Don't diff token

This PR was automatically generated by the
update-native-provider-workflows workflow in the pulumi/ci-mgmt repo,
from commit 6ef5444d6e792b70fd2ed0791d776a6f9f77714e.

.github/workflows/build.yml

@@ -64,14 +64,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -121,7 +118,14 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        allowed-changes: |-
+          sdk/**/pulumi-plugin.json
+          sdk/dotnet/Pulumi.*.csproj
+          sdk/go/*/internal/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
@@ -163,14 +167,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -221,7 +222,14 @@ jobs:
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        allowed-changes: |-
+          sdk/**/pulumi-plugin.json
+          sdk/dotnet/Pulumi.*.csproj
+          sdk/go/*/internal/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
@@ -260,14 +268,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -379,8 +384,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Unshallow clone for tags
+    - id: version
-      run: git fetch --prune --unshallow --tags
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -411,11 +419,10 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
-    - name: Set PreRelease Version
-      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
-        >> $GITHUB_ENV
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v5
+      env:
+        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
       with:
         args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
         version: latest
@@ -435,14 +442,17 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
+    - id: version
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
     - name: Checkout Scripts Repo
       uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -515,14 +525,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -552,11 +559,10 @@ jobs:
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
-    - name: Set PACKAGE_VERSION to Env
-      run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
-        $GITHUB_ENV
     - name: Publish Java SDK
       uses: gradle/gradle-build-action@v3
+      env:
+        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
       with:
         arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
         build-root-directory: ./sdk/java

.github/workflows/prerelease.yml

@@ -56,14 +56,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -113,7 +110,14 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        allowed-changes: |-
+          sdk/**/pulumi-plugin.json
+          sdk/dotnet/Pulumi.*.csproj
+          sdk/go/*/internal/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
@@ -155,14 +159,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -213,7 +214,14 @@ jobs:
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        allowed-changes: |-
+          sdk/**/pulumi-plugin.json
+          sdk/dotnet/Pulumi.*.csproj
+          sdk/go/*/internal/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
@@ -251,14 +259,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -370,8 +375,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Unshallow clone for tags
+    - id: version
-      run: git fetch --prune --unshallow --tags
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -402,11 +410,10 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
-    - name: Set PreRelease Version
-      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
-        >> $GITHUB_ENV
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v5
+      env:
+        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
       with:
         args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
         version: latest
@@ -426,14 +433,17 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
+    - id: version
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
     - name: Checkout Scripts Repo
       uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -506,14 +516,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -543,12 +550,46 @@ jobs:
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
-    - name: Set PACKAGE_VERSION to Env
-      run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
-        $GITHUB_ENV
     - name: Publish Java SDK
       uses: gradle/gradle-build-action@v3
+      env:
+        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
       with:
         arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
         build-root-directory: ./sdk/java
         gradle-version: 7.4.1
+  publish_go_sdk:
+    runs-on: ubuntu-latest
+    name: publish-go-sdk
+    needs: publish_sdk
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        lfs: true
+    - id: version
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
+    - name: Download go SDK
+      uses: actions/download-artifact@v4
+      with:
+        name: go-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: Uncompress go SDK
+      run: tar -zxf ${{github.workspace}}/sdk/go.tar.gz -C
+        ${{github.workspace}}/sdk/go
+    - name: Publish Go SDK
+      uses: pulumi/publish-go-sdk-action@v1
+      with:
+        repository: ${{ github.repository }}
+        base-ref: ${{ github.sha }}
+        source: sdk
+        path: sdk
+        version: ${{ steps.version.outputs.version }}
+        additive: false
+        files: |-
+          go.*
+          go/**
+          !*.tar.gz

.github/workflows/release.yml

@@ -56,14 +56,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -113,7 +110,14 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        allowed-changes: |-
+          sdk/**/pulumi-plugin.json
+          sdk/dotnet/Pulumi.*.csproj
+          sdk/go/*/internal/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
@@ -155,14 +159,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -213,7 +214,14 @@ jobs:
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        allowed-changes: |-
+          sdk/**/pulumi-plugin.json
+          sdk/dotnet/Pulumi.*.csproj
+          sdk/go/*/internal/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
@@ -251,14 +259,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -370,8 +375,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Unshallow clone for tags
+    - id: version
-      run: git fetch --prune --unshallow --tags
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -402,11 +410,10 @@ jobs:
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
         role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
-    - name: Set PreRelease Version
-      run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)"
-        >> $GITHUB_ENV
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v5
+      env:
+        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
       with:
         args: -p 3 release --clean --timeout 60m0s
         version: latest
@@ -426,14 +433,17 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
+    - id: version
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
     - name: Checkout Scripts Repo
       uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -506,14 +516,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -543,34 +550,52 @@ jobs:
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
-    - name: Set PACKAGE_VERSION to Env
-      run: echo "PACKAGE_VERSION=$(pulumictl get version --language generic)" >>
-        $GITHUB_ENV
     - name: Publish Java SDK
       uses: gradle/gradle-build-action@v3
+      env:
+        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
       with:
         arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
         build-root-directory: ./sdk/java
         gradle-version: 7.4.1
-  tag_sdk:
+  publish_go_sdk:
     runs-on: ubuntu-latest
+    name: publish-go-sdk
     needs: publish_sdk
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Install pulumictl
+    - id: version
-      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        repo: pulumi/pulumictl
+        set-env: PROVIDER_VERSION
-    - name: Add SDK version tag
+    - name: Download go SDK
-      run: git tag sdk/v$(pulumictl get version --language generic) && git push origin
+      uses: actions/download-artifact@v4
-        sdk/v$(pulumictl get version --language generic)
+      with:
-    name: tag_sdk
+        name: go-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: Uncompress go SDK
+      run: tar -zxf ${{github.workspace}}/sdk/go.tar.gz -C
+        ${{github.workspace}}/sdk/go
+    - name: Publish Go SDK
+      uses: pulumi/publish-go-sdk-action@v1
+      with:
+        repository: ${{ github.repository }}
+        base-ref: ${{ github.sha }}
+        source: sdk
+        path: sdk
+        version: ${{ steps.version.outputs.version }}
+        additive: false
+        files: |-
+          go.*
+          go/**
+          !*.tar.gz
   dispatch_docs_build:
     runs-on: ubuntu-latest
-    needs: tag_sdk
+    needs: publish_go_sdk
     steps:
     - name: Install pulumictl
       uses: jaxxstorm/action-install-gh-release@v1.11.0

.github/workflows/run-acceptance-tests.yml

@@ -81,14 +81,11 @@ jobs:
       with:
         lfs: true
         ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -138,7 +135,14 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        allowed-changes: |-
+          sdk/**/pulumi-plugin.json
+          sdk/dotnet/Pulumi.*.csproj
+          sdk/go/*/internal/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
@@ -183,14 +187,11 @@ jobs:
       with:
         lfs: true
         ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:
@@ -241,7 +242,14 @@ jobs:
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        allowed-changes: |-
+          sdk/**/pulumi-plugin.json
+          sdk/dotnet/Pulumi.*.csproj
+          sdk/go/*/internal/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
@@ -283,14 +291,11 @@ jobs:
       with:
         lfs: true
         ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Checkout Scripts Repo
+    - id: version
-      uses: actions/checkout@v4
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
       with:
-        path: ci-scripts
+        set-env: PROVIDER_VERSION
-        repository: pulumi/scripts
-    - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
     - name: Install Go
       uses: actions/setup-go@v5
       with:

.github/workflows/weekly-pulumi-update.yml

@@ -54,8 +54,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         lfs: true
-    - name: Unshallow clone for tags
+    - id: version
-      run: git fetch --prune --unshallow --tags
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
     - name: Install Go
       uses: actions/setup-go@v5
       with:

CHANGELOG.md

@@ -0,0 +1,12 @@
+## Unreleased
+
+## 0.0.2 (2024-04-25)
+
+### Fixed
+
+- Upgraded pulumi-go-provider to fix a panic during cancellation.
+
+## 0.0.1 (2024-04-23)
+
+Initial release.
+

Makefile

@@ -7,7 +7,6 @@ NODE_MODULE_NAME := @pulumi/docker-build
 NUGET_PKG_NAME   := Pulumi.DockerBuild
 
 PROVIDER         := pulumi-resource-${PACK}
-VERSION          ?= $(shell pulumictl get version)
 PROVIDER_PATH    := provider
 VERSION_PATH     := ${PROVIDER_PATH}.Version
 SCHEMA_PATH      := ${PROVIDER_PATH}/cmd/pulumi-resource-${PACK}/schema.json
@@ -21,6 +20,12 @@ TESTPARALLELISM  := 4
 PULUMI           := bin/pulumi
 GOGLANGCILINT    := bin/golangci-lint
 
+# Override during CI using `make [TARGET] PROVIDER_VERSION=""` or by setting a PROVIDER_VERSION environment variable
+# Local & branch builds will just used this fixed default version unless specified
+PROVIDER_VERSION ?= 1.0.0-alpha.0+dev
+# Use this normalised version everywhere rather than the raw input to ensure consistency.
+VERSION_GENERIC = $(shell pulumictl convert-version --language generic --version "$(PROVIDER_VERSION)")
+
 .PHONY: ensure
 ensure:: tidy lint test_provider examples
 
@@ -35,7 +40,7 @@ provider: bin/${PROVIDER} bin/pulumi-gen-${PACK} # Required by CI
 local_generate: sdk # Required by CI
 
 provider_debug::
-	(cd provider && go build -o $(WORKING_DIR)/bin/${PROVIDER} -gcflags="all=-N -l" -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
+	(cd provider && go build -o $(WORKING_DIR)/bin/${PROVIDER} -gcflags="all=-N -l" -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
 
 test_provider:: # Required by CI
 	go test -short -v -coverprofile="coverage.txt" -coverpkg=./provider/... -timeout 2h -parallel ${TESTPARALLELISM} ./provider/...
@@ -176,7 +181,7 @@ ${SCHEMA_PATH}: bin/${PROVIDER}
 	pulumi package get-schema bin/${PROVIDER} > $(SCHEMA_PATH)
 
 bin/${PROVIDER}: $(shell find ./provider -name '*.go') go.mod
-	(cd provider && go build -o ../bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
+	(cd provider && go build -o ../bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
 
 bin/pulumi-gen-${PACK}: # Required by CI
 	touch bin/pulumi-gen-${PACK}
@@ -187,7 +192,7 @@ go.sum: go.mod
 sdk: $(shell mkdir -p sdk)
 sdk: sdk/python sdk/nodejs sdk/java sdk/python sdk/go sdk/dotnet
 
-sdk/python: PYPI_VERSION := $(shell pulumictl get version --language python)
+sdk/python: PYPI_VERSION := $(shell pulumictl convert-version --language python -v "$(VERSION_GENERIC)")
 sdk/python: TMPDIR := $(shell mktemp -d)
 sdk/python: $(PULUMI) bin/${PROVIDER}
 	rm -rf sdk/python
@@ -203,7 +208,7 @@ sdk/python: $(PULUMI) bin/${PROVIDER}
 		../venv/bin/python -m build .
 	mv -f ${TMPDIR}/python ${WORKING_DIR}/sdk/.
 
