		},
 		{
 			schema.TypeSpec{Type: "number"},
-			resource.NewPropertyValue(`42.5`),
+			makeValue(`42.5`),
 			resource.NewNumberProperty(42.5),
 		},
 		{
 			schema.TypeSpec{Type: "string"},
-			resource.NewStringProperty(""),
+			structpb.NewStringValue(""),
 			resource.NewStringProperty(""),
 		},
 		{
 			schema.TypeSpec{Type: "string"},
-			resource.NewStringProperty("hello"),
+			structpb.NewStringValue("hello"),
 			resource.NewStringProperty("hello"),
 		},
 		{
 			schema.TypeSpec{Type: "array"},
-			resource.NewPropertyValue(`[]`),
+			makeValue(`[]`),
 			resource.NewArrayProperty([]resource.PropertyValue{}),
 		},
 		{
 			schema.TypeSpec{Type: "array"},
-			resource.NewPropertyValue(`["hello","there"]`),
+			makeValue(`["hello","there"]`),
 			resource.NewArrayProperty([]resource.PropertyValue{
 				resource.NewStringProperty("hello"),
 				resource.NewStringProperty("there"),
@@ -114,12 +119,12 @@ func TestConfigEncoding(t *testing.T) {
 		},
 		{
 			schema.TypeSpec{Type: "object"},
-			resource.NewPropertyValue(`{}`),
+			makeValue(`{}`),
 			resource.NewObjectProperty(resource.PropertyMap{}),
 		},
 		{
 			schema.TypeSpec{Type: "object"},
-			resource.NewPropertyValue(`{"key":"value"}`),
+			makeValue(`{"key":"value"}`),
 			resource.NewObjectProperty(resource.PropertyMap{
 				"key": resource.NewStringProperty("value"),
 			}),
@@ -130,7 +135,7 @@ func TestConfigEncoding(t *testing.T) {
 		for i, tc := range turnaroundTestCases {
 			tc := tc
 
-			t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Run(fmt.Sprintf("UnmarshalPropertyValue/%d", i), func(t *testing.T) {
 				t.Parallel()
 				checkUnmarshal(t, tc)
 			})
@@ -142,32 +147,32 @@ func TestConfigEncoding(t *testing.T) {
 		cases := []testCase{
 			{
 				schema.TypeSpec{Type: "boolean"},
-				resource.NewPropertyValue(""),
+				makeValue(""),
 				resource.NewBoolProperty(false),
 			},
 			{
 				schema.TypeSpec{Type: "number"},
-				resource.NewPropertyValue(""),
+				makeValue(""),
 				resource.NewNumberProperty(0.),
 			},
 			{
 				schema.TypeSpec{Type: "integer"},
-				resource.NewPropertyValue(""),
+				makeValue(""),
 				resource.NewNumberProperty(0),
 			},
 			{
 				schema.TypeSpec{Type: "string"},
-				resource.NewPropertyValue(""),
+				makeValue(""),
 				resource.NewStringProperty(""),
 			},
 			{
 				schema.TypeSpec{Type: "object"},
-				resource.NewPropertyValue(""),
+				makeValue(""),
 				resource.NewObjectProperty(make(resource.PropertyMap)),
 			},
 			{
 				schema.TypeSpec{Type: "array"},
-				resource.NewPropertyValue(""),
+				makeValue(""),
 				resource.NewArrayProperty([]resource.PropertyValue{}),
 			},
 		}
@@ -182,18 +187,18 @@ func TestConfigEncoding(t *testing.T) {
 	})
 
 	t.Run("computed", func(t *testing.T) {
-		unk := resource.MakeComputed(resource.NewStringProperty(""))
+		unk := makeValue(plugin.UnknownStringValue)
 
 		for i, tc := range turnaroundTestCases {
 			tc := tc
 
-			t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Run(fmt.Sprintf("UnmarshalPropertyValue/%d", i), func(t *testing.T) {
 				t.Parallel()
 				// Unknown sentinel unmarshals to a Computed with a type-appropriate zero value.
 				checkUnmarshal(t, testCase{
-					ty:    tc.ty,
+					tc.ty,
-					given: unk,
+					unk,
-					want:  resource.MakeComputed(makeEnc(tc.ty).zeroValue(tc.ty.Type)),
+					resource.MakeComputed(makeEnc(tc.ty).zeroValue(tc.ty.Type)),
 				})
 			})
 		}
@@ -210,30 +215,46 @@ func TestConfigEncoding(t *testing.T) {
 
