update sharding

.ci-mgmt.yaml

@@ -1,20 +0,0 @@
-template: native
-provider: docker-build
-major-version: 0
-providerDefaultBranch: main
-providerVersion: github.com/pulumi/pulumi-docker-build/provider.Version
-aws: true
-modulePath: .
-gcp: true
-sdkModuleDir: sdk/go/dockerbuild
-parallel: 3
-esc:
-  enabled: true
-envOverride:
-  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
-  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
-  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
-  GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
-  GOOGLE_REGION: us-central1
-  GOOGLE_ZONE: us-central1-a

.config/mise.test.toml

@@ -1,4 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-
-[tools]
-"aqua:gotestyourself/gotestsum" = "1.12.0"

.config/mise.toml

@@ -1,35 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-# You can create your own root-level mise.toml file to override/augment this. See https://mise.jdx.dev/configuration.html
-
-[env]
-_.vfox-pulumi = { module_path = "." } # Sets GO_VERSION_MISE and PULUMI_VERSION_MISE
-PULUMI_HOME = "{{config_root}}/.pulumi"
-
-[tools]
-
-# Runtimes
-go = "{{ env.GO_VERSION_MISE }}"
-node = '20.19.5'
-python = '3.11.8'
-"vfox:version-fox/vfox-dotnet" = "8.0.20" # vfox backend doesn't work on Windows, gives "error converting Lua table to PreInstall (no version returned from vfox plugin)" https://github.com/jdx/mise/discussions/5876 https://github.com/jdx/mise/discussions/5550
-# Corretto version used as Java SE/OpenJDK version no longer offered
-java = 'corretto-11'
-
-# Executable tools
-"github:pulumi/pulumi" = "{{ env.PULUMI_VERSION_MISE }}"
-"github:pulumi/pulumictl" = '0.0.50'
-"github:pulumi/schema-tools" = "0.6.0"
-"go:github.com/pulumi/upgrade-provider" = "main"
-"aqua:gradle/gradle-distributions" = '7.6.6'
-golangci-lint = "2.9.0" # See note about about overrides if you need to customize this.
-"npm:yarn" = "1.22.22"
-
-[settings]
-experimental = true # Required for Go binaries (e.g. pulumictl).
-lockfile = false
-http_retries = 3
-pin = true # `mise use` should pin versions instead of defaulting to latest.
-fetch_remote_versions_cache = "24h" # Mise queries versions even if they're pinned to confirm they exist. Reduce GitHub API calls by doing that less often.
-
-[plugins]
-vfox-pulumi = "https://github.com/pulumi/vfox-pulumi"

.gitattributes

@@ -1,2 +1,2 @@
 sdk/**/* linguist-generated=true
-.github/workflows/*.lock.yml linguist-generated=true merge=ours
+provider/internal/mock*.go linguist-generated=true

.github/ISSUE_TEMPLATE/bug.yaml

@@ -1,69 +0,0 @@
-name: Bug Report
-description: Report something that's not working correctly
-labels: ["kind/bug", "needs-triage"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this bug report! 
-        You can also ask questions on our [Community Slack](https://slack.pulumi.com/).
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: Describe what happened
-      description: Please summarize what happened, including what Pulumi commands you ran, as well as
-        an inline snippet of any relevant error or console output.
-    validations:
-      required: true
-  - type: textarea
-    id: sample-program
-    attributes:
-      label: Sample program
-      description: |
-        <details><summary>Provide a reproducible sample program</summary>
-        If this is a bug you encountered while running a Pulumi command, please provide us with a minimal, 
-        self-contained Pulumi program that reproduces this behavior so that we can investigate on our end. 
-        Without a functional reproduction, we will not be able to prioritize this bug.
-        **Note:** If the program output is more than a few lines, please send us a Gist or a link to a file.
-        </details>
-    validations:
-      required: true
-  - type: textarea
-    id: log-output
-    attributes:
-      label: Log output
-      description: |
-        <details><summary>How to Submit Logs</summary>
-        If this is something that is dependent on your environment, please also provide us with the output of
-        `pulumi up --logtostderr --logflow -v=10` from the root of your project.
-        We may also ask you to supply us with debug output following [these steps](https://www.pulumi.com/docs/using-pulumi/pulumi-packages/debugging-provider-packages/).
-        **Note:** If the log output is more than a few lines, please send us a Gist or a link to a file.
-        </details>
-  - type: textarea
-    id: resources
-    attributes:
-      label: Affected Resource(s)
-      description: Please list the affected Pulumi Resource(s) or Function(s).
-    validations:
-      required: false
-  - type: textarea
-    id: versions
-    attributes:
-      label: Output of `pulumi about`
-      description: Provide the output of `pulumi about` from the root of your project.
-    validations:
-      required: true
-  - type: textarea
-    id: ctx
-    attributes:
-      label: Additional context
-      description: Anything else you would like to add?
-    validations:
-      required: false
-  - type: textarea
-    id: voting
-    attributes:
-      label: Contributing
-      value: |
-        Vote on this issue by adding a 👍 reaction. 
-        To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

.github/ISSUE_TEMPLATE/epic.md

@@ -1,35 +0,0 @@
----
-name: Epic
-about: Tracks a shippable unit of work
-title: '[Epic] {your-title-here}'
-labels: kind/epic
-projects: ['pulumi/32']
-assignees: ''
-type: Epic
----
-
-## Overview
-<!-- Start with a one- to three-sentence summary that should be understandable by any Pulumian or community member, even those without any context on the work. -->
-
-## Key KPIs
-<!-- What KPIs should this Epic will move; what could we measure to observe that this project was successful? -->
-
-## Key Stakeholders
-- Product and Engineering: <!-- Teams and individuals involved in the design and implementation -->
-- Documentation: <!-- Representative from the docs team -->
-- Marketing/Partnerships: <!-- Representative from the Marketing team -->
-- Customers: <!-- [Tracking Issue](add-link-and-uncomment) -->
-
-## Key Deliverables
-<!-- List any discrete chunks of work or milestones that are planned in the epic (eg. subcomponent A, dogfood release, beta, etc.) -->
-
-### References 📔
-
-<!-- Any project that is more than one iteration should have a Project Board using this [template](https://github.com/orgs/pulumi/projects/131).  -->
-- [ ] Project View <!-- [Link](add-link-and-uncomment) -->
-- [ ] PR/FAQ <!-- [Link](add-link-and-uncomment) -->
-- [ ] Design Doc <!-- [Link](add-link-and-uncomment) -->
-- [ ] UX Designs <!-- [Link](add-link-and-uncomment) -->
-- [ ] Decision Log <!-- [Link](add-link-and-uncomment) -->
-
-<!-- Work items should be added to the project board linked above  -->

.github/actions/download-provider/action.yml

@@ -1,19 +0,0 @@
-name: Download Provider Binary
-description: Downloads the provider binary artifact and restores executable permissions
-
-runs:
-  using: "composite"
-  steps:
-    - name: Download provider
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin
-
-    - name: UnTar provider binaries
-      shell: bash
-      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace}}/bin
-
-    - name: Restore Binary Permissions
-      shell: bash
-      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print -exec chmod +x {} \;

.github/actions/download-sdk/action.yml

@@ -1,20 +0,0 @@
-name: Download SDK
-description: Downloads and extracts SDK artifacts for a specific language
-
-inputs:
-  language:
-    description: 'The SDK language to download (nodejs, python, dotnet, java)'
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: Download SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: ${{ inputs.language }}-sdk.tar.gz
-        path: ${{ github.workspace }}/sdk/
-
-    - name: UnTar SDK folder
-      shell: bash
-      run: tar -zxf ${{ github.workspace }}/sdk/${{ inputs.language }}.tar.gz -C ${{ github.workspace }}/sdk/${{ inputs.language }}

.github/actions/esc-action/action.yaml

@@ -1,12 +0,0 @@
-name: "Load secrets"
-description: |
-  This is a temporary action which assists with our migration to ESC. Instead
-  of surrounding every step that references secrets with an "if ESC" block, we
-  instead modify those steps to consume their secrets from this step's outputs.
-  Then, later, we can replace this action with esc-action to actually load
-  secrets from ESC.
-inputs: {}
-outputs: {}
-runs:
-  using: "node20"
-  main: "index.js"

.github/actions/esc-action/index.js

@@ -1,14 +0,0 @@
-const fs = require("fs");
-
-const file = process.env["GITHUB_OUTPUT"];
-var stream = fs.createWriteStream(file, { flags: "a" });
-
-for (const [name, value] of Object.entries(process.env)) {
-  try {
-    stream.write(`${name}<<EEEOOOFFF\n${value}\nEEEOOOFFF\n`); // << syntax accommodates multiline strings.
-  } catch (err) {
-    console.log(`error: failed to set output for ${name}: ${err.message}`);
-  }
-}
-
-stream.end();

.github/actions/setup-tools/action.yml

@@ -1,41 +1,34 @@
-name: Setup Tools
-description: Installs all tools (Go, Node, Python, .NET, Java, Pulumi, etc.) using mise
-
-inputs:
-  cache:
-    description: Enable caching
-    required: false
-    default: "false"
-  github_token:
-    description: GitHub token
-    required: true
+name: Setup tools
+description: Installs all tools necessary for building and testing the project.
 
 runs:
   using: "composite"
   steps:
-    - name: Setup mise
-      uses: jdx/mise-action@8d3b0ba20a9cea7b883d922ea958553c941ab082
+    - name: Collect workflow stats
+      uses: catchpoint/workflow-telemetry-action@v2
+      with:
+        comment_on_pr: false
       env:
-        MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
-      with:
-        version: 2026.3.7
-        cache_save: ${{ inputs.cache }}
-        github_token: ${{ inputs.github_token }}
+        GITHUB_TOKEN: ""
 
-    - name: Setup Go Cache
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
-      with:
-        cache: ${{ inputs.cache }}
-        cache-dependency-path: |
-          provider/*.sum
-          upstream/*.sum
-          sdk/go/*.sum
-          sdk/*.sum
-          *.sum
+    - name: Setup mise
+      uses: jdx/mise-action@v2
 
-    - name: Setup Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+    - name: Go cache paths
+      id: go-cache-paths
+      shell: sh
+      run: |
+        echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
+        echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
+
+    - name: Go build cache
+      uses: actions/cache@v2
       with:
-        # we don't set node-version because we install with mise.
-        # this step is needed to setup npm auth
-        registry-url: https://registry.npmjs.org
+        path: ${{ steps.go-cache-paths.outputs.go-build }}
+        key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
+
+    - name: Go mod cache
+      uses: actions/cache@v2
+      with:
+        path: ${{ steps.go-cache-paths.outputs.go-mod }}
+        key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

.github/agents/agentic-workflows.agent.md

@@ -1,177 +0,0 @@
----
-description: GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing
-disable-model-invocation: true
----
-
-# GitHub Agentic Workflows Agent
-
-This agent helps you work with **GitHub Agentic Workflows (gh-aw)**, a CLI extension for creating AI-powered workflows in natural language using markdown files.
-
-## What This Agent Does
-
-This is a **dispatcher agent** that routes your request to the appropriate specialized prompt based on your task:
-
-- **Creating new workflows**: Routes to `create` prompt
-- **Updating existing workflows**: Routes to `update` prompt
-- **Debugging workflows**: Routes to `debug` prompt  
-- **Upgrading workflows**: Routes to `upgrade-agentic-workflows` prompt
-- **Creating report-generating workflows**: Routes to `report` prompt — consult this whenever the workflow posts status updates, audits, analyses, or any structured output as issues, discussions, or comments
-- **Creating shared components**: Routes to `create-shared-agentic-workflow` prompt
-- **Fixing Dependabot PRs**: Routes to `dependabot` prompt — use this when Dependabot opens PRs that modify generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`). Never merge those PRs directly; instead update the source `.md` files and rerun `gh aw compile --dependabot` to bundle all fixes
-- **Analyzing test coverage**: Routes to `test-coverage` prompt — consult this whenever the workflow reads, analyzes, or reports on test coverage data from PRs or CI runs
-
-Workflows may optionally include:
-
-- **Project tracking / monitoring** (GitHub Projects updates, status reporting)
-- **Orchestration / coordination** (one workflow assigning agents or dispatching and coordinating other workflows)
-
-## Files This Applies To
-
-- Workflow files: `.github/workflows/*.md` and `.github/workflows/**/*.md`
-- Workflow lock files: `.github/workflows/*.lock.yml`
-- Shared components: `.github/workflows/shared/*.md`
-- Configuration: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/github-agentic-workflows.md
-
-## Problems This Solves
-
-- **Workflow Creation**: Design secure, validated agentic workflows with proper triggers, tools, and permissions
-- **Workflow Debugging**: Analyze logs, identify missing tools, investigate failures, and fix configuration issues
-- **Version Upgrades**: Migrate workflows to new gh-aw versions, apply codemods, fix breaking changes
-- **Component Design**: Create reusable shared workflow components that wrap MCP servers
-
-## How to Use
-
-When you interact with this agent, it will:
-
-1. **Understand your intent** - Determine what kind of task you're trying to accomplish
-2. **Route to the right prompt** - Load the specialized prompt file for your task
-3. **Execute the task** - Follow the detailed instructions in the loaded prompt
-
-## Available Prompts
-
-### Create New Workflow
-**Load when**: User wants to create a new workflow from scratch, add automation, or design a workflow that doesn't exist yet
-
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/create-agentic-workflow.md
-
-**Use cases**:
-- "Create a workflow that triages issues"
-- "I need a workflow to label pull requests"
-- "Design a weekly research automation"
-
-### Update Existing Workflow  
-**Load when**: User wants to modify, improve, or refactor an existing workflow
-
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/update-agentic-workflow.md
-
-**Use cases**:
-- "Add web-fetch tool to the issue-classifier workflow"
-- "Update the PR reviewer to use discussions instead of issues"
-- "Improve the prompt for the weekly-research workflow"
-
-### Debug Workflow  
-**Load when**: User needs to investigate, audit, debug, or understand a workflow, troubleshoot issues, analyze logs, or fix errors
-
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/debug-agentic-workflow.md
-
-**Use cases**:
-- "Why is this workflow failing?"
-- "Analyze the logs for workflow X"
-- "Investigate missing tool calls in run #12345"
-
-### Upgrade Agentic Workflows
-**Load when**: User wants to upgrade workflows to a new gh-aw version or fix deprecations
-
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/upgrade-agentic-workflows.md
-
-**Use cases**:
-- "Upgrade all workflows to the latest version"
-- "Fix deprecated fields in workflows"
-- "Apply breaking changes from the new release"
-
-### Create a Report-Generating Workflow
-**Load when**: The workflow being created or updated produces reports — recurring status updates, audit summaries, analyses, or any structured output posted as a GitHub issue, discussion, or comment
-
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/report.md
-
-**Use cases**:
-- "Create a weekly CI health report"
-- "Post a daily security audit to Discussions"
-- "Add a status update comment to open PRs"
-
-### Create Shared Agentic Workflow
-**Load when**: User wants to create a reusable workflow component or wrap an MCP server
-
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/create-shared-agentic-workflow.md
-
-**Use cases**:
-- "Create a shared component for Notion integration"
-- "Wrap the Slack MCP server as a reusable component"
-- "Design a shared workflow for database queries"
-
-### Fix Dependabot PRs
-**Load when**: User needs to close or fix open Dependabot PRs that update dependencies in generated manifest files (`.github/workflows/package.json`, `.github/workflows/requirements.txt`, `.github/workflows/go.mod`)
-
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/dependabot.md
-
-**Use cases**:
-- "Fix the open Dependabot PRs for npm dependencies"
-- "Bundle and close the Dependabot PRs for workflow dependencies"
-- "Update @playwright/test to fix the Dependabot PR"
-
-### Analyze Test Coverage
-**Load when**: The workflow reads, analyzes, or reports test coverage — whether triggered by a PR, a schedule, or a slash command. Always consult this prompt before designing the coverage data strategy.
-
-**Prompt file**: https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/test-coverage.md
-
-**Use cases**:
-- "Create a workflow that comments coverage on PRs"
-- "Analyze coverage trends over time"
-- "Add a coverage gate that blocks PRs below a threshold"
-
-## Instructions
-
-When a user interacts with you:
-
-1. **Identify the task type** from the user's request
-2. **Load the appropriate prompt** from the GitHub repository URLs listed above
-3. **Follow the loaded prompt's instructions** exactly
-4. **If uncertain**, ask clarifying questions to determine the right prompt
-
-## Quick Reference
-
-```bash
-# Initialize repository for agentic workflows
-gh aw init
-
-# Generate the lock file for a workflow
-gh aw compile [workflow-name]
-
-# Debug workflow runs
-gh aw logs [workflow-name]
-gh aw audit <run-id>
-
-# Upgrade workflows
-gh aw fix --write
-gh aw compile --validate
-```
-
-## Key Features of gh-aw
-
-- **Natural Language Workflows**: Write workflows in markdown with YAML frontmatter
-- **AI Engine Support**: Copilot, Claude, Codex, or custom engines
-- **MCP Server Integration**: Connect to Model Context Protocol servers for tools
-- **Safe Outputs**: Structured communication between AI and GitHub API
-- **Strict Mode**: Security-first validation and sandboxing
-- **Shared Components**: Reusable workflow building blocks
-- **Repo Memory**: Persistent git-backed storage for agents
-- **Sandboxed Execution**: All workflows run in the Agent Workflow Firewall (AWF) sandbox, enabling full `bash` and `edit` tools by default
-
-## Important Notes
-
-- Always reference the instructions file at https://github.com/github/gh-aw/blob/v0.56.2/.github/aw/github-agentic-workflows.md for complete documentation
-- Use the MCP tool `agentic-workflows` when running in GitHub Copilot Cloud
-- Workflows must be compiled to `.lock.yml` files before running in GitHub Actions
-- **Bash tools are enabled by default** - Don't restrict bash commands unnecessarily since workflows are sandboxed by the AWF
-- Follow security best practices: minimal permissions, explicit network access, no template injection
-- **Single-file output**: When creating a workflow, produce exactly **one** workflow `.md` file. Do not create separate documentation files (architecture docs, runbooks, usage guides, etc.). If documentation is needed, add a brief `## Usage` section inside the workflow file itself.