-sdk/nodejs: NODE_VERSION := $(shell pulumictl get version --language javascript)
+sdk/nodejs: NODE_VERSION := $(shell pulumictl convert-version --language javascript -v "$(VERSION_GENERIC)")
 sdk/nodejs: TMPDIR := $(shell mktemp -d)
 sdk/nodejs: $(PULUMI) bin/${PROVIDER}
 	rm -rf sdk/nodejs
@@ -228,7 +233,7 @@ sdk/go: $(PULUMI) bin/${PROVIDER}
 		go mod tidy
 	mv -f ${TMPDIR}/go ${WORKING_DIR}/sdk/go
 
-sdk/dotnet: DOTNET_VERSION  := $(shell pulumictl get version --language dotnet)
+sdk/dotnet: DOTNET_VERSION  := $(shell pulumictl convert-version --language dotnet -v "$(VERSION_GENERIC)")
 sdk/dotnet: TMPDIR := $(shell mktemp -d)
 sdk/dotnet: $(PULUMI) bin/${PROVIDER}
 	rm -rf sdk/dotnet
@@ -238,7 +243,7 @@ sdk/dotnet: $(PULUMI) bin/${PROVIDER}
 		dotnet build /p:Version=${DOTNET_VERSION}
 	mv -f ${TMPDIR}/dotnet ${WORKING_DIR}/sdk/.
 
-sdk/java: PACKAGE_VERSION := $(shell pulumictl get version --language generic)
+sdk/java: PACKAGE_VERSION := $(shell pulumictl convert-version --language generic -v "$(VERSION_GENERIC)")
 sdk/java: TMPDIR := $(shell mktemp -d)
 sdk/java: $(PULUMI) bin/${PROVIDER}
 	rm -rf sdk/java

go.mod

@@ -15,8 +15,7 @@ require (
 	github.com/muesli/reflow v0.3.0
 	github.com/otiai10/copy v1.14.0
 	github.com/pulumi/providertest v0.0.12
-	github.com/pulumi/pulumi-go-provider v0.16.0
+	github.com/pulumi/pulumi-go-provider v0.16.1-0.20240426163030-72606b1e6fb7
-	github.com/pulumi/pulumi-go-provider/integration v0.10.1-0.20240314105842-9fbffb634faf
 	github.com/pulumi/pulumi-java/pkg v0.10.0
 	github.com/pulumi/pulumi/pkg/v3 v3.113.3
 	github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20240415162817-44c8de53d5d2
@@ -455,7 +454,7 @@ require (
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f // indirect
 	golang.org/x/mod v0.16.0 // indirect
-	golang.org/x/net v0.22.0 // indirect
+	golang.org/x/net v0.23.0 // indirect
 	golang.org/x/oauth2 v0.18.0 // indirect
 	golang.org/x/sync v0.6.0 // indirect
 	golang.org/x/sys v0.18.0 // indirect

go.sum

@@ -2316,10 +2316,8 @@ github.com/pulumi/esc v0.6.2 h1:+z+l8cuwIauLSwXQS0uoI3rqB+YG4SzsZYtHfNoXBvw=
 github.com/pulumi/esc v0.6.2/go.mod h1:jNnYNjzsOgVTjCp0LL24NsCk8ZJxq4IoLQdCT0X7l8k=
 github.com/pulumi/providertest v0.0.12 h1:UjcFQHHs4AGJyJqxhvC2q8yVQ7Li+UyCyP95HZcK03U=
 github.com/pulumi/providertest v0.0.12/go.mod h1:REAoaN+hGOtdWJGirfWYqcSjCejlbGfzyVTUuemJTuE=
-github.com/pulumi/pulumi-go-provider v0.16.0 h1:vLAiECprIoLdTPd0UFs9Vv/HgSw7l/SBAurRBm3vpSU=
+github.com/pulumi/pulumi-go-provider v0.16.1-0.20240426163030-72606b1e6fb7 h1:zHoiZbyFIeEfdoaqwA9Lp3jzdDgtdCPKM2aWhaA4EGg=
-github.com/pulumi/pulumi-go-provider v0.16.0/go.mod h1:2yjjeyMSmsb/o/BRJeWk+kcXrJWF5U2EulJKnN7qVLs=
+github.com/pulumi/pulumi-go-provider v0.16.1-0.20240426163030-72606b1e6fb7/go.mod h1:sJUl1EjF3BQXAkrOeRhS3kZq17lz2o2QnTQd+c1FepU=
-github.com/pulumi/pulumi-go-provider/integration v0.10.1-0.20240314105842-9fbffb634faf h1:7fDWArOUFH+qQ9EywoC4K2ElXP76Ks/CtVJkEBmv2pk=
-github.com/pulumi/pulumi-go-provider/integration v0.10.1-0.20240314105842-9fbffb634faf/go.mod h1:sf87soow+4JkV361vHI0W04hpJmWiWajzJytFMNonCE=
 github.com/pulumi/pulumi-java/pkg v0.10.0 h1:D1i5MiiNrxYr2uJ1szcj1aQwF9DYv7TTsPmajB9dKSw=
 github.com/pulumi/pulumi-java/pkg v0.10.0/go.mod h1:xu6UgYtQm+xXOo1/DZNa2CWVPytu+RMkZVTtI7w7ffY=
 github.com/pulumi/pulumi-yaml v1.6.0 h1:mb/QkebWXTa1fR+P3ZkCCHGXOYC6iTN8X8By9eNz8xM=
@@ -3003,8 +3001,8 @@ golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
-golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=

provider/internal/cache.go

@@ -17,6 +17,7 @@ package internal
 import (
 	"errors"
 	"fmt"
+	"reflect"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
@@ -460,6 +461,23 @@ func (c CacheFrom) String() string {
 	return join(c.Local, c.Registry, c.GHA, c.AZBlob, c.S3, c.Raw)
 }
 
+// Diff returns false if both cache entries are identical enough to ignore
+// changes during diff. Differences to tokens are allowed.
+func (c CacheFrom) Diff(other CacheFrom) bool {
+	if c.GHA != nil && other.GHA != nil {
+		other.GHA.Token = c.GHA.Token
+	}
+	if c.S3 != nil && other.S3 != nil {
+		other.S3.AccessKeyID = c.S3.AccessKeyID
+		other.S3.SecretAccessKey = c.S3.SecretAccessKey
+		other.S3.SessionToken = c.S3.SessionToken
+	}
+	if c.AZBlob != nil && other.AZBlob != nil {
+		other.AZBlob.SecretAccessKey = c.AZBlob.SecretAccessKey
+	}
+	return reflect.DeepEqual(c, other)
+}
+
 func (c CacheFrom) validate(preview bool) (*controllerapi.CacheOptionsEntry, error) {
 	if strings.Count(c.String(), "type=") > 1 {
 		return nil, errors.New("cacheFrom should only specify one cache type")
@@ -670,6 +688,23 @@ func (c CacheTo) String() string {
 	return join(c.Inline, c.Local, c.Registry, c.GHA, c.AZBlob, c.S3, c.Raw)
 }
 
+// Diff returns false if both cache entries are identical enough to ignore
+// changes during diff. Differences to tokens are allowed.
+func (c CacheTo) Diff(other CacheTo) bool {
+	if c.GHA != nil && other.GHA != nil {
+		other.GHA.Token = c.GHA.Token
+	}
+	if c.S3 != nil && other.S3 != nil {
+		other.S3.AccessKeyID = c.S3.AccessKeyID
+		other.S3.SecretAccessKey = c.S3.SecretAccessKey
+		other.S3.SessionToken = c.S3.SessionToken
+	}
+	if c.AZBlob != nil && other.AZBlob != nil {
+		other.AZBlob.SecretAccessKey = c.AZBlob.SecretAccessKey
+	}
+	return reflect.DeepEqual(c, other)
+}
+
 func (c CacheTo) validate(preview bool) (*controllerapi.CacheOptionsEntry, error) {
 	if strings.Count(c.String(), "type=") > 1 {
 		return nil, errors.New("cacheTo should only specify one cache type")

provider/internal/cli.go

@@ -19,6 +19,7 @@ package internal
 import (
 	"bufio"
 	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -40,7 +41,6 @@ import (
 	"github.com/sirupsen/logrus"
 
 	provider "github.com/pulumi/pulumi-go-provider"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/diag"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
 )
@@ -157,7 +157,7 @@ func (c *cli) rc() *regclient.RegClient {
 
 // tail is meant to be called as a goroutine and will pipe output from the CLI
 // back to the Pulumi engine. Requires a corresponding call to close.
-func (c *cli) tail(ctx provider.Context) {
+func (c *cli) tail(ctx context.Context) {
 	c.done = make(chan struct{}, 1)
 	defer func() {
 		c.done <- struct{}{}
@@ -171,18 +171,18 @@ func (c *cli) tail(ctx provider.Context) {
 	s := bufio.NewScanner(c.r)
 	for s.Scan() {
 		text := s.Text()
-		ctx.LogStatus(diag.Info, text)
+		provider.GetLogger(ctx).InfoStatus(text)
 		_, _ = b.WriteString(text + "\n")
 	}
-	ctx.LogStatus(diag.Info, "") // clear confusing "DONE" statements.
+	provider.GetLogger(ctx).InfoStatus("") // clear confusing "DONE" statements.
 
 	if c.dumplogs {
 		// Persist the full Docker output on error for easier debugging.
 		if b.Len() > 0 {
-			ctx.Log(diag.Info, b.String())
+			provider.GetLogger(ctx).Info(b.String())
 		}
 		if c.err.Len() > 0 {
-			ctx.Log(diag.Error, c.err.String())
+			provider.GetLogger(ctx).Error(c.err.String())
 		}
 	}
 }

provider/internal/client.go

@@ -45,20 +45,19 @@ import (
 	"github.com/regclient/regclient/types/ref"
 
 	provider "github.com/pulumi/pulumi-go-provider"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/diag"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
 )
 
 // Client handles all our Docker API calls.
 type Client interface {
-	Build(ctx provider.Context, b Build) (*client.SolveResponse, error)
+	Build(ctx context.Context, b Build) (*client.SolveResponse, error)
 	BuildKitEnabled() (bool, error)
 	Inspect(ctx context.Context, id string) ([]descriptor.Descriptor, error)
 	Delete(ctx context.Context, id string) error
 
-	ManifestCreate(ctx provider.Context, push bool, target string, refs ...string) error
+	ManifestCreate(ctx context.Context, push bool, target string, refs ...string) error
-	ManifestInspect(ctx provider.Context, target string) (string, error)
+	ManifestInspect(ctx context.Context, target string) (string, error)
-	ManifestDelete(ctx provider.Context, target string) error
+	ManifestDelete(ctx context.Context, target string) error
 }
 