 		var secretCases []testCase
 
+		pbSecret := func(v *structpb.Value) *structpb.Value {
+			return structpb.NewStructValue(&structpb.Struct{Fields: map[string]*structpb.Value{
+				"4dabf18193072939515e22adb298388d": makeValue("1b47061264138c4ac30d75fd1eb44270"),
+				"value":                            v,
+			}})
+		}
+
 		for _, tc := range turnaroundTestCases {
 			secretCases = append(secretCases, testCase{
-				ty:    tc.ty,
+				tc.ty,
-				given: resource.MakeSecret(tc.given),
+				pbSecret(tc.v),
-				want:  resource.MakeSecret(tc.want),
+				resource.MakeSecret(tc.pv),
 			})
 		}
 
 		for i, tc := range secretCases {
 			tc := tc
 
-			t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Run(fmt.Sprintf("secret/UnmarshalPropertyValue/%d", i), func(t *testing.T) {
 				t.Parallel()
+
+				// Unmarshallin will remove secrts, so the expected value needs to be modified.
+				tc.pv = tc.pv.SecretValue().Element
 				checkUnmarshal(t, tc)
 			})
 		}
 
-		t.Run("nested secrets", func(t *testing.T) {
+		t.Run("tolerate secrets in Configure", func(t *testing.T) {
+			// This is a bit of a histirocal quirk: the engine may send secrets to Configure before
+			// receiving the response from Configure indicating that the provider does not want to receive
+			// secrets. These are simply ignored. The engine does not currently send secrets to CheckConfig.
+			// The engine does take care of making sure the secrets are stored as such in the statefile.
+			//
+			// Check here that unmarshalilng such values removes the secrets.
 			checkUnmarshal(t, testCase{
 				schema.TypeSpec{Type: "object"},
-				resource.MakeSecret(resource.NewPropertyValue(`{"key":"val"}`)),
+				pbSecret(makeValue(`{"key":"val"}`)),
-				resource.MakeSecret(resource.NewObjectProperty(resource.PropertyMap{
+				resource.NewObjectProperty(resource.PropertyMap{
 					"key": resource.NewStringProperty("val"),
-				})),
+				}),
 			})
 		})
 	})
@@ -241,7 +262,7 @@ func TestConfigEncoding(t *testing.T) {
 	regressUnmarshalTestCases := []testCase{
 		{
 			schema.TypeSpec{Type: "array"},
-			resource.NewPropertyValue(`
+			makeValue(`
 			[
 			  {
 			    "address": "somewhere.org",
@@ -255,7 +276,7 @@ func TestConfigEncoding(t *testing.T) {
 			resource.NewArrayProperty([]resource.PropertyValue{
 				resource.NewObjectProperty(resource.PropertyMap{
 					"address":  resource.NewStringProperty("somewhere.org"),
-					"password": resource.MakeSecret(resource.NewStringProperty("some-password")),
+					"password": resource.NewStringProperty("some-password"),
 					"username": resource.NewStringProperty("some-user"),
 				}),
 			}),
@@ -265,7 +286,7 @@ func TestConfigEncoding(t *testing.T) {
 	t.Run("regress-unmarshal", func(t *testing.T) {
 		for i, tc := range regressUnmarshalTestCases {
 			tc := tc
-			t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Run(fmt.Sprintf("UnmarshalPropertyValue/%d", i), func(t *testing.T) {
 				t.Parallel()
 				checkUnmarshal(t, tc)
 			})

provider/internal/image.go

@@ -328,8 +328,8 @@ func (is *ImageState) Annotate(a infer.Annotator) {
 	`))
 }
 
-// client produces a CLI client scoped to this resource and layered on top of
+// client produces a CLI client with scoped to this resource and layered on top
-// any host-level credentials.
+// of any host-level credentials.
 func (i *Image) client(ctx context.Context, state ImageState, args ImageArgs) (Client, error) {
 	cfg := infer.GetConfig[Config](ctx)
 