.github/aw/actions-lock.json

@@ -1,41 +0,0 @@
-{
-  "entries": {
-    "actions/github-script@v9.0.0": {
-      "repo": "actions/github-script",
-      "version": "v9.0.0",
-      "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
-    },
-    "github/gh-aw-actions/setup@v0.76.1": {
-      "repo": "github/gh-aw-actions/setup",
-      "version": "v0.76.1",
-      "sha": "46d564922b082d0db93244972e8005ea6904ee5f"
-    },
-    "github/gh-aw/actions/setup@v0.76.1": {
-      "repo": "github/gh-aw/actions/setup",
-      "version": "v0.76.1",
-      "sha": "58d1bedbb7200f59c2d224151339e38fd8687d05"
-    }
-  },
-  "containers": {
-    "ghcr.io/github/gh-aw-firewall/agent:0.25.55": {
-      "image": "ghcr.io/github/gh-aw-firewall/agent:0.25.55",
-      "digest": "sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731"
-    },
-    "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55": {
-      "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55",
-      "digest": "sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"
-    },
-    "ghcr.io/github/gh-aw-firewall/squid:0.25.55": {
-      "image": "ghcr.io/github/gh-aw-firewall/squid:0.25.55",
-      "digest": "sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca",
-      "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca"
-    },
-    "ghcr.io/github/gh-aw-mcpg:v0.3.19": {
-      "image": "ghcr.io/github/gh-aw-mcpg:v0.3.19",
-      "digest": "sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f",
-      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f"
-    }
-  }
-}

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: daily
+    groups:
+      pulumi:
+        patterns:
+          - "github.com/pulumi/*"
+      docker:
+        patterns:
+          - "github.com/distribution/*"
+          - "github.com/docker/*"
+          - "github.com/moby/*"
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+      other:
+        patterns:
+          - "*"
+    labels:
+      - dependencies
+      - impact/no-changelog-required

.github/workflows/build.yml

@@ -1,6 +1,6 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
-name: main # For consistency with bridged providers.
+name: build
 on:
   push:
     branches:
@@ -15,67 +15,74 @@ on:
     - "**"
   workflow_dispatch: {}
 env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
   JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  TF_APPEND_USER_AGENT: pulumi
-
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 jobs:
   prerequisites:
     runs-on: ubuntu-latest
     name: prerequisites
-    permissions:
-      id-token: write # For ESC secrets.
-      pull-requests: write # For schema check comment.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        cache: 'true'
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
     - if: github.event_name == 'pull_request'
       name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
         repo: pulumi/schema-tools
     - name: Build codegen binaries
@@ -85,27 +92,25 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        {
-          echo 'SCHEMA_CHANGES<<EOF';
+        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
 
-          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
 
-          echo 'EOF';
-        } >> "$GITHUB_ENV"
+        echo 'EOF' >> $GITHUB_ENV
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-    - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+    - if: github.event_name == 'pull_request'
       name: Comment on PR with Details of Schema Check
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      uses: thollander/actions-comment-pull-request@v2
       with:
         message: |
           ${{ env.SCHEMA_CHANGES }}
-        comment-tag: schemaCheck
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        comment_tag: schemaCheck
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
         github.actor == 'pulumi-bot'
       name: Add label if no breaking changes
-      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+      uses: actions-ecosystem/action-add-labels@v1.1.0
       with:
         labels: impact/no-changelog-required
         number: ${{ github.event.issue.number }}
@@ -113,49 +118,42 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
         github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
         pulumi-gen-${{ env.PROVIDER}}
     - name: Upload artifacts
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
         path: ${{ github.workspace }}/bin/provider.tar.gz
     - name: Test Provider Library
       run: make test_provider
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      uses: codecov/codecov-action@v4
       env:
-        CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in building provider prerequisites
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   build_sdks:
     needs: prerequisites
     runs-on: pulumi-ubuntu-8core
     strategy:
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
+      fail-fast: true
       matrix:
         language:
         - nodejs
@@ -164,111 +162,90 @@ jobs:
         - go
         - java
     name: build_sdks
-    permissions:
-      pull-requests: write # For Renovate SDK updates.
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Generate SDK
       run: make generate_${{ matrix.language }}
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
         retention-days: 30
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure while building SDKs
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
-
-  tag_release_if_labeled_needs_release:
-    name: Tag release if labeled as needs-release
-    needs: publish
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - name: check if this commit needs release
-      if: ${{ env.RELEASE_BOT_ENDPOINT != '' }}
-      uses: pulumi/action-release-by-pr-label@main
-      with:
-        command: "release-if-needed"
-        repo: ${{ github.repository }}
-        commit: ${{ github.sha }}
-        slack_channel: C02MGR8JVST
-      env:
-        RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }}
-        RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   test:
     runs-on: pulumi-ubuntu-8core
     needs:
@@ -282,51 +259,75 @@ jobs:
         - dotnet
         - go
         - java
-        - yaml
     name: test
     permissions:
       contents: read
-      id-token: write # For ESC secrets and Pulumi access token OIDC.
+      id-token: write
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Download SDK
-      if: ${{ matrix.language != 'yaml' }}
-      uses: ./.github/actions/download-sdk
+      uses: actions/download-artifact@v4
       with:
-        language: ${{ matrix.language }}
+        name: ${{ matrix.language }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: UnTar SDK folder
+      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
+        github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
@@ -335,23 +336,18 @@ jobs:
         pip3 install virtualenv==20.0.23
         pip3 install pipenv
     - name: Install dependencies
-      if: ${{ matrix.language != 'yaml' }}
       run: make install_${{ matrix.language}}_sdk
-    - name: Generate Pulumi Access Token
-      id: generate_pulumi_token
-      uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        organization: pulumi
-        requested-token-type: urn:pulumi:token-type:access_token:organization
-        export-environment-variables: false
-    - name: Export AWS Credentials
-      uses: pulumi/esc-action@f3cfbabf37488463817366338165b92b5f99117e
-      env:
-        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
-      with:
-        environment: logins/pulumi-ci
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-region: ${{ env.AWS_REGION }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        role-duration-seconds: 3600
+        role-session-name: ${{ env.PROVIDER }}@githubActions
+        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
     - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+      uses: google-github-actions/auth@v0
       with:
         workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
           }}/locations/global/workloadIdentityPools/${{
@@ -359,7 +355,7 @@ jobs:
           env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
         service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
     - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+      uses: google-github-actions/setup-gcloud@v2
       with:
         install_components: gke-gcloud-auth-plugin
     - name: Install gotestfmt
@@ -371,58 +367,35 @@ jobs:
       run: >-
         set -euo pipefail
 
-        cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        cd examples && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in SDK tests
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish:
     runs-on: ubuntu-latest
     needs: test
     name: publish
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
     - name: Clear GitHub Actions Ubuntu runner disk space
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         dotnet: false
@@ -430,86 +403,82 @@ jobs:
         haskell: true
         swap-storage: true
         large-packages: false
-    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
-        aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
         aws-region: us-east-2
-        aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         role-duration-seconds: 7200
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
-        role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
+        role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
+      uses: goreleaser/goreleaser-action@v5
       env:
         GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
-        AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
-        AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
-        AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
-        AZURE_SIGNING_ACCOUNT_ENDPOINT: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_ENDPOINT }}
-        AZURE_SIGNING_ACCOUNT_NAME: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_NAME }}
-        AZURE_SIGNING_CERT_PROFILE_NAME: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CERT_PROFILE_NAME }}
-        SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_ENDPOINT == '' && steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_NAME == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CERT_PROFILE_NAME == '' }}
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
       with:
         args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
         version: latest
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing binaries
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_sdk:
     runs-on: ubuntu-latest
     needs: publish
     name: publish_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Checkout Scripts Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
     - name: Download python SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: python-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -517,7 +486,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
         ${{github.workspace}}/sdk/python
     - name: Download dotnet SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: dotnet-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -525,7 +494,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
         ${{github.workspace}}/sdk/dotnet
     - name: Download nodejs SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: nodejs-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -537,26 +506,86 @@ jobs:
     - name: Publish SDKs
       run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
       env:
-        NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
-        NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         PYPI_PUBLISH_ARTIFACTS: all
-        PYPI_USERNAME: __token__
-        PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
-        SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
-        SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
-        SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
-        PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
-        PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing SDK
         fields: repo,commit,author,action
         status: ${{ job.status }}
+  publish_java_sdk:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    needs: publish
+    name: publish_java_sdk
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        lfs: true
+    - id: version
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
+    - name: Install Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download java SDK
+      uses: actions/download-artifact@v4
+      with:
+        name: java-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: Uncompress java SDK
+      run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
+        ${{github.workspace}}/sdk/java
+    - name: Publish Java SDK
+      uses: gradle/gradle-build-action@v3
       env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
+        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
+      with:
+        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
+        build-root-directory: ./sdk/java
+        gradle-version: 7.4.1
   lint:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        lfs: true
+        ref: ${{ env.PR_COMMIT_SHA }}
+    - name: Install Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: golangci-lint provider pkg
+      uses: golangci/golangci-lint-action@v4
+      with:
+        version: ${{ env.GOLANGCI_LINT_VERSION }}
+        args: -c ../.golangci.yml
+        working-directory: provider
     name: lint
-    uses: ./.github/workflows/lint.yml
-    secrets: inherit
+    if: github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository

.github/workflows/claude.yml

@@ -1,139 +0,0 @@
-name: Claude Code
-
-on:
-  # Responds to @claude mentions in comments.
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    # Only run when @claude is mentioned by a trusted user (OWNER, MEMBER, or COLLABORATOR)
-    # Note: the claude-code-action can only be triggered by users with write access to the repository so this is extra
-    # see https://github.com/anthropics/claude-code-action/blob/main/docs/security.md
-    if: |
-      (github.event_name == 'issue_comment' &&
-        contains(github.event.comment.body, '@claude') &&
-        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
-      (github.event_name == 'pull_request_review_comment' &&
-        contains(github.event.comment.body, '@claude') &&
-        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
-      (github.event_name == 'pull_request_review' &&
-        contains(github.event.review.body, '@claude') &&
-        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association)) ||
-      (github.event_name == 'issues' &&
-        (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&
-        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
-      id-token: write
-      actions: read
-    steps:
-      - env:
-          ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-          ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-          ESC_ACTION_OIDC_AUTH: "true"
-          ESC_ACTION_OIDC_ORGANIZATION: pulumi
-          ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-        id: esc-secrets
-        name: Fetch secrets from ESC
-        uses: pulumi/esc-action@f3cfbabf37488463817366338165b92b5f99117e
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          fetch-depth: 0
-      - name: Checkout PR head (if applicable)
-        if: ${{ github.event.pull_request.number || (github.event.issue.pull_request && github.event.issue.number) }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
-        run: gh pr checkout "$PR_NUMBER"
-      - name: Setup mise
-        uses: jdx/mise-action@8d3b0ba20a9cea7b883d922ea958553c941ab082
-        env:
-          MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
-        with:
-          version: 2026.3.7
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          # only saving the cache in the prerequisites job
-          cache_save: false
-      - name: Set git identity
-        run: |-
-          git config --global user.name "claude[bot]"
-          git config --global user.email "bot@pulumi.com"
-        shell: bash
-      - name: Prepare local workspace
-        # this runs install_plugins and upstream
-        run: make prepare_local_workspace
-      - name: Run Claude Code Review
-        # Comment must contain '@claude review'
-        if: |
-          (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude review')) ||
-          (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude review')) ||
-          (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude review'))
-        id: claude-review
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1
-        with:
-          anthropic_api_key: ${{ steps.esc-secrets.outputs.ANTHROPIC_API_KEY }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
-
-            Review this pull request using the provider-code-review skill for guidelines.
-            The PR branch is already checked out in the current working directory.
-
-            Use `gh pr comment` for top-level feedback.
-            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
-          # Taken from https://github.com/anthropics/claude-code/blob/main/plugins/code-review/commands/code-review.md
-          claude_args: |
-            --allowedTools "Skill,Bash(gh issue view *),Bash(gh search *),Bash(gh issue list *),Bash(gh pr comment *),Bash(gh pr diff *),Bash(gh pr view *),Bash(gh pr list *),mcp__github_inline_comment__create_inline_comment"
-      - name: Run Claude Code
-        # Comment must contain '@claude', but not '@claude review'
-        if: |
-          !contains(github.event.comment.body, '@claude review') &&
-          !contains(github.event.review.body, '@claude review')
-        id: claude-action
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1
-        with:
-          anthropic_api_key: ${{ steps.esc-secrets.outputs.ANTHROPIC_API_KEY }}
-          # This allows claude to read github action logs
-          additional_permissions: |
-            actions: read
-          # Sandbox settings: --allowedTools controls which tools Claude can invoke,
-          # but the sandbox also enforces OS-level filesystem restrictions. Edit()
-          # rules in permissions.allow control all bash filesystem writes (mkdir,
-          # output redirection, etc.), not just the Edit tool. Without these, commands
-          # like `mkdir .pulumi` or `cmd > file.txt` would be blocked by the sandbox.
-          settings: |
-            {
-              "permissions": {
-                "allow": ["Edit(./**)", "Edit(/tmp/**)"]
-              }
-            }
-          claude_args: |
-            --max-turns 50
-            --allowedTools "Skill,Edit,MultiEdit,Write,Read,Glob,Grep,LS,Bash(upgrade-provider *),Bash(./scripts/upstream.sh *),Bash(git *),Bash(GIT_EDITOR=* git *),Bash(make *),Bash(gh *),Bash(mkdir *),Bash(go mod tidy *),Bash(ls *),Bash(test *),Bash(cat *),Bash(pwd),Bash(head *),Bash(tail *),Bash(tee *),Bash(rg *),Bash(grep *),Bash(sed *),Bash(awk *),Bash(find *)"
-        # If the claude action fails you don't get any logs on what claude was doing
-        # Uploading the artifact allows you to download the artifact from the UI
-      - name: Upload Claude review output on failure
-        if: failure() && steps.claude-review.outputs.execution_file
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: claude-review-execution-log
-          path: ${{ steps.claude-review.outputs.execution_file }}
-          retention-days: 7
-      - name: Upload Claude output on failure
-        if: failure() && steps.claude-action.outputs.execution_file
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: claude-execution-log
-          path: ${{ steps.claude-action.outputs.execution_file }}
-          retention-days: 7