 // Build encapsulates all of the user-provider build parameters and options.
@@ -98,13 +97,12 @@ func newDockerCLI(config *Config) (*command.DockerCli, error) {
 // "default", if no targets were specified) to SolveResponses, which capture
 // the build's digest and tags (if any).
 func (c *cli) Build(
-	pctx provider.Context,
+	ctx context.Context,
 	build Build,
 ) (*client.SolveResponse, error) {
-	ctx := context.Context(pctx)
 	opts := build.BuildOptions()
 
-	go c.tail(pctx)
+	go c.tail(ctx)
 	defer contract.IgnoreClose(c)
 
 	if build.ShouldExec() {
@@ -134,7 +132,7 @@ func (c *cli) Build(
 			for _, d := range w.Detail {
 				fmt.Fprintf(b, "\n%s", d)
 			}
-			pctx.Log(diag.Warning, b.String())
+			provider.GetLogger(ctx).Warning(b.String())
 		}
 	}()
 
@@ -247,7 +245,7 @@ func (c *cli) BuildKitEnabled() (bool, error) {
 	return c.Cli.BuildKitEnabled()
 }
 
-func (c *cli) ManifestCreate(ctx provider.Context, push bool, target string, refs ...string) error {
+func (c *cli) ManifestCreate(ctx context.Context, push bool, target string, refs ...string) error {
 	go c.tail(ctx)
 	defer contract.IgnoreClose(c)
 
@@ -271,11 +269,11 @@ func (c *cli) ManifestCreate(ctx provider.Context, push bool, target string, ref
 	cmd.SetErr(c.Err())
 	cmd.SetOut(c.Out())
 
-	ctx.Log(diag.Debug, fmt.Sprint("creating manifest with args", args))
+	provider.GetLogger(ctx).Debug(fmt.Sprint("creating manifest with args", args))
 	return cmd.ExecuteContext(ctx)
 }
 
-func (c *cli) ManifestInspect(ctx provider.Context, target string) (string, error) {
+func (c *cli) ManifestInspect(ctx context.Context, target string) (string, error) {
 	rc := c.rc()
 
 	ref, err := ref.New(target)
@@ -291,7 +289,7 @@ func (c *cli) ManifestInspect(ctx provider.Context, target string) (string, erro
 	return string(m.GetDescriptor().Digest), nil
 }
 
-func (c *cli) ManifestDelete(ctx provider.Context, target string) error {
+func (c *cli) ManifestDelete(ctx context.Context, target string) error {
 	rc := c.rc()
 
 	ref, err := ref.New(target)
@@ -299,9 +297,9 @@ func (c *cli) ManifestDelete(ctx provider.Context, target string) error {
 		return err
 	}
 
-	err = rc.ManifestDelete(context.Context(ctx), ref)
+	err = rc.ManifestDelete(ctx, ref)
 	if errors.Is(err, errs.ErrHTTPStatus) {
-		ctx.Log(diag.Warning, "this registry does not support deletions")
+		provider.GetLogger(ctx).Warning("this registry does not support deletions")
 		return nil
 	}
 	if err != nil {

provider/internal/client_test.go

@@ -17,6 +17,8 @@ package internal
 import (
 	"bytes"
 	"context"
+	"io"
+	"log/slog"
 	"os"
 	"path/filepath"
 	"testing"
@@ -24,9 +26,6 @@ import (
 	"github.com/docker/docker/api/types/registry"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
-
-	"github.com/pulumi/pulumi/sdk/v3/go/common/diag"
 )
 
 func TestAuth(t *testing.T) {
@@ -79,21 +78,9 @@ func TestCustomHost(t *testing.T) {
 
 func TestBuild(t *testing.T) {
 	t.Parallel()
-	// Workaround for https://github.com/pulumi/pulumi-go-provider/issues/159
-	ctrl, ctx := gomock.WithContext(context.Background(), t)
-	pctx := NewMockProviderContext(ctrl)
-	pctx.EXPECT().Log(gomock.Any(), gomock.Any()).AnyTimes()
-	pctx.EXPECT().LogStatus(gomock.Any(), gomock.Any()).AnyTimes()
-	pctx.EXPECT().Done().Return(ctx.Done()).AnyTimes()
-	pctx.EXPECT().
-		Value(gomock.Any()).
-		DoAndReturn(func(key any) any { return ctx.Value(key) }).
-		AnyTimes()
-	pctx.EXPECT().Err().Return(ctx.Err()).AnyTimes()
-	pctx.EXPECT().Deadline().Return(ctx.Deadline()).AnyTimes()
 
 	tmpdir := t.TempDir()
-	max := Max
+	Max := Max
 
 	exampleContext := &BuildContext{Context: Context{Location: "../../examples/app"}}
 
@@ -135,7 +122,7 @@ func TestBuild(t *testing.T) {
 				Tags:    []string{"cached"},
 				CacheTo: []CacheTo{{Local: &CacheToLocal{
 					Dest:          filepath.Join(tmpdir, "cache"),
-					CacheWithMode: CacheWithMode{Mode: &max},
+					CacheWithMode: CacheWithMode{Mode: &Max},
 				}}},
 				CacheFrom: []CacheFrom{{Local: &CacheFromLocal{
 					Src: filepath.Join(tmpdir, "cache"),
@@ -300,12 +287,13 @@ func TestBuild(t *testing.T) {
 			if tt.skip {
 				t.Skip()
 			}
+			ctx := context.Background()
 			cli := testcli(t, true, tt.auths...)
 
-			build, err := tt.args.toBuild(pctx, false)
+			build, err := tt.args.toBuild(ctx, false)
 			require.NoError(t, err)
 
-			_, err = cli.Build(pctx, build)
+			_, err = cli.Build(ctx, build)
 			assert.NoError(t, err, cli.err.String())
 		})
 	}
@@ -366,14 +354,22 @@ func TestNormalizeReference(t *testing.T) {
 	}
 }
 
+//nolint:paralleltest // Overrides default logger.
 func TestBuildError(t *testing.T) {
-	t.Parallel()
-
 	if os.Getenv("CI") != "" {
 		t.Skip("flaky on CI for some reason")
 	}
 
-	ctrl, ctx := gomock.WithContext(context.Background(), t)
+	l := slog.Default()
+	defer slog.SetDefault(l)
+
+	// Override go-provider's default logger to capture and tee to stdout.
+	logger := &bytes.Buffer{}
+	slog.SetDefault(
+		slog.New(
+			slog.NewTextHandler(io.MultiWriter(logger, os.Stdout), nil),
+		),
+	)
 
 	exampleContext := &BuildContext{Context: Context{Location: "../../examples/app"}}
 
@@ -383,28 +379,14 @@ func TestBuildError(t *testing.T) {
 			Inline: "FROM alpine\nRUN echo hello\nRUN badcmd",
 		},
 	}
-	logged := bytes.Buffer{}
-
-	pctx := NewMockProviderContext(ctrl)
-	pctx.EXPECT().Done().Return(ctx.Done()).AnyTimes()
-	pctx.EXPECT().
-		Value(gomock.Any()).
-		DoAndReturn(func(key any) any { return ctx.Value(key) }).
-		AnyTimes()
-	pctx.EXPECT().Err().Return(ctx.Err()).AnyTimes()
-	pctx.EXPECT().Deadline().Return(ctx.Deadline()).AnyTimes()
-
-	pctx.EXPECT().LogStatus(gomock.Any(), gomock.Any()).AnyTimes()
-	pctx.EXPECT().Log(gomock.Any(), gomock.Any()).DoAndReturn(func(_ diag.Severity, msg string) {
-		logged.WriteString(msg)
-	}).AnyTimes()
 
+	ctx := context.Background()
 	cli := testcli(t, true)
 
-	build, err := args.toBuild(pctx, false)
+	build, err := args.toBuild(ctx, false)
 	require.NoError(t, err)
 
-	_, err = cli.Build(pctx, build)
+	_, err = cli.Build(ctx, build)
 	assert.Error(t, err)
 
 	want := []string{
@@ -413,7 +395,7 @@ func TestBuildError(t *testing.T) {
 	}
 
 	for _, want := range want {
-		assert.Contains(t, logged.String(), want)
+		assert.Contains(t, logger.String(), want)
 	}
 	assert.ErrorContains(t, err,
 		`process "/bin/sh -c badcmd" did not complete successfully: exit code: 127`,
@@ -422,7 +404,6 @@ func TestBuildError(t *testing.T) {
 
 func TestBuildExecError(t *testing.T) {
 	t.Parallel()
-	ctrl, _ := gomock.WithContext(context.Background(), t)
 
 	exampleContext := &BuildContext{Context: Context{Location: "../../examples/app"}}
 
@@ -434,20 +415,13 @@ func TestBuildExecError(t *testing.T) {
 		Exec: true,
 	}
 
-	pctx := NewMockProviderContext(ctrl)
+	ctx := context.Background()
-	pctx.EXPECT().Log(
-		diag.Warning,
-		"No exports were specified so the build will only remain in the local build cache. "+
-			"Use `push` to upload the image to a registry, or silence this warning with a `cacheonly` export.",
-	)
-	pctx.EXPECT().LogStatus(gomock.Any(), gomock.Any()).AnyTimes()
-
 	cli := testcli(t, true)
 
-	build, err := args.toBuild(pctx, false)
+	build, err := args.toBuild(ctx, false)
 	require.NoError(t, err)
 
-	_, err = cli.Build(pctx, build)
+	_, err = cli.Build(ctx, build)
 	assert.Error(t, err)
 
 	want := []string{

provider/internal/deprecated/configencoding.go

@@ -17,9 +17,6 @@ package deprecated
 import (
 	"encoding/json"
 	"fmt"
-	"sort"
-
-	"google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
@@ -113,6 +110,7 @@ func (enc *ConfigEncoding) unmarshalOpts() plugin.MarshalOptions {
 	return plugin.MarshalOptions{
 		Label:        "config",
 		KeepUnknowns: true,
+		KeepSecrets:  true,
 		SkipNulls:    true,
 		RejectAssets: true,
 	}
@@ -120,15 +118,10 @@ func (enc *ConfigEncoding) unmarshalOpts() plugin.MarshalOptions {
 
 // Like plugin.UnmarshalPropertyValue but overrides string parsing with convertStringToPropertyValue.
 func (enc *ConfigEncoding) unmarshalPropertyValue(key resource.PropertyKey,
-	v *structpb.Value,
+	pv resource.PropertyValue,
-) (*resource.PropertyValue, error) {
+) (resource.PropertyValue, error) {
 	opts := enc.unmarshalOpts()
 
-	pv, err := plugin.UnmarshalPropertyValue(key, v, enc.unmarshalOpts())
-	if err != nil {
-		return nil, fmt.Errorf("error unmarshalling property %q: %w", key, err)
-	}
-
 	prop, ok := enc.schema.Variables[string(key)]
 
 	// Only apply JSON-encoded recognition for known fields.
@@ -136,8 +129,10 @@ func (enc *ConfigEncoding) unmarshalPropertyValue(key resource.PropertyKey,
 		return pv, nil
 	}
 
