[internal] Update GitHub Actions workflow files

Update GitHub Actions workflows. (#586 )
This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit ed2094cef48b491325b4ceebfceb6c0a555f1c04.
2025-09-03 05:36:33 +00:00 · 2025-08-28 05:49:05 +00:00 · 2025-08-27 19:47:54 +00:00 · 2025-08-27 11:14:21 -07:00 · 2025-08-26 05:48:46 +00:00 · 2025-08-23 05:46:29 +00:00
30 changed files with 1674 additions and 1596 deletions
--- a/.github/actions/esc-action/action.yaml
+++ b/.github/actions/esc-action/action.yaml
@@ -0,0 +1,12 @@
+name: "Load secrets"
+description: |
+  This is a temporary action which assists with our migration to ESC. Instead
+  of surrounding every step that references secrets with an "if ESC" block, we
+  instead modify those steps to consume their secrets from this step's outputs.
+  Then, later, we can replace this action with esc-action to actually load
+  secrets from ESC.
+inputs: {}
+outputs: {}
+runs:
+  using: "node20"
+  main: "index.js"
--- a/.github/actions/esc-action/index.js
+++ b/.github/actions/esc-action/index.js
@@ -0,0 +1,14 @@
+const fs = require("fs");
+
+const file = process.env["GITHUB_OUTPUT"];
+var stream = fs.createWriteStream(file, { flags: "a" });
+
+for (const [name, value] of Object.entries(process.env)) {
+  try {
+    stream.write(`${name}=${value}\n`);
+  } catch (err) {
+    console.log(`error: failed to set output for ${name}: ${err.message}`);
+  }
+}
+
+stream.end();
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,30 +15,10 @@ on:
    - "**"
  workflow_dispatch: {}
 env:
-  AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
-  AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
-  AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
-  AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }}
-  SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' &&
-    secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID
-    == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }}
-  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: docker-build
-  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PYPI_USERNAME: __token__
-  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
-  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
-  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
-  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: "1.21.x"
  NODEVERSION: "20.x"
  PYTHONVERSION: "3.11.8"
@@ -66,7 +46,7 @@ jobs:
    name: prerequisites
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -74,6 +54,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -196,7 +178,7 @@ jobs:
    - name: Test Provider Library
      run: make test_provider
    - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
+      uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    - if: failure() && github.event_name == 'push'
@@ -206,6 +188,8 @@ jobs:
        author_name: Failure in building provider prerequisites
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  build_sdks:
    needs: prerequisites
    runs-on: pulumi-ubuntu-8core
@@ -221,7 +205,7 @@ jobs:
    name: build_sdks
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -229,6 +213,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -254,17 +240,17 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download provider
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
@@ -353,6 +339,8 @@ jobs:
        author_name: Failure while building SDKs
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