.github/workflows/command-dispatch.yml

@@ -1,53 +1,67 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
-env:
-  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
-  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
-  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
-  GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
-  GOOGLE_REGION: us-central1
-  GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  PULUMI_PULUMI_ENABLE_JOURNALING: "true"
-  TF_APPEND_USER_AGENT: pulumi
-
-jobs:
-  command-dispatch-for-testing:
-    name: command-dispatch-for-testing
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        persist-credentials: false    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: peter-evans/slash-command-dispatch@5c11dc7efead556e3bdabf664302212f79eb26fa # v5
-      with:
-        commands: |
-          run-acceptance-tests
-          release
-        issue-type: pull-request
-        permission: write
-        reaction-token: ${{ secrets.GITHUB_TOKEN }}
-        repository: pulumi/pulumi-docker-build
-        token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
 name: command-dispatch
 on:
   issue_comment:
     types:
     - created
     - edited
+env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+  PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
+  JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
+  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
+  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
+  GOOGLE_PROJECT: pulumi-ci-gcp-provider
+  GOOGLE_PROJECT_NUMBER: 895284651812
+  GOOGLE_REGION: us-central1
+  GOOGLE_ZONE: us-central1-a
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+jobs:
+  command-dispatch-for-testing:
+    runs-on: ubuntu-latest
+    name: command-dispatch-for-testing
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        lfs: true
+    - uses: peter-evans/slash-command-dispatch@v2
+      with:
+        token: ${{ secrets.PULUMI_BOT_TOKEN }}
+        reaction-token: ${{ secrets.GITHUB_TOKEN }}
+        commands: run-acceptance-tests
+        permission: write
+        issue-type: pull-request
+        repository: pulumi/pulumi-docker-build
+    if: ${{ github.event.issue.pull_request }}

.github/workflows/comment-on-stale-issues.yml

@@ -1,44 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-name: "Comment on stale issues"
-
-on:
-  workflow_dispatch: {}
-  schedule:
-  - cron: "46 4 * * *" # run once per day
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-latest
-    name: Stale issue job
-    steps:
-    - uses: pose/stale-issue-cleanup@d2922f61fc5669f4154408689f9bb2a981996112
-      with:
-        issue-types: issues # only look at issues (ignore pull-requests)
-
-        # Setting messages to an empty string causes the automation to skip that category
-        ancient-issue-message: "Unfortunately, it looks like this issue hasn't seen any updates in a while. If you're still experiencing this issue, could you leave a quick comment to let us know so we can prioritize it?"
-        ancient-pr-message: ""
-        stale-issue-message: ""
-        stale-pr-message: ""
-
-        # These labels are required
-        stale-issue-label: awaiting-feedback # somewhat confusingly, this is also used for when labeling "ancient" issues
-        exempt-issue-labels: kind/enhancement,kind/task,kind/epic,kind/engineering, awaiting-upstream # only run on kind/bug for now, ignore awaiting-upstream too.
-        stale-pr-label: no-pr-activity # unused because we aren't processing PRs
-        exempt-pr-labels: awaiting-approval # unused because we aren't processing PRs
-        response-requested-label: response-requested # unused because we don't set a "stale-issue-message" above
-
-        # Issue timing
-        days-before-close: 10000 # this action lacks the option not to close, so just set this indefinitly far in the future
-        days-before-ancient: 180 # 6 months
-
-        # If you don't want to mark a issue as being ancient based on a
-        # threshold of "upvotes", you can set this here. An "upvote" is
-        # the total number of +1, heart, hooray, and rocket reactions
-        # on an issue.
-        minimum-upvotes-to-exempt: 2
-
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        loglevel: DEBUG
-        # Set dry-run to true to not perform label or close actions.
-        dry-run: true

.github/workflows/community-moderation.yml

@@ -1,43 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-
-jobs:
-  warn_codegen:
-    name: warn_codegen
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        persist-credentials: false
-    - id: schema_changed
-      name: Check for diff in schema
-      uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-      with:
-        filters: "changed: 'provider/cmd/**/schema.json'"
-    - id: sdk_changed
-      if: steps.schema_changed.outputs.changed == 'false'
-      name: Check for diff in sdk/**
-      uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-      with:
-        filters: "changed: 'sdk/**'"
-    - if: steps.sdk_changed.outputs.changed == 'true' &&
-        github.event.pull_request.head.repo.full_name != github.repository
-      name: Send codegen warning as comment on PR
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
-      with:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        message: >
-          Hello and thank you for your pull request! :heart: :sparkles:
-
-          It looks like you're directly modifying files in the language SDKs, many of which are autogenerated.
-
-          Be sure any files you're editing do not begin with a code generation warning.
-
-          For generated files, you will need to make changes in `resources.go` instead, and [generate the code](https://github.com/pulumi/${{ github.event.repository.name }}/blob/master/CONTRIBUTING.md#committing-generated-code).
-name: warn-codegen
-on:
-  pull_request_target:
-    branches:
-    - main
-    types:
-    - opened

.github/workflows/export-repo-secrets.yml

@@ -1,25 +0,0 @@
-permissions: write-all # Equivalent to default permissions plus id-token: write
-name: Export secrets to ESC
-on: [workflow_dispatch]
-jobs:
-  export-to-esc:
-    runs-on: ubuntu-latest
-    name: export GitHub secrets to ESC
-    steps:
-      - name: Generate a GitHub token
-        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
-        with:
-          app-id: 1256780 # Export Secrets GitHub App
-          private-key: ${{ secrets.EXPORT_SECRETS_PRIVATE_KEY }}
-      - name: Export secrets to ESC
-        uses: pulumi/esc-export-secrets-action@9d6485759b6adff2538ae91f1b77cc96265c9dad # v1
-        with:
-          organization: pulumi
-          org-environment: imports/github-secrets
-          exclude-secrets: EXPORT_SECRETS_PRIVATE_KEY
-          github-token: ${{ steps.generate-token.outputs.token }}
-          oidc-auth: true
-          oidc-requested-token-type: urn:pulumi:token-type:access_token:organization
-        env:
-          GITHUB_SECRETS: ${{ toJSON(secrets) }}

.github/workflows/gh-aw-pr-rereview.md

@@ -1,20 +0,0 @@
----
-on:
-  slash_command:
-    events:
-    - pull_request_comment
-    - pull_request_review_comment
-    name: review-again
-permissions:
-  contents: read
-  id-token: write
-  pull-requests: read
-imports:
-- shared/review.md
-- shared/plugins/code-review/code-review.md
-description: Run PR re-review on explicit maintainer slash command.
-source: pulumi-labs/gh-aw-internal/.github/workflows/gh-aw-pr-rereview.md@8a92f53fac170563f7727cacab2dbedb5d5b9e29
-strict: true
-timeout-minutes: 15
----
-# Internal PR Re-Review (Slash Command)

.github/workflows/gh-aw-pr-review.md

@@ -1,25 +0,0 @@
----
-on:
-  pull_request:
-    types:
-    - opened
-    - ready_for_review
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: Pull request number to review
-        required: true
-        type: string
-permissions:
-  contents: read
-  id-token: write
-  pull-requests: read
-imports:
-- shared/review.md
-- shared/plugins/code-review/code-review.md
-description: Automated PR review for trusted internal contributors.
-source: pulumi-labs/gh-aw-internal/.github/workflows/gh-aw-pr-review.md@8a92f53fac170563f7727cacab2dbedb5d5b9e29
-strict: true
-timeout-minutes: 15
----
-# Internal Trusted PR Reviewer

.github/workflows/lint.yml

@@ -1,66 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-
-name: lint
-
-on:
-  workflow_call:
-    inputs: {}
-
-env:
-  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
-  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
-  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
-  GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
-  GOOGLE_REGION: us-central1
-  GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  PULUMI_PULUMI_ENABLE_JOURNALING: "true"
-  TF_APPEND_USER_AGENT: pulumi
-
-jobs:
-  lint:
-    name: lint
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      id-token: write # For ESC secrets.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        persist-credentials: false    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
-    - name: Setup mise
-      uses: jdx/mise-action@8d3b0ba20a9cea7b883d922ea958553c941ab082
-      env:
-        MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
-      with:
-        version: 2026.3.7
-        github_token: ${{ steps.app-auth.outputs.token }}
-        cache_save: false # A different job handles caching our tools.
-    - name: prepare workspace
-      continue-on-error: true
-      run: make prepare_local_workspace
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: lint
-      run: make lint

.github/workflows/prerelease.yml

@@ -6,68 +6,75 @@ on:
     tags:
     - v*.*.*-**
 env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
   JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  TF_APPEND_USER_AGENT: pulumi
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
   IS_PRERELEASE: true
-
 jobs:
   prerequisites:
     runs-on: ubuntu-latest
     name: prerequisites
-    permissions:
-      id-token: write # For ESC secrets.
-      pull-requests: write # For schema check comment.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        cache: 'true'
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
     - if: github.event_name == 'pull_request'
       name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
         repo: pulumi/schema-tools
     - name: Build codegen binaries
@@ -77,27 +84,25 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        {
-          echo 'SCHEMA_CHANGES<<EOF';
+        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
 
-          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
 
-          echo 'EOF';
-        } >> "$GITHUB_ENV"
+        echo 'EOF' >> $GITHUB_ENV
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-    - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+    - if: github.event_name == 'pull_request'
       name: Comment on PR with Details of Schema Check
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      uses: thollander/actions-comment-pull-request@v2
       with:
         message: |
           ${{ env.SCHEMA_CHANGES }}
-        comment-tag: schemaCheck
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        comment_tag: schemaCheck
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
         github.actor == 'pulumi-bot'
       name: Add label if no breaking changes
-      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+      uses: actions-ecosystem/action-add-labels@v1.1.0
       with:
         labels: impact/no-changelog-required
         number: ${{ github.event.issue.number }}
@@ -105,49 +110,42 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
         github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
         pulumi-gen-${{ env.PROVIDER}}
     - name: Upload artifacts
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
         path: ${{ github.workspace }}/bin/provider.tar.gz
     - name: Test Provider Library
       run: make test_provider
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      uses: codecov/codecov-action@v4
       env:
-        CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in building provider prerequisites
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   build_sdks:
     needs: prerequisites
     runs-on: pulumi-ubuntu-8core
     strategy:
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
+      fail-fast: true
       matrix:
         language:
         - nodejs
@@ -156,75 +154,89 @@ jobs:
         - go
         - java
     name: build_sdks
-    permissions:
-      pull-requests: write # For Renovate SDK updates.
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Generate SDK
       run: make generate_${{ matrix.language }}
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure while building SDKs
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   test:
     runs-on: pulumi-ubuntu-8core
     needs:
@@ -238,51 +250,75 @@ jobs:
         - dotnet
         - go
         - java
-        - yaml
     name: test
     permissions:
       contents: read
-      id-token: write # For ESC secrets and Pulumi access token OIDC.
+      id-token: write
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Download SDK
-      if: ${{ matrix.language != 'yaml' }}
-      uses: ./.github/actions/download-sdk
+      uses: actions/download-artifact@v4
       with:
-        language: ${{ matrix.language }}
+        name: ${{ matrix.language }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: UnTar SDK folder
+      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
+        github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
@@ -291,23 +327,18 @@ jobs:
         pip3 install virtualenv==20.0.23
         pip3 install pipenv
     - name: Install dependencies
-      if: ${{ matrix.language != 'yaml' }}
       run: make install_${{ matrix.language}}_sdk
-    - name: Generate Pulumi Access Token
-      id: generate_pulumi_token
-      uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        organization: pulumi
-        requested-token-type: urn:pulumi:token-type:access_token:organization
-        export-environment-variables: false
-    - name: Export AWS Credentials
-      uses: pulumi/esc-action@f3cfbabf37488463817366338165b92b5f99117e
-      env:
-        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
-      with:
-        environment: logins/pulumi-ci
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-region: ${{ env.AWS_REGION }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        role-duration-seconds: 3600
+        role-session-name: ${{ env.PROVIDER }}@githubActions
+        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
     - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+      uses: google-github-actions/auth@v0
       with:
         workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
           }}/locations/global/workloadIdentityPools/${{
@@ -315,7 +346,7 @@ jobs:
           env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
         service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
     - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+      uses: google-github-actions/setup-gcloud@v2
       with:
         install_components: gke-gcloud-auth-plugin
     - name: Install gotestfmt
@@ -327,58 +358,35 @@ jobs:
       run: >-
         set -euo pipefail
 
-        cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        cd examples && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in SDK tests
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish:
     runs-on: ubuntu-latest
     needs: test
     name: publish
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
     - name: Clear GitHub Actions Ubuntu runner disk space
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         dotnet: false
@@ -386,86 +394,82 @@ jobs:
         haskell: true
         swap-storage: true
         large-packages: false
-    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
-        aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
         aws-region: us-east-2
-        aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         role-duration-seconds: 7200
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
-        role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
+        role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
+      uses: goreleaser/goreleaser-action@v5
       env:
         GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
-        AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
-        AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
-        AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
-        AZURE_SIGNING_ACCOUNT_ENDPOINT: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_ENDPOINT }}
-        AZURE_SIGNING_ACCOUNT_NAME: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_NAME }}
-        AZURE_SIGNING_CERT_PROFILE_NAME: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CERT_PROFILE_NAME }}
-        SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_ENDPOINT == '' && steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_NAME == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CERT_PROFILE_NAME == '' }}
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
       with:
         args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
         version: latest
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing binaries
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_sdk:
     runs-on: ubuntu-latest
     needs: publish
     name: publish_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Checkout Scripts Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
     - name: Download python SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: python-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -473,7 +477,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
         ${{github.workspace}}/sdk/python
     - name: Download dotnet SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: dotnet-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -481,7 +485,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
         ${{github.workspace}}/sdk/dotnet
     - name: Download nodejs SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: nodejs-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -493,98 +497,83 @@ jobs:
     - name: Publish SDKs
       run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
       env:
-        NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
-        NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         PYPI_PUBLISH_ARTIFACTS: all
-        PYPI_USERNAME: __token__
-        PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing SDK
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_java_sdk:
     runs-on: ubuntu-latest
     continue-on-error: true
     needs: publish
     name: publish_java_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
     - name: Download java SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: java-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
-    - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-      with:
-        gradle-version: "7.6"
     - name: Publish Java SDK
-      run: gradle -p ./sdk/java publishToSonatype closeAndReleaseSonatypeStagingRepository
+      uses: gradle/gradle-build-action@v3
       env:
         PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
-        SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
-        SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
-        SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
-        PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
-        PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
+      with:
+        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
+        build-root-directory: ./sdk/java
+        gradle-version: 7.4.1
   publish_go_sdk:
     runs-on: ubuntu-latest
     name: publish-go-sdk
     needs: publish_sdk
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
         lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Download go SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: go-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/

.github/workflows/pull-request.yml

@@ -3,22 +3,62 @@
 name: pull-request
 on:
   pull_request_target: {}
-
+env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+  PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
+  JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
+  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
+  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
+  GOOGLE_PROJECT: pulumi-ci-gcp-provider
+  GOOGLE_PROJECT_NUMBER: 895284651812
+  GOOGLE_REGION: us-central1
+  GOOGLE_ZONE: us-central1-a
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 jobs:
   comment-on-pr:
     runs-on: ubuntu-latest
     name: comment-on-pr
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
         lfs: true
     - name: Comment PR
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      uses: thollander/actions-comment-pull-request@v2
       with:
         message: >
           PR is now waiting for a maintainer to run the acceptance tests.
 