-	var jsonString string
+	var (
-	var jsonStringDetected, jsonStringSecret bool
+		jsonString                           string
+		jsonStringDetected, jsonStringSecret bool
+	)
 
 	if pv.IsString() {
 		jsonString = pv.StringValue()
@@ -153,22 +148,21 @@ func (enc *ConfigEncoding) unmarshalPropertyValue(key resource.PropertyKey,
 	if jsonStringDetected {
 		v, err := enc.convertStringToPropertyValue(jsonString, prop)
 		if err != nil {
-			return nil, fmt.Errorf("error unmarshalling property %q: %w", key, err)
+			return resource.PropertyValue{}, fmt.Errorf("error unmarshalling property %q: %w", key, err)
 		}
 		if jsonStringSecret {
-			s := resource.MakeSecret(v)
+			return resource.MakeSecret(v), nil
-			return &s, nil
 		}
-		return &v, nil
+		return v, nil
 	}
 
-	// Computed sentinels are coming in as always having an empty string, but the encoding coerses them to a zero
+	// Computed sentinels are coming in as always having an empty string, but the encoding coerces them to a zero
 	// value of the appropriate type.
 	if pv.IsComputed() {
 		el := pv.V.(resource.Computed).Element
 		if el.IsString() && el.StringValue() == "" {
 			res := resource.MakeComputed(enc.zeroValue(prop.Type))
-			return &res, nil
+			return res, nil
 		}
 	}
 
@@ -177,36 +171,20 @@ func (enc *ConfigEncoding) unmarshalPropertyValue(key resource.PropertyKey,
 
 // UnmarshalProperties is copied from plugin.UnmarshalProperties substituting plugin.UnmarshalPropertyValue.
 func (enc *ConfigEncoding) UnmarshalProperties(
-	props *structpb.Struct,
+	props resource.PropertyMap,
 ) (resource.PropertyMap, error) {
-	opts := enc.unmarshalOpts()
-
 	result := make(resource.PropertyMap)
 
 	// First sort the keys so we enumerate them in order (in case errors happen, we want determinism).
-	var keys []string
+	keys := props.StableKeys()
-	if props != nil {
-		for k := range props.Fields {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
-	}
 
 	// And now unmarshal every field it into the map.
 	for _, key := range keys {
-		pk := resource.PropertyKey(key)
+		v, err := enc.unmarshalPropertyValue(key, props[key])
-		v, err := enc.unmarshalPropertyValue(pk, props.Fields[key])
 		if err != nil {
-			return nil, err
+			return resource.PropertyMap{}, err
-		} else if v != nil {
-			if opts.SkipNulls && v.IsNull() {
-				continue
-			}
-			if opts.SkipInternalKeys && resource.IsInternalPropertyKey(pk) {
-				continue
-			}
-			result[pk] = *v
 		}
+		result[key] = v
 	}
 
 	return result, nil

provider/internal/deprecated/configencoding_test.go

@@ -16,23 +16,23 @@ package deprecated
 
 import (
 	"fmt"
+	"strconv"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	structpb "google.golang.org/protobuf/types/known/structpb"
+	"github.com/stretchr/testify/require"
 
 	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
 )
 
 func TestConfigEncoding(t *testing.T) {
 	t.Parallel()
 
 	type testCase struct {
-		ty schema.TypeSpec
+		ty    schema.TypeSpec
-		v  *structpb.Value
+		given resource.PropertyValue
-		pv resource.PropertyValue
+		want  resource.PropertyValue
 	}
 
 	knownKey := "mykey"
@@ -49,69 +49,64 @@ func TestConfigEncoding(t *testing.T) {
 		)
 	}
 
-	makeValue := func(x any) *structpb.Value {
-		vv, err := structpb.NewValue(x)
-		assert.NoErrorf(t, err, "structpb.NewValue failed")
-		return vv
-	}
-
 	checkUnmarshal := func(t *testing.T, tc testCase) {
 		enc := makeEnc(tc.ty)
-		pv, err := enc.unmarshalPropertyValue(resource.PropertyKey(knownKey), tc.v)
+		key := resource.PropertyKey(knownKey)
-		assert.NoError(t, err)
+
-		assert.NotNil(t, pv)
+		actual, err := enc.unmarshalPropertyValue(key, tc.given)
-		assert.Equal(t, tc.pv, *pv)
+		require.NoError(t, err)
+		assert.Equal(t, tc.want, actual)
 	}
 
 	turnaroundTestCases := []testCase{
 		{
 			schema.TypeSpec{Type: "boolean"},
-			makeValue(`true`),
+			resource.NewPropertyValue(`true`),
 			resource.NewBoolProperty(true),
 		},
 		{
 			schema.TypeSpec{Type: "boolean"},
-			makeValue(`false`),
+			resource.NewPropertyValue(`false`),
 			resource.NewBoolProperty(false),
 		},
 		{
 			schema.TypeSpec{Type: "integer"},
-			makeValue(`0`),
+			resource.NewPropertyValue(`0`),
 			resource.NewNumberProperty(0),
 		},
 		{
 			schema.TypeSpec{Type: "integer"},
-			makeValue(`42`),
+			resource.NewPropertyValue(`42`),
 			resource.NewNumberProperty(42),
 		},
 		{
 			schema.TypeSpec{Type: "number"},
-			makeValue(`0`),
+			resource.NewPropertyValue(`0`),
 			resource.NewNumberProperty(0.0),
 		},
 		{
 			schema.TypeSpec{Type: "number"},
-			makeValue(`42.5`),
+			resource.NewPropertyValue(`42.5`),
 			resource.NewNumberProperty(42.5),
 		},
 		{
 			schema.TypeSpec{Type: "string"},
-			structpb.NewStringValue(""),
+			resource.NewStringProperty(""),
 			resource.NewStringProperty(""),
 		},
 		{
 			schema.TypeSpec{Type: "string"},
-			structpb.NewStringValue("hello"),
+			resource.NewStringProperty("hello"),
 			resource.NewStringProperty("hello"),
 		},
 		{
 			schema.TypeSpec{Type: "array"},
-			makeValue(`[]`),
+			resource.NewPropertyValue(`[]`),
 			resource.NewArrayProperty([]resource.PropertyValue{}),
 		},
 		{
 			schema.TypeSpec{Type: "array"},
-			makeValue(`["hello","there"]`),
+			resource.NewPropertyValue(`["hello","there"]`),
 			resource.NewArrayProperty([]resource.PropertyValue{
 				resource.NewStringProperty("hello"),
 				resource.NewStringProperty("there"),
@@ -119,12 +114,12 @@ func TestConfigEncoding(t *testing.T) {
 		},
 		{
 			schema.TypeSpec{Type: "object"},
-			makeValue(`{}`),
+			resource.NewPropertyValue(`{}`),
 			resource.NewObjectProperty(resource.PropertyMap{}),
 		},
 		{
 			schema.TypeSpec{Type: "object"},
-			makeValue(`{"key":"value"}`),
+			resource.NewPropertyValue(`{"key":"value"}`),
 			resource.NewObjectProperty(resource.PropertyMap{
 				"key": resource.NewStringProperty("value"),
 			}),
@@ -135,7 +130,7 @@ func TestConfigEncoding(t *testing.T) {
 		for i, tc := range turnaroundTestCases {
 			tc := tc
 
-			t.Run(fmt.Sprintf("UnmarshalPropertyValue/%d", i), func(t *testing.T) {
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
 				t.Parallel()
 				checkUnmarshal(t, tc)
 			})
@@ -147,32 +142,32 @@ func TestConfigEncoding(t *testing.T) {
 		cases := []testCase{
 			{
 				schema.TypeSpec{Type: "boolean"},
-				makeValue(""),
+				resource.NewPropertyValue(""),
 				resource.NewBoolProperty(false),
 			},
 			{
 				schema.TypeSpec{Type: "number"},
-				makeValue(""),
+				resource.NewPropertyValue(""),
 				resource.NewNumberProperty(0.),
 			},
 			{
 				schema.TypeSpec{Type: "integer"},
-				makeValue(""),
+				resource.NewPropertyValue(""),
 				resource.NewNumberProperty(0),
 			},
 			{
 				schema.TypeSpec{Type: "string"},
-				makeValue(""),
+				resource.NewPropertyValue(""),
 				resource.NewStringProperty(""),
 			},
 			{
 				schema.TypeSpec{Type: "object"},
-				makeValue(""),
+				resource.NewPropertyValue(""),
 				resource.NewObjectProperty(make(resource.PropertyMap)),
 			},
 			{
 				schema.TypeSpec{Type: "array"},
-				makeValue(""),
+				resource.NewPropertyValue(""),
 				resource.NewArrayProperty([]resource.PropertyValue{}),
 			},
 		}
@@ -187,18 +182,18 @@ func TestConfigEncoding(t *testing.T) {
 	})
 
 	t.Run("computed", func(t *testing.T) {
-		unk := makeValue(plugin.UnknownStringValue)
+		unk := resource.MakeComputed(resource.NewStringProperty(""))
 
 		for i, tc := range turnaroundTestCases {
 			tc := tc
 
-			t.Run(fmt.Sprintf("UnmarshalPropertyValue/%d", i), func(t *testing.T) {
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
 				t.Parallel()
 				// Unknown sentinel unmarshals to a Computed with a type-appropriate zero value.
 				checkUnmarshal(t, testCase{
-					tc.ty,
+					ty:    tc.ty,
-					unk,
+					given: unk,
-					resource.MakeComputed(makeEnc(tc.ty).zeroValue(tc.ty.Type)),
+					want:  resource.MakeComputed(makeEnc(tc.ty).zeroValue(tc.ty.Type)),
 				})
 			})
 		}
@@ -215,46 +210,30 @@ func TestConfigEncoding(t *testing.T) {
 
 		var secretCases []testCase
 
-		pbSecret := func(v *structpb.Value) *structpb.Value {
-			return structpb.NewStructValue(&structpb.Struct{Fields: map[string]*structpb.Value{
-				"4dabf18193072939515e22adb298388d": makeValue("1b47061264138c4ac30d75fd1eb44270"),
-				"value":                            v,
-			}})
-		}
-
 		for _, tc := range turnaroundTestCases {
 			secretCases = append(secretCases, testCase{
-				tc.ty,
+				ty:    tc.ty,
-				pbSecret(tc.v),
+				given: resource.MakeSecret(tc.given),
-				resource.MakeSecret(tc.pv),
+				want:  resource.MakeSecret(tc.want),
 			})
 		}
 
 		for i, tc := range secretCases {
 			tc := tc
 
-			t.Run(fmt.Sprintf("secret/UnmarshalPropertyValue/%d", i), func(t *testing.T) {
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
 				t.Parallel()
-
-				// Unmarshallin will remove secrts, so the expected value needs to be modified.
-				tc.pv = tc.pv.SecretValue().Element
 				checkUnmarshal(t, tc)
 			})
 		}
 