  tag_release_if_labeled_needs_release:
    name: Tag release if labeled as needs-release
@@ -392,7 +380,7 @@ jobs:
      id-token: write
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -400,6 +388,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -425,17 +415,17 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download provider
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
@@ -447,7 +437,7 @@ jobs:
        -exec chmod +x {} \;
    - name: Download SDK
      if: ${{ matrix.language != 'yaml' }}
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: ${{ matrix.language }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -481,7 +471,7 @@ jobs:
      with:
        environment: logins/pulumi-ci
    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
+      uses: google-github-actions/auth@b7593ed2efd1c1617e1b0254da33b86225adb2a5 # v2.1.12
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
@@ -489,7 +479,7 @@ jobs:
          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
    - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
+      uses: google-github-actions/setup-gcloud@26f734c2779b00b7dda794207734c511110a4368 # v3.0.0
      with:
        install_components: gke-gcloud-auth-plugin
    - name: Install gotestfmt
@@ -509,13 +499,15 @@ jobs:
        author_name: Failure in SDK tests
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  publish:
    runs-on: ubuntu-latest
    needs: test
    name: publish
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -523,6 +515,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -544,7 +538,7 @@ jobs:
    - name: Install Pulumi CLI
      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: us-east-2
@@ -557,6 +551,12 @@ jobs:
      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
      env:
        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+        AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
+        AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
+        AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
+        AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }}
+        SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' && secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }}
      with:
        args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
        version: latest
@@ -567,13 +567,15 @@ jobs:
        author_name: Failure in publishing binaries
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  publish_sdk:
    runs-on: ubuntu-latest
    needs: publish
    name: publish_sdk
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -581,8 +583,10 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Checkout Scripts Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        path: ci-scripts
        repository: pulumi/scripts
@@ -612,7 +616,7 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Download python SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: python-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -620,7 +624,7 @@ jobs:
      run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
        ${{github.workspace}}/sdk/python
    - name: Download dotnet SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: dotnet-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -628,7 +632,7 @@ jobs:
      run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
        ${{github.workspace}}/sdk/dotnet
    - name: Download nodejs SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: nodejs-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -640,8 +644,16 @@ jobs:
    - name: Publish SDKs
      run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
      env:
+        NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        PYPI_PUBLISH_ARTIFACTS: all
+        PYPI_USERNAME: __token__
+        PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+        SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+        SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+        PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+        PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
@@ -649,11 +661,13 @@ jobs:
        author_name: Failure in publishing SDK
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  lint:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
        persist-credentials: false
--- a/.github/workflows/command-dispatch.yml
+++ b/.github/workflows/command-dispatch.yml
@@ -23,7 +23,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        persist-credentials: false
    - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4
--- a/.github/workflows/community-moderation.yml
+++ b/.github/workflows/community-moderation.yml
@@ -8,7 +8,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        persist-credentials: false
    - id: schema_changed
--- a/.github/workflows/export-repo-secrets.yml
+++ b/.github/workflows/export-repo-secrets.yml
@@ -0,0 +1,25 @@
+permissions: write-all # Equivalent to default permissions plus id-token: write
+name: Export secrets to ESC
+on: [workflow_dispatch]
+jobs:
+  export-to-esc:
+    runs-on: ubuntu-latest
+    name: export GitHub secrets to ESC
+    steps:
+      - name: Generate a GitHub token
+        id: generate-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: 1256780 # Export Secrets GitHub App
+          private-key: ${{ secrets.EXPORT_SECRETS_PRIVATE_KEY }}
+      - name: Export secrets to ESC
+        uses: pulumi/esc-export-secrets-action@v1
+        with:
+          organization: pulumi
+          org-environment: imports/github-secrets
+          exclude-secrets: EXPORT_SECRETS_PRIVATE_KEY
+          github-token: ${{ steps.generate-token.outputs.token }}
+          oidc-auth: true
+          oidc-requested-token-type: urn:pulumi:token-type:access_token:organization
+        env:
+          GITHUB_SECRETS: ${{ toJSON(secrets) }}
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -6,30 +6,10 @@ on:
    tags:
    - v*.*.*-**
 env:
-  AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
-  AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
-  AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
-  AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }}
-  SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' &&
-    secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID
-    == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }}
-  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: docker-build
-  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PYPI_USERNAME: __token__
-  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
-  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
-  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
-  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: "1.21.x"
  NODEVERSION: "20.x"
  PYTHONVERSION: "3.11.8"
@@ -58,7 +38,7 @@ jobs:
    name: prerequisites
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -66,6 +46,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -188,7 +170,7 @@ jobs:
    - name: Test Provider Library
      run: make test_provider
    - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
+      uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    - if: failure() && github.event_name == 'push'
@@ -198,6 +180,8 @@ jobs:
        author_name: Failure in building provider prerequisites
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  build_sdks:
    needs: prerequisites
    runs-on: pulumi-ubuntu-8core
@@ -213,7 +197,7 @@ jobs:
    name: build_sdks
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -221,6 +205,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -246,17 +232,17 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download provider
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
@@ -344,6 +330,8 @@ jobs:
        author_name: Failure while building SDKs
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  test:
    runs-on: pulumi-ubuntu-8core
    needs:
@@ -364,7 +352,7 @@ jobs:
      id-token: write
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -372,6 +360,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -397,17 +387,17 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download provider
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
@@ -419,7 +409,7 @@ jobs:
        -exec chmod +x {} \;
    - name: Download SDK
      if: ${{ matrix.language != 'yaml' }}
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: ${{ matrix.language }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -453,7 +443,7 @@ jobs:
      with:
        environment: logins/pulumi-ci
    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
+      uses: google-github-actions/auth@b7593ed2efd1c1617e1b0254da33b86225adb2a5 # v2.1.12
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
@@ -461,7 +451,7 @@ jobs:
          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
    - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
+      uses: google-github-actions/setup-gcloud@26f734c2779b00b7dda794207734c511110a4368 # v3.0.0
      with:
        install_components: gke-gcloud-auth-plugin
    - name: Install gotestfmt
@@ -481,13 +471,15 @@ jobs:
        author_name: Failure in SDK tests
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  publish:
    runs-on: ubuntu-latest
    needs: test
    name: publish
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -495,6 +487,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -516,7 +510,7 @@ jobs:
    - name: Install Pulumi CLI
      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: us-east-2
@@ -529,6 +523,12 @@ jobs:
      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
      env:
        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+        AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
+        AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
+        AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
+        AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }}
+        SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' && secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }}
      with:
        args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
        version: latest
@@ -539,13 +539,15 @@ jobs:
        author_name: Failure in publishing binaries
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  publish_sdk:
    runs-on: ubuntu-latest
    needs: publish
    name: publish_sdk
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -553,8 +555,10 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Checkout Scripts Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        path: ci-scripts
        repository: pulumi/scripts
@@ -584,7 +588,7 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Download python SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: python-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -592,7 +596,7 @@ jobs:
      run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
        ${{github.workspace}}/sdk/python
    - name: Download dotnet SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: dotnet-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -600,7 +604,7 @@ jobs:
      run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
        ${{github.workspace}}/sdk/dotnet
    - name: Download nodejs SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: nodejs-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -612,8 +616,11 @@ jobs:
    - name: Publish SDKs
      run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
      env:
+        NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        PYPI_PUBLISH_ARTIFACTS: all
+        PYPI_USERNAME: __token__
+        PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
@@ -621,6 +628,8 @@ jobs:
        author_name: Failure in publishing SDK
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  publish_java_sdk:
    runs-on: ubuntu-latest
    continue-on-error: true
@@ -628,7 +637,7 @@ jobs:
    name: publish_java_sdk
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -636,6 +645,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -648,38 +659,43 @@ jobs:
    - name: Install Pulumi CLI
      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download java SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: java-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: Uncompress java SDK
      run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
        ${{github.workspace}}/sdk/java
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+      with:
+        gradle-version: "7.6"
    - name: Publish Java SDK
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      run: gradle -p ./sdk/java publishToSonatype closeAndReleaseSonatypeStagingRepository
      env:
        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
-      with:
-        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
-        build-root-directory: ./sdk/java
-        gradle-version: 7.4.1
+        SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+        SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+        SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+        PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+        PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
  publish_go_sdk:
    runs-on: ubuntu-latest
    name: publish-go-sdk
    needs: publish_sdk
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -687,8 +703,10 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Download go SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: go-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -4,23 +4,11 @@ name: pull-request
 on:
  pull_request_target: {}
 env:
-  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: docker-build
-  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PYPI_USERNAME: __token__
-  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
-  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
-  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
-  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: "1.21.x"
  NODEVERSION: "20.x"
  PYTHONVERSION: "3.11.8"
@@ -48,7 +36,7 @@ jobs:
    name: comment-on-pr
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - name: Comment PR
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,30 +7,10 @@ on:
    - v*.*.*
    - "!v*.*.*-**"
 env:
-  AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
-  AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
-  AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
-  AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }}
-  SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' &&
-    secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID
-    == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }}
-  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: docker-build
-  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PYPI_USERNAME: __token__
-  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
-  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
-  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
-  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: "1.21.x"
  NODEVERSION: "20.x"
  PYTHONVERSION: "3.11.8"
@@ -58,7 +38,7 @@ jobs:
    name: prerequisites
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -66,6 +46,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -188,7 +170,7 @@ jobs:
    - name: Test Provider Library
      run: make test_provider
    - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
+      uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    - if: failure() && github.event_name == 'push'
@@ -198,6 +180,8 @@ jobs:
        author_name: Failure in building provider prerequisites
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  build_sdks:
    needs: prerequisites
    runs-on: pulumi-ubuntu-8core
@@ -213,7 +197,7 @@ jobs:
    name: build_sdks
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -221,6 +205,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -246,17 +232,17 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download provider
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
@@ -344,6 +330,8 @@ jobs:
        author_name: Failure while building SDKs
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  test:
    runs-on: pulumi-ubuntu-8core
    needs:
@@ -364,7 +352,7 @@ jobs:
      id-token: write
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -372,6 +360,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -397,17 +387,17 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download provider
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
@@ -419,7 +409,7 @@ jobs:
        -exec chmod +x {} \;
    - name: Download SDK
      if: ${{ matrix.language != 'yaml' }}
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: ${{ matrix.language }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -453,7 +443,7 @@ jobs:
      with:
        environment: logins/pulumi-ci
    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
+      uses: google-github-actions/auth@b7593ed2efd1c1617e1b0254da33b86225adb2a5 # v2.1.12
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
@@ -461,7 +451,7 @@ jobs:
          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
    - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
+      uses: google-github-actions/setup-gcloud@26f734c2779b00b7dda794207734c511110a4368 # v3.0.0
      with:
        install_components: gke-gcloud-auth-plugin
    - name: Install gotestfmt
@@ -481,13 +471,15 @@ jobs:
        author_name: Failure in SDK tests
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  publish:
    runs-on: ubuntu-latest
    needs: test
    name: publish
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -495,6 +487,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -516,7 +510,7 @@ jobs:
    - name: Install Pulumi CLI
      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: us-east-2
@@ -529,6 +523,12 @@ jobs:
      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
      env:
        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+        AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
+        AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
+        AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
+        AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }}
+        SKIP_SIGNING: ${{ secrets.AZURE_SIGNING_CLIENT_ID == '' && secrets.AZURE_SIGNING_CLIENT_SECRET == '' && secrets.AZURE_SIGNING_TENANT_ID == '' && secrets.AZURE_SIGNING_KEY_VAULT_URI == '' }}
      with:
        args: -p 3 release --clean --timeout 60m0s
        version: latest
@@ -539,13 +539,15 @@ jobs:
        author_name: Failure in publishing binaries
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  publish_sdk:
    runs-on: ubuntu-latest
    needs: publish
    name: publish_sdks
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -553,8 +555,10 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Checkout Scripts Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        path: ci-scripts
        repository: pulumi/scripts
@@ -584,7 +588,7 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Download python SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: python-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -592,7 +596,7 @@ jobs:
      run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
        ${{github.workspace}}/sdk/python
    - name: Download dotnet SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: dotnet-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -600,7 +604,7 @@ jobs:
      run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
        ${{github.workspace}}/sdk/dotnet
    - name: Download nodejs SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: nodejs-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -612,8 +616,11 @@ jobs:
    - name: Publish SDKs
      run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
      env:
+        NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        PYPI_PUBLISH_ARTIFACTS: all
+        PYPI_USERNAME: __token__
+        PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
@@ -621,6 +628,8 @@ jobs:
        author_name: Failure in publishing SDK
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  publish_java_sdk:
    runs-on: ubuntu-latest
    continue-on-error: true
@@ -628,7 +637,7 @@ jobs:
    name: publish_java_sdk
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -636,6 +645,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -648,38 +659,43 @@ jobs:
    - name: Install Pulumi CLI
      uses: pulumi/actions@df5a93ad715135263c732ba288301bd044c383c0 # v6.3.0
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download java SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: java-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: Uncompress java SDK
      run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
        ${{github.workspace}}/sdk/java
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+      with:
+        gradle-version: "7.6"
    - name: Publish Java SDK
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      run: gradle -p ./sdk/java publishToSonatype closeAndReleaseSonatypeStagingRepository
      env:
        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
-      with:
-        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
-        build-root-directory: ./sdk/java
-        gradle-version: 7.4.1
+        SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+        SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+        SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+        PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+        PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
  publish_go_sdk:
    runs-on: ubuntu-latest
    name: publish-go-sdk
    needs: publish_sdk
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - id: version
@@ -687,8 +703,10 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Download go SDK
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: go-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
--- a/.github/workflows/release_command.yml
+++ b/.github/workflows/release_command.yml
@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        persist-credentials: false
    - name: Should release PR
--- a/.github/workflows/run-acceptance-tests.yml
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -10,23 +10,10 @@ on:
    - CHANGELOG.md
  workflow_dispatch: {}
 env:
-  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: docker-build
-  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PYPI_USERNAME: __token__
-  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
-  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
-  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
-  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: "1.21.x"
  NODEVERSION: "20.x"
  PYTHONVERSION: "3.11.8"
@@ -71,19 +58,8 @@ jobs:
    runs-on: ubuntu-latest
    name: prerequisites
    steps:
-    - name: fromJSON operates on outputs
-      id: setup
-      shell: bash
-      run: |
-        echo 'JSON={"FOO": "BAR", "FOO": "BAZ"}' >> "$GITHUB_OUTPUT"
-
-    - name: Testing duplicate JSON key behavior
-      shell: bash
-      run: |
-        echo "${{ toJSON(fromJSON(steps.setup.outputs.JSON)) }}"
-    
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
        persist-credentials: false
@@ -93,6 +69,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -215,7 +193,7 @@ jobs:
    - name: Test Provider Library
      run: make test_provider
    - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
+      uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    - if: failure() && github.event_name == 'push'
@@ -225,6 +203,8 @@ jobs:
        author_name: Failure in building provider prerequisites
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository
  build_sdks:
@@ -242,7 +222,7 @@ jobs:
    name: build_sdks
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
        persist-credentials: false
@@ -252,6 +232,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -277,17 +259,17 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download provider
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
@@ -375,6 +357,8 @@ jobs:
        author_name: Failure while building SDKs
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository
  test:
@@ -397,7 +381,7 @@ jobs:
      id-token: write
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
        persist-credentials: false
@@ -407,6 +391,8 @@ jobs:
      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
      with:
        set-env: PROVIDER_VERSION
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Install Go
      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
      with:
@@ -432,17 +418,17 @@ jobs:
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
-      uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
-      uses: gradle/gradle-build-action@ac2d340dc04d9e1113182899e983b5400c17cda1 # v3.5.0
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
      with:
        gradle-version: "7.6"
    - name: Download provider
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
@@ -454,7 +440,7 @@ jobs:
        -exec chmod +x {} \;
    - name: Download SDK
      if: ${{ matrix.language != 'yaml' }}
-      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
      with:
        name: ${{ matrix.language }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
@@ -488,7 +474,7 @@ jobs:
      with:
        environment: logins/pulumi-ci
    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
+      uses: google-github-actions/auth@b7593ed2efd1c1617e1b0254da33b86225adb2a5 # v2.1.12
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
@@ -496,7 +482,7 @@ jobs:
          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
    - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
+      uses: google-github-actions/setup-gcloud@26f734c2779b00b7dda794207734c511110a4368 # v3.0.0
      with:
        install_components: gke-gcloud-auth-plugin
    - name: Install gotestfmt
@@ -516,6 +502,8 @@ jobs:
        author_name: Failure in SDK tests
        fields: repo,commit,author,action
        status: ${{ job.status }}
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository
  sentinel:
@@ -542,7 +530,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
        persist-credentials: false
--- a/.github/workflows/weekly-pulumi-update.yml
+++ b/.github/workflows/weekly-pulumi-update.yml
@@ -8,21 +8,9 @@ on:
 env:
  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: docker-build
-  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PYPI_USERNAME: __token__
-  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
-  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
-  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
-  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: "1.21.x"
  NODEVERSION: "20.x"
  PYTHONVERSION: "3.11.8"
@@ -49,7 +37,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repo
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        lfs: true
    - name: Install Go
@@ -76,6 +64,16 @@ jobs:
      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
      with:
        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
+      with:
+        gradle-version: "7.6"
    - name: Update Pulumi/Pulumi
      id: gomod
      run: >-
--- a/.pulumi.version
+++ b/.pulumi.version
@@ -1 +1 @@
-3.185.0
+3.187.0
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,9 +1,15 @@
 ## Unreleased

+## 0.0.13 (2025-08-27)
+
 ### Changed

 - Docker Build Cloud and `exec` errors are more helpful. (https://github.com/pulumi/pulumi-docker-build/issues/549)

+### Fixed
+
+- The provider is no longer replaced on version changes. (https://github.com/pulumi/pulumi-docker-build/issues/581)
+
 ## 0.0.12 (2025-05-16)