           **Note for the maintainer:** To run the acceptance tests, please comment */run-acceptance-tests* on the PR
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     if: github.event.pull_request.head.repo.full_name != github.repository

.github/workflows/release.yml

@@ -7,67 +7,74 @@ on:
     - v*.*.*
     - "!v*.*.*-**"
 env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
   JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  TF_APPEND_USER_AGENT: pulumi
-
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 jobs:
   prerequisites:
     runs-on: ubuntu-latest
     name: prerequisites
-    permissions:
-      id-token: write # For ESC secrets.
-      pull-requests: write # For schema check comment.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        cache: 'true'
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
     - if: github.event_name == 'pull_request'
       name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
         repo: pulumi/schema-tools
     - name: Build codegen binaries
@@ -77,27 +84,25 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        {
-          echo 'SCHEMA_CHANGES<<EOF';
+        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
 
-          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
 
-          echo 'EOF';
-        } >> "$GITHUB_ENV"
+        echo 'EOF' >> $GITHUB_ENV
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-    - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+    - if: github.event_name == 'pull_request'
       name: Comment on PR with Details of Schema Check
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      uses: thollander/actions-comment-pull-request@v2
       with:
         message: |
           ${{ env.SCHEMA_CHANGES }}
-        comment-tag: schemaCheck
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        comment_tag: schemaCheck
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
         github.actor == 'pulumi-bot'
       name: Add label if no breaking changes
-      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+      uses: actions-ecosystem/action-add-labels@v1.1.0
       with:
         labels: impact/no-changelog-required
         number: ${{ github.event.issue.number }}
@@ -105,49 +110,42 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
         github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
         pulumi-gen-${{ env.PROVIDER}}
     - name: Upload artifacts
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
         path: ${{ github.workspace }}/bin/provider.tar.gz
     - name: Test Provider Library
       run: make test_provider
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      uses: codecov/codecov-action@v4
       env:
-        CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in building provider prerequisites
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   build_sdks:
     needs: prerequisites
     runs-on: pulumi-ubuntu-8core
     strategy:
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
+      fail-fast: true
       matrix:
         language:
         - nodejs
@@ -156,75 +154,89 @@ jobs:
         - go
         - java
     name: build_sdks
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Generate SDK
       run: make generate_${{ matrix.language }}
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure while building SDKs
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   test:
     runs-on: pulumi-ubuntu-8core
     needs:
@@ -238,51 +250,75 @@ jobs:
         - dotnet
         - go
         - java
-        - yaml
     name: test
     permissions:
       contents: read
-      id-token: write # For ESC secrets.
+      id-token: write
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Download SDK
-      if: ${{ matrix.language != 'yaml' }}
-      uses: ./.github/actions/download-sdk
+      uses: actions/download-artifact@v4
       with:
-        language: ${{ matrix.language }}
+        name: ${{ matrix.language }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: UnTar SDK folder
+      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
+        github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
@@ -291,23 +327,18 @@ jobs:
         pip3 install virtualenv==20.0.23
         pip3 install pipenv
     - name: Install dependencies
-      if: ${{ matrix.language != 'yaml' }}
       run: make install_${{ matrix.language}}_sdk
-    - name: Generate Pulumi Access Token
-      id: generate_pulumi_token
-      uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        organization: pulumi
-        requested-token-type: urn:pulumi:token-type:access_token:organization
-        export-environment-variables: false
-    - name: Export AWS Credentials
-      uses: pulumi/esc-action@f3cfbabf37488463817366338165b92b5f99117e
-      env:
-        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
-      with:
-        environment: logins/pulumi-ci
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-region: ${{ env.AWS_REGION }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        role-duration-seconds: 3600
+        role-session-name: ${{ env.PROVIDER }}@githubActions
+        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
     - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+      uses: google-github-actions/auth@v0
       with:
         workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
           }}/locations/global/workloadIdentityPools/${{
@@ -315,7 +346,7 @@ jobs:
           env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
         service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
     - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+      uses: google-github-actions/setup-gcloud@v2
       with:
         install_components: gke-gcloud-auth-plugin
     - name: Install gotestfmt
@@ -327,58 +358,35 @@ jobs:
       run: >-
         set -euo pipefail
 
-        cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
-      env:
-        GTIHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        cd examples && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in SDK tests
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish:
     runs-on: ubuntu-latest
     needs: test
     name: publish
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
     - name: Clear GitHub Actions Ubuntu runner disk space
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         dotnet: false
@@ -386,86 +394,82 @@ jobs:
         haskell: true
         swap-storage: true
         large-packages: false
-    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
-        aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
         aws-region: us-east-2
-        aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         role-duration-seconds: 7200
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
-        role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
+        role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
+      uses: goreleaser/goreleaser-action@v5
       env:
         GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
-        AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
-        AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
-        AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
-        AZURE_SIGNING_ACCOUNT_ENDPOINT: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_ENDPOINT }}
-        AZURE_SIGNING_ACCOUNT_NAME: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_NAME }}
-        AZURE_SIGNING_CERT_PROFILE_NAME: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CERT_PROFILE_NAME }}
-        SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_ENDPOINT == '' && steps.esc-secrets.outputs.AZURE_SIGNING_ACCOUNT_NAME == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CERT_PROFILE_NAME == '' }}
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
       with:
         args: -p 3 release --clean --timeout 60m0s
         version: latest
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing binaries
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_sdk:
     runs-on: ubuntu-latest
     needs: publish
     name: publish_sdks
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Checkout Scripts Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
     - name: Download python SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: python-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -473,7 +477,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
         ${{github.workspace}}/sdk/python
     - name: Download dotnet SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: dotnet-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -481,7 +485,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
         ${{github.workspace}}/sdk/dotnet
     - name: Download nodejs SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: nodejs-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -493,98 +497,83 @@ jobs:
     - name: Publish SDKs
       run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
       env:
-        NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
-        NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         PYPI_PUBLISH_ARTIFACTS: all
-        PYPI_USERNAME: __token__
-        PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing SDK
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_java_sdk:
     runs-on: ubuntu-latest
     continue-on-error: true
     needs: publish
     name: publish_java_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
     - name: Download java SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: java-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
-    - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
-      with:
-        gradle-version: "7.6"
     - name: Publish Java SDK
-      run: gradle -p ./sdk/java publishToSonatype closeAndReleaseSonatypeStagingRepository
+      uses: gradle/gradle-build-action@v3
       env:
         PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
-        SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
-        SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
-        SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
-        PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
-        PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
+      with:
+        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
+        build-root-directory: ./sdk/java
+        gradle-version: 7.4.1
   publish_go_sdk:
     runs-on: ubuntu-latest
     name: publish-go-sdk
     needs: publish_sdk
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
         lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Download go SDK
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@v4
       with:
         name: go-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -604,36 +593,14 @@ jobs:
   dispatch_docs_build:
     runs-on: ubuntu-latest
     needs: publish_go_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
     - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
         repo: pulumi/pulumictl
     - name: Dispatch Event
       run: pulumictl create docs-build pulumi-${{ env.PROVIDER }}
-        "${GITHUB_REF#refs/tags/}"
+        ${GITHUB_REF#refs/tags/}
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     name: dispatch_docs_build

.github/workflows/release_command.yml

@@ -1,54 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-
-name: release-command
-on:
-  repository_dispatch:
-    types:
-    - release-command
-jobs:
-  should_release:
-    name: Should release PR
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        persist-credentials: false    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - name: Should release PR
-      uses: pulumi/action-release-by-pr-label@main
-      with:
-        command: "should-release"
-        repo: ${{ github.repository }}
-        pr: ${{ github.event.client_payload.pull_request.number }}
-        version: ${{ github.event.client_payload.slash_command.args.all }}
-        slack_channel: ${{ steps.esc-secrets.outputs.RELEASE_OPS_STAGING_SLACK_CHANNEL }}
-      env:
-        RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }}
-        RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - if: failure()
-      name: Notify failure
-      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
-        issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
-        body: |
-          "release command failed: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-    - if: success()
-      name: Notify success
-      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
-        comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
-        reaction-type: hooray

.github/workflows/run-acceptance-tests.yml

@@ -4,533 +4,296 @@ name: run-acceptance-tests
 on:
   repository_dispatch:
     types:
-    - run-acceptance-tests-command
+      - run-acceptance-tests-command
   pull_request:
     paths-ignore:
-    - CHANGELOG.md
+      - CHANGELOG.md
   workflow_dispatch: {}
 env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
-  JAVAVERSION: "11"
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  PULUMI_PULUMI_ENABLE_JOURNALING: "true"
-  TF_APPEND_USER_AGENT: pulumi
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
   PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
 jobs:
   comment-notification:
-    if: github.event_name == 'repository_dispatch'
     runs-on: ubuntu-latest
     name: comment-notification
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Create URL to the run output
-      id: vars
-      run: echo
-        "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-        >> "$GITHUB_OUTPUT"
-    - name: Update with Result
-      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
-        issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
-        body: "Please view the PR build: ${{ steps.vars.outputs.run-url }}"
+      - name: Create URL to the run output
+        id: vars
+        run: echo
+          run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID
+          >> "$GITHUB_OUTPUT"
+      - name: Update with Result
+        uses: peter-evans/create-or-update-comment@v1
+        with:
+          token: ${{ secrets.PULUMI_BOT_TOKEN }}
+          repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
+          issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
+          body: "Please view the PR build: ${{ steps.vars.outputs.run-url }}"
+    if: github.event_name == 'repository_dispatch'
   prerequisites:
+    if: github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
-    name: prerequisites
-    permissions:
-      id-token: write # For ESC secrets.
-      pull-requests: write # For schema check comment.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
-      with:
-        set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
-      with:
-        cache: 'true'
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - if: github.event_name == 'pull_request'
-      name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@25e24d2d23ae098373794ef1d6faecb48ee52da8 # v3.0.0
-      with:
-        repo: pulumi/schema-tools
-    - name: Build codegen binaries
-      run: make codegen
-    - name: Build Schema
-      run: make generate_schema
-    - if: github.event_name == 'pull_request'
-      name: Check Schema is Valid
-      run: >-
-        {
-          echo 'SCHEMA_CHANGES<<EOF';
-
-          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
-
-          echo 'EOF';
-        } >> "$GITHUB_ENV"
-      env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-    - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
-      name: Comment on PR with Details of Schema Check
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
-      with:
-        message: |
-          ${{ env.SCHEMA_CHANGES }}
-        comment-tag: schemaCheck
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-    - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
-        github.actor == 'pulumi-bot'
-      name: Add label if no breaking changes
-      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
-      with:
-        labels: impact/no-changelog-required
-        number: ${{ github.event.issue.number }}
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Build Provider
-      run: make provider
-    - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
-          sdk/go/**/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
-          sdk/java/build.gradle
-      # This worktree check is a safeguard against someone forgetting to
-      # re-build and commit locally, but we handle that commit automatically in
-      # the case of dependency bumps.
-      continue-on-error: ${{ contains(github.actor, 'renovate') }}
-    - name: Commit SDK changes for Renovate
-      if: steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk provider/cmd/pulumi-resource-docker-build/schema.json
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
-    - run: git status --porcelain
-    - name: Tar provider binaries
-      run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
-        github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
-        pulumi-gen-${{ env.PROVIDER}}
-    - name: Upload artifacts
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-      with:
-        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin/provider.tar.gz
-    - name: Test Provider Library
-      run: make test_provider
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
-      env:
-        CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
-    - if: failure() && github.event_name == 'push'
-      name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
-      with:
-        author_name: Failure in building provider prerequisites
-        fields: repo,commit,author,action
-        status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
-    if: github.event_name == 'repository_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-  build_sdks:
-    needs: prerequisites
-    runs-on: pulumi-ubuntu-8core
-    strategy:
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
-      matrix:
-        language:
-        - nodejs
-        - python
-        - dotnet
-        - go
-        - java
-    name: build_sdks
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
-      with:
-        set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
-      with:
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Download provider
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin
-    - name: UnTar provider binaries
-      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
-        github.workspace}}/bin
-    - name: Restore Binary Permissions
-      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-        -exec chmod +x {} \;
-    - name: Generate SDK
-      run: make generate_${{ matrix.language }}
-    - name: Build SDK
-      run: make build_${{ matrix.language }}
-    - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
-          sdk/go/**/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
-          sdk/java/build.gradle
-      continue-on-error: ${{ contains(github.actor, 'renovate') }}
-    - name: Commit SDK changes for Renovate
-      if: steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-        # Apply and add our changes, but don't commit any files we expect to
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk provider/cmd/pulumi-resource-docker-build/schema.json
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
-    - run: git status --porcelain
-    - name: Tar SDK folder
-      run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
-    - name: Upload artifacts
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-      with:
-        name: ${{ matrix.language  }}-sdk.tar.gz
-        path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
-        retention-days: 30
-    - if: failure() && github.event_name == 'push'
-      name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
-      with:
-        author_name: Failure while building SDKs
-        fields: repo,commit,author,action
-        status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
-    if: github.event_name == 'repository_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-  test:
-    runs-on: pulumi-ubuntu-8core
-    needs:
-    - build_sdks
-    strategy:
-      fail-fast: true
-      matrix:
-        language:
-        - nodejs
-        - python
-        - dotnet
-        - go
-        - java
-        - yaml
-    name: test
     permissions:
       contents: read
       id-token: write
+      actions: write # For telemetry.
+      pull-requests: write # For schema comment.
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
-      with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@3a647064cf4697c7c6352b9a1d9e554450cbe957 # v1.6.1
-      with:
-        set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
-      with:
-        github_token: ${{ steps.app-auth.outputs.token }}
-    - name: Download provider
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin
-    - name: UnTar provider binaries
-      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
-        github.workspace}}/bin
-    - name: Restore Binary Permissions
-      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-        -exec chmod +x {} \;
-    - name: Download SDK
-      if: ${{ matrix.language != 'yaml' }}
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-      with:
-        name: ${{ matrix.language }}-sdk.tar.gz
-        path: ${{ github.workspace}}/sdk/
-    - name: UnTar SDK folder
-      if: ${{ matrix.language != 'yaml' }}
-      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
-        github.workspace}}/sdk/${{ matrix.language}}
-    - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
-    - name: Install Node dependencies
-      run: yarn global add typescript
-    - run: dotnet nuget add source ${{ github.workspace }}/nuget
-    - name: Install Python deps
-      run: |-
-        pip3 install virtualenv==20.0.23
-        pip3 install pipenv
-    - name: Install dependencies
-      if: ${{ matrix.language != 'yaml' }}
-      run: make install_${{ matrix.language}}_sdk
-    - name: Generate Pulumi Access Token
-      id: generate_pulumi_token
-      uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
-      with:
-        organization: pulumi
-        requested-token-type: urn:pulumi:token-type:access_token:organization
-        export-environment-variables: false
-    - name: Export AWS Credentials
-      uses: pulumi/esc-action@f3cfbabf37488463817366338165b92b5f99117e
-      env:
-        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
-      with:
-        environment: logins/pulumi-ci
-    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
-      with:
-        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
-          }}/locations/global/workloadIdentityPools/${{
-          env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
-          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
-        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
-    - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
-      with:
-        install_components: gke-gcloud-auth-plugin
-    - name: Install gotestfmt
-      uses: GoTestTools/gotestfmt-action@v2
-      with:
-        version: v2.5.0
-        token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Run tests
-      run: >-
-        set -euo pipefail
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          lfs: true
+          ref: ${{ env.PR_COMMIT_SHA }}
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+      - id: version
+        name: Set Provider Version
+        uses: pulumi/provider-version-action@v1
+        with:
+          set-env: PROVIDER_VERSION
+      - name: Build codegen binaries
+        run: make codegen
+      - name: Build Schema
+        run: make generate_schema
+      - if: github.event_name == 'pull_request'
+        name: Check Schema is Valid
+        run: >-
+          echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
 