@@ -889,6 +889,12 @@ func (*Image) Diff(
 	if !reflect.DeepEqual(olds.Builder, news.Builder) {
 		diff["builder"] = update
 	}
+	if !reflect.DeepEqual(olds.CacheFrom, news.CacheFrom) {
+		diff["cacheFrom"] = update
+	}
+	if !reflect.DeepEqual(olds.CacheTo, news.CacheTo) {
+		diff["cacheTo"] = update
+	}
 	if olds.Context.Location != news.Context.Location {
 		diff["context.location"] = update
 	}
@@ -969,31 +975,6 @@ func (*Image) Diff(
 			break
 		}
 	}
-	// The GHA cache needs similar handling to ignore changes to the token.
-	if len(olds.CacheFrom) != len(news.CacheFrom) {
-		diff["cacheFrom"] = update
-	} else {
-		for idx, oldc := range olds.CacheFrom {
-			newc := news.CacheFrom[idx]
-			if newc.Diff(oldc) {
-				continue
-			}
-			diff[fmt.Sprintf("cacheFrom[%d]", idx)] = update
-			break
-		}
-	}
-	if len(olds.CacheTo) != len(news.CacheTo) {
-		diff["cacheTo"] = update
-	} else {
-		for idx, oldc := range olds.CacheTo {
-			newc := news.CacheTo[idx]
-			if !newc.Diff(oldc) {
-				continue
-			}
-			diff[fmt.Sprintf("cacheTo[%d]", idx)] = update
-			break
-		}
-	}
 
 	return provider.DiffResponse{
 		HasChanges:   len(diff) > 0,

provider/internal/image_test.go

@@ -370,7 +370,7 @@ func TestRead(t *testing.T) {
 }
 
 func TestImageDiff(t *testing.T) {
-	// t.Parallel()
+	t.Parallel()
 	emptyDir := t.TempDir()
 	host := Host
 