 ### Changed
--- a/examples/go/go.mod
+++ b/examples/go/go.mod
@@ -6,7 +6,7 @@ toolchain go1.24.5

 require (
 	github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12
-	github.com/pulumi/pulumi/sdk/v3 v3.169.0
+	github.com/pulumi/pulumi/sdk/v3 v3.187.0
 )

 require (
@@ -62,7 +62,7 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.13.0 // indirect
+	github.com/pulumi/esc v0.14.3 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
@@ -78,18 +78,20 @@ require (
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zclconf/go-cty v1.16.2 // indirect
+	go.opentelemetry.io/otel v1.36.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/crypto v0.38.0 // indirect
+	golang.org/x/crypto v0.39.0 // indirect
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
-	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/mod v0.25.0 // indirect
 	golang.org/x/net v0.40.0 // indirect
-	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sync v0.15.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
 	golang.org/x/term v0.32.0 // indirect
-	golang.org/x/text v0.25.0 // indirect
-	golang.org/x/tools v0.32.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e // indirect
-	google.golang.org/grpc v1.71.1 // indirect
+	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/tools v0.33.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 // indirect
+	google.golang.org/grpc v1.72.1 // indirect
 	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
--- a/examples/go/go.sum
+++ b/examples/go/go.sum
@@ -146,6 +146,8 @@ github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pgavlin/fx v0.1.6 h1:r9jEg69DhNoCd3Xh0+5mIbdbS3PqWrVWujkY76MFRTU=
 github.com/pgavlin/fx v0.1.6/go.mod h1:KWZJ6fqBBSh8GxHYqwYCf3rYE7Gp2p0N8tJp8xv9u9M=
+github.com/pgavlin/fx/v2 v2.0.3 h1:ZBVklTFjxcWvBVPE+ti5qwnmTIQ0Gq6nuj3J5RKDtKk=
+github.com/pgavlin/fx/v2 v2.0.3/go.mod h1:Cvnwqq0BopdHUJ7CU50h1XPeKrF4ZwdFj1nJLXbAjCE=
 github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
 github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -157,12 +159,12 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.13.0 h1:O2MPR2koScaQ2fXwyer8Q3Dd7z+DCnaDfsgNl5mVNMk=
-github.com/pulumi/esc v0.13.0/go.mod h1:IIQo6W6Uzajt6f1RW4QvNxIRDlbK3TNQysnrwBHNo3U=
+github.com/pulumi/esc v0.14.3 h1:Zli+9LiSDT/W+Fsfr8tITxCo+5wn969tLrE4KLv44G8=
+github.com/pulumi/esc v0.14.3/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc=
 github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12 h1:uzmw+0iic764m0Yvh4I/jRV1x3q49dVh5Ctq9RllsQ8=
 github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12/go.mod h1:6zFMe786NvFDO03BVJwdw1R/Yms4F6vAU49iBHo8zbQ=
-github.com/pulumi/pulumi/sdk/v3 v3.169.0 h1:bgz1fp2rl28khSXgF4FaRQiB9wh3lSKWtzUOGalf+x4=
-github.com/pulumi/pulumi/sdk/v3 v3.169.0/go.mod h1:Qhe4dOjqedyLr47kGGnG6ULIbzaPTlmjAvPqNQ1Ollo=
+github.com/pulumi/pulumi/sdk/v3 v3.187.0 h1:BflBBeD/qaoKN4Tov11g4aHzJ7pTXBSb8otgmteRer0=
+github.com/pulumi/pulumi/sdk/v3 v3.187.0/go.mod h1:BnpKxUc6QlxqoCqobHNZsUuIuY27H6ZFUk0Cp+0JN5U=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
@@ -210,32 +212,32 @@ github.com/zclconf/go-cty v1.16.2 h1:LAJSwc3v81IRBZyUVQDUdZ7hs3SYs9jv0eZJDWHD/70
 github.com/zclconf/go-cty v1.16.2/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
-go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
-go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
-go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
-go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
+go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
+go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
+go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
+go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
+go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
 go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
 go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
-go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
-go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
+go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
-golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
+golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
 golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
+golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -247,8 +249,8 @@ golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=
-golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -272,24 +274,24 @@ golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
-golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
+golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.32.0 h1:Q7N1vhpkQv7ybVzLFtTjvQya2ewbwNDZzUgfXGqtMWU=
-golang.org/x/tools v0.32.0/go.mod h1:ZxrU41P/wAbZD8EDa6dDCa6XfpkhJ7HFMjHJXfBDu8s=
+golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
+golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e h1:ztQaXfzEXTmCBvbtWYRhJxW+0iJcz2qXfd38/e9l7bA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250414145226-207652e42e2e/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.71.1 h1:ffsFWr7ygTUscGPI0KKK6TLrGz0476KUvvsbqWK0rPI=
-google.golang.org/grpc v1.71.1/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
+google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
 google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
 google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
--- a/go.mod
+++ b/go.mod
@@ -15,15 +15,15 @@ require (
 	github.com/muesli/reflow v0.3.0
 	github.com/otiai10/copy v1.14.0
 	github.com/pulumi/providertest v0.3.1
-	github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250711153256-84fa063f54d2
-	github.com/pulumi/pulumi-go-provider v1.1.0
+	github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250806132441-44ca9a522cef
+	github.com/pulumi/pulumi-go-provider v1.1.1
 	github.com/pulumi/pulumi-java/pkg v1.16.0
 	github.com/pulumi/pulumi-yaml v1.21.2
-	github.com/pulumi/pulumi/pkg/v3 v3.183.1-0.20250718110245-a8f88047ab64
-	github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250718110245-a8f88047ab64
-	github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250718110245-a8f88047ab64
-	github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250718110245-a8f88047ab64
-	github.com/pulumi/pulumi/sdk/v3 v3.184.0
+	github.com/pulumi/pulumi/pkg/v3 v3.187.0
+	github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250806165243-bee5e4fa4815
+	github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250806165243-bee5e4fa4815
+	github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250806165243-bee5e4fa4815
+	github.com/pulumi/pulumi/sdk/v3 v3.187.0
 	github.com/regclient/regclient v0.7.1
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/afero v1.14.0
@@ -308,7 +308,7 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/moby v26.1.5+incompatible // indirect
+	github.com/moby/moby v28.3.3+incompatible // indirect
 	github.com/moby/spdystream v0.4.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
@@ -357,7 +357,7 @@ require (
 	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.14.3 // indirect
+	github.com/pulumi/esc v0.17.0 // indirect
 	github.com/pulumi/inflector v0.2.1 // indirect
 	github.com/quasilyte/go-ruleguard v0.4.2 // indirect
 	github.com/quasilyte/go-ruleguard/dsl v0.3.22 // indirect
@@ -462,7 +462,7 @@ require (
 	golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f // indirect
 	golang.org/x/mod v0.25.0 // indirect
 	golang.org/x/net v0.40.0 // indirect
-	golang.org/x/oauth2 v0.27.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sync v0.15.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
 	golang.org/x/term v0.32.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -740,8 +740,8 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby v26.1.5+incompatible h1:O/XM3Qzmd6WzbeqAp2hbKu3ugujrsGnrla/yvELtgls=
-github.com/moby/moby v26.1.5+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
+github.com/moby/moby v28.3.3+incompatible h1:nzkZIIn9bQP9S553kNmJ+U8PBhdS2ciFWphV2vX/Zp4=
+github.com/moby/moby v28.3.3+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/spdystream v0.4.0 h1:Vy79D6mHeJJjiPdFEL2yku1kl0chZpJfZcPpb16BRl8=
@@ -888,30 +888,30 @@ github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0leargg
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.14.3 h1:Zli+9LiSDT/W+Fsfr8tITxCo+5wn969tLrE4KLv44G8=
-github.com/pulumi/esc v0.14.3/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc=
+github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w=
+github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc=
 github.com/pulumi/inflector v0.2.1 h1:bqyiish3tq//vLeLiEstSFE5K7RNjy/ce47ed4QATu8=
 github.com/pulumi/inflector v0.2.1/go.mod h1:HUFCjcPTz96YtTuUlwG3i3EZG4WlniBvR9bd+iJxCUY=
 github.com/pulumi/providertest v0.3.1 h1:vlftr7TZlObh81mL88IhhF0/9ZbLrZZos4NAvR4HUUw=
 github.com/pulumi/providertest v0.3.1/go.mod h1:fFHUP4/9DRyYnHWiRnwcynMtM/a7hHR/QcJfcuZKO3A=
-github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250711153256-84fa063f54d2 h1:65dgYdOk87zFOjAxc2i6WY6XPvkPb7hEgo1X0lW09O4=
-github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250711153256-84fa063f54d2/go.mod h1:aLCAyjnCVzOUPEHiJRUuu1SlPhg1FG47/Qx+Yn7EOLY=
-github.com/pulumi/pulumi-go-provider v1.1.0 h1:TNrLoQ7LrT6Z2xPbspJKXE3pKZsz+pCVo62zKFGxjBI=
-github.com/pulumi/pulumi-go-provider v1.1.0/go.mod h1:bWvFWytb2ULBefjDW/YG+GcjHbzVojwtl1RW5afMvR0=
+github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250806132441-44ca9a522cef h1:cxRa9R9To6OYKacIG2Em6zcM7BDNr6joC43uiV1lSVY=
+github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250806132441-44ca9a522cef/go.mod h1:VLcnE1lj92EfRi7CRMzdPkQ9OQvrlg2upJM1lBZzNmg=
+github.com/pulumi/pulumi-go-provider v1.1.1 h1:4UT3LeNT9CdGhkq8OSWKJsmKTW9Tg+vsfOO/hsFVyb4=
+github.com/pulumi/pulumi-go-provider v1.1.1/go.mod h1:3lNIuxT/BArFyiKrVfv+UT7gMMtplss7V69KuBZ4zIk=
 github.com/pulumi/pulumi-java/pkg v1.16.0 h1:8KCiIXWv2uxfIks0SdgOezyXg4HZIoPfHID9eMg4nuM=
 github.com/pulumi/pulumi-java/pkg v1.16.0/go.mod h1:VeMZ1s9LfXBypao4A1tRF3EB7fYnYZ1LwImyg6FBX0c=
 github.com/pulumi/pulumi-yaml v1.21.2 h1:czqC5AazinfX6Bj0nqAAQ6x/Cr8/3oUz3HUjJg6tJ4o=
 github.com/pulumi/pulumi-yaml v1.21.2/go.mod h1:KOqDnuJksfIq8belFVFN3IEI4r0NgW69M0QPSj54On4=
-github.com/pulumi/pulumi/pkg/v3 v3.183.1-0.20250718110245-a8f88047ab64 h1:YyVpJ1C3O1VWVhZUo1fzeQPkXLV8I+4Mfv4Wp6ZR3gU=
-github.com/pulumi/pulumi/pkg/v3 v3.183.1-0.20250718110245-a8f88047ab64/go.mod h1:Jd6IpgYooIih0IzADV9mZ03eOE4yWxSVB5H58toP/Rw=
-github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250718110245-a8f88047ab64 h1:kRc8BMAJUCtEExnWO8jyDApKT6uoMqzgXebwuhtF1yQ=
-github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250718110245-a8f88047ab64/go.mod h1:28k5jUyNfhU1JGxbZKRSUaNXsm/OplNY3JP/JV8usCY=
-github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250718110245-a8f88047ab64 h1:Nekf6EeZrCi1lrlsA4WEs/XaNGrmdKJTItKFXe5+lKI=
-github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250718110245-a8f88047ab64/go.mod h1:/WSNtC7raBf0TpUvHnRp9rap8y2k/sjjSw0Ez8O+pmw=
-github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250718110245-a8f88047ab64 h1:3x/gafIPQwk/G6nK5rN9ssW4KXAQMFQypC30PlTigzM=
-github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250718110245-a8f88047ab64/go.mod h1:FHCsy+aAJdr+phX5jpdRdvedlCBI2osMos828Pbze7c=
-github.com/pulumi/pulumi/sdk/v3 v3.184.0 h1:VdJAmkeO5k7l8bOzVxXw9AfuTO75BBYmw6eQ9YMNCeI=
-github.com/pulumi/pulumi/sdk/v3 v3.184.0/go.mod h1:YS7uQ+eoIV/Fco804Upv3jmz5pwo/MkLYmbGH3VgA9c=
+github.com/pulumi/pulumi/pkg/v3 v3.187.0 h1:VTbireKCxG/wKPX3slHNb3Zk3xKMr5CvcvjH8194H2I=
+github.com/pulumi/pulumi/pkg/v3 v3.187.0/go.mod h1:3y5nyMg62dd+DBzYW/P4d+Ye9pJ/zhJd+aGzMzfUL1g=
+github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250806165243-bee5e4fa4815 h1:tipGG4aEPejP424igQYxJ6TOtWVtZJa0z679oIv00ho=
+github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250806165243-bee5e4fa4815/go.mod h1:V2MMs29cFeGBdZyFKxNqTGVfBgDLhIOGfrXOxheieuI=
+github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250806165243-bee5e4fa4815 h1:+QJTFK7UcOFTYCg3XaSTrRZHWJ6Hqza8w9oADa4pPcM=
+github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250806165243-bee5e4fa4815/go.mod h1:0kA9b5LsaXLEKQzo0o9UUsHtZkACthHYLyBVUDUVMxc=
+github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250806165243-bee5e4fa4815 h1:bkvtySMos0ij3fWZWZaU5sVrvGvU0dZCusoxpgEtX6I=
+github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250806165243-bee5e4fa4815/go.mod h1:SJtr0N/XFyelI7M7U0UbJXr15pgEdSmpN40cglTsRTA=
+github.com/pulumi/pulumi/sdk/v3 v3.187.0 h1:BflBBeD/qaoKN4Tov11g4aHzJ7pTXBSb8otgmteRer0=
+github.com/pulumi/pulumi/sdk/v3 v3.187.0/go.mod h1:BnpKxUc6QlxqoCqobHNZsUuIuY27H6ZFUk0Cp+0JN5U=
 github.com/quasilyte/go-ruleguard v0.4.2 h1:htXcXDK6/rO12kiTHKfHuqR4kr3Y4M0J0rOL6CH/BYs=
 github.com/quasilyte/go-ruleguard v0.4.2/go.mod h1:GJLgqsLeo4qgavUoL8JeGFNS7qcisx3awV/w9eWTmNI=
 github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
@@ -1261,8 +1261,8 @@ golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
 golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
-golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
--- a/sdk/go/dockerbuild/go.mod
+++ b/sdk/go/dockerbuild/go.mod
@@ -4,7 +4,7 @@ go 1.24.1