-        cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - if: failure() && github.event_name == 'push'
-      name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
-      with:
-        author_name: Failure in SDK tests
-        fields: repo,commit,author,action
-        status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
+
+          echo 'EOF' >> $GITHUB_ENV
+        env:
+          GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+      - if: github.event_name == 'pull_request'
+        name: Comment on PR with Details of Schema Check
+        uses: thollander/actions-comment-pull-request@v2
+        with:
+          message: |
+            ${{ env.SCHEMA_CHANGES }}
+          comment_tag: schemaCheck
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - if:
+          contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
+          github.actor == 'pulumi-bot'
+        name: Add label if no breaking changes
+        uses: actions-ecosystem/action-add-labels@v1.1.0
+        with:
+          labels: impact/no-changelog-required
+          number: ${{ github.event.issue.number }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build Provider
+        run: make provider
+      - name: Check worktree clean
+        uses: pulumi/git-status-check-action@v1
+        with:
+          allowed-changes: |-
+            sdk/**/pulumi-plugin.json
+            sdk/dotnet/Pulumi.*.csproj
+            sdk/go/**/pulumiUtilities.go
+            sdk/nodejs/package.json
+            sdk/python/pyproject.toml
+      - run: git status --porcelain
+      - name: Tar provider binaries
+        run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+          github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
+          pulumi-gen-${{ env.PROVIDER}}
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+          path: ${{ github.workspace }}/bin/provider.tar.gz
+      - name: Test Provider Library
+        run: make test_provider
+      - name: Upload coverage reports to Codecov
+        uses: codecov/codecov-action@v4
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      - if: failure() && github.event_name == 'push'
+        name: Notify Slack
+        uses: 8398a7/action-slack@v3
+        with:
+          author_name: Failure in building provider prerequisites
+          fields: repo,commit,author,action
+          status: ${{ job.status }}
+
+      - name: Generate & Build SDK
+        run: mise run sdk
+      - name: Check worktree clean
+        uses: pulumi/git-status-check-action@v1
+        with:
+          allowed-changes: |-
+            sdk/**/pulumi-plugin.json
+            sdk/dotnet/Pulumi.*.csproj
+            sdk/go/**/pulumiUtilities.go
+            sdk/nodejs/package.json
+            sdk/python/pyproject.toml
+      - run: git status --porcelain
+      - name: Tar SDK folder
+        run: tar -zcf sdk.tar.gz -C sdk .
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdk.tar.gz
+          path: ${{ github.workspace}}/sdk.tar.gz
+          retention-days: 30
+      - if: failure() && github.event_name == 'push'
+        name: Notify Slack
+        uses: 8398a7/action-slack@v3
+        with:
+          author_name: Failure while building SDKs
+          fields: repo,commit,author,action
+          status: ${{ job.status }}
+
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      actions: write # For telemetry.
+    needs:
+      - prerequisites
+    strategy:
+      fail-fast: true
+      matrix:
+        shard: [0, 1, 2, 3, 4, 5, 6, 7]
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          lfs: true
+          ref: ${{ env.PR_COMMIT_SHA }}
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+      - id: version
+        name: Set Provider Version
+        uses: pulumi/provider-version-action@v1
+        with:
+          set-env: PROVIDER_VERSION
+      - name: Download provider + tfgen binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+          path: ${{ github.workspace }}/bin
+      - name: UnTar provider binaries
+        run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+          github.workspace}}/bin
+      - name: Restore Binary Permissions
+        run:
+          find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+          -exec chmod +x {} \;
+      - name: Download SDK
+        uses: actions/download-artifact@v4
+        with:
+          name: sdk.tar.gz
+          path: ${{ github.workspace}}
+      - name: UnTar SDK folder
+        run: tar -zxf ${{ github.workspace}}/sdk.tar.gz -C ${{github.workspace}}/sdk
+      - name: Update path
+        run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      - name: Install Node dependencies
+        run: yarn global add typescript
+      - run: dotnet nuget add source ${{ github.workspace }}/nuget
+      - name: Install dependencies
+        run: mise run install
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-region: ${{ env.AWS_REGION }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-duration-seconds: 3600
+          role-session-name: ${{ env.PROVIDER }}@githubActions
+          role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v0
+        with:
+          workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
+            }}/locations/global/workloadIdentityPools/${{
+            env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
+            env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
+      - name: Setup gcloud auth
+        uses: google-github-actions/setup-gcloud@v2
+        with:
+          skip_install: true
+      - name: Shard tests
+        run: mise run "test:examples:shard" -- --total ${{ strategy.job-total }} --index ${{ strategy.job-index }} > go-test
+      - name: Run tests
+        run: mise run "test:examples" $(cat go-test) 2>&1 | tee /tmp/gotest.log | gotestfmt
+      - if: failure() && github.event_name == 'push'
+        name: Notify Slack
+        uses: 8398a7/action-slack@v3
+        with:
+          author_name: Failure in SDK tests
+          fields: repo,commit,author,action
+          status: ${{ job.status }}
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
   sentinel:
     runs-on: ubuntu-latest
     name: sentinel
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - name: Mark workflow as successful
-      uses: guibranco/github-status-action-v2@77639353504055053524efa7a3719aaf0b731ce9 # v1.2.4
-      with:
-        authToken: ${{ secrets.GITHUB_TOKEN }}
-        context: Sentinel
-        state: success
-        description: Sentinel checks passed
-        sha: ${{ github.event.pull_request.head.sha || github.sha }}
-    permissions:
-      statuses: write
-      id-token: write # For ESC secrets.
+      - name: Mark workflow as successful
+        uses: guibranco/github-status-action-v2@0849440ec82c5fa69b2377725b9b7852a3977e76
+        with:
+          authToken: ${{ secrets.GITHUB_TOKEN }}
+          context: Sentinel
+          state: success
+          description: Sentinel checks passed
+          sha: ${{ github.event.pull_request.head.sha || github.sha }}
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
     needs:
-    - test
-    - prerequisites
-    - lint
+      - test
+      - lint
   lint:
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
-    name: lint
-    uses: ./.github/workflows/lint.yml
-    secrets: inherit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      actions: write # For telemetry.
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          lfs: true
+          ref: ${{ env.PR_COMMIT_SHA }}
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+      - run: make lint

.github/workflows/shared/plugins/code-review/code-review.md

@@ -1,214 +0,0 @@
----
-description: High-signal PR review for gh-aw workflows using safe outputs
----
-
-Provide a code review for the given pull request.
-
-**Agent assumptions (applies to all agents and subagents):**
-- All tools are functional and will work without error. Do not test tools or make exploratory calls. Make sure this is clear to every subagent that is launched.
-- Only call a tool if it is required to complete the task. Every tool call should have a clear purpose.
-- Use GitHub MCP tools for repository reads. Do not use `gh` CLI commands for repository inspection or for posting review output.
-- Use the workflow PR number as the authoritative target.
-- Review output must be terse and issue-focused. Do not praise the PR, narrate checks that passed, explain why code is correct, or offer "good change" commentary.
-- Use only gh-aw safe outputs for review side effects:
-  - `create-pull-request-review-comment` for actionable inline findings on changed lines
-  - `resolve-pull-request-review-thread` for unresolved bot-authored review threads that are now fixed or clearly acknowledged
-  - `submit-pull-request-review` for the final review decision
-  - `noop` when no action should be taken
-- Use cache-memory only for short-lived continuity and deduplication hints. Treat live PR state and current review threads as the source of truth.
-- Never post free-form issue comments or use any side channel for review output.
-- Respect the workflow safe-output limits. Prioritize the highest-signal unique findings and keep the inline review set within the configured maximum.
-- Consult `.gitattributes` when relevant and treat files matched there as generated by default. Ignore findings that exist only in generated outputs such as `.lock.yml` files unless the corresponding source-of-truth files show a real behavioral problem.
-
-To do this, follow these steps precisely:
-
-1. Create a short todo list for yourself before starting.
-
-2. Launch a fast subagent to check if any of the following are true:
-   - The pull request is closed
-   - The pull request is a draft
-   - The pull request does not need code review (e.g. automated PR, trivial change that is obviously correct)
-   - Required PR context cannot be read from the workflow tools
-
-   If any condition is true, call `noop` with a brief reason and stop.
-
-Note: Do not skip solely because prior automated review comments exist. Use prior comments for deduplication and stale-thread cleanup instead.
-
-3. Read any prior review memory for this PR from cache-memory before you start detailed analysis.
-
-   Use a PR-specific file such as:
-   - `/tmp/gh-aw/cache-memory/pr-${PR_NUMBER}.json`
-
-   If a prior memory file exists, use it only as a hint for:
-   - Previously reported issues
-   - Dedupe patterns
-   - Prior review timestamps
-   - Risk areas worth re-checking
-
-   Do not trust cache-memory over current GitHub state. If memory conflicts with the live PR, changed files, or review threads, trust the live PR and ignore stale memory.
-
-4. Launch a fast subagent to return a list of file paths (not their contents) for all relevant `CLAUDE.md` files including:
-   - The root CLAUDE.md file, if it exists
-   - Any CLAUDE.md files in directories containing files modified by the pull request
-
-5. Launch a subagent to summarize:
-   - The PR title and description
-   - The changed files
-   - The main behavioral changes in the diff
-   - Any obvious risk areas worth checking carefully
-
-6. Fetch existing review comments and review threads on the PR before preparing any new findings. Use them to identify:
-   - Similar issues already flagged
-   - Threads where a human already acknowledged the feedback
-   - Comments on code that has changed since the earlier review and may now be stale
-   - Unresolved bot-authored review threads that may now be fixed or obsolete
-
-7. Launch 4 review subagents in parallel. Each agent should return a list of candidate issues, where each issue includes:
-   - A concise description
-   - The reason it was flagged (for example `CLAUDE.md adherence` or `bug`)
-   - The changed file path
-   - The changed line or closest changed hunk
-   - Why the issue is likely real
-
-   Agents 1 + 2: CLAUDE.md compliance sonnet agents
-   Audit changes for `CLAUDE.md` compliance in parallel. When evaluating a file, only consider `CLAUDE.md` files that share a path scope with that file or its parents.
-
-   Agent 3: bug-focused review agent
-   Scan for obvious bugs. Focus only on the diff itself without reading extra context. Flag only significant bugs; ignore nitpicks and likely false positives. Do not flag issues that you cannot validate without looking at context outside of the git diff.
-
-   Agent 4: behavior-focused review agent
-   Look for problems introduced by the new code, including security issues, incorrect logic, regressions, and missing error handling. Only look for issues that fall within changed code.
-
-   **CRITICAL: We only want HIGH SIGNAL issues.** Flag issues where:
-   - The code will fail to compile or parse (syntax errors, type errors, missing imports, unresolved references)
-   - The code will definitely produce wrong results regardless of inputs (clear logic errors)
-   - The code introduces a clear security or regression bug in changed lines
-   - Clear, unambiguous `CLAUDE.md` violations where you can quote the exact rule being broken
-
-   Do NOT flag:
-   - Code style or quality concerns
-   - Potential issues that depend on specific inputs or state
-   - Subjective suggestions or improvements
-
-   If you are not certain an issue is real, do not flag it. False positives erode trust and waste reviewer time.
-
-   Each review subagent should receive the PR title and description so it can evaluate intent.
-
-8. For each candidate issue, launch validation subagents in parallel. Each validator should receive the PR title, description, issue description, affected file, and affected hunk. The validator must confirm that the issue is real with high confidence.
-
-   For bug and logic issues, verify the changed code actually causes the stated problem.
-
-   For `CLAUDE.md` issues, verify both:
-   - The cited rule exists
-   - The rule applies to that file path and is actually violated
-
-9. Filter out any issue that fails validation.
-
-10. Deduplicate and prune the validated issue list. Remove:
-   - Issues already covered by an existing review comment
-   - Issues in threads where a human has already acknowledged the feedback
-   - Issues that were present in an earlier revision but are fixed in the latest code
-   - Duplicate findings reported by multiple subagents
-   - Findings that are not on changed lines or cannot be tied to a changed hunk
-   - Findings that only came from cache-memory and are not confirmed by the current PR state
-
-   Also create a separate internal list of review threads to resolve. A thread is eligible for resolution only when all of the following are true:
-   - The thread is currently unresolved
-   - The thread was started by this automation or another bot, not by a human reviewer
-   - The underlying issue is fixed in the latest diff, outdated, or explicitly acknowledged by a human as intentionally left as-is
-   - You have high confidence that resolving it will not hide an outstanding real issue
-
-   Never resolve human-authored review threads. When uncertain, leave the thread unresolved.
-
-11. Classify the remaining issues:
-   - `Blocking`: correctness, security, regression, data loss, or clear required-rule violations
-   - `Non-blocking`: actionable but not merge-blocking concerns that are still worth interrupting the author for now
-
-   Drop any candidate that is merely:
-   - praise
-   - reassurance
-   - a follow-up idea
-   - a readability suggestion with no concrete risk
-   - an observation that does not require author action
-
-12. Produce a short internal summary of findings for yourself:
-   - If issues remain, list the highest-signal ones first
-   - If no issues remain, summarize that no actionable high-signal issues were found
-
-13. If no actionable issues remain, submit exactly one final review with `submit-pull-request-review`:
-   - Use `APPROVE`
-   - Use one short sentence only, such as `No actionable issues found.`
-   - Do not create inline comments
-   - Do not include praise, summaries of what was checked, or correctness narration
-   - Before stopping, write a compact review memory file for this PR containing:
-     - review timestamp
-     - PR number
-     - files reviewed
-     - summary of what was checked
-     - `issues_reported: []`
-   - Stop after the final review is submitted and memory is updated
-
-14. If actionable issues remain, choose the highest-signal unique issues up to the safe-output comment limit. Create a list of planned inline comments for yourself before posting anything.
-
-   Prefer zero comments over low-signal comments. Non-blocking comments should be rare.
-
-15. Post one inline comment per chosen issue using `create-pull-request-review-comment`. For each comment:
-   - Provide a brief description of the issue
-   - Explain why it matters
-   - Reference the exact changed line
-   - Cite the relevant `CLAUDE.md` rule when applicable
-   - Keep the comment concise and actionable
-   - Do not post comments that merely suggest optional follow-up cleanup or extra documentation
-   - Do not post comments whose conclusion is that the code is acceptable as-is
-   - Do not post duplicate comments for the same issue
-
-16. Resolve eligible stale review threads using `resolve-pull-request-review-thread` before submitting the final review.
-   - Resolve only threads from your internal resolution list
-   - Resolve only bot-authored threads
-   - Do not add explanatory comments when resolving
-   - If no threads qualify, do nothing
-
-17. Submit exactly one final review using `submit-pull-request-review`:
-   - Use `REQUEST_CHANGES` when at least one blocking issue remains
-   - Use `APPROVE` otherwise, including when only non-blocking inline comments were left
-   - Do not use `COMMENT` as the final review state
-   - Keep the summary to one or two short sentences
-   - Do not restate inline comments in the final review; point readers to the inline comments instead
-   - Do not include praise, correctness checklists, or "overall LGTM" framing unless there are zero inline comments and you are using the exact terse approval style above
-
-18. After the final review is submitted, update the PR-specific cache-memory file with a compact record of this review. Store only short-lived operational state such as:
-   - review timestamp
-   - PR number
-   - files reviewed
-   - issue fingerprints or short summaries
-   - whether the final review was `APPROVE` or `REQUEST_CHANGES`
-
-   Do not store secrets, tokens, personal data, or large blobs. Keep the file concise so future runs can use it for continuity and dedupe.
-
-Use this list when evaluating issues in Steps 4 and 5 (these are false positives, do NOT flag):
-
-- Pre-existing issues
-- Something that appears to be a bug but is actually correct
-- Pedantic nitpicks that a senior engineer would not flag
-- Issues that a linter will catch (do not run the linter to verify)
-- General code quality concerns (e.g., lack of test coverage, general security issues) unless explicitly required in CLAUDE.md
-- Issues mentioned in CLAUDE.md but explicitly silenced in the code (e.g., via a lint ignore comment)
-- Differences that exist only in files classified as generated by `.gitattributes`, unless they expose a real issue in the source workflow, prompt, or other source-of-truth file
-- Explanations that a change is good, correct, well-structured, or acceptable as-is
-- Non-blocking observations that do not require the author to change anything now
-- Requests for extra comments or documentation unless their absence creates a concrete correctness risk
-
-Notes:
-
-- Use GitHub tools for all repository reads. Do not use web fetch.
-- Always operate on the workflow PR target rather than guessing from local git state.
-- Inline comments should only be created for actionable issues on changed lines.
-- If you leave inline comments, the final review should not repeat them.
-- Cache-memory is best-effort and may be missing or stale. Use it to improve continuity, never to override current repository state.
-- When linking to code in an inline comment, use a full GitHub blob URL with a full SHA and a line range, for example: https://github.com/anthropics/claude-code/blob/c21d3c10bc8e898b7ac1a2d745bdc9bc4e423afe/package.json#L10-L15
-  - Requires full git sha
-  - Do not use shell substitution in the URL
-  - Repo name must match the repo you're code reviewing
-  - Use `#L[start]-L[end]`
-  - Provide at least one line of context before and after when possible
-- If context checks fail or the PR is not reviewable, call `noop` with a brief explanation instead of exiting silently.