-		t.Run("tolerate secrets in Configure", func(t *testing.T) {
+		t.Run("nested secrets", func(t *testing.T) {
-			// This is a bit of a histirocal quirk: the engine may send secrets to Configure before
-			// receiving the response from Configure indicating that the provider does not want to receive
-			// secrets. These are simply ignored. The engine does not currently send secrets to CheckConfig.
-			// The engine does take care of making sure the secrets are stored as such in the statefile.
-			//
-			// Check here that unmarshalilng such values removes the secrets.
 			checkUnmarshal(t, testCase{
 				schema.TypeSpec{Type: "object"},
-				pbSecret(makeValue(`{"key":"val"}`)),
+				resource.MakeSecret(resource.NewPropertyValue(`{"key":"val"}`)),
-				resource.NewObjectProperty(resource.PropertyMap{
+				resource.MakeSecret(resource.NewObjectProperty(resource.PropertyMap{
 					"key": resource.NewStringProperty("val"),
-				}),
+				})),
 			})
 		})
 	})
@@ -262,7 +241,7 @@ func TestConfigEncoding(t *testing.T) {
 	regressUnmarshalTestCases := []testCase{
 		{
 			schema.TypeSpec{Type: "array"},
-			makeValue(`
+			resource.NewPropertyValue(`
 			[
 			  {
 			    "address": "somewhere.org",
@@ -276,7 +255,7 @@ func TestConfigEncoding(t *testing.T) {
 			resource.NewArrayProperty([]resource.PropertyValue{
 				resource.NewObjectProperty(resource.PropertyMap{
 					"address":  resource.NewStringProperty("somewhere.org"),
-					"password": resource.NewStringProperty("some-password"),
+					"password": resource.MakeSecret(resource.NewStringProperty("some-password")),
 					"username": resource.NewStringProperty("some-user"),
 				}),
 			}),
@@ -286,7 +265,7 @@ func TestConfigEncoding(t *testing.T) {
 	t.Run("regress-unmarshal", func(t *testing.T) {
 		for i, tc := range regressUnmarshalTestCases {
 			tc := tc
-			t.Run(fmt.Sprintf("UnmarshalPropertyValue/%d", i), func(t *testing.T) {
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
 				t.Parallel()
 				checkUnmarshal(t, tc)
 			})

provider/internal/image.go

@@ -38,7 +38,6 @@ import (
 
 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/diag"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )
@@ -329,12 +328,10 @@ func (is *ImageState) Annotate(a infer.Annotator) {
 	`))
 }
 
-// client produces a CLI client with scoped to this resource and layered on top
+// client produces a CLI client scoped to this resource and layered on top of
-// of any host-level credentials.
+// any host-level credentials.
-func (i *Image) client(pctx provider.Context, state ImageState, args ImageArgs) (Client, error) {
+func (i *Image) client(ctx context.Context, state ImageState, args ImageArgs) (Client, error) {
-	ctx := context.Context(pctx)
+	cfg := infer.GetConfig[Config](ctx)
-
-	cfg := infer.GetConfig[Config](pctx)
 
 	if cli, ok := ctx.Value(_mockClientKey).(Client); ok {
 		return cli, nil
@@ -353,7 +350,7 @@ func (i *Image) client(pctx provider.Context, state ImageState, args ImageArgs)
 // Check validates ImageArgs, sets defaults, and ensures our client is
 // authenticated.
 func (i *Image) Check(
-	_ provider.Context,
+	_ context.Context,
 	_ string,
 	_ resource.PropertyMap,
 	news resource.PropertyMap,
@@ -491,7 +488,7 @@ func (b build) ShouldExec() bool {
 }
 
 func (ia ImageArgs) toBuild(
-	ctx provider.Context,
+	ctx context.Context,
 	preview bool,
 ) (Build, error) {
 	opts, err := ia.validate(preview)
@@ -500,18 +497,15 @@ func (ia ImageArgs) toBuild(
 	}
 
 	if len(ia.Exports) == 0 && !ia.Push && !ia.Load {
-		ctx.Log(diag.Warning,
+		provider.GetLogger(ctx).Warning(
-			"No exports were specified so the build will only remain in the local build cache. "+
+			"No exports were specified so the build will only remain in the local build cache. " +
-				"Use `push` to upload the image to a registry, or silence this warning with a `cacheonly` export.",
+				"Use `push` to upload the image to a registry, or silence this warning with a `cacheonly` export.")
-		)
 	}
 
 	if len(opts.Platforms) > 1 && len(opts.CacheTo) > 0 {
-		ctx.Log(
+		provider.GetLogger(ctx).Warning(
-			diag.Warning,
+			"Caching doesn't work reliably with multi-platform builds (https://github.com/docker/buildx/discussions/1382). " +
-			"Caching doesn't work reliably with multi-platform builds (https://github.com/docker/buildx/discussions/1382). "+
+				"Instead, perform one cached build per platform and create an Index to join them all together.")
-				"Instead, perform one cached build per platform and create an Index to join them all together.",
-		)
 	}
 
 	return build{
@@ -667,7 +661,7 @@ func (ia *ImageArgs) validate(preview bool) (controllerapi.BuildOptions, error)
 
 // Create builds an image using buildkit.
 func (i *Image) Create(
-	ctx provider.Context,
+	ctx context.Context,
 	name string,
 	input ImageArgs,
 	preview bool,
@@ -716,7 +710,7 @@ func (i *Image) Create(
 		return id, state, nil
 	}
 	if preview && !input.buildable() {
-		ctx.Log(diag.Warning, "Skipping preview build because some inputs are unknown.")
+		provider.GetLogger(ctx).Warning("Skipping preview build because some inputs are unknown.")
 		return id, state, nil
 	}
 
@@ -754,7 +748,7 @@ func (i *Image) Create(
 // images built locally there is nothing to delete. We treat those cases as
 // updates and simply re-build the image without deleting anything.
 func (i *Image) Update(
-	ctx provider.Context,
+	ctx context.Context,
 	name string,
 	_ ImageState,
 	input ImageArgs,
@@ -767,7 +761,7 @@ func (i *Image) Update(
 // Read attempts to read manifests from an image's exports. An image without
 // exports will have no manifests.
 func (i *Image) Read(
-	ctx provider.Context,
+	ctx context.Context,
 	name string,
 	input ImageArgs,
 	state ImageState,
@@ -801,7 +795,7 @@ func (i *Image) Read(
 		// Does a tag with this digest exist?
 		descriptors, err := cli.Inspect(ctx, ref)
 		if err != nil {
-			ctx.Log(diag.Warning, err.Error())
+			provider.GetLogger(ctx).Warning(err.Error())
 			continue
 		}
 
@@ -830,7 +824,7 @@ func (i *Image) Read(
 // Delete deletes an Image. If the Image was already deleted out-of-band it is
 // treated as a success.
 func (i *Image) Delete(
-	ctx provider.Context,
+	ctx context.Context,
 	_ string,
 	state ImageState,
 ) error {
@@ -861,9 +855,9 @@ func (i *Image) Delete(
 
 	var multierr error
 	for _, digested := range digests {
-		err = cli.Delete(context.Context(ctx), digested)
+		err = cli.Delete(ctx, digested)
 		if errdefs.IsNotFound(err) {
-			ctx.Log(diag.Warning, digested+" not found")
+			provider.GetLogger(ctx).Warning(digested + " not found")
 			continue // Nothing to do.
 		}
 		multierr = errors.Join(multierr, err)
@@ -875,7 +869,7 @@ func (i *Image) Delete(
 // Diff re-implements most of the default diff behavior, with the exception of
 // ignoring "password" changes on registry inputs.
 func (*Image) Diff(
-	_ provider.Context,
+	_ context.Context,
 	_ string,
 	olds ImageState,
 	news ImageArgs,
@@ -895,12 +889,6 @@ func (*Image) Diff(
 	if !reflect.DeepEqual(olds.Builder, news.Builder) {
 		diff["builder"] = update
 	}
-	if !reflect.DeepEqual(olds.CacheFrom, news.CacheFrom) {
-		diff["cacheFrom"] = update
-	}
-	if !reflect.DeepEqual(olds.CacheTo, news.CacheTo) {
-		diff["cacheTo"] = update
-	}
 	if olds.Context.Location != news.Context.Location {
 		diff["context.location"] = update
 	}
@@ -981,6 +969,31 @@ func (*Image) Diff(
 			break
 		}
 	}
+	// The GHA cache needs similar handling to ignore changes to the token.
+	if len(olds.CacheFrom) != len(news.CacheFrom) {
+		diff["cacheFrom"] = update
+	} else {
+		for idx, oldc := range olds.CacheFrom {
+			newc := news.CacheFrom[idx]
+			if newc.Diff(oldc) {
+				continue
+			}
+			diff[fmt.Sprintf("cacheFrom[%d]", idx)] = update
+			break
+		}
+	}
+	if len(olds.CacheTo) != len(news.CacheTo) {
+		diff["cacheTo"] = update
+	} else {
+		for idx, oldc := range olds.CacheTo {
+			newc := news.CacheTo[idx]
+			if !newc.Diff(oldc) {
+				continue
+			}
+			diff[fmt.Sprintf("cacheTo[%d]", idx)] = update
+			break
+		}
+	}
 
 	return provider.DiffResponse{
 		HasChanges:   len(diff) > 0,

provider/internal/image_test.go

@@ -15,6 +15,7 @@
 package internal
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -64,7 +65,7 @@ func TestImageLifecycle(t *testing.T) {
 				c := NewMockClient(ctrl)
 				c.EXPECT().BuildKitEnabled().Return(true, nil).AnyTimes()
 				c.EXPECT().Build(gomock.Any(), gomock.AssignableToTypeOf(build{})).DoAndReturn(
-					func(_ provider.Context, b Build) (*client.SolveResponse, error) {
+					func(_ context.Context, b Build) (*client.SolveResponse, error) {
 						assert.Equal(t, "testdata/noop/Dockerfile", b.BuildOptions().DockerfileName)
 						return &client.SolveResponse{
 							ExporterResponse: map[string]string{
@@ -238,7 +239,7 @@ func TestImageLifecycle(t *testing.T) {
 				c := NewMockClient(ctrl)
 				c.EXPECT().BuildKitEnabled().Return(true, nil).AnyTimes()
 				c.EXPECT().Build(gomock.Any(), gomock.AssignableToTypeOf(build{})).DoAndReturn(
-					func(_ provider.Context, b Build) (*client.SolveResponse, error) {
+					func(_ context.Context, b Build) (*client.SolveResponse, error) {
 						assert.Equal(t, "testdata/noop/Dockerfile", b.BuildOptions().DockerfileName)
 						return &client.SolveResponse{
 							ExporterResponse: map[string]string{"image.name": "test:latest"},
@@ -369,7 +370,7 @@ func TestRead(t *testing.T) {
 }
 
 func TestImageDiff(t *testing.T) {
-	t.Parallel()
+	// t.Parallel()
 	emptyDir := t.TempDir()
 	host := Host
 