 require (
 	github.com/blang/semver v3.5.1+incompatible
-	github.com/pulumi/pulumi/sdk/v3 v3.184.0
+	github.com/pulumi/pulumi/sdk/v3 v3.187.0
 )

 require (
@@ -63,7 +63,7 @@ require (
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.14.3 // indirect
+	github.com/pulumi/esc v0.17.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
--- a/sdk/go/dockerbuild/go.sum
+++ b/sdk/go/dockerbuild/go.sum
@@ -162,10 +162,10 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.14.3 h1:Zli+9LiSDT/W+Fsfr8tITxCo+5wn969tLrE4KLv44G8=
-github.com/pulumi/esc v0.14.3/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc=
-github.com/pulumi/pulumi/sdk/v3 v3.184.0 h1:VdJAmkeO5k7l8bOzVxXw9AfuTO75BBYmw6eQ9YMNCeI=
-github.com/pulumi/pulumi/sdk/v3 v3.184.0/go.mod h1:YS7uQ+eoIV/Fco804Upv3jmz5pwo/MkLYmbGH3VgA9c=
+github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w=
+github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc=
+github.com/pulumi/pulumi/sdk/v3 v3.187.0 h1:BflBBeD/qaoKN4Tov11g4aHzJ7pTXBSb8otgmteRer0=
+github.com/pulumi/pulumi/sdk/v3 v3.187.0/go.mod h1:BnpKxUc6QlxqoCqobHNZsUuIuY27H6ZFUk0Cp+0JN5U=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
--- a/sdk/python/pulumi_docker_build/init.py
+++ b/sdk/python/pulumi_docker_build/init.py
@@ -2,7 +2,7 @@
 # *** WARNING: this file was generated by pulumi-language-python. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

-import builtins
+import builtins as _builtins
 from . import _utilities
 import typing
 # Export this package's modules as members:
--- a/sdk/python/pulumi_docker_build/_enums.py
+++ b/sdk/python/pulumi_docker_build/_enums.py
@@ -2,7 +2,7 @@
 # *** WARNING: this file was generated by pulumi-language-python. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

-import builtins
+import builtins as _builtins
 import pulumi
 from enum import Enum

@@ -15,7 +15,7 @@ __all__ = [


@pulumi.type_token("docker-build:index:CacheMode")
-class CacheMode(builtins.str, Enum):
+class CacheMode(_builtins.str, Enum):
    MIN = "min"
    """
    Only layers that are exported into the resulting image are cached.
@@ -27,7 +27,7 @@ class CacheMode(builtins.str, Enum):


@pulumi.type_token("docker-build:index:CompressionType")
-class CompressionType(builtins.str, Enum):
+class CompressionType(_builtins.str, Enum):
    GZIP = "gzip"
    """
    Use `gzip` for compression.
@@ -43,7 +43,7 @@ class CompressionType(builtins.str, Enum):


@pulumi.type_token("docker-build:index:NetworkMode")
-class NetworkMode(builtins.str, Enum):
+class NetworkMode(_builtins.str, Enum):
    DEFAULT = "default"
    """
    The default sandbox network mode.
@@ -59,7 +59,7 @@ class NetworkMode(builtins.str, Enum):


@pulumi.type_token("docker-build:index:Platform")
-class Platform(builtins.str, Enum):
+class Platform(_builtins.str, Enum):
    DARWIN_386 = "darwin/386"
    DARWIN_AMD64 = "darwin/amd64"
    DARWIN_ARM = "darwin/arm"
--- a/sdk/python/pulumi_docker_build/_inputs.py
+++ b/sdk/python/pulumi_docker_build/_inputs.py
--- a/sdk/python/pulumi_docker_build/config/init.py
+++ b/sdk/python/pulumi_docker_build/config/init.py
@@ -2,7 +2,7 @@
 # *** WARNING: this file was generated by pulumi-language-python. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

-import builtins
+import builtins as _builtins
 import sys
 from .vars import _ExportableConfig

--- a/sdk/python/pulumi_docker_build/config/init.pyi
+++ b/sdk/python/pulumi_docker_build/config/init.pyi
@@ -2,8 +2,7 @@
 # *** WARNING: this file was generated by pulumi-language-python. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

-import builtins
-import copy
+import builtins as _builtins
 import warnings
 import sys
 import pulumi
--- a/sdk/python/pulumi_docker_build/config/vars.py
+++ b/sdk/python/pulumi_docker_build/config/vars.py
@@ -2,8 +2,7 @@
 # *** WARNING: this file was generated by pulumi-language-python. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

-import builtins
-import copy
+import builtins as _builtins
 import warnings
 import sys
 import pulumi
@@ -22,14 +21,14 @@ __config__ = pulumi.Config('docker-build')


 class _ExportableConfig(types.ModuleType):
-    @property
+    @_builtins.property
    def host(self) -> str:
        """
        The build daemon's address.
        """
        return __config__.get('host') or (_utilities.get_env('DOCKER_HOST') or '')

-    @property
+    @_builtins.property
    def registries(self) -> Optional[str]:
        return __config__.get('registries')

--- a/sdk/python/pulumi_docker_build/image.py
+++ b/sdk/python/pulumi_docker_build/image.py
@@ -2,8 +2,7 @@
 # *** WARNING: this file was generated by pulumi-language-python. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

-import builtins
-import copy
+import builtins as _builtins
 import warnings
 import sys
 import pulumi
@@ -23,39 +22,39 @@ __all__ = ['ImageArgs', 'Image']
@pulumi.input_type
 class ImageArgs:
    def __init__(__self__, *,
-                 push: pulumi.Input[builtins.bool],
-                 add_hosts: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
-                 build_args: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
-                 build_on_preview: Optional[pulumi.Input[builtins.bool]] = None,
+                 push: pulumi.Input[_builtins.bool],
+                 add_hosts: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 build_args: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
+                 build_on_preview: Optional[pulumi.Input[_builtins.bool]] = None,
                 builder: Optional[pulumi.Input['BuilderConfigArgs']] = None,
                 cache_from: Optional[pulumi.Input[Sequence[pulumi.Input['CacheFromArgs']]]] = None,
                 cache_to: Optional[pulumi.Input[Sequence[pulumi.Input['CacheToArgs']]]] = None,
                 context: Optional[pulumi.Input['BuildContextArgs']] = None,
                 dockerfile: Optional[pulumi.Input['DockerfileArgs']] = None,
-                 exec_: Optional[pulumi.Input[builtins.bool]] = None,
+                 exec_: Optional[pulumi.Input[_builtins.bool]] = None,
                 exports: Optional[pulumi.Input[Sequence[pulumi.Input['ExportArgs']]]] = None,
-                 labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
-                 load: Optional[pulumi.Input[builtins.bool]] = None,
+                 labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
+                 load: Optional[pulumi.Input[_builtins.bool]] = None,
                 network: Optional[pulumi.Input['NetworkMode']] = None,
-                 no_cache: Optional[pulumi.Input[builtins.bool]] = None,
+                 no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
                 platforms: Optional[pulumi.Input[Sequence[pulumi.Input['Platform']]]] = None,
-                 pull: Optional[pulumi.Input[builtins.bool]] = None,
+                 pull: Optional[pulumi.Input[_builtins.bool]] = None,
                 registries: Optional[pulumi.Input[Sequence[pulumi.Input['RegistryArgs']]]] = None,
-                 secrets: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
+                 secrets: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
                 ssh: Optional[pulumi.Input[Sequence[pulumi.Input['SSHArgs']]]] = None,
-                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
-                 target: Optional[pulumi.Input[builtins.str]] = None):
+                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 target: Optional[pulumi.Input[_builtins.str]] = None):
        """
        The set of arguments for constructing a Image resource.
-        :param pulumi.Input[builtins.bool] push: When `true` the build will automatically include a `registry` export.
+        :param pulumi.Input[_builtins.bool] push: When `true` the build will automatically include a `registry` export.
               