.github/workflows/shared/review.md

@@ -1,74 +0,0 @@
----
-permissions:
-  contents: read
-  pull-requests: read
-  id-token: write
-engine:
-  id: claude
-  env:
-    ANTHROPIC_API_KEY: ${{ steps.esc-secrets.outputs.ANTHROPIC_API_KEY || '__GH_AW_ACTIVATION_PLACEHOLDER__' }}
-steps:
-  - env:
-      ESC_ACTION_ENVIRONMENT: imports/github-secrets
-      ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-      ESC_ACTION_OIDC_AUTH: "true"
-      ESC_ACTION_OIDC_ORGANIZATION: pulumi
-      ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-    id: esc-secrets
-    name: Fetch secrets from ESC
-    uses: pulumi/esc-action@6cf9520e68354d86f81c455e8d43eabd58f5c9f5  # v1.5.0
-  - name: Validate ESC secret output
-    env:
-      ANTHROPIC_API_KEY_FROM_ESC: ${{ steps.esc-secrets.outputs.ANTHROPIC_API_KEY }}
-    run: |
-      test -n "$ANTHROPIC_API_KEY_FROM_ESC" || {
-        echo "ESC did not return ANTHROPIC_API_KEY";
-        exit 1;
-      }
-tools:
-  cache-memory: true
-  github:
-    toolsets: [pull_requests, repos]
-safe-outputs:
-  threat-detection: false
-  create-pull-request-review-comment:
-    max: 12
-    side: "RIGHT"
-    target: "${{ github.event.pull_request.number || github.event.inputs.pr_number || github.event.issue.number }}"
-    target-repo: "${{ github.repository }}"
-  resolve-pull-request-review-thread:
-    max: 12
-    target: "${{ github.event.pull_request.number || github.event.inputs.pr_number || github.event.issue.number }}"
-    target-repo: "${{ github.repository }}"
-  submit-pull-request-review:
-    max: 1
-    allowed-events: [APPROVE, REQUEST_CHANGES, COMMENT]
-    target: "${{ github.event.pull_request.number || github.event.inputs.pr_number || github.event.issue.number }}"
-  noop:
-    max: 1
-  messages:
-    footer: "> Reviewed by [{workflow_name}]({run_url})"
-    run-started: "Started automated PR review for #${{ github.event.pull_request.number || github.event.inputs.pr_number || github.event.issue.number }}."
-    run-success: "Finished automated PR review for #${{ github.event.pull_request.number || github.event.inputs.pr_number || github.event.issue.number }}."
-    run-failure: "Automated PR review failed for #${{ github.event.pull_request.number || github.event.inputs.pr_number || github.event.issue.number }} ({status})."
----
-
-
-Review pull request #${{ github.event.pull_request.number || github.event.inputs.pr_number || github.event.issue.number }} in repository `${{ github.repository }}`.
-
-Workflow-specific rules:
-- Use `${{ github.event.pull_request.number || github.event.inputs.pr_number || github.event.issue.number }}` as the authoritative PR target.
-- Treat the imported review prompt as the source of the review procedure.
-- Use only gh-aw safe outputs for side effects:
-  - `create-pull-request-review-comment` for actionable inline findings on changed lines
-  - `resolve-pull-request-review-thread` for previously reported bot-authored threads that are now fixed or clearly acknowledged
-  - `submit-pull-request-review` for the final review
-  - `noop` when the PR is not reviewable or required context is missing
-- Submit exactly one final review:
-  - `REQUEST_CHANGES` when at least one blocking issue exists.
-  - `APPROVE` otherwise, including when only non-blocking observations exist.
-  - Do not submit `COMMENT` as the final review state.
-- Do not post free-form issue comments outside safe outputs.
-- Respect the configured inline comment limit and prioritize the highest-signal unique findings.
-- Use cache-memory only as a best-effort continuity aid; live PR state and current review threads are authoritative.
-- Ignore discovery steps intended for runs without PR context.

.github/workflows/weekly-pulumi-update.yml

@@ -8,53 +8,76 @@ on:
 env:
   GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
   JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  PULUMI_PULUMI_ENABLE_JOURNALING: "true"
-  TF_APPEND_USER_AGENT: pulumi
-
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 jobs:
   weekly-pulumi-update:
     runs-on: ubuntu-latest
-    permissions: write-all
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-      id: app-auth
+        lfs: true
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        app-id: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_APP_ID }}
-        private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
-        owner: ${{ github.repository_owner }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
-        github_token: ${{ steps.app-auth.outputs.token }}
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
     - name: Update Pulumi/Pulumi
       id: gomod
       run: >-
@@ -64,9 +87,9 @@ jobs:
 
         git checkout -b update-pulumi/${{ github.run_id }}-${{ github.run_number }}
 
-        gh repo view pulumi/pulumi --json latestRelease --jq .latestRelease.tagName | sed 's/^v//' > .pulumi.version
+        for MODFILE in $(find . -name go.mod); do pushd $(dirname $MODFILE); go get github.com/pulumi/pulumi/pkg/v3 github.com/pulumi/pulumi/sdk/v3; go mod tidy; popd; done
 
-        VERSION=$(cat .pulumi.version) find . -name go.mod -execdir sh -c 'go get github.com/pulumi/pulumi/pkg/v3@v${VERSION} github.com/pulumi/pulumi/sdk/v3@v${VERSION}; go mod tidy' \;
+        gh repo view pulumi/pulumi --json latestRelease --jq .latestRelease.tagName | sed 's/^v//' > .pulumi.version
 
         git update-index -q --refresh
 
@@ -104,12 +127,12 @@ jobs:
     - name: Create PR
       id: create-pr
       if: steps.gomod.outputs.changes != 0
-      run: >
-        ver=$(cat .pulumi.version)
-
-        msg="Automated upgrade: bump pulumi/pulumi to ${ver}"
-
-        gh pr create -t "$msg" -b "$msg"
+      uses: repo-sync/pull-request@v2.6.2
+      with:
+        source_branch: update-pulumi/${{ github.run_id }}-${{ github.run_number }}
+        destination_branch: main
+        pr_title: Automated Pulumi/Pulumi upgrade
+        github_token: ${{ secrets.PULUMI_BOT_TOKEN }}
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     name: weekly-pulumi-update

.gitignore

@@ -2,12 +2,12 @@
 **/bin/
 **/obj/
 **/node_modules/
+**/venv
 **/.vs
 **/.idea
 **/.ionide
 **/.vscode
 *.swp
-.pulumi
 Pulumi.*.yaml
 yarn.lock
 ci-scripts
@@ -19,4 +19,7 @@ sdk/dotnet/version.txt
 sdk/java/.gradle
 sdk/java/build/
 sdk/java/build.gradle
-sdk/python/venv
+
+# Allow local mise overrides.
+.mise.*.local.toml
+.mise.local.toml

.golangci.yml

@@ -1,53 +1,104 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+run:
+  timeout: 10m
 
-version: "2"
 linters:
+  enable-all: false
   enable:
-    - goconst
+    - depguard
+    - errcheck
+    - exhaustive
+    - exportloopref
+    - gci
+    - gocritic
+    - gofumpt
+    - goheader
     - gosec
+    - govet
+    - importas
+    - ineffassign
     - lll
     - misspell
     - nakedret
+    - nolintlint
+    - paralleltest
+    - perfsprint
+    - prealloc
     - revive
     - unconvert
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    paths:
-      - schema.go
-      - pulumiManifest.go
-      - pkg/vendored
-      - third_party$
-      - builtin$
-      - examples$
+    - unused
+
+linters-settings:
+  depguard:
     rules:
-      - linters:
-          - revive
-        path: pkg/
-        text: "var-naming" # https://github.com/pulumi/ci-mgmt/issues/2100
-formatters:
-  enable:
-    - gci
-    - gofmt
-  settings:
-    gci:
-      sections:
-        - standard # Standard section: captures all standard library packages.
-        - blank # Blank section: contains all blank imports.
-        - default # Default section: contains all imports that could not be matched to another section type.
-        - prefix(github.com/pulumi/) # Custom section: groups all imports with the github.com/pulumi/ prefix.
-        - prefix(github.com/pulumi/pulumi-docker-build) # Custom section: local imports
-      custom-order: true
-  exclusions:
-    generated: lax
-    paths:
-      - schema.go
-      - pulumiManifest.go
-      - pkg/vendored
-      - third_party$
-      - builtin$
-      - examples$
+      protobuf:
+        deny:
+          - pkg: "github.com/golang/protobuf"
+            desc: Use google.golang.org/protobuf instead
+  gci:
+    sections:
+      - standard # Standard section: captures all standard library packages.
+      - blank # Blank section: contains all blank imports.
+      - default # Default section: contains all imports that could not be matched to another section type.
+      - prefix(github.com/pulumi/) # Custom section: groups all imports with the github.com/pulumi/ prefix.
+      - prefix(github.com/pulumi/pulumi-dockerbuild/) # Custom section: local imports
+    custom-order: true
+  gocritic:
+    enable-all: true
+    disabled-checks:
+      - hugeParam
+      - importShadow
+  goheader:
+    template: |-
+      Copyright 2024, Pulumi Corporation.
+
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      You may obtain a copy of the License at
+
+          http://www.apache.org/licenses/LICENSE-2.0
+
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.
+  govet:
+    enable:
+      - nilness
+      # Reject comparisons of reflect.Value with DeepEqual or '=='.
+      - reflectvaluecompare
+      # Reject sort.Slice calls with a non-slice argument.
+      - sortslice
+      # Detect write to struct/arrays by-value that aren't read again.
+      - unusedwrite
+  nakedret:
+    # Make an issue if func has more lines of code than this setting, and it has naked returns.
+    # Default: 30
+    max-func-lines: 60
+  nolintlint:
+    # Some linter exclusions are added to generated or templated files
+    # pre-emptively.
+    # Don't complain about these.
+    allow-unused: true
+
+issues:
+  exclude-use-default: false
+  exclude-rules:
+    # Don't warn on unused parameters.
+    # Parameter names are useful; replacing them with '_' is undesirable.
+    - linters: [revive]
+      text: 'unused-parameter: parameter \S+ seems to be unused, consider removing or renaming it as _'
+
+    # staticcheck already has smarter checks for empty blocks.
+    # revive's empty-block linter has false positives.
+    # For example, as of writing this, the following is not allowed.
+    #   for foo() { }
+    - linters: [revive]
+      text: "empty-block: this block is empty, you can remove it"
+
+    # We *frequently* use the term 'new' in the context of properties
+    # (new and old properties),
+    # and we rarely use the 'new' built-in function.
+    # It's fine to ignore these cases.
+    - linters: [revive]
+      text: "redefines-builtin-id: redefinition of the built-in function new"

.goreleaser.prerelease.yml

@@ -2,43 +2,24 @@
 
 project_name: pulumi-docker-build
 builds:
-- id: build-provider
-  dir: provider
+- dir: provider
   env:
   - CGO_ENABLED=0
   - GO111MODULE=on
   goos:
   - darwin
+  - windows
   - linux
   goarch:
   - amd64
   - arm64
-  ignore: &a1 []
+  ignore: []
   main: ./cmd/pulumi-resource-docker-build/
-  ldflags: &a2
-    - -s
-    - -w
-    - -X
-      github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
-    - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
+  ldflags:
+  - -X
+    github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
+  - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
   binary: pulumi-resource-docker-build
-- id: build-provider-sign-windows
-  dir: provider
-  env:
-  - CGO_ENABLED=0
-  - GO111MODULE=on
-  goos:
-  - windows
-  goarch:
-  - amd64
-  - arm64
-  ignore: *a1
-  main: ./cmd/pulumi-resource-docker-build/
-  ldflags: *a2
-  binary: pulumi-resource-docker-build
-  hooks:
-    post:
-    - make sign-goreleaser-exe-{{ .Arch }}
 archives:
 - name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
   id: archive

.goreleaser.yml

@@ -1,43 +1,25 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
 project_name: pulumi-docker-build
 builds:
-- id: build-provider
-  dir: provider
+- dir: provider
   env:
   - CGO_ENABLED=0
   - GO111MODULE=on
   goos:
   - darwin
+  - windows
   - linux
   goarch:
   - amd64
   - arm64
-  ignore: &a1 []
+  ignore: []
   main: ./cmd/pulumi-resource-docker-build/
-  ldflags: &a2
-    - -s
-    - -w
-    - -X
-      github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
-    - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
+  ldflags:
+  - -X
+    github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
+  - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
   binary: pulumi-resource-docker-build
-- id: build-provider-sign-windows
-  dir: provider
-  env:
-  - CGO_ENABLED=0
-  - GO111MODULE=on
-  goos:
-  - windows
-  goarch:
-  - amd64
-  - arm64
-  ignore: *a1
-  main: ./cmd/pulumi-resource-docker-build/
-  ldflags: *a2
-  binary: pulumi-resource-docker-build
-  hooks:
-    post:
-    - make sign-goreleaser-exe-{{ .Arch }}
 archives:
 - name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
   id: archive

.mise.toml

@@ -0,0 +1,133 @@
+[tasks.provider]
+run = ["make provider"]
+sources = ["provider/**/*.go", "go.mod"]
+outputs = ["bin/pulumi-resource-docker-build"]
+
+# Generate
+
+[tasks."generate:nodejs"]
+depends = ["provider"]
+run = "make generate_nodejs"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/nodejs/**/*.ts"]
+
+[tasks."generate:python"]
+run = "make generate_python"
+depends = ["provider"]
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/python/**/*.py"]
+
+[tasks."generate:dotnet"]
+depends = ["provider"]
+run = "make generate_dotnet"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/dotnet/**/*.cs"]
+
+[tasks."generate:go"]
+depends = ["provider"]
+run = "make generate_go"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/go/**/*.go"]
+
+[tasks."generate:java"]
+depends = ["provider"]
+run = "make generate_java"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/java/**/*.java"]
+
+# Build
+
+[tasks."build:nodejs"]
+depends = ["generate:nodejs"]
+run = "make build_nodejs"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+[tasks."build:python"]
+depends = ["generate:python"]
+run = "make build_python"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+[tasks."build:dotnet"]
+depends = ["generate:dotnet"]
+run = "make build_dotnet"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+[tasks."build:go"]
+depends = ["generate:go"]
+run = "make build_go"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+[tasks."build:java"]
+depends = ["generate:java"]
+run = "make build_java"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+# TODO: Might be able to link these directly?
+[tasks."install:dotnet"]
+run = "make install_dotnet_sdk"
+
+[tasks."install:nodejs"]
+run = "make install_nodejs_sdk"
+
+[tasks.sdk]
+depends = ["generate:*", "build:*"]
+
+[tasks.install]
+depends = ["install:*"]
+
+[tasks.test]
+sources = ["**/*.go"]
+outputs = ["*"]
+run = "make test_provider"
+
+[tasks."test:examples"]
+run = "go test -v -json -cover -timeout 2h -tags=all -parallel 4"
+
+[tasks."test:examples:shard"]
+run = "go run github.com/blampe/shard@latest --root ./examples"
+
+[tasks.schema]
+run = "pulumi package get-schema bin/pulumi-resource-docker-build | jq 'del(.version)' > provider/cmd/pulumi-resource-docker-build/schema.json"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["provider/cmd/pulumi-resource-docker-build/schema.json"]
+
+[tasks.docs]
+run = "go generate docs/generate.go"
+depends = ["schema"]
+sources = ["docs/yaml/*.yaml"]
+outputs= ["provider/internal/embed/*.md"]
+
+# TODO: tasks.examples
+
+[tools]
+# Development tooling.
+go = "latest" # Will read version from go.mod.
+lefthook = "1.7.12"
+golangci-lint = "1.58.1"
+
+# Build and test tools.
+pulumi = "3.128.0"
+node = "22"
+dotnet = "6"
+python = "3.11.9"
+java = "temurin-11"
+gradle = "7.6"
+"go:github.com/pulumi/schema-tools" = "v0.6.0"
+"go:github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt" = "v2.5.0"
+"go:github.com/pulumi/pulumictl/cmd/pulumictl" = "a1b89aaf4299fe5bc78e140fc60eba79088b3dc5" # blampe/replace branch doesn't work?
+yarn = "1.22.19"
+gcloud = "455.0.0"
+
+[env]
+# TODO(https://github.com/jdx/mise/issues/1898): create = true
+_.python.venv = { path = "venv", create = false }
+CGO_ENABLED = "0"
+
+[settings]
+experimental = true    # Enable Go backend.
+python_compile = false # Don't build Python from source.