@@ -418,6 +419,106 @@ func TestImageDiff(t *testing.T) {
 			},
 			wantChanges: false,
 		},
+		{
+			name: "no diff if cache tokens change",
+			olds: func(_ *testing.T, s ImageState) ImageState {
+				s.CacheTo = []CacheTo{
+					{
+						GHA: &CacheToGitHubActions{
+							CacheFromGitHubActions: CacheFromGitHubActions{
+								URL:   "unchanged-cacheto-url",
+								Token: "old-cacheto-token",
+							},
+						},
+					},
+					{
+						S3: &CacheToS3{
+							CacheFromS3: CacheFromS3{
+								AccessKeyID:     "old-cacheto-access-key-id",
+								SecretAccessKey: "old-cacheto-secret-access-key",
+								SessionToken:    "old-cacheto-session-token",
+							},
+						},
+					},
+					{
+						AZBlob: &CacheToAzureBlob{
+							CacheFromAzureBlob: CacheFromAzureBlob{
+								SecretAccessKey: "old-cacheto-secret-access-key",
+							},
+						},
+					},
+				}
+				s.CacheFrom = []CacheFrom{
+					{
+						GHA: &CacheFromGitHubActions{
+							URL:   "unchanged-cachefrom-url",
+							Token: "old-cachefrom-token",
+						},
+					},
+					{
+						S3: &CacheFromS3{
+							AccessKeyID:     "old-cachefrom-access-key-id",
+							SecretAccessKey: "old-cachefrom-secret-access-key",
+							SessionToken:    "old-cachefrom-session-token",
+						},
+					},
+					{
+						AZBlob: &CacheFromAzureBlob{
+							SecretAccessKey: "old-cachefrom-secret-access-key",
+						},
+					},
+				}
+				return s
+			},
+			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+				a.CacheTo = []CacheTo{
+					{
+						GHA: &CacheToGitHubActions{
+							CacheFromGitHubActions: CacheFromGitHubActions{
+								URL:   "unchanged-cacheto-url",
+								Token: "new-cacheto-token",
+							},
+						},
+					},
+					{
+						S3: &CacheToS3{
+							CacheFromS3: CacheFromS3{
+								AccessKeyID:     "new-cacheto-access-key-id",
+								SecretAccessKey: "new-cacheto-secret-access-key",
+								SessionToken:    "new-cacheto-session-token",
+							},
+						},
+					},
+					{
+						AZBlob: &CacheToAzureBlob{
+							CacheFromAzureBlob: CacheFromAzureBlob{
+								SecretAccessKey: "new-cacheto-secret-access-key",
+							},
+						},
+					},
+				}
+				a.CacheFrom = []CacheFrom{
+					{
+						GHA: &CacheFromGitHubActions{
+							URL:   "unchanged-cachefrom-url",
+							Token: "new-cachefrom-token",
+						},
+					}, {
+						S3: &CacheFromS3{
+							AccessKeyID:     "new-cachefrom-access-key-id",
+							SecretAccessKey: "new-cachefrom-secret-access-key",
+							SessionToken:    "new-cachefrom-session-token",
+						},
+					}, {
+						AZBlob: &CacheFromAzureBlob{
+							SecretAccessKey: "new-cachefrom-secret-access-key",
+						},
+					},
+				}
+				return a
+			},
+			wantChanges: false,
+		},
 		{
 			name: "no diff if pull=true but no exports",
 			olds: func(_ *testing.T, is ImageState) ImageState {
@@ -430,6 +531,108 @@ func TestImageDiff(t *testing.T) {
 			},
 			wantChanges: false,
 		},
+		{
+			name: "diff if gha cache parameters change",
+			olds: func(_ *testing.T, s ImageState) ImageState {
+				s.CacheTo = []CacheTo{{
+					GHA: &CacheToGitHubActions{
+						CacheFromGitHubActions: CacheFromGitHubActions{
+							Scope: "old-cacheto-scope",
+						},
+					},
+				}}
+				s.CacheFrom = []CacheFrom{{
+					GHA: &CacheFromGitHubActions{
+						Scope: "old-cachefrom-scope",
+					},
+				}}
+				return s
+			},
+			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+				a.CacheTo = []CacheTo{{
+					GHA: &CacheToGitHubActions{
+						CacheFromGitHubActions: CacheFromGitHubActions{
+							Scope: "new-cacheto-scope",
+						},
+					},
+				}}
+				a.CacheFrom = []CacheFrom{{
+					GHA: &CacheFromGitHubActions{
+						Scope: "new-cachefrom-scope",
+					},
+				}}
+				return a
+			},
+			wantChanges: true,
+		},
+		{
+			name: "diff if s3 cache parameters change",
+			olds: func(_ *testing.T, s ImageState) ImageState {
+				s.CacheTo = []CacheTo{{
+					S3: &CacheToS3{
+						CacheFromS3: CacheFromS3{
+							Region: "old-cacheto-region",
+						},
+					},
+				}}
+				s.CacheFrom = []CacheFrom{{
+					S3: &CacheFromS3{
+						Region: "old-cachefrom-region",
+					},
+				}}
+				return s
+			},
+			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+				a.CacheTo = []CacheTo{{
+					S3: &CacheToS3{
+						CacheFromS3: CacheFromS3{
+							Region: "new-cacheto-region",
+						},
+					},
+				}}
+				a.CacheFrom = []CacheFrom{{
+					S3: &CacheFromS3{
+						Region: "new-cachefrom-region",
+					},
+				}}
+				return a
+			},
+			wantChanges: true,
+		},
+		{
+			name: "diff if azblob cache parameters change",
+			olds: func(_ *testing.T, s ImageState) ImageState {
+				s.CacheTo = []CacheTo{{
+					AZBlob: &CacheToAzureBlob{
+						CacheFromAzureBlob: CacheFromAzureBlob{
+							Name: "old-cacheto-name",
+						},
+					},
+				}}
+				s.CacheFrom = []CacheFrom{{
+					AZBlob: &CacheFromAzureBlob{
+						Name: "old-cachefrom-name",
+					},
+				}}
+				return s
+			},
+			news: func(_ *testing.T, a ImageArgs) ImageArgs {
+				a.CacheTo = []CacheTo{{
+					AZBlob: &CacheToAzureBlob{
+						CacheFromAzureBlob: CacheFromAzureBlob{
+							Name: "new-cacheto-name",
+						},
+					},
+				}}
+				a.CacheFrom = []CacheFrom{{
+					AZBlob: &CacheFromAzureBlob{
+						Name: "new-cachefrom-name",
+					},
+				}}
+				return a
+			},
+			wantChanges: true,
+		},
 		{
 			name: "diff if pull=true with exports",
 			olds: func(_ *testing.T, is ImageState) ImageState {
@@ -960,17 +1163,14 @@ func TestBuildable(t *testing.T) {
 
 func TestToBuild(t *testing.T) {
 	t.Parallel()
-	ctrl := gomock.NewController(t)
+	Max := Max
-	pctx := NewMockProviderContext(ctrl)
-	pctx.EXPECT().Log(gomock.Any(), gomock.Any()).AnyTimes()
-	max := Max
 
 	ia := ImageArgs{
 		Tags:      []string{"foo", "bar"},
 		Platforms: []Platform{"linux/amd64"},
 		Context:   &BuildContext{Context: Context{Location: "testdata/noop"}},
 		CacheTo: []CacheTo{
-			{GHA: &CacheToGitHubActions{CacheWithMode: CacheWithMode{&max}}},
+			{GHA: &CacheToGitHubActions{CacheWithMode: CacheWithMode{&Max}}},
 			{
 				Registry: &CacheToRegistry{
 					CacheFromRegistry: CacheFromRegistry{Ref: "docker.io/foo/bar"},
@@ -989,6 +1189,6 @@ func TestToBuild(t *testing.T) {
 		},
 	}
 
-	_, err := ia.toBuild(pctx, false)
+	_, err := ia.toBuild(context.Background(), false)
 	assert.NoError(t, err)
 }

provider/internal/index.go

@@ -15,6 +15,7 @@
 package internal
 
 import (
+	"context"
 	"fmt"
 	"reflect"
 	"strings"
@@ -24,7 +25,6 @@ import (
 
 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/diag"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 )
 
@@ -121,7 +121,7 @@ func (i *IndexState) Annotate(a infer.Annotator) {
 
 // Create is a passthrough to Update.
 func (i *Index) Create(
-	ctx provider.Context,
+	ctx context.Context,
 	name string,
 	input IndexArgs,
 	preview bool,
@@ -133,7 +133,7 @@ func (i *Index) Create(
 // Update performs `buildx imagetools create` to create a new OCI index /
 // manifest list.
 func (i *Index) Update(
-	ctx provider.Context,
+	ctx context.Context,
 	name string,
 	state IndexState,
 	input IndexArgs,
@@ -151,7 +151,7 @@ func (i *Index) Update(
 		return state, nil
 	}
 
-	ctx.Log(diag.Debug, fmt.Sprintf("creating index with tag %s and sources %s", input.Tag, input.Sources))
+	provider.GetLogger(ctx).Debugf("creating index with tag %s and sources %s", input.Tag, input.Sources)
 
 	err = cli.ManifestCreate(ctx, input.Push, input.Tag, input.Sources...)
 	if err != nil {
@@ -166,7 +166,7 @@ func (i *Index) Update(
 }
 
 func (i *Index) Read(
-	ctx provider.Context,
+	ctx context.Context,
 	name string,
 	input IndexArgs,
 	state IndexState,
@@ -175,7 +175,7 @@ func (i *Index) Read(
 	state.Ref = input.Tag
 
 	if !input.Push {
-		ctx.Log(diag.Debug, "skipping read because index was not pushed")
+		provider.GetLogger(ctx).Debug("skipping read because index was not pushed")
 		return name, input, state, nil // Nothing to read.
 	}
 
@@ -184,7 +184,7 @@ func (i *Index) Read(
 		return name, input, state, err
 	}
 
-	ctx.Log(diag.Debug, "reading index with tag "+input.Tag)
+	provider.GetLogger(ctx).Debug("reading index with tag " + input.Tag)
 
 	digest, err := cli.ManifestInspect(ctx, input.Tag)
 	if err != nil && strings.Contains(err.Error(), "No such manifest:") && input.Push {
@@ -211,7 +211,7 @@ func (i *Index) Read(
 // exist on the same registry. This is sufficient to handle the most common
 // cases for now.
 func (i *Index) Check(
-	_ provider.Context,
+	_ context.Context,
 	_ string,
 	_ resource.PropertyMap,
 	news resource.PropertyMap,
@@ -247,7 +247,7 @@ func (i *Index) Check(
 }
 
 // Delete attempts to delete the remote manifest.
-func (i *Index) Delete(ctx provider.Context, _ string, state IndexState) error {
+func (i *Index) Delete(ctx context.Context, _ string, state IndexState) error {
 	if !state.Push {
 		return nil // Nothing to delete.
 	}
@@ -271,7 +271,7 @@ func (i *Index) Delete(ctx provider.Context, _ string, state IndexState) error {
 // force `ignoreChanges`-style behavior on our registry password (which can
 // change all the time due to short-lived AWS credentials).
 func (i *Index) Diff(
-	_ provider.Context,
+	_ context.Context,
 	_ string,
 	olds IndexState,
 	news IndexArgs,
@@ -309,10 +309,10 @@ func (i *Index) Diff(
 	}, nil
 }
 