               Defaults to `false`.
               
               Equivalent to Docker's `--push` flag.
-        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] add_hosts: Custom `host:ip` mappings to use during the build.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] add_hosts: Custom `host:ip` mappings to use during the build.
               
               Equivalent to Docker's `--add-host` flag.
-        :param pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]] build_args: `ARG` names and values to set during the build.
+        :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] build_args: `ARG` names and values to set during the build.
               
               These variables are accessed like environment variables inside `RUN`
               instructions.
@@ -64,7 +63,7 @@ class ImageArgs:
               if these arguments are sensitive.
               
               Equivalent to Docker's `--build-arg` flag.
-        :param pulumi.Input[builtins.bool] build_on_preview: Setting this to `false` will always skip image builds during previews,
+        :param pulumi.Input[_builtins.bool] build_on_preview: Setting this to `false` will always skip image builds during previews,
               and setting it to `true` will always build images during previews.
               
               Images built during previews are never exported to registries, however
@@ -88,7 +87,7 @@ class ImageArgs:
        :param pulumi.Input['DockerfileArgs'] dockerfile: Dockerfile settings.
               
               Equivalent to Docker's `--file` flag.
-        :param pulumi.Input[builtins.bool] exec_: Use `exec` mode to build this image.
+        :param pulumi.Input[_builtins.bool] exec_: Use `exec` mode to build this image.
               
               By default the provider embeds a v25 Docker client with v0.12 buildx
               support. This helps ensure consistent behavior across environments and
@@ -117,10 +116,10 @@ class ImageArgs:
               0.13 or later.
               
               Equivalent to Docker's `--output` flag.
-        :param pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]] labels: Attach arbitrary key/value metadata to the image.
+        :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] labels: Attach arbitrary key/value metadata to the image.
               
               Equivalent to Docker's `--label` flag.
-        :param pulumi.Input[builtins.bool] load: When `true` the build will automatically include a `docker` export.
+        :param pulumi.Input[_builtins.bool] load: When `true` the build will automatically include a `docker` export.
               
               Defaults to `false`.
               
@@ -130,13 +129,13 @@ class ImageArgs:
               For custom networks, configure your builder with `--driver-opt network=...`.
               
               Equivalent to Docker's `--network` flag.
-        :param pulumi.Input[builtins.bool] no_cache: Do not import cache manifests when building the image.
+        :param pulumi.Input[_builtins.bool] no_cache: Do not import cache manifests when building the image.
               
               Equivalent to Docker's `--no-cache` flag.
        :param pulumi.Input[Sequence[pulumi.Input['Platform']]] platforms: Set target platform(s) for the build. Defaults to the host's platform.
               
               Equivalent to Docker's `--platform` flag.
-        :param pulumi.Input[builtins.bool] pull: Always pull referenced images.
+        :param pulumi.Input[_builtins.bool] pull: Always pull referenced images.
               
               Equivalent to Docker's `--pull` flag.
        :param pulumi.Input[Sequence[pulumi.Input['RegistryArgs']]] registries: Registry credentials. Required if reading or exporting to private
@@ -146,7 +145,7 @@ class ImageArgs:
               credentials on the host.
               
               Similar to `docker login`.
-        :param pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]] secrets: A mapping of secret names to their corresponding values.
+        :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] secrets: A mapping of secret names to their corresponding values.
               
               Unlike the Docker CLI, these can be passed by value and do not need to
               exist on-disk or in environment variables.
@@ -158,13 +157,13 @@ class ImageArgs:
        :param pulumi.Input[Sequence[pulumi.Input['SSHArgs']]] ssh: SSH agent socket or keys to expose to the build.
               
               Equivalent to Docker's `--ssh` flag.
-        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] tags: Name and optionally a tag (format: `name:tag`).
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: Name and optionally a tag (format: `name:tag`).
               
               If exporting to a registry, the name should include the fully qualified
               registry address (e.g. `docker.io/pulumi/pulumi:latest`).
               
               Equivalent to Docker's `--tag` flag.
-        :param pulumi.Input[builtins.str] target: Set the target build stage(s) to build.
+        :param pulumi.Input[_builtins.str] target: Set the target build stage(s) to build.
               
               If not specified all targets will be built by default.
               
@@ -218,9 +217,9 @@ class ImageArgs:
        if target is not None:
            pulumi.set(__self__, "target", target)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def push(self) -> pulumi.Input[builtins.bool]:
+    def push(self) -> pulumi.Input[_builtins.bool]:
        """
        When `true` the build will automatically include a `registry` export.

@@ -231,12 +230,12 @@ class ImageArgs:
        return pulumi.get(self, "push")

    @push.setter
-    def push(self, value: pulumi.Input[builtins.bool]):
+    def push(self, value: pulumi.Input[_builtins.bool]):
        pulumi.set(self, "push", value)

-    @property
+    @_builtins.property
    @pulumi.getter(name="addHosts")
-    def add_hosts(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
+    def add_hosts(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        Custom `host:ip` mappings to use during the build.

@@ -245,12 +244,12 @@ class ImageArgs:
        return pulumi.get(self, "add_hosts")

    @add_hosts.setter
-    def add_hosts(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
+    def add_hosts(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "add_hosts", value)

-    @property
+    @_builtins.property
    @pulumi.getter(name="buildArgs")
-    def build_args(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]:
+    def build_args(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
        """
        `ARG` names and values to set during the build.

@@ -265,12 +264,12 @@ class ImageArgs:
        return pulumi.get(self, "build_args")

    @build_args.setter
-    def build_args(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]):
+    def build_args(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "build_args", value)

-    @property
+    @_builtins.property
    @pulumi.getter(name="buildOnPreview")
-    def build_on_preview(self) -> Optional[pulumi.Input[builtins.bool]]:
+    def build_on_preview(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Setting this to `false` will always skip image builds during previews,
        and setting it to `true` will always build images during previews.
@@ -287,10 +286,10 @@ class ImageArgs:
        return pulumi.get(self, "build_on_preview")

    @build_on_preview.setter
-    def build_on_preview(self, value: Optional[pulumi.Input[builtins.bool]]):
+    def build_on_preview(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "build_on_preview", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def builder(self) -> Optional[pulumi.Input['BuilderConfigArgs']]:
        """
@@ -302,7 +301,7 @@ class ImageArgs:
    def builder(self, value: Optional[pulumi.Input['BuilderConfigArgs']]):
        pulumi.set(self, "builder", value)

-    @property
+    @_builtins.property
    @pulumi.getter(name="cacheFrom")
    def cache_from(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['CacheFromArgs']]]]:
        """
@@ -316,7 +315,7 @@ class ImageArgs:
    def cache_from(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['CacheFromArgs']]]]):
        pulumi.set(self, "cache_from", value)

-    @property
+    @_builtins.property
    @pulumi.getter(name="cacheTo")
    def cache_to(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['CacheToArgs']]]]:
        """
@@ -330,7 +329,7 @@ class ImageArgs:
    def cache_to(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['CacheToArgs']]]]):
        pulumi.set(self, "cache_to", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def context(self) -> Optional[pulumi.Input['BuildContextArgs']]:
        """
@@ -344,7 +343,7 @@ class ImageArgs:
    def context(self, value: Optional[pulumi.Input['BuildContextArgs']]):
        pulumi.set(self, "context", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def dockerfile(self) -> Optional[pulumi.Input['DockerfileArgs']]:
        """
@@ -358,9 +357,9 @@ class ImageArgs:
    def dockerfile(self, value: Optional[pulumi.Input['DockerfileArgs']]):
        pulumi.set(self, "dockerfile", value)

-    @property
+    @_builtins.property
    @pulumi.getter(name="exec")
-    def exec_(self) -> Optional[pulumi.Input[builtins.bool]]:
+    def exec_(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Use `exec` mode to build this image.

@@ -386,10 +385,10 @@ class ImageArgs:
        return pulumi.get(self, "exec_")

    @exec_.setter
-    def exec_(self, value: Optional[pulumi.Input[builtins.bool]]):
+    def exec_(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "exec_", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def exports(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['ExportArgs']]]]:
        """
@@ -409,9 +408,9 @@ class ImageArgs:
    def exports(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['ExportArgs']]]]):
        pulumi.set(self, "exports", value)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def labels(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]:
+    def labels(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
        """
        Attach arbitrary key/value metadata to the image.

@@ -420,12 +419,12 @@ class ImageArgs:
        return pulumi.get(self, "labels")

    @labels.setter
-    def labels(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]):
+    def labels(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "labels", value)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def load(self) -> Optional[pulumi.Input[builtins.bool]]:
+    def load(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        When `true` the build will automatically include a `docker` export.

@@ -436,10 +435,10 @@ class ImageArgs:
        return pulumi.get(self, "load")

    @load.setter
-    def load(self, value: Optional[pulumi.Input[builtins.bool]]):
+    def load(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "load", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def network(self) -> Optional[pulumi.Input['NetworkMode']]:
        """
@@ -455,9 +454,9 @@ class ImageArgs:
    def network(self, value: Optional[pulumi.Input['NetworkMode']]):
        pulumi.set(self, "network", value)

-    @property
+    @_builtins.property
    @pulumi.getter(name="noCache")
-    def no_cache(self) -> Optional[pulumi.Input[builtins.bool]]:
+    def no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Do not import cache manifests when building the image.