.pulumi.version

@@ -1 +1 @@
-3.239.0
+3.128.0

CHANGELOG.md

@@ -2,104 +2,13 @@
 
 ### Fixed
 
-- Fixes a regression where a 404 status code during deletion wasn't considered deleted. (https://github.com/pulumi/pulumi-docker-build/issues/849)
-
-## 0.0.15 (2025-10-17)
-
-### Changed
-
-- Arguments `CacheFromGitHubActions.URL` and `CacheFromGitHubActions.Token` have been removed. If the previous behaviour is desired, set the `ACTIONS_CACHE_URL` and `ACTIONS_RUNTIME_TOKEN` environment variables. (https://github.com/pulumi/pulumi-docker-build/issues/75)
-
-## 0.0.14 (2025-09-30)
-
-### Fixed
-
-- A warning is no longer emitted for the reserved `__internal` key. (https://github.com/pulumi/pulumi-docker-build/issues/579)
-
-## 0.0.13 (2025-08-27)
-
-### Changed
-
-- Docker Build Cloud and `exec` errors are more helpful. (https://github.com/pulumi/pulumi-docker-build/issues/549)
-
-### Fixed
-
-- The provider is no longer replaced on version changes. (https://github.com/pulumi/pulumi-docker-build/issues/581)
-
-## 0.0.12 (2025-05-16)
-
-### Changed
-
-- Upgraded pulumi-go-provider to v1.0.0-rc2.
-
-### Fixed
-
-- Builds now respect cancellation. (https://github.com/pulumi/pulumi-docker-build/issues/533, https://github.com/pulumi/pulumi-docker-build/pull/522)
-
-## 0.0.11 (2025-04-11)
-
-### Changed
-
-- Upgraded buildx from 0.18.0 to 0.20.1 to remain compatible with upcoming
-  changes to GitHub Actions. (https://github.com/pulumi/pulumi-docker-build/pull/519)
-
-### Fixed
-
-- Upgrading docker-build no longer causes resource replacements. (<https://github.com/pulumi/pulumi-docker-build/issues/404>)
-- Fixed a panic that could occur in `exec` mode. (https://github.com/pulumi/pulumi-docker-build/issues/482)
-- The default GitHub Actions cache scope is now correctly set as `buildkit`. (https://github.com/pulumi/pulumi-docker-build/issues/496)
-
-## 0.0.10 (2025-01-27)
-
-### Changed
-
-- Windows binaries are now signed. (https://github.com/pulumi/pulumi-docker-build/pull/429)
-
-## 0.0.9 (2025-01-16)
-
-### Changed
-
-- Upgraded pulumi-go-provider to v0.24.1. (https://github.com/pulumi/pulumi-docker-build/pull/413)
-
-### Fixed
-
-- `ACTIONS_RUNTIME_TOKEN` is now correctly marked as a secret. (https://github.com/pulumi/pulumi-docker-build/issues/403)
-
-## 0.0.8 (2024-12-10)
-
-### Added
-
-- Multiple exports are now allowed if the build daemon is detected to have
-  version 0.13 of Buildkit or newer.
-  (https://github.com/pulumi/pulumi-docker-build/issues/21)
-
-### Changed
-
-- Upgraded buildx from 0.16.0 to 0.18.0.
-
-### Fixed
-
-- Custom `# syntax=` directives no longer cause validation errors.
-  (https://github.com/pulumi/pulumi-docker-build/issues/300)
-
-## 0.0.7 (2024-10-16)
-
-### Fixed
-
-- Fixed an issue where registry authentication couldn't be specified on the
-  provider. (<https://github.com/pulumi/pulumi-docker-build/issues/262>)
-
-## 0.0.6 (2024-08-13)
-
-### Fixed
-
 - Refreshing an `Index` resource will no longer fail if its stored credentials
-  have expired. (<https://github.com/pulumi/pulumi-docker-build/pull/194>)
+  have expired. (https://github.com/pulumi/pulumi-docker-build/pull/194)
 
 ### Changed
 
 - Local and tar exporters will now trigger an update if an export doesn't exist
-  at the expected path. (<https://github.com/pulumi/pulumi-docker-build/pull/195>)
+  at the expected path. (https://github.com/pulumi/pulumi-docker-build/pull/195)
 
 ## 0.0.5 (2024-08-08)
 
@@ -124,9 +33,9 @@
 
 ### Fixed
 
-- Fixed the default value for `ACTIONS_CACHE_URL` when using GitHub action caching. (<https://github.com/pulumi/pulumi-docker-build/pull/80>)
-- Fixed Java SDK publishing. (<https://github.com/pulumi/pulumi-docker-build/pull/89>)
-- Fixed a panic that could occur when `context` was omitted. (<https://github.com/pulumi/pulumi-docker-build/pull/83>)
+- Fixed the default value for `ACTIONS_CACHE_URL` when using GitHub action caching. (https://github.com/pulumi/pulumi-docker-build/pull/80)
+- Fixed Java SDK publishing. (https://github.com/pulumi/pulumi-docker-build/pull/89)
+- Fixed a panic that could occur when `context` was omitted. (https://github.com/pulumi/pulumi-docker-build/pull/83)
 
 ### Changed
 

Makefile

@@ -17,10 +17,6 @@ WORKING_DIR      := $(shell pwd)
 EXAMPLES_DIR     := ${WORKING_DIR}/examples/yaml
 TESTPARALLELISM  := 4
 
-PULUMI           := pulumi
-GOGLANGCILINT    := golangci-lint
-GOTEST           := go test
-
 # Override during CI using `make [TARGET] PROVIDER_VERSION=""` or by setting a PROVIDER_VERSION environment variable
 # Local & branch builds will just used this fixed default version unless specified
 PROVIDER_VERSION ?= 0.1.0-alpha.0+dev
@@ -47,10 +43,10 @@ provider_debug::
 	(cd provider && go build -o $(WORKING_DIR)/bin/${PROVIDER} -gcflags="all=-N -l" -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
 
 test_provider:: # Required by CI
-	${GOTEST} -short -v -coverprofile="coverage.txt" -coverpkg=./provider/... -timeout 2h -parallel ${TESTPARALLELISM} ./provider/...
+	go test -short -v -coverprofile="coverage.txt" -coverpkg=./provider/... -timeout 2h -parallel ${TESTPARALLELISM} ./provider/...
 
 test_examples: install_nodejs_sdk install_dotnet_sdk
-	${GOTEST} -short -v -cover -tags=all -timeout 2h -parallel ${TESTPARALLELISM} ./examples/...
+	go test -short -v -cover -tags=all -timeout 2h -parallel ${TESTPARALLELISM} ./examples/...
 
 test_all:: test_provider test_examples
 
@@ -58,7 +54,7 @@ test_all:: test_provider test_examples
 gen_examples:
 
 examples: $(shell mkdir -p examples)
-examples: sdk examples/yaml examples/go examples/nodejs examples/python examples/dotnet examples/java examples/hcl
+examples: sdk examples/yaml examples/go examples/nodejs examples/python examples/dotnet examples/java
 
 examples/yaml:
 	rm -rf ${WORKING_DIR}/examples/yaml/app
@@ -84,9 +80,6 @@ examples/java: bin/${PROVIDER} ${WORKING_DIR}/examples/yaml/Pulumi.yaml
 	$(call example,java)
 	@git checkout examples/java/pom.xml
 
-examples/hcl: bin/${PROVIDER} ${WORKING_DIR}/examples/yaml/Pulumi.yaml
-	$(call example,hcl)
-
 define pulumi_login
     export PULUMI_CONFIG_PASSPHRASE=asdfqwerty1234; \
     pulumi login --local;
@@ -133,7 +126,7 @@ only_build:: build
 
 .PHONY: lint
 lint:
-	${GOGLANGCILINT} run --fix -c .golangci.yml
+	golangci-lint run --fix -c .golangci.yml
 
 install:: install_nodejs_sdk install_dotnet_sdk
 	cp $(WORKING_DIR)/bin/${PROVIDER} ${GOPATH}/bin
@@ -179,16 +172,15 @@ generate_dotnet: sdk/dotnet # Required by CI
 build_dotnet: # Required by CI
 
 ${SCHEMA_PATH}: bin/${PROVIDER}
-	pulumi package get-schema ./bin/${PROVIDER} | jq 'del(.version)' > $(SCHEMA_PATH)
+	pulumi package get-schema bin/${PROVIDER} | jq 'del(.version)' > $(SCHEMA_PATH)
 
 bin/${PROVIDER}: $(shell find ./provider -name '*.go') go.mod
 	(cd provider && go build -o ../bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
 
 bin/pulumi-gen-${PACK}: # Required by CI
-	@mkdir -p bin
 	touch bin/pulumi-gen-${PACK}
 
-go.mod: $(shell find . -name '*.go')
+go.mod: $(shell find provider -name '*.go')
 go.sum: go.mod
 
 sdk: $(shell mkdir -p sdk)
@@ -200,7 +192,7 @@ sdk: sdk/python sdk/nodejs sdk/java sdk/python sdk/go sdk/dotnet
 sdk/python: TMPDIR := $(shell mktemp -d)
 sdk/python: bin/${PROVIDER}
 	rm -rf sdk/python
-	$(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language python -o ${TMPDIR}
+	pulumi package gen-sdk bin/$(PROVIDER) --language python -o ${TMPDIR}
 	cp README.md ${TMPDIR}/python/
 	cd ${TMPDIR}/python/ && \
 		rm -rf ./bin/ ../python.bin/ && cp -R . ../python.bin && mv ../python.bin ./bin && \
@@ -213,7 +205,7 @@ sdk/python: bin/${PROVIDER}
 sdk/nodejs: TMPDIR := $(shell mktemp -d)
 sdk/nodejs: bin/${PROVIDER}
 	rm -rf sdk/nodejs
-	$(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language nodejs -o ${TMPDIR}
+	pulumi package gen-sdk bin/$(PROVIDER) --language nodejs -o ${TMPDIR}
 	cp README.md LICENSE ${TMPDIR}/nodejs
 	cd ${TMPDIR}/nodejs/ && \
 		yarn install && \
@@ -225,7 +217,7 @@ sdk/go: TMPDIR := $(shell mktemp -d)
 sdk/go: PATH := "$(WORKING_DIR)/bin:$(PATH)"
 sdk/go: bin/${PROVIDER}
 	rm -rf sdk/go
-	PATH=$(PATH) $(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language go -o ${TMPDIR}
+	PATH=$(PATH) pulumi package gen-sdk bin/$(PROVIDER) --language go -o ${TMPDIR}
 	cp go.mod ${TMPDIR}/go/dockerbuild/go.mod
 	cd ${TMPDIR}/go/dockerbuild && \
 		go mod edit -module=github.com/pulumi/pulumi-${PACK}/${PACKDIR}/go/dockerbuild && \
@@ -235,7 +227,7 @@ sdk/go: bin/${PROVIDER}
 sdk/dotnet: TMPDIR := $(shell mktemp -d)
 sdk/dotnet: bin/${PROVIDER}
 	rm -rf sdk/dotnet
-	$(PULUMI) package gen-sdk ./bin/${PROVIDER} --language dotnet -o ${TMPDIR}
+	pulumi package gen-sdk bin/${PROVIDER} --language dotnet -o ${TMPDIR}
 	cd ${TMPDIR}/dotnet/ && \
 		echo "$(VERSION_GENERIC)" > version.txt && \
 		dotnet build
@@ -245,71 +237,10 @@ sdk/java: PACKAGE_VERSION := $(shell pulumictl convert-version --language generi
 sdk/java: TMPDIR := $(shell mktemp -d)
 sdk/java: bin/${PROVIDER}
 	rm -rf sdk/java
-	$(PULUMI) package gen-sdk --language java ./bin/${PROVIDER} -o ${TMPDIR}
+	pulumi package gen-sdk --language java bin/${PROVIDER} -o ${TMPDIR}
 	cd ${TMPDIR}/java/ && gradle --console=plain build
 	mv -f ${TMPDIR}/java ${WORKING_DIR}/sdk/.
 
 docs: $(shell find docs/yaml -type f) $(shell find ./provider/internal/embed -name '*.md') ${SCHEMA_PATH}
 	go generate docs/generate.go
 	@touch docs
-
-# Set these variables to enable signing of the windows binary with Azure Trusted Signing.
-AZURE_SIGNING_CLIENT_ID ?=
-AZURE_SIGNING_CLIENT_SECRET ?=
-AZURE_SIGNING_TENANT_ID ?=
-AZURE_SIGNING_ACCOUNT_ENDPOINT ?=
-AZURE_SIGNING_ACCOUNT_NAME ?=
-AZURE_SIGNING_CERT_PROFILE_NAME ?=
-SKIP_SIGNING ?=
-
-bin/jsign-7.4.jar:
-	@mkdir -p bin
-	wget https://github.com/ebourg/jsign/releases/download/7.4/jsign-7.4.jar --output-document=bin/jsign-7.4.jar
-
-sign-goreleaser-exe-amd64: GORELEASER_ARCH := amd64_v1
-sign-goreleaser-exe-arm64: GORELEASER_ARCH := arm64
-
-# Set the shell to bash to allow for the use of bash syntax.
-sign-goreleaser-exe-%: SHELL:=/bin/bash
-sign-goreleaser-exe-%: bin/jsign-7.4.jar
-	@# Only sign windows binary if fully configured.
-	@# Test variables set by joining with | between and looking for || showing at least one variable is empty.
-	@# Move the binary to a temporary location and sign it there to avoid the target being up-to-date if signing fails.
-	@set -e; \
-	if [[ "${SKIP_SIGNING}" != "true" ]]; then \
-		if [[ "|${AZURE_SIGNING_CLIENT_ID}|${AZURE_SIGNING_CLIENT_SECRET}|${AZURE_SIGNING_TENANT_ID}|${AZURE_SIGNING_ACCOUNT_ENDPOINT}|${AZURE_SIGNING_ACCOUNT_NAME}|${AZURE_SIGNING_CERT_PROFILE_NAME}|" == *"||"* ]]; then \
-			echo "Can't sign windows binaries as required configuration not set: AZURE_SIGNING_CLIENT_ID, AZURE_SIGNING_CLIENT_SECRET, AZURE_SIGNING_TENANT_ID, AZURE_SIGNING_ACCOUNT_ENDPOINT, AZURE_SIGNING_ACCOUNT_NAME, AZURE_SIGNING_CERT_PROFILE_NAME"; \
-			echo "To rebuild with signing delete the unsigned windows exe file and rebuild with the fixed configuration"; \
-			if [[ "${CI}" == "true" ]]; then exit 1; fi; \
-		else \
-			file=dist/build-provider-sign-windows_windows_${GORELEASER_ARCH}/pulumi-resource-docker-build.exe; \
-			mv $${file} $${file}.unsigned; \
-			az login --service-principal \
-				--username "${AZURE_SIGNING_CLIENT_ID}" \
-				--password "${AZURE_SIGNING_CLIENT_SECRET}" \
-				--tenant "${AZURE_SIGNING_TENANT_ID}" \
-				--output none; \
-			ACCESS_TOKEN=$$(az account get-access-token --resource "https://codesigning.azure.net" | jq -r .accessToken); \
-			ENDPOINT_HOST="$${AZURE_SIGNING_ACCOUNT_ENDPOINT#https://}"; \
-			ENDPOINT_HOST="$${ENDPOINT_HOST#http://}"; \
-			ENDPOINT_HOST="$${ENDPOINT_HOST%/}"; \
-			java -jar bin/jsign-7.4.jar \
-				--storetype TRUSTEDSIGNING \
-				--keystore "$${ENDPOINT_HOST}" \
-				--storepass "$${ACCESS_TOKEN}" \
-				--alias "${AZURE_SIGNING_ACCOUNT_NAME}/${AZURE_SIGNING_CERT_PROFILE_NAME}" \
-				$${file}.unsigned; \
-			mv $${file}.unsigned $${file}; \
-			az logout; \
-		fi; \
-	fi
-
-# To make an immediately observable change to .ci-mgmt.yaml:
-#
-# - Edit .ci-mgmt.yaml
-# - Run make ci-mgmt to apply the change locally.
-#
-ci-mgmt: .ci-mgmt.yaml
-	go run github.com/pulumi/ci-mgmt/provider-ci@master generate
-.PHONY: ci-mgmt
-	fi