@@ -419,106 +419,6 @@ func TestImageDiff(t *testing.T) {
 			},
 			wantChanges: false,
 		},
-		{
-			name: "no diff if cache tokens change",
-			olds: func(_ *testing.T, s ImageState) ImageState {
-				s.CacheTo = []CacheTo{
-					{
-						GHA: &CacheToGitHubActions{
-							CacheFromGitHubActions: CacheFromGitHubActions{
-								URL:   "unchanged-cacheto-url",
-								Token: "old-cacheto-token",
-							},
-						},
-					},
-					{
-						S3: &CacheToS3{
-							CacheFromS3: CacheFromS3{
-								AccessKeyID:     "old-cacheto-access-key-id",
-								SecretAccessKey: "old-cacheto-secret-access-key",
-								SessionToken:    "old-cacheto-session-token",
-							},
-						},
-					},
-					{
-						AZBlob: &CacheToAzureBlob{
-							CacheFromAzureBlob: CacheFromAzureBlob{
-								SecretAccessKey: "old-cacheto-secret-access-key",
-							},
-						},
-					},
-				}
-				s.CacheFrom = []CacheFrom{
-					{
-						GHA: &CacheFromGitHubActions{
-							URL:   "unchanged-cachefrom-url",
-							Token: "old-cachefrom-token",
-						},
-					},
-					{
-						S3: &CacheFromS3{
-							AccessKeyID:     "old-cachefrom-access-key-id",
-							SecretAccessKey: "old-cachefrom-secret-access-key",
-							SessionToken:    "old-cachefrom-session-token",
-						},
-					},
-					{
-						AZBlob: &CacheFromAzureBlob{
-							SecretAccessKey: "old-cachefrom-secret-access-key",
-						},
-					},
-				}
-				return s
-			},
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
-				a.CacheTo = []CacheTo{
-					{
-						GHA: &CacheToGitHubActions{
-							CacheFromGitHubActions: CacheFromGitHubActions{
-								URL:   "unchanged-cacheto-url",
-								Token: "new-cacheto-token",
-							},
-						},
-					},
-					{
-						S3: &CacheToS3{
-							CacheFromS3: CacheFromS3{
-								AccessKeyID:     "new-cacheto-access-key-id",
-								SecretAccessKey: "new-cacheto-secret-access-key",
-								SessionToken:    "new-cacheto-session-token",
-							},
-						},
-					},
-					{
-						AZBlob: &CacheToAzureBlob{
-							CacheFromAzureBlob: CacheFromAzureBlob{
-								SecretAccessKey: "new-cacheto-secret-access-key",
-							},
-						},
-					},
-				}
-				a.CacheFrom = []CacheFrom{
-					{
-						GHA: &CacheFromGitHubActions{
-							URL:   "unchanged-cachefrom-url",
-							Token: "new-cachefrom-token",
-						},
-					}, {
-						S3: &CacheFromS3{
-							AccessKeyID:     "new-cachefrom-access-key-id",
-							SecretAccessKey: "new-cachefrom-secret-access-key",
-							SessionToken:    "new-cachefrom-session-token",
-						},
-					}, {
-						AZBlob: &CacheFromAzureBlob{
-							SecretAccessKey: "new-cachefrom-secret-access-key",
-						},
-					},
-				}
-				return a
-			},
-			wantChanges: false,
-		},
 		{
 			name: "no diff if pull=true but no exports",
 			olds: func(_ *testing.T, is ImageState) ImageState {
@@ -531,108 +431,6 @@ func TestImageDiff(t *testing.T) {
 			},
 			wantChanges: false,
 		},
-		{
-			name: "diff if gha cache parameters change",
-			olds: func(_ *testing.T, s ImageState) ImageState {
-				s.CacheTo = []CacheTo{{
-					GHA: &CacheToGitHubActions{
-						CacheFromGitHubActions: CacheFromGitHubActions{
-							Scope: "old-cacheto-scope",
-						},
-					},
-				}}
-				s.CacheFrom = []CacheFrom{{
-					GHA: &CacheFromGitHubActions{
-						Scope: "old-cachefrom-scope",
-					},
-				}}
-				return s
-			},
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
-				a.CacheTo = []CacheTo{{
-					GHA: &CacheToGitHubActions{
-						CacheFromGitHubActions: CacheFromGitHubActions{
-							Scope: "new-cacheto-scope",
-						},
-					},
-				}}
-				a.CacheFrom = []CacheFrom{{
-					GHA: &CacheFromGitHubActions{
-						Scope: "new-cachefrom-scope",
-					},
-				}}
-				return a
-			},
-			wantChanges: true,
-		},
-		{
-			name: "diff if s3 cache parameters change",
-			olds: func(_ *testing.T, s ImageState) ImageState {
-				s.CacheTo = []CacheTo{{
-					S3: &CacheToS3{
-						CacheFromS3: CacheFromS3{
-							Region: "old-cacheto-region",
-						},
-					},
-				}}
-				s.CacheFrom = []CacheFrom{{
-					S3: &CacheFromS3{
-						Region: "old-cachefrom-region",
-					},
-				}}
-				return s
-			},
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
-				a.CacheTo = []CacheTo{{
-					S3: &CacheToS3{
-						CacheFromS3: CacheFromS3{
-							Region: "new-cacheto-region",
-						},
-					},
-				}}
-				a.CacheFrom = []CacheFrom{{
-					S3: &CacheFromS3{
-						Region: "new-cachefrom-region",
-					},
-				}}
-				return a
-			},
-			wantChanges: true,
-		},
-		{
-			name: "diff if azblob cache parameters change",
-			olds: func(_ *testing.T, s ImageState) ImageState {
-				s.CacheTo = []CacheTo{{
-					AZBlob: &CacheToAzureBlob{
-						CacheFromAzureBlob: CacheFromAzureBlob{
-							Name: "old-cacheto-name",
-						},
-					},
-				}}
-				s.CacheFrom = []CacheFrom{{
-					AZBlob: &CacheFromAzureBlob{
-						Name: "old-cachefrom-name",
-					},
-				}}
-				return s
-			},
-			news: func(_ *testing.T, a ImageArgs) ImageArgs {
-				a.CacheTo = []CacheTo{{
-					AZBlob: &CacheToAzureBlob{
-						CacheFromAzureBlob: CacheFromAzureBlob{
-							Name: "new-cacheto-name",
-						},
-					},
-				}}
-				a.CacheFrom = []CacheFrom{{
-					AZBlob: &CacheFromAzureBlob{
-						Name: "new-cachefrom-name",
-					},
-				}}
-				return a
-			},
-			wantChanges: true,
-		},
 		{
 			name: "diff if pull=true with exports",
 			olds: func(_ *testing.T, is ImageState) ImageState {
@@ -1163,14 +961,14 @@ func TestBuildable(t *testing.T) {
 