@@ -466,10 +465,10 @@ class ImageArgs:
        return pulumi.get(self, "no_cache")

    @no_cache.setter
-    def no_cache(self, value: Optional[pulumi.Input[builtins.bool]]):
+    def no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "no_cache", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def platforms(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['Platform']]]]:
        """
@@ -483,9 +482,9 @@ class ImageArgs:
    def platforms(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['Platform']]]]):
        pulumi.set(self, "platforms", value)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def pull(self) -> Optional[pulumi.Input[builtins.bool]]:
+    def pull(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        Always pull referenced images.

@@ -494,10 +493,10 @@ class ImageArgs:
        return pulumi.get(self, "pull")

    @pull.setter
-    def pull(self, value: Optional[pulumi.Input[builtins.bool]]):
+    def pull(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "pull", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def registries(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RegistryArgs']]]]:
        """
@@ -515,9 +514,9 @@ class ImageArgs:
    def registries(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['RegistryArgs']]]]):
        pulumi.set(self, "registries", value)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def secrets(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]:
+    def secrets(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
        """
        A mapping of secret names to their corresponding values.

@@ -532,10 +531,10 @@ class ImageArgs:
        return pulumi.get(self, "secrets")

    @secrets.setter
-    def secrets(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]]):
+    def secrets(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "secrets", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def ssh(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['SSHArgs']]]]:
        """
@@ -549,9 +548,9 @@ class ImageArgs:
    def ssh(self, value: Optional[pulumi.Input[Sequence[pulumi.Input['SSHArgs']]]]):
        pulumi.set(self, "ssh", value)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def tags(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]:
+    def tags(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
        """
        Name and optionally a tag (format: `name:tag`).

@@ -563,12 +562,12 @@ class ImageArgs:
        return pulumi.get(self, "tags")

    @tags.setter
-    def tags(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]]):
+    def tags(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
        pulumi.set(self, "tags", value)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def target(self) -> Optional[pulumi.Input[builtins.str]]:
+    def target(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        Set the target build stage(s) to build.

@@ -579,7 +578,7 @@ class ImageArgs:
        return pulumi.get(self, "target")

    @target.setter
-    def target(self, value: Optional[pulumi.Input[builtins.str]]):
+    def target(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "target", value)


@@ -589,28 +588,28 @@ class Image(pulumi.CustomResource):
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
-                 add_hosts: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
-                 build_args: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
-                 build_on_preview: Optional[pulumi.Input[builtins.bool]] = None,
+                 add_hosts: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 build_args: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
+                 build_on_preview: Optional[pulumi.Input[_builtins.bool]] = None,
                 builder: Optional[pulumi.Input[Union['BuilderConfigArgs', 'BuilderConfigArgsDict']]] = None,
                 cache_from: Optional[pulumi.Input[Sequence[pulumi.Input[Union['CacheFromArgs', 'CacheFromArgsDict']]]]] = None,
                 cache_to: Optional[pulumi.Input[Sequence[pulumi.Input[Union['CacheToArgs', 'CacheToArgsDict']]]]] = None,
                 context: Optional[pulumi.Input[Union['BuildContextArgs', 'BuildContextArgsDict']]] = None,
                 dockerfile: Optional[pulumi.Input[Union['DockerfileArgs', 'DockerfileArgsDict']]] = None,
-                 exec_: Optional[pulumi.Input[builtins.bool]] = None,
+                 exec_: Optional[pulumi.Input[_builtins.bool]] = None,
                 exports: Optional[pulumi.Input[Sequence[pulumi.Input[Union['ExportArgs', 'ExportArgsDict']]]]] = None,
-                 labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
-                 load: Optional[pulumi.Input[builtins.bool]] = None,
+                 labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
+                 load: Optional[pulumi.Input[_builtins.bool]] = None,
                 network: Optional[pulumi.Input['NetworkMode']] = None,
-                 no_cache: Optional[pulumi.Input[builtins.bool]] = None,
+                 no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
                 platforms: Optional[pulumi.Input[Sequence[pulumi.Input['Platform']]]] = None,
-                 pull: Optional[pulumi.Input[builtins.bool]] = None,
-                 push: Optional[pulumi.Input[builtins.bool]] = None,
+                 pull: Optional[pulumi.Input[_builtins.bool]] = None,
+                 push: Optional[pulumi.Input[_builtins.bool]] = None,
                 registries: Optional[pulumi.Input[Sequence[pulumi.Input[Union['RegistryArgs', 'RegistryArgsDict']]]]] = None,
-                 secrets: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
+                 secrets: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
                 ssh: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SSHArgs', 'SSHArgsDict']]]]] = None,
-                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
-                 target: Optional[pulumi.Input[builtins.str]] = None,
+                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 target: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        """
        A Docker image built using buildx -- Docker's interface to the improved
@@ -921,10 +920,10 @@ class Image(pulumi.CustomResource):

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] add_hosts: Custom `host:ip` mappings to use during the build.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] add_hosts: Custom `host:ip` mappings to use during the build.
               
               Equivalent to Docker's `--add-host` flag.
-        :param pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]] build_args: `ARG` names and values to set during the build.
+        :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] build_args: `ARG` names and values to set during the build.
               
               These variables are accessed like environment variables inside `RUN`
               instructions.
@@ -933,7 +932,7 @@ class Image(pulumi.CustomResource):
               if these arguments are sensitive.
               
               Equivalent to Docker's `--build-arg` flag.
-        :param pulumi.Input[builtins.bool] build_on_preview: Setting this to `false` will always skip image builds during previews,
+        :param pulumi.Input[_builtins.bool] build_on_preview: Setting this to `false` will always skip image builds during previews,
               and setting it to `true` will always build images during previews.
               
               Images built during previews are never exported to registries, however
@@ -957,7 +956,7 @@ class Image(pulumi.CustomResource):
        :param pulumi.Input[Union['DockerfileArgs', 'DockerfileArgsDict']] dockerfile: Dockerfile settings.
               
               Equivalent to Docker's `--file` flag.
-        :param pulumi.Input[builtins.bool] exec_: Use `exec` mode to build this image.
+        :param pulumi.Input[_builtins.bool] exec_: Use `exec` mode to build this image.
               
               By default the provider embeds a v25 Docker client with v0.12 buildx
               support. This helps ensure consistent behavior across environments and
@@ -986,10 +985,10 @@ class Image(pulumi.CustomResource):
               0.13 or later.
               
               Equivalent to Docker's `--output` flag.
-        :param pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]] labels: Attach arbitrary key/value metadata to the image.
+        :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] labels: Attach arbitrary key/value metadata to the image.
               
               Equivalent to Docker's `--label` flag.
-        :param pulumi.Input[builtins.bool] load: When `true` the build will automatically include a `docker` export.
+        :param pulumi.Input[_builtins.bool] load: When `true` the build will automatically include a `docker` export.
               
               Defaults to `false`.
               
@@ -999,16 +998,16 @@ class Image(pulumi.CustomResource):
               For custom networks, configure your builder with `--driver-opt network=...`.
               
               Equivalent to Docker's `--network` flag.
-        :param pulumi.Input[builtins.bool] no_cache: Do not import cache manifests when building the image.
+        :param pulumi.Input[_builtins.bool] no_cache: Do not import cache manifests when building the image.
               
               Equivalent to Docker's `--no-cache` flag.
        :param pulumi.Input[Sequence[pulumi.Input['Platform']]] platforms: Set target platform(s) for the build. Defaults to the host's platform.
               
               Equivalent to Docker's `--platform` flag.
-        :param pulumi.Input[builtins.bool] pull: Always pull referenced images.
+        :param pulumi.Input[_builtins.bool] pull: Always pull referenced images.
               
               Equivalent to Docker's `--pull` flag.
-        :param pulumi.Input[builtins.bool] push: When `true` the build will automatically include a `registry` export.
+        :param pulumi.Input[_builtins.bool] push: When `true` the build will automatically include a `registry` export.
               
               Defaults to `false`.
               
@@ -1020,7 +1019,7 @@ class Image(pulumi.CustomResource):
               credentials on the host.
               
               Similar to `docker login`.
-        :param pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]] secrets: A mapping of secret names to their corresponding values.
+        :param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] secrets: A mapping of secret names to their corresponding values.
               
               Unlike the Docker CLI, these can be passed by value and do not need to
               exist on-disk or in environment variables.
@@ -1032,13 +1031,13 @@ class Image(pulumi.CustomResource):
        :param pulumi.Input[Sequence[pulumi.Input[Union['SSHArgs', 'SSHArgsDict']]]] ssh: SSH agent socket or keys to expose to the build.
               
               Equivalent to Docker's `--ssh` flag.
-        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] tags: Name and optionally a tag (format: `name:tag`).
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] tags: Name and optionally a tag (format: `name:tag`).
               
               If exporting to a registry, the name should include the fully qualified
               registry address (e.g. `docker.io/pulumi/pulumi:latest`).
               
               Equivalent to Docker's `--tag` flag.
-        :param pulumi.Input[builtins.str] target: Set the target build stage(s) to build.
+        :param pulumi.Input[_builtins.str] target: Set the target build stage(s) to build.
               
               If not specified all targets will be built by default.
               