docs/_index.md

@@ -1,428 +0,0 @@
----
-title: Docker Build
-meta_desc: Provides an overview of the Docker Build Provider for Pulumi.
-layout: package
----
-
-The Docker Build provider leverages [buildx and BuildKit](https://docs.docker.com/build/architecture/) to build modern Docker images with Pulumi.
-
-Not to be confused with the earlier
-[Docker](../docker) provider, which is still
-appropriate for managing resources unrelated to building images.
-
-| Provider               | Use cases                                                               |
-| ----------------       | ----------------------------------------------------------------------- |
-| `@pulumi/docker-build` | Anything related to building images with `docker build`.                |
-| `@pulumi/docker`       | Everything else -- including running containers and creating networks.  |
-
-## Example
-
-If your Pulumi program has a directory called `app` alongside it, containing a
-file named "Dockerfile" (which can be as simple as `FROM alpine` for the
-purpose of example), then the code below shows how to build a multi-platform
-image, publish it to a remote AWS ECR registry, and use an [inline
-cache](https://docs.docker.com/build/cache/backends/inline/) to speed up
-subsequent builds.
-
-{{< chooser language "typescript,python,csharp,go,yaml,java" >}}
-
-{{% choosable language typescript %}}
-
-```typescript
-import * as aws from "@pulumi/aws";
-import * as docker_build from "@pulumi/docker-build";
-
-// Create an ECR repository for pushing.
-const ecrRepository = new aws.ecr.Repository("ecr-repository", {});
-
-// Grab auth credentials for ECR.
-const authToken = aws.ecr.getAuthorizationTokenOutput({
-    registryId: ecrRepository.registryId,
-});
-
-// Build and push an image to ECR with inline caching.
-const myImage = new docker_build.Image("my-image", {
-    // Tag our image with our ECR repository's address.
-    tags: [pulumi.interpolate`${ecrRepository.repositoryUrl}:latest`],
-    context: {
-        location: "./app",
-    },
-    // Use the pushed image as a cache source.
-    cacheFrom: [{
-        registry: {
-            ref: pulumi.interpolate`${ecrRepository.repositoryUrl}:latest`,
-        },
-    }],
-    // Include an inline cache with our pushed image.
-    cacheTo: [{
-        inline: {},
-    }],
-    // Build a multi-platform image manifest for ARM and AMD.
-    platforms: [
-        "linux/amd64",
-        "linux/arm64",
-    ],
-    // Push the final result to ECR.
-    push: true,
-    // Provide our ECR credentials.
-    registries: [{
-        address: ecrRepository.repositoryUrl,
-        password: authToken.password,
-        username: authToken.userName,
-    }],
-});
-
-// Export a ref for the pushed images so we can deploy it.
-export const ref = myImage.ref;
-```
-
-{{% /choosable %}}
-
-{{% choosable language python %}}
-
-```python
-import pulumi
-import pulumi_aws as aws
-import pulumi_docker_build as docker_build
-
-# Create an ECR repository for pushing.
-ecr_repository = aws.ecr.Repository("ecr-repository")
-
-# Grab auth credentials for ECR.
-auth_token = aws.ecr.get_authorization_token_output(registry_id=ecr_repository.registry_id)
-
-# Build and push an image to ECR with inline caching.
-my_image = docker_build.Image("my-image",
-    # Tag our image with our ECR repository's address.
-    tags=[ecr_repository.repository_url.apply(lambda repository_url: f"{repository_url}:latest")],
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
-    # Use the pushed image as a cache source.
-    cache_from=[docker_build.CacheFromArgs(
-        registry=docker_build.CacheFromRegistryArgs(
-            ref=ecr_repository.repository_url.apply(lambda repository_url: f"{repository_url}:latest"),
-        ),
-    )],
-    # Include an inline cache with our pushed image.
-    cache_to=[docker_build.CacheToArgs(
-        inline=docker_build.CacheToInlineArgs(),
-    )],
-    # Build a multi-platform image manifest for ARM and AMD.
-    platforms=[
-        docker_build.Platform.LINUX_AMD64,
-        docker_build.Platform.LINUX_ARM64,
-    ],
-    # Push the final result to ECR.
-    push=True,
-    # Provide our ECR credentials.
-    registries=[docker_build.RegistryArgs(
-        address=ecr_repository.repository_url,
-        password=auth_token.password,
-        username=auth_token.user_name,
-    )],
-)
-
-# Export a ref for the pushed images so we can deploy it.
-pulumi.export("ref", my_image.ref)
-```
-
-{{% /choosable %}}
-
-{{% choosable language csharp %}}
-
-```csharp
-using System.Collections.Generic;
-using System.Linq;
-using Pulumi;
-using Aws = Pulumi.Aws;
-using DockerBuild = Pulumi.DockerBuild;
-
-return await Deployment.RunAsync(() =>
-{
-    // Create an ECR repository for pushing.
-    var ecrRepository = new Aws.Ecr.Repository("ecr-repository");
-
-    // Grab auth credentials for ECR.
-    var authToken = Aws.Ecr.GetAuthorizationToken.Invoke(new()
-    {
-        RegistryId = ecrRepository.RegistryId,
-    });
-
-    // Build and push an image to ECR with inline caching.
-    var myImage = new DockerBuild.Image("my-image", new()
-    {
-        // Tag our image with our ECR repository's address.
-        Tags = new[]
-        {
-            ecrRepository.RepositoryUrl.Apply(repositoryUrl => $"{repositoryUrl}:latest"),
-        },
-        Context = new DockerBuild.Inputs.BuildContextArgs
-        {
-            Location = "./app",
-        },
-        // Use the pushed image as a cache source.
-        CacheFrom = new[]
-        {
-            new DockerBuild.Inputs.CacheFromArgs
-            {
-                Registry = new DockerBuild.Inputs.CacheFromRegistryArgs
-                {
-                    Ref = ecrRepository.RepositoryUrl.Apply(repositoryUrl => $"{repositoryUrl}:latest"),
-                },
-            },
-        },
-        // Include an inline cache with our pushed image.
-        CacheTo = new[]
-        {
-            new DockerBuild.Inputs.CacheToArgs
-            {
-                Inline = null,
-            },
-        },
-        // Build a multi-platform image manifest for ARM and AMD.
-        Platforms = new[]
-        {
-            DockerBuild.Platform.Linux_amd64,
-            DockerBuild.Platform.Linux_arm64,
-        },
-        // Push the final result to ECR.
-        Push = true,
-        // Provide our ECR credentials.
-        Registries = new[]
-        {
-            new DockerBuild.Inputs.RegistryArgs
-            {
-                Address = ecrRepository.RepositoryUrl,
-                Password = authToken.Apply(getAuthorizationTokenResult => getAuthorizationTokenResult.Password),
-                Username = authToken.Apply(getAuthorizationTokenResult => getAuthorizationTokenResult.UserName),
-            },
-        },
-    });
-
-    // Export a ref for the pushed images so we can deploy it.
-    return new Dictionary<string, object?>
-    {
-        ["ref"] = myImage.Ref,
-    };
-});
-
-```
-
-{{% /choosable %}}
-
-{{% choosable language go %}}
-
-```go
-package main
-
-import (
-    "fmt"
-
-    "github.com/pulumi/pulumi-aws/sdk/v6/go/aws/ecr"
-    "github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild"
-    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
-)
-
-func main() {
-    pulumi.Run(func(ctx *pulumi.Context) error {
-        // Create an ECR repository for pushing.
-        ecrRepository, err := ecr.NewRepository(ctx, "ecr-repository", nil)
-        if err != nil {
-            return err
-        }
-
-        // Grab auth credentials for ECR.
-        authToken := ecr.GetAuthorizationTokenOutput(ctx, ecr.GetAuthorizationTokenOutputArgs{
-            RegistryId: ecrRepository.RegistryId,
-        }, nil)
-
-        // Build and push an image to ECR with inline caching.
-        myImage, err := dockerbuild.NewImage(ctx, "my-image", &dockerbuild.ImageArgs{
-            // Tag our image with our ECR repository's address.
-            Tags: pulumi.StringArray{
-                ecrRepository.RepositoryUrl.ApplyT(func(repositoryUrl string) (string, error) {
-                    return fmt.Sprintf("%v:latest", repositoryUrl), nil
-                }).(pulumi.StringOutput),
-            },
-            Context: &dockerbuild.BuildContextArgs{
-                Location: pulumi.String("./app"),
-            },
-            // Use the pushed image as a cache source.
-            CacheFrom: dockerbuild.CacheFromArray{
-                &dockerbuild.CacheFromArgs{
-                    Registry: &dockerbuild.CacheFromRegistryArgs{
-                        Ref: ecrRepository.RepositoryUrl.ApplyT(func(repositoryUrl string) (string, error) {
-                            return fmt.Sprintf("%v:latest", repositoryUrl), nil
-                        }).(pulumi.StringOutput),
-                    },
-                },
-            },
-            // Include an inline cache with our pushed image.
-            CacheTo: dockerbuild.CacheToArray{
-                &dockerbuild.CacheToArgs{
-                    Inline: nil,
-                },
-            },
-            // Build a multi-platform image manifest for ARM and AMD.
-            Platforms: dockerbuild.PlatformArray{
-                dockerbuild.Platform_Linux_amd64,
-                dockerbuild.Platform_Linux_arm64,
-            },
-            // Push the final result to ECR.
-            Push: pulumi.Bool(true),
-            // Provide our ECR credentials.
-            Registries: dockerbuild.RegistryArray{
-                &dockerbuild.RegistryArgs{
-                    Address: ecrRepository.RepositoryUrl,
-                    Password: authToken.ApplyT(func(authToken ecr.GetAuthorizationTokenResult) (*string, error) {
-                        return &authToken.Password, nil
-                    }).(pulumi.StringPtrOutput),
-                    Username: authToken.ApplyT(func(authToken ecr.GetAuthorizationTokenResult) (*string, error) {
-                        return &authToken.UserName, nil
-                    }).(pulumi.StringPtrOutput),
-                },
-            },
-        })
-        if err != nil {
-            return err
-        }
-
-        // Export a ref for the pushed images so we can deploy it.
-        ctx.Export("ref", myImage.Ref)
-        return nil
-    })
-}
-```
-
-{{% /choosable %}}
-
-{{% choosable language yaml %}}
-
-```yaml
-description: Push to AWS ECR with caching
-name: ecr
-outputs:
-    ref: ${my-image.ref}
-resources:
-    # Create an ECR repository for pushing.
-    ecr-repository:
-        type: aws:ecr:Repository
-
-    # Build and push an image to ECR with inline caching.
-    my-image:
-        type: docker-build:Image
-        properties:
-            # Tag our image with our ECR repository's address.
-            tags:
-                - ${ecr-repository.repositoryUrl}:latest
-            context:
-                location: ./app
-            # Use the pushed image as a cache source.
-            cacheFrom:
-                - registry:
-                    ref: ${ecr-repository.repositoryUrl}:latest
-            # Include an inline cache with our pushed image.
-            cacheTo:
-                - inline: {}
-            # Build a multi-platform image manifest for ARM and AMD.
-            platforms:
-                - linux/amd64
-                - linux/arm64
-            # Push the final result to ECR.
-            push: true
-            # Provide our ECR credentials.
-            registries:
-                - address: ${ecr-repository.repositoryUrl}
-                  password: ${auth-token.password}
-                  username: ${auth-token.userName}
-
-runtime: yaml
-variables:
-    auth-token:
-        # Grab auth credentials for ECR.
-        fn::aws:ecr:getAuthorizationToken:
-            registryId: ${ecr-repository.registryId}
-```
-
-{{% /choosable %}}
-
-{{% choosable language java %}}
-
-```java
-package myapp;
-
-import com.pulumi.Context;
-import com.pulumi.Pulumi;
-import com.pulumi.core.Output;
-import com.pulumi.aws.ecr.Repository;
-import com.pulumi.aws.ecr.EcrFunctions;
-import com.pulumi.aws.ecr.inputs.GetAuthorizationTokenArgs;
-import com.pulumi.dockerbuild.Image;
-import com.pulumi.dockerbuild.ImageArgs;
-import com.pulumi.dockerbuild.inputs.CacheFromArgs;
-import com.pulumi.dockerbuild.inputs.CacheFromRegistryArgs;
-import com.pulumi.dockerbuild.inputs.CacheToArgs;
-import com.pulumi.dockerbuild.inputs.CacheToInlineArgs;
-import com.pulumi.dockerbuild.inputs.BuildContextArgs;
-import com.pulumi.dockerbuild.inputs.RegistryArgs;
-import java.util.List;
-import java.util.ArrayList;
-import java.util.Map;
-import java.io.File;
-import java.nio.file.Files;
-import java.nio.file.Paths;
-
-public class App {
-    public static void main(String[] args) {
-        Pulumi.run(App::stack);
-    }
-
-    public static void stack(Context ctx) {
-        // Create an ECR repository for pushing.
-        var ecrRepository = new Repository("ecrRepository");
-
-        // Grab auth credentials for ECR.
-        final var authToken = EcrFunctions.getAuthorizationToken(GetAuthorizationTokenArgs.builder()
-            .registryId(ecrRepository.registryId())
-            .build());
-
-        // Build and push an image to ECR with inline caching.
-        var myImage = new Image("myImage", ImageArgs.builder()
-            // Tag our image with our ECR repository's address.
-            .tags(ecrRepository.repositoryUrl().applyValue(repositoryUrl -> String.format("%s:latest", repositoryUrl)))
-            .context(BuildContextArgs.builder()
-                .location("./app")
-                .build())
-            // Use the pushed image as a cache source.
-            .cacheFrom(CacheFromArgs.builder()
-                .registry(CacheFromRegistryArgs.builder()
-                    .ref(ecrRepository.repositoryUrl().applyValue(repositoryUrl -> String.format("%s:latest", repositoryUrl)))
-                    .build())
-                .build())
-            // Include an inline cache with our pushed image.
-            .cacheTo(CacheToArgs.builder()
-                .inline()
-                .build())
-            // Build a multi-platform image manifest for ARM and AMD.
-            .platforms(
-                "linux/amd64",
-                "linux/arm64")
-            // Push the final result to ECR.
-            .push(true)
-            // Provide our ECR credentials.
-            .registries(RegistryArgs.builder()
-                .address(ecrRepository.repositoryUrl())
-                .password(authToken.applyValue(getAuthorizationTokenResult -> getAuthorizationTokenResult).applyValue(authToken -> authToken.applyValue(getAuthorizationTokenResult -> getAuthorizationTokenResult.password())))
-                .username(authToken.applyValue(getAuthorizationTokenResult -> getAuthorizationTokenResult).applyValue(authToken -> authToken.applyValue(getAuthorizationTokenResult -> getAuthorizationTokenResult.userName())))
-                .build())
-            .build());
-
-        ctx.export("ref", myImage.ref());
-    }
-}
-```
-
-{{% /choosable %}}
-
-{{< /chooser >}}

docs/generate.go

@@ -81,7 +81,6 @@ func markdownExample(description string,
 	csharp string,
 	golang string,
 	yaml string,
-	hcl string,
 	java string,
 ) string {
 	return fmt.Sprintf("{{%% example %%}}\n### %s\n\n"+
@@ -90,10 +89,9 @@ func markdownExample(description string,
 		"```csharp\n%s```\n"+
 		"```go\n%s```\n"+
 		"```yaml\n%s```\n"+
-		"```hcl\n%s```\n"+
 		"```java\n%s```\n"+
 		"{{%% /example %%}}\n",
-		description, typescript, python, csharp, golang, yaml, hcl, java)
+		description, typescript, python, csharp, golang, yaml, java)