 func TestToBuild(t *testing.T) {
 	t.Parallel()
-	Max := Max
+	max := Max
 
 	ia := ImageArgs{
 		Tags:      []string{"foo", "bar"},
 		Platforms: []Platform{"linux/amd64"},
 		Context:   &BuildContext{Context: Context{Location: "testdata/noop"}},
 		CacheTo: []CacheTo{
-			{GHA: &CacheToGitHubActions{CacheWithMode: CacheWithMode{&Max}}},
+			{GHA: &CacheToGitHubActions{CacheWithMode: CacheWithMode{&max}}},
 			{
 				Registry: &CacheToRegistry{
 					CacheFromRegistry: CacheFromRegistry{Ref: "docker.io/foo/bar"},

provider/internal/index.go

@@ -151,7 +151,7 @@ func (i *Index) Update(
 		return state, nil
 	}
 
-	provider.GetLogger(ctx).Debugf("creating index with tag %s and sources %s", input.Tag, input.Sources)
+	provider.GetLogger(ctx).Debug(fmt.Sprintf("creating index with tag %s and sources %s", input.Tag, input.Sources))
 
 	err = cli.ManifestCreate(ctx, input.Push, input.Tag, input.Sources...)
 	if err != nil {
@@ -309,8 +309,8 @@ func (i *Index) Diff(
 	}, nil
 }
 
-// client produces a CLI client scoped to this resource and layered on top of
+// client produces a CLI client with scoped to this resource and layered on top
-// any host-level credentials.
+// of any host-level credentials.
 func (i *Index) client(
 	ctx context.Context,
 	_ IndexState,

provider/internal/metadata.json

@@ -0,0 +1 @@
+{}

provider/provider.go

@@ -18,12 +18,13 @@ import (
 	"context"
 	"encoding/json"
 
-	"github.com/pulumi/pulumi-docker-build/provider/internal"
-	"github.com/pulumi/pulumi-docker-build/provider/internal/deprecated"
 	gp "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
 	"github.com/pulumi/pulumi/pkg/v3/resource/provider"
 	rpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
+
+	"github.com/pulumi/pulumi-docker-build/provider/internal"
+	"github.com/pulumi/pulumi-docker-build/provider/internal/deprecated"
 )
 
 // Version is initialized by the Go linker to contain the semver of this build.

provider/provider_test.go

@@ -24,10 +24,10 @@ import (
 	emptypb "google.golang.org/protobuf/types/known/emptypb"
 	"google.golang.org/protobuf/types/known/structpb"
 
-	"github.com/pulumi/pulumi-docker-build/provider/internal"
 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/integration"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
+	rpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
 )
 
 // TestConfigure checks backwards-compatibility with SDKs that still send
@@ -37,19 +37,35 @@ import (
 func TestConfigure(t *testing.T) {
 	t.Parallel()
 
-	p := configurableProvider(internal.NewBuildxProvider())
+	p, err := New(nil)
+	require.NoError(t, err)
 
 	args, err := structpb.NewStruct(map[string]any{
 		"registries": `[{"address": "docker.io"}]`,
 	})
 	require.NoError(t, err)
+
+	// Ideally we would just call p.Configure directly, but we need the
+	// integration server to inject runtime info for us.
 	argsMap, err := plugin.UnmarshalProperties(args, plugin.MarshalOptions{})
 	require.NoError(t, err)
-
+	s := integration.NewServer("docker-build", semver.Version{Major: 0}, provider.Provider{
-	s := integration.NewServer("docker-build", semver.Version{Major: 0}, p)
+		// Roundabout way to get the integration server to invoke our outermost
+		// Configure RPC endpoint.
+		Configure: func(ctx context.Context, req provider.ConfigureRequest) error {
+			args, err := plugin.MarshalProperties(req.Args, plugin.MarshalOptions{})
+			require.NoError(t, err)
+			_, err = p.Configure(ctx, &rpc.ConfigureRequest{
+				Variables: req.Variables,
+				Args:      args,
+			})
+			return err
+		},
+	})
 	err = s.Configure(provider.ConfigureRequest{
 		Args: argsMap,
 	})
+
 	assert.NoError(t, err)
 }