@@ -1372,28 +1371,28 @@ class Image(pulumi.CustomResource):
    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
-                 add_hosts: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
-                 build_args: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
-                 build_on_preview: Optional[pulumi.Input[builtins.bool]] = None,
+                 add_hosts: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 build_args: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
+                 build_on_preview: Optional[pulumi.Input[_builtins.bool]] = None,
                 builder: Optional[pulumi.Input[Union['BuilderConfigArgs', 'BuilderConfigArgsDict']]] = None,
                 cache_from: Optional[pulumi.Input[Sequence[pulumi.Input[Union['CacheFromArgs', 'CacheFromArgsDict']]]]] = None,
                 cache_to: Optional[pulumi.Input[Sequence[pulumi.Input[Union['CacheToArgs', 'CacheToArgsDict']]]]] = None,
                 context: Optional[pulumi.Input[Union['BuildContextArgs', 'BuildContextArgsDict']]] = None,
                 dockerfile: Optional[pulumi.Input[Union['DockerfileArgs', 'DockerfileArgsDict']]] = None,
-                 exec_: Optional[pulumi.Input[builtins.bool]] = None,
+                 exec_: Optional[pulumi.Input[_builtins.bool]] = None,
                 exports: Optional[pulumi.Input[Sequence[pulumi.Input[Union['ExportArgs', 'ExportArgsDict']]]]] = None,
-                 labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
-                 load: Optional[pulumi.Input[builtins.bool]] = None,
+                 labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
+                 load: Optional[pulumi.Input[_builtins.bool]] = None,
                 network: Optional[pulumi.Input['NetworkMode']] = None,
-                 no_cache: Optional[pulumi.Input[builtins.bool]] = None,
+                 no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
                 platforms: Optional[pulumi.Input[Sequence[pulumi.Input['Platform']]]] = None,
-                 pull: Optional[pulumi.Input[builtins.bool]] = None,
-                 push: Optional[pulumi.Input[builtins.bool]] = None,
+                 pull: Optional[pulumi.Input[_builtins.bool]] = None,
+                 push: Optional[pulumi.Input[_builtins.bool]] = None,
                 registries: Optional[pulumi.Input[Sequence[pulumi.Input[Union['RegistryArgs', 'RegistryArgsDict']]]]] = None,
-                 secrets: Optional[pulumi.Input[Mapping[str, pulumi.Input[builtins.str]]]] = None,
+                 secrets: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
                 ssh: Optional[pulumi.Input[Sequence[pulumi.Input[Union['SSHArgs', 'SSHArgsDict']]]]] = None,
-                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
-                 target: Optional[pulumi.Input[builtins.str]] = None,
+                 tags: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 target: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
@@ -1483,9 +1482,9 @@ class Image(pulumi.CustomResource):
        __props__.__dict__["target"] = None
        return Image(resource_name, opts=opts, __props__=__props__)

-    @property
+    @_builtins.property
    @pulumi.getter(name="addHosts")
-    def add_hosts(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
+    def add_hosts(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        Custom `host:ip` mappings to use during the build.

@@ -1493,9 +1492,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "add_hosts")

-    @property
+    @_builtins.property
    @pulumi.getter(name="buildArgs")
-    def build_args(self) -> pulumi.Output[Optional[Mapping[str, builtins.str]]]:
+    def build_args(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
        """
        `ARG` names and values to set during the build.

@@ -1509,9 +1508,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "build_args")

-    @property
+    @_builtins.property
    @pulumi.getter(name="buildOnPreview")
-    def build_on_preview(self) -> pulumi.Output[Optional[builtins.bool]]:
+    def build_on_preview(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Setting this to `false` will always skip image builds during previews,
        and setting it to `true` will always build images during previews.
@@ -1527,7 +1526,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "build_on_preview")

-    @property
+    @_builtins.property
    @pulumi.getter
    def builder(self) -> pulumi.Output[Optional['outputs.BuilderConfig']]:
        """
@@ -1535,7 +1534,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "builder")

-    @property
+    @_builtins.property
    @pulumi.getter(name="cacheFrom")
    def cache_from(self) -> pulumi.Output[Optional[Sequence['outputs.CacheFrom']]]:
        """
@@ -1545,7 +1544,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "cache_from")

-    @property
+    @_builtins.property
    @pulumi.getter(name="cacheTo")
    def cache_to(self) -> pulumi.Output[Optional[Sequence['outputs.CacheTo']]]:
        """
@@ -1555,7 +1554,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "cache_to")

-    @property
+    @_builtins.property
    @pulumi.getter
    def context(self) -> pulumi.Output[Optional['outputs.BuildContext']]:
        """
@@ -1565,9 +1564,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "context")

-    @property
+    @_builtins.property
    @pulumi.getter(name="contextHash")
-    def context_hash(self) -> pulumi.Output[builtins.str]:
+    def context_hash(self) -> pulumi.Output[_builtins.str]:
        """
        A preliminary hash of the image's build context.

@@ -1575,9 +1574,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "context_hash")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def digest(self) -> pulumi.Output[builtins.str]:
+    def digest(self) -> pulumi.Output[_builtins.str]:
        """
        A SHA256 digest of the image if it was exported to a registry or
        elsewhere.
@@ -1589,7 +1588,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "digest")

-    @property
+    @_builtins.property
    @pulumi.getter
    def dockerfile(self) -> pulumi.Output[Optional['outputs.Dockerfile']]:
        """
@@ -1599,9 +1598,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "dockerfile")

-    @property
+    @_builtins.property
    @pulumi.getter(name="exec")
-    def exec_(self) -> pulumi.Output[Optional[builtins.bool]]:
+    def exec_(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Use `exec` mode to build this image.

@@ -1626,7 +1625,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "exec_")

-    @property
+    @_builtins.property
    @pulumi.getter
    def exports(self) -> pulumi.Output[Optional[Sequence['outputs.Export']]]:
        """
@@ -1642,9 +1641,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "exports")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def labels(self) -> pulumi.Output[Optional[Mapping[str, builtins.str]]]:
+    def labels(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
        """
        Attach arbitrary key/value metadata to the image.

@@ -1652,9 +1651,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "labels")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def load(self) -> pulumi.Output[Optional[builtins.bool]]:
+    def load(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        When `true` the build will automatically include a `docker` export.

@@ -1664,7 +1663,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "load")

-    @property
+    @_builtins.property
    @pulumi.getter
    def network(self) -> pulumi.Output[Optional['NetworkMode']]:
        """
@@ -1676,9 +1675,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "network")

-    @property
+    @_builtins.property
    @pulumi.getter(name="noCache")
-    def no_cache(self) -> pulumi.Output[Optional[builtins.bool]]:
+    def no_cache(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Do not import cache manifests when building the image.

@@ -1686,7 +1685,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "no_cache")

-    @property
+    @_builtins.property
    @pulumi.getter
    def platforms(self) -> pulumi.Output[Optional[Sequence['Platform']]]:
        """
@@ -1696,9 +1695,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "platforms")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def pull(self) -> pulumi.Output[Optional[builtins.bool]]:
+    def pull(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        Always pull referenced images.

@@ -1706,9 +1705,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "pull")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def push(self) -> pulumi.Output[builtins.bool]:
+    def push(self) -> pulumi.Output[_builtins.bool]:
        """
        When `true` the build will automatically include a `registry` export.

@@ -1718,9 +1717,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "push")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def ref(self) -> pulumi.Output[builtins.str]:
+    def ref(self) -> pulumi.Output[_builtins.str]:
        """
        If the image was pushed to any registries then this will contain a
        single fully-qualified tag including the build's digest.
@@ -1739,7 +1738,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "ref")

-    @property
+    @_builtins.property
    @pulumi.getter
    def registries(self) -> pulumi.Output[Optional[Sequence['outputs.Registry']]]:
        """
@@ -1753,9 +1752,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "registries")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def secrets(self) -> pulumi.Output[Optional[Mapping[str, builtins.str]]]:
+    def secrets(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
        """
        A mapping of secret names to their corresponding values.

@@ -1769,7 +1768,7 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "secrets")

-    @property
+    @_builtins.property
    @pulumi.getter
    def ssh(self) -> pulumi.Output[Optional[Sequence['outputs.SSH']]]:
        """
@@ -1779,9 +1778,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "ssh")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def tags(self) -> pulumi.Output[Optional[Sequence[builtins.str]]]:
+    def tags(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
        """
        Name and optionally a tag (format: `name:tag`).

@@ -1792,9 +1791,9 @@ class Image(pulumi.CustomResource):
        """
        return pulumi.get(self, "tags")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def target(self) -> pulumi.Output[Optional[builtins.str]]:
+    def target(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        Set the target build stage(s) to build.

--- a/sdk/python/pulumi_docker_build/index.py
+++ b/sdk/python/pulumi_docker_build/index.py
@@ -2,8 +2,7 @@
 # *** WARNING: this file was generated by pulumi-language-python. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

-import builtins
-import copy
+import builtins as _builtins
 import warnings
 import sys
 import pulumi
@@ -22,15 +21,15 @@ __all__ = ['IndexArgs', 'Index']
@pulumi.input_type
 class IndexArgs:
    def __init__(__self__, *,
-                 sources: pulumi.Input[Sequence[pulumi.Input[builtins.str]]],
-                 tag: pulumi.Input[builtins.str],
-                 push: Optional[pulumi.Input[builtins.bool]] = None,
+                 sources: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]],
+                 tag: pulumi.Input[_builtins.str],
+                 push: Optional[pulumi.Input[_builtins.bool]] = None,
                 registry: Optional[pulumi.Input['RegistryArgs']] = None):
        """
        The set of arguments for constructing a Index resource.
-        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] sources: Existing images to include in the index.
-        :param pulumi.Input[builtins.str] tag: The tag to apply to the index.
-        :param pulumi.Input[builtins.bool] push: If true, push the index to the target registry.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sources: Existing images to include in the index.
+        :param pulumi.Input[_builtins.str] tag: The tag to apply to the index.
+        :param pulumi.Input[_builtins.bool] push: If true, push the index to the target registry.
               
               Defaults to `true`.
        :param pulumi.Input['RegistryArgs'] registry: Authentication for the registry where the tagged index will be pushed.
@@ -46,33 +45,33 @@ class IndexArgs:
        if registry is not None:
            pulumi.set(__self__, "registry", registry)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def sources(self) -> pulumi.Input[Sequence[pulumi.Input[builtins.str]]]:
+    def sources(self) -> pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]:
        """
        Existing images to include in the index.
        """
        return pulumi.get(self, "sources")

    @sources.setter
-    def sources(self, value: pulumi.Input[Sequence[pulumi.Input[builtins.str]]]):
+    def sources(self, value: pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]):
        pulumi.set(self, "sources", value)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def tag(self) -> pulumi.Input[builtins.str]:
+    def tag(self) -> pulumi.Input[_builtins.str]:
        """
        The tag to apply to the index.
        """
        return pulumi.get(self, "tag")

    @tag.setter
-    def tag(self, value: pulumi.Input[builtins.str]):
+    def tag(self, value: pulumi.Input[_builtins.str]):
        pulumi.set(self, "tag", value)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def push(self) -> Optional[pulumi.Input[builtins.bool]]:
+    def push(self) -> Optional[pulumi.Input[_builtins.bool]]:
        """
        If true, push the index to the target registry.