-// client produces a CLI client with scoped to this resource and layered on top
+// client produces a CLI client scoped to this resource and layered on top of
-// of any host-level credentials.
+// any host-level credentials.
 func (i *Index) client(
-	ctx provider.Context,
+	ctx context.Context,
 	_ IndexState,
 	args IndexArgs,
 ) (Client, error) {

provider/internal/metadata.json

@@ -1 +0,0 @@
-{}

provider/internal/mockclient_test.go

@@ -15,7 +15,6 @@ import (
 	pb "github.com/docker/buildx/controller/pb"
 	client "github.com/moby/buildkit/client"
 	session "github.com/moby/buildkit/session"
-	provider "github.com/pulumi/pulumi-go-provider"
 	descriptor "github.com/regclient/regclient/types/descriptor"
 	gomock "go.uber.org/mock/gomock"
 )
@@ -44,7 +43,7 @@ func (m *MockClient) EXPECT() *MockClientMockRecorder {
 }
 
 // Build mocks base method.
-func (m *MockClient) Build(ctx provider.Context, b Build) (*client.SolveResponse, error) {
+func (m *MockClient) Build(ctx context.Context, b Build) (*client.SolveResponse, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Build", ctx, b)
 	ret0, _ := ret[0].(*client.SolveResponse)
@@ -71,13 +70,13 @@ func (c *ClientBuildCall) Return(arg0 *client.SolveResponse, arg1 error) *Client
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *ClientBuildCall) Do(f func(provider.Context, Build) (*client.SolveResponse, error)) *ClientBuildCall {
+func (c *ClientBuildCall) Do(f func(context.Context, Build) (*client.SolveResponse, error)) *ClientBuildCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ClientBuildCall) DoAndReturn(f func(provider.Context, Build) (*client.SolveResponse, error)) *ClientBuildCall {
+func (c *ClientBuildCall) DoAndReturn(f func(context.Context, Build) (*client.SolveResponse, error)) *ClientBuildCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -199,7 +198,7 @@ func (c *ClientInspectCall) DoAndReturn(f func(context.Context, string) ([]descr
 }
 
 // ManifestCreate mocks base method.
-func (m *MockClient) ManifestCreate(ctx provider.Context, push bool, target string, refs ...string) error {
+func (m *MockClient) ManifestCreate(ctx context.Context, push bool, target string, refs ...string) error {
 	m.ctrl.T.Helper()
 	varargs := []any{ctx, push, target}
 	for _, a := range refs {
@@ -230,19 +229,19 @@ func (c *ClientManifestCreateCall) Return(arg0 error) *ClientManifestCreateCall
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *ClientManifestCreateCall) Do(f func(provider.Context, bool, string, ...string) error) *ClientManifestCreateCall {
+func (c *ClientManifestCreateCall) Do(f func(context.Context, bool, string, ...string) error) *ClientManifestCreateCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ClientManifestCreateCall) DoAndReturn(f func(provider.Context, bool, string, ...string) error) *ClientManifestCreateCall {
+func (c *ClientManifestCreateCall) DoAndReturn(f func(context.Context, bool, string, ...string) error) *ClientManifestCreateCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
 
 // ManifestDelete mocks base method.
-func (m *MockClient) ManifestDelete(ctx provider.Context, target string) error {
+func (m *MockClient) ManifestDelete(ctx context.Context, target string) error {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ManifestDelete", ctx, target)
 	ret0, _ := ret[0].(error)
@@ -268,19 +267,19 @@ func (c *ClientManifestDeleteCall) Return(arg0 error) *ClientManifestDeleteCall
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *ClientManifestDeleteCall) Do(f func(provider.Context, string) error) *ClientManifestDeleteCall {
+func (c *ClientManifestDeleteCall) Do(f func(context.Context, string) error) *ClientManifestDeleteCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ClientManifestDeleteCall) DoAndReturn(f func(provider.Context, string) error) *ClientManifestDeleteCall {
+func (c *ClientManifestDeleteCall) DoAndReturn(f func(context.Context, string) error) *ClientManifestDeleteCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
 
 // ManifestInspect mocks base method.
-func (m *MockClient) ManifestInspect(ctx provider.Context, target string) (string, error) {
+func (m *MockClient) ManifestInspect(ctx context.Context, target string) (string, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ManifestInspect", ctx, target)
 	ret0, _ := ret[0].(string)
@@ -307,13 +306,13 @@ func (c *ClientManifestInspectCall) Return(arg0 string, arg1 error) *ClientManif
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *ClientManifestInspectCall) Do(f func(provider.Context, string) (string, error)) *ClientManifestInspectCall {
+func (c *ClientManifestInspectCall) Do(f func(context.Context, string) (string, error)) *ClientManifestInspectCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ClientManifestInspectCall) DoAndReturn(f func(provider.Context, string) (string, error)) *ClientManifestInspectCall {
+func (c *ClientManifestInspectCall) DoAndReturn(f func(context.Context, string) (string, error)) *ClientManifestInspectCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }

provider/internal/mockprovidercontext_test.go

@@ -1,386 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: providercontext.go
-//
-// Generated by this command:
-//
-//	mockgen -typed -package internal -source providercontext.go -destination mockprovidercontext_test.go --self_package github.com/pulumi/pulumi-docker/provider/v4/internal
-//
-// Package internal is a generated GoMock package.
-package internal
-
-import (
-	reflect "reflect"
-	time "time"
-
-	provider "github.com/pulumi/pulumi-go-provider"
-	diag "github.com/pulumi/pulumi/sdk/v3/go/common/diag"
-	gomock "go.uber.org/mock/gomock"
-)
-
-// MockProviderContext is a mock of ProviderContext interface.
-type MockProviderContext struct {
-	ctrl     *gomock.Controller
-	recorder *MockProviderContextMockRecorder
-}
-
-// MockProviderContextMockRecorder is the mock recorder for MockProviderContext.
-type MockProviderContextMockRecorder struct {
-	mock *MockProviderContext
-}
-
-// NewMockProviderContext creates a new mock instance.
-func NewMockProviderContext(ctrl *gomock.Controller) *MockProviderContext {
-	mock := &MockProviderContext{ctrl: ctrl}
-	mock.recorder = &MockProviderContextMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockProviderContext) EXPECT() *MockProviderContextMockRecorder {
-	return m.recorder
-}
-
-// Deadline mocks base method.
-func (m *MockProviderContext) Deadline() (time.Time, bool) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Deadline")
-	ret0, _ := ret[0].(time.Time)
-	ret1, _ := ret[1].(bool)
-	return ret0, ret1
-}
-
-// Deadline indicates an expected call of Deadline.
-func (mr *MockProviderContextMockRecorder) Deadline() *ProviderContextDeadlineCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Deadline", reflect.TypeOf((*MockProviderContext)(nil).Deadline))
-	return &ProviderContextDeadlineCall{Call: call}
-}
-
-// ProviderContextDeadlineCall wrap *gomock.Call
-type ProviderContextDeadlineCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextDeadlineCall) Return(deadline time.Time, ok bool) *ProviderContextDeadlineCall {
-	c.Call = c.Call.Return(deadline, ok)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextDeadlineCall) Do(f func() (time.Time, bool)) *ProviderContextDeadlineCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextDeadlineCall) DoAndReturn(f func() (time.Time, bool)) *ProviderContextDeadlineCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// Done mocks base method.
-func (m *MockProviderContext) Done() <-chan struct{} {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Done")
-	ret0, _ := ret[0].(<-chan struct{})
-	return ret0
-}
-
-// Done indicates an expected call of Done.
-func (mr *MockProviderContextMockRecorder) Done() *ProviderContextDoneCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Done", reflect.TypeOf((*MockProviderContext)(nil).Done))
-	return &ProviderContextDoneCall{Call: call}
-}
-
-// ProviderContextDoneCall wrap *gomock.Call
-type ProviderContextDoneCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextDoneCall) Return(arg0 <-chan struct{}) *ProviderContextDoneCall {
-	c.Call = c.Call.Return(arg0)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextDoneCall) Do(f func() <-chan struct{}) *ProviderContextDoneCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextDoneCall) DoAndReturn(f func() <-chan struct{}) *ProviderContextDoneCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// Err mocks base method.
-func (m *MockProviderContext) Err() error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Err")
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// Err indicates an expected call of Err.
-func (mr *MockProviderContextMockRecorder) Err() *ProviderContextErrCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Err", reflect.TypeOf((*MockProviderContext)(nil).Err))
-	return &ProviderContextErrCall{Call: call}
-}
-
-// ProviderContextErrCall wrap *gomock.Call
-type ProviderContextErrCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextErrCall) Return(arg0 error) *ProviderContextErrCall {
-	c.Call = c.Call.Return(arg0)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextErrCall) Do(f func() error) *ProviderContextErrCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextErrCall) DoAndReturn(f func() error) *ProviderContextErrCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// Log mocks base method.
-func (m *MockProviderContext) Log(severity diag.Severity, msg string) {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Log", severity, msg)
-}
-
-// Log indicates an expected call of Log.
-func (mr *MockProviderContextMockRecorder) Log(severity, msg any) *ProviderContextLogCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Log", reflect.TypeOf((*MockProviderContext)(nil).Log), severity, msg)
-	return &ProviderContextLogCall{Call: call}
-}
-
-// ProviderContextLogCall wrap *gomock.Call
-type ProviderContextLogCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextLogCall) Return() *ProviderContextLogCall {
-	c.Call = c.Call.Return()
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextLogCall) Do(f func(diag.Severity, string)) *ProviderContextLogCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextLogCall) DoAndReturn(f func(diag.Severity, string)) *ProviderContextLogCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// LogStatus mocks base method.
-func (m *MockProviderContext) LogStatus(severity diag.Severity, msg string) {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "LogStatus", severity, msg)
-}
-
-// LogStatus indicates an expected call of LogStatus.
-func (mr *MockProviderContextMockRecorder) LogStatus(severity, msg any) *ProviderContextLogStatusCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LogStatus", reflect.TypeOf((*MockProviderContext)(nil).LogStatus), severity, msg)
-	return &ProviderContextLogStatusCall{Call: call}
-}
-
-// ProviderContextLogStatusCall wrap *gomock.Call
-type ProviderContextLogStatusCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextLogStatusCall) Return() *ProviderContextLogStatusCall {
-	c.Call = c.Call.Return()
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextLogStatusCall) Do(f func(diag.Severity, string)) *ProviderContextLogStatusCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextLogStatusCall) DoAndReturn(f func(diag.Severity, string)) *ProviderContextLogStatusCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// LogStatusf mocks base method.
-func (m *MockProviderContext) LogStatusf(severity diag.Severity, msg string, args ...any) {
-	m.ctrl.T.Helper()
-	varargs := []any{severity, msg}
-	for _, a := range args {
-		varargs = append(varargs, a)
-	}
-	m.ctrl.Call(m, "LogStatusf", varargs...)
-}
-
-// LogStatusf indicates an expected call of LogStatusf.
-func (mr *MockProviderContextMockRecorder) LogStatusf(severity, msg any, args ...any) *ProviderContextLogStatusfCall {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{severity, msg}, args...)
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LogStatusf", reflect.TypeOf((*MockProviderContext)(nil).LogStatusf), varargs...)
-	return &ProviderContextLogStatusfCall{Call: call}
-}
-
-// ProviderContextLogStatusfCall wrap *gomock.Call
-type ProviderContextLogStatusfCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextLogStatusfCall) Return() *ProviderContextLogStatusfCall {
-	c.Call = c.Call.Return()
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextLogStatusfCall) Do(f func(diag.Severity, string, ...any)) *ProviderContextLogStatusfCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextLogStatusfCall) DoAndReturn(f func(diag.Severity, string, ...any)) *ProviderContextLogStatusfCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// Logf mocks base method.
-func (m *MockProviderContext) Logf(severity diag.Severity, msg string, args ...any) {
-	m.ctrl.T.Helper()
-	varargs := []any{severity, msg}
-	for _, a := range args {
-		varargs = append(varargs, a)
-	}
-	m.ctrl.Call(m, "Logf", varargs...)
-}
-
-// Logf indicates an expected call of Logf.
-func (mr *MockProviderContextMockRecorder) Logf(severity, msg any, args ...any) *ProviderContextLogfCall {
-	mr.mock.ctrl.T.Helper()
-	varargs := append([]any{severity, msg}, args...)
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Logf", reflect.TypeOf((*MockProviderContext)(nil).Logf), varargs...)
-	return &ProviderContextLogfCall{Call: call}
-}
-
-// ProviderContextLogfCall wrap *gomock.Call
-type ProviderContextLogfCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextLogfCall) Return() *ProviderContextLogfCall {
-	c.Call = c.Call.Return()
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextLogfCall) Do(f func(diag.Severity, string, ...any)) *ProviderContextLogfCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextLogfCall) DoAndReturn(f func(diag.Severity, string, ...any)) *ProviderContextLogfCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// RuntimeInformation mocks base method.
-func (m *MockProviderContext) RuntimeInformation() provider.RunInfo {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RuntimeInformation")
-	ret0, _ := ret[0].(provider.RunInfo)
-	return ret0
-}
-
-// RuntimeInformation indicates an expected call of RuntimeInformation.
-func (mr *MockProviderContextMockRecorder) RuntimeInformation() *ProviderContextRuntimeInformationCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RuntimeInformation", reflect.TypeOf((*MockProviderContext)(nil).RuntimeInformation))
-	return &ProviderContextRuntimeInformationCall{Call: call}
-}
-
-// ProviderContextRuntimeInformationCall wrap *gomock.Call
-type ProviderContextRuntimeInformationCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextRuntimeInformationCall) Return(arg0 provider.RunInfo) *ProviderContextRuntimeInformationCall {
-	c.Call = c.Call.Return(arg0)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextRuntimeInformationCall) Do(f func() provider.RunInfo) *ProviderContextRuntimeInformationCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextRuntimeInformationCall) DoAndReturn(f func() provider.RunInfo) *ProviderContextRuntimeInformationCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// Value mocks base method.
-func (m *MockProviderContext) Value(key any) any {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Value", key)
-	ret0, _ := ret[0].(any)
-	return ret0
-}
-
-// Value indicates an expected call of Value.
-func (mr *MockProviderContextMockRecorder) Value(key any) *ProviderContextValueCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Value", reflect.TypeOf((*MockProviderContext)(nil).Value), key)
-	return &ProviderContextValueCall{Call: call}
-}
-
-// ProviderContextValueCall wrap *gomock.Call
-type ProviderContextValueCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *ProviderContextValueCall) Return(arg0 any) *ProviderContextValueCall {
-	c.Call = c.Call.Return(arg0)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *ProviderContextValueCall) Do(f func(any) any) *ProviderContextValueCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *ProviderContextValueCall) DoAndReturn(f func(any) any) *ProviderContextValueCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}

provider/internal/provider.go

@@ -55,7 +55,7 @@ func (c *Config) Annotate(a infer.Annotator) {
 }
 
 // Configure validates and processes user-provided configuration values.
-func (c *Config) Configure(_ provider.Context) error {
+func (c *Config) Configure(_ context.Context) error {
 	h, err := newHost(c)
 	if err != nil {
 		return fmt.Errorf("getting host: %w", err)

provider/internal/provider_test.go

@@ -59,7 +59,10 @@ func TestAnnotate(t *testing.T) {
 func TestSchema(t *testing.T) {
 	t.Parallel()
 
-	Schema(context.Background(), "v4")
+	s := newServer(nil)
+
+	_, err := s.GetSchema(provider.GetSchemaRequest{Version: 0})
+	assert.NoError(t, err)
 }
 
 type annotator struct{}
@@ -73,10 +76,10 @@ func newServer(client Client) integration.Server {
 
 	// Inject a mock client if provided.
 	if client != nil {
-		p = mwcontext.Wrap(p, func(ctx provider.Context) provider.Context {
+		p = mwcontext.Wrap(p, func(ctx context.Context) context.Context {
-			return provider.CtxWithValue(ctx, _mockClientKey, client)
+			return context.WithValue(ctx, _mockClientKey, client)
 		})
 	}
 
-	return integration.NewServer("docker", semver.Version{Major: 4}, p)
+	return integration.NewServer("docker-build", semver.Version{Major: 0}, p)
 }

provider/internal/providercontext.go

@@ -1,27 +0,0 @@
-// Copyright 2024, Pulumi Corporation.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-//go:generate go run go.uber.org/mock/mockgen -typed -package internal -source providercontext.go -destination mockprovidercontext_test.go --self_package github.com/pulumi/pulumi-docker/provider/v4/internal
-
-package internal
-
-import (
-	provider "github.com/pulumi/pulumi-go-provider"
-)
-
-// ProviderContext is a workaround for
-// https://github.com/pulumi/pulumi-go-provider/issues/159
-type ProviderContext interface {
-	provider.Context
-}

provider/provider.go

@@ -16,13 +16,13 @@ package provider
 
 import (
 	"context"
-	"fmt"
+	"encoding/json"
 
 	"github.com/pulumi/pulumi-docker-build/provider/internal"
 	"github.com/pulumi/pulumi-docker-build/provider/internal/deprecated"
 	gp "github.com/pulumi/pulumi-go-provider"
+	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
 	"github.com/pulumi/pulumi/pkg/v3/resource/provider"
-	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
 	rpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
 )
 
@@ -39,11 +39,7 @@ func Serve() error {
 
 // New creates a new provider.
 func New(host *provider.HostClient) (rpc.ResourceProviderServer, error) {
-	server, err := gp.RawServer(Name, Version, internal.NewBuildxProvider())(host)
+	return gp.RawServer(Name, Version, configurableProvider(internal.NewBuildxProvider()))(host)
-	if err != nil {
-		return nil, fmt.Errorf("building raw server: %w", err)
-	}
-	return &configurableProvider{ResourceProviderServer: server}, nil
 }
 
 // configurableProvider is a workaround for
@@ -54,26 +50,26 @@ func New(host *provider.HostClient) (rpc.ResourceProviderServer, error) {
 //
 // If you find yourself in a position where you need to copy this -- STOP!
 // https://github.com/pulumi/pulumi/pull/15032 should be merged with this fix.
-type configurableProvider struct {
+func configurableProvider(p gp.Provider) gp.Provider {
-	rpc.ResourceProviderServer
+	configure := p.Configure
-}
 
-func (p configurableProvider) Configure(
+	p.Configure = func(ctx context.Context, req gp.ConfigureRequest) error {
-	ctx context.Context,
+		r, err := p.GetSchema(ctx, gp.GetSchemaRequest{Version: 0})
-	request *rpc.ConfigureRequest,
+		if err != nil {
-) (*rpc.ConfigureResponse, error) {
+			return err
-	schema := internal.Schema(ctx, Version)
+		}
-	ce := deprecated.New(schema.Config)
+		spec := schema.PackageSpec{}
-	buildxReq := request
+		err = json.Unmarshal([]byte(r.Schema), &spec)
-	if props, err := ce.UnmarshalProperties(request.Args); err == nil {
+		if err != nil {
-		args, _ := plugin.MarshalProperties(props, plugin.MarshalOptions{
+			return err
-			Label:        "config",
+		}
-			KeepUnknowns: true,
+
-			SkipNulls:    true,
+		ce := deprecated.New(spec.Config)
-			KeepSecrets:  true,
+		if props, err := ce.UnmarshalProperties(req.Args); err == nil {
-			RejectAssets: true,
+			req.Args = props
-		})
+		}
-		buildxReq.Args = args
+		return configure(ctx, req)
 	}
-	return p.ResourceProviderServer.Configure(ctx, buildxReq)
+
+	return p
 }

provider/provider_test.go

@@ -24,7 +24,10 @@ import (
 	emptypb "google.golang.org/protobuf/types/known/emptypb"
 	"google.golang.org/protobuf/types/known/structpb"
 
-	pulumirpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
+	"github.com/pulumi/pulumi-docker-build/provider/internal"
+	provider "github.com/pulumi/pulumi-go-provider"
+	"github.com/pulumi/pulumi-go-provider/integration"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
 )
 
 // TestConfigure checks backwards-compatibility with SDKs that still send
@@ -34,20 +37,19 @@ import (
 func TestConfigure(t *testing.T) {
 	t.Parallel()
 
-	ctx := context.Background()
+	p := configurableProvider(internal.NewBuildxProvider())
-
-	p, err := New(nil)
-	require.NoError(t, err)
 
 	args, err := structpb.NewStruct(map[string]any{
 		"registries": `[{"address": "docker.io"}]`,
 	})
 	require.NoError(t, err)
+	argsMap, err := plugin.UnmarshalProperties(args, plugin.MarshalOptions{})
+	require.NoError(t, err)
 
-	_, err = p.Configure(ctx, &pulumirpc.ConfigureRequest{
+	s := integration.NewServer("docker-build", semver.Version{Major: 0}, p)
-		Args: args,
+	err = s.Configure(provider.ConfigureRequest{
+		Args: argsMap,
 	})
-
 	assert.NoError(t, err)
 }
 

sdk/go/dockerbuild/go.mod

@@ -82,7 +82,7 @@ require (
 	golang.org/x/crypto v0.21.0 // indirect
 	golang.org/x/exp v0.0.0-20240112132812-db7319d0e0e3 // indirect
 	golang.org/x/mod v0.16.0 // indirect
-	golang.org/x/net v0.22.0 // indirect
+	golang.org/x/net v0.23.0 // indirect
 	golang.org/x/sync v0.6.0 // indirect
 	golang.org/x/sys v0.18.0 // indirect
 	golang.org/x/term v0.18.0 // indirect

sdk/go/dockerbuild/go.sum

@@ -236,8 +236,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
-golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=