@@ -81,10 +80,10 @@ class IndexArgs:
        return pulumi.get(self, "push")

    @push.setter
-    def push(self, value: Optional[pulumi.Input[builtins.bool]]):
+    def push(self, value: Optional[pulumi.Input[_builtins.bool]]):
        pulumi.set(self, "push", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def registry(self) -> Optional[pulumi.Input['RegistryArgs']]:
        """
@@ -105,10 +104,10 @@ class Index(pulumi.CustomResource):
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
-                 push: Optional[pulumi.Input[builtins.bool]] = None,
+                 push: Optional[pulumi.Input[_builtins.bool]] = None,
                 registry: Optional[pulumi.Input[Union['RegistryArgs', 'RegistryArgsDict']]] = None,
-                 sources: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
-                 tag: Optional[pulumi.Input[builtins.str]] = None,
+                 sources: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 tag: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        """
        A wrapper around `docker buildx imagetools create` to create an index
@@ -182,14 +181,14 @@ class Index(pulumi.CustomResource):

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[builtins.bool] push: If true, push the index to the target registry.
+        :param pulumi.Input[_builtins.bool] push: If true, push the index to the target registry.
               
               Defaults to `true`.
        :param pulumi.Input[Union['RegistryArgs', 'RegistryArgsDict']] registry: Authentication for the registry where the tagged index will be pushed.
               
               Credentials can also be included with the provider's configuration.
-        :param pulumi.Input[Sequence[pulumi.Input[builtins.str]]] sources: Existing images to include in the index.
-        :param pulumi.Input[builtins.str] tag: The tag to apply to the index.
+        :param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] sources: Existing images to include in the index.
+        :param pulumi.Input[_builtins.str] tag: The tag to apply to the index.
        """
        ...
    @overload
@@ -282,10 +281,10 @@ class Index(pulumi.CustomResource):
    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
-                 push: Optional[pulumi.Input[builtins.bool]] = None,
+                 push: Optional[pulumi.Input[_builtins.bool]] = None,
                 registry: Optional[pulumi.Input[Union['RegistryArgs', 'RegistryArgsDict']]] = None,
-                 sources: Optional[pulumi.Input[Sequence[pulumi.Input[builtins.str]]]] = None,
-                 tag: Optional[pulumi.Input[builtins.str]] = None,
+                 sources: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
+                 tag: Optional[pulumi.Input[_builtins.str]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
        if not isinstance(opts, pulumi.ResourceOptions):
@@ -335,9 +334,9 @@ class Index(pulumi.CustomResource):
        __props__.__dict__["tag"] = None
        return Index(resource_name, opts=opts, __props__=__props__)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def push(self) -> pulumi.Output[Optional[builtins.bool]]:
+    def push(self) -> pulumi.Output[Optional[_builtins.bool]]:
        """
        If true, push the index to the target registry.

@@ -345,9 +344,9 @@ class Index(pulumi.CustomResource):
        """
        return pulumi.get(self, "push")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def ref(self) -> pulumi.Output[builtins.str]:
+    def ref(self) -> pulumi.Output[_builtins.str]:
        """
        The pushed tag with digest.

@@ -355,7 +354,7 @@ class Index(pulumi.CustomResource):
        """
        return pulumi.get(self, "ref")

-    @property
+    @_builtins.property
    @pulumi.getter
    def registry(self) -> pulumi.Output[Optional['outputs.Registry']]:
        """
@@ -365,17 +364,17 @@ class Index(pulumi.CustomResource):
        """
        return pulumi.get(self, "registry")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def sources(self) -> pulumi.Output[Sequence[builtins.str]]:
+    def sources(self) -> pulumi.Output[Sequence[_builtins.str]]:
        """
        Existing images to include in the index.
        """
        return pulumi.get(self, "sources")

-    @property
+    @_builtins.property
    @pulumi.getter
-    def tag(self) -> pulumi.Output[builtins.str]:
+    def tag(self) -> pulumi.Output[_builtins.str]:
        """
        The tag to apply to the index.
        """
--- a/sdk/python/pulumi_docker_build/outputs.py
+++ b/sdk/python/pulumi_docker_build/outputs.py
--- a/sdk/python/pulumi_docker_build/provider.py
+++ b/sdk/python/pulumi_docker_build/provider.py
@@ -2,8 +2,7 @@
 # *** WARNING: this file was generated by pulumi-language-python. ***
 # *** Do not edit by hand unless you're certain you know what you are doing! ***

-import builtins
-import copy
+import builtins as _builtins
 import warnings
 import sys
 import pulumi
@@ -21,11 +20,11 @@ __all__ = ['ProviderArgs', 'Provider']
@pulumi.input_type
 class ProviderArgs:
    def __init__(__self__, *,
-                 host: Optional[pulumi.Input[builtins.str]] = None,
+                 host: Optional[pulumi.Input[_builtins.str]] = None,
                 registries: Optional[pulumi.Input[Sequence[pulumi.Input['RegistryArgs']]]] = None):
        """
        The set of arguments for constructing a Provider resource.
-        :param pulumi.Input[builtins.str] host: The build daemon's address.
+        :param pulumi.Input[_builtins.str] host: The build daemon's address.
        """
        if host is None:
            host = (_utilities.get_env('DOCKER_HOST') or '')
@@ -34,19 +33,19 @@ class ProviderArgs:
        if registries is not None:
            pulumi.set(__self__, "registries", registries)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def host(self) -> Optional[pulumi.Input[builtins.str]]:
+    def host(self) -> Optional[pulumi.Input[_builtins.str]]:
        """
        The build daemon's address.
        """
        return pulumi.get(self, "host")

    @host.setter
-    def host(self, value: Optional[pulumi.Input[builtins.str]]):
+    def host(self, value: Optional[pulumi.Input[_builtins.str]]):
        pulumi.set(self, "host", value)

-    @property
+    @_builtins.property
    @pulumi.getter
    def registries(self) -> Optional[pulumi.Input[Sequence[pulumi.Input['RegistryArgs']]]]:
        return pulumi.get(self, "registries")
@@ -62,14 +61,14 @@ class Provider(pulumi.ProviderResource):
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
-                 host: Optional[pulumi.Input[builtins.str]] = None,
+                 host: Optional[pulumi.Input[_builtins.str]] = None,
                 registries: Optional[pulumi.Input[Sequence[pulumi.Input[Union['RegistryArgs', 'RegistryArgsDict']]]]] = None,
                 __props__=None):
        """
        Create a Docker-build resource with the given unique name, props, and options.
        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
-        :param pulumi.Input[builtins.str] host: The build daemon's address.
+        :param pulumi.Input[_builtins.str] host: The build daemon's address.
        """
        ...
    @overload
@@ -94,7 +93,7 @@ class Provider(pulumi.ProviderResource):
    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
-                 host: Optional[pulumi.Input[builtins.str]] = None,
+                 host: Optional[pulumi.Input[_builtins.str]] = None,
                 registries: Optional[pulumi.Input[Sequence[pulumi.Input[Union['RegistryArgs', 'RegistryArgsDict']]]]] = None,
                 __props__=None):
        opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
@@ -115,9 +114,9 @@ class Provider(pulumi.ProviderResource):
            __props__,
            opts)

-    @property
+    @_builtins.property
    @pulumi.getter
-    def host(self) -> pulumi.Output[Optional[builtins.str]]:
+    def host(self) -> pulumi.Output[Optional[_builtins.str]]:
        """
        The build daemon's address.
        """
Author	SHA1	Message	Date
Pulumi Bot	e16174b1a4	[internal] Update GitHub Actions workflow files	2025-09-03 05:36:33 +00:00
Pulumi Bot	c46d343c53	Update GitHub Actions workflows. (#586 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit ed2094cef48b491325b4ceebfceb6c0a555f1c04.	2025-08-28 05:49:05 +00:00
Pulumi Bot	4166f9da1b	Update GitHub Actions workflows. (#585 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit 89dd865db8cef8be4f3f0a978cf8007892e51567.	2025-08-27 19:47:54 +00:00
Bryce Lampe	4e934974ee	Update p-go-provider to fix version replacement behavior (#584 ) Updates p-go-provider to pull in https://github.com/pulumi/pulumi-go-provider/pull/410. In particular this fixes an issue where the provider would get replaced on version changes. Fixes https://github.com/pulumi/pulumi-docker-build/issues/581	2025-08-27 11:14:21 -07:00
Pulumi Bot	4262717644	Update GitHub Actions workflows. (#582 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit 19c542b12a65e3f3ec1d8213111262a9887dcda0.	2025-08-26 05:48:46 +00:00
Pulumi Bot	997794b59f	Update GitHub Actions workflows. (#580 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit dfe14f327ab8b4653dc5a4edf60e1f13814519e9.	2025-08-23 05:46:29 +00:00
Pulumi Bot	a168c92f12	Update GitHub Actions workflows. (#577 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit 9b60d6c643780f4a645273cb6a5b3dcce6687d94.	2025-08-15 21:38:53 +00:00
Pulumi Bot	91fdae679d	Update GitHub Actions workflows. (#575 ) This PR was automatically generated by the update-workflows-single-bridged-provider workflow in the pulumi/ci-mgmt repo, from commit 4ac37ece8be37ce71d07d3e42b89c7c306173b9b.	2025-08-15 16:45:42 +00:00
Pulumi Bot	ee4aa2505e	Update GitHub Actions workflows. (#574 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit f90df7559c86efa5ae3108b58c7d554865f2eb56.	2025-08-15 05:47:34 +00:00
Pulumi Bot	9fa5fcabe5	Update GitHub Actions workflows. (#572 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit b21f824c0283ef293cdf550403adf1d4bbfcfdb1.	2025-08-14 05:48:17 +00:00
Matthew (Matt) Jeffryes	b7d239127c	Update pulumi/pulumi dependency to 3.187.0 (#568 ) Fixes https://github.com/pulumi/pulumi-docker-build/issues/551 (sort of - the underlying problem that this repo pins SDK dependencies that don't get automatically update by the workflow still exists, but it should at least work until the codegen APIs change again.)	2025-08-12 14:47:58 -07:00
Pulumi Bot	c4526b3f31	Update GitHub Actions workflows. (#567 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit 44b6bb6137363838b9ea58d69a7ad2f45bb93b7f.	2025-08-12 05:51:01 +00:00
Pulumi Bot	eebb4e8d0e	Update GitHub Actions workflows. (#566 ) This PR was automatically generated by the update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt repo, from commit c53718801bb3dd185442d5f4161ab52eae5e2ab7.	2025-08-09 05:48:18 +00:00
@@ -1 +1 @@
 .185.0
 .187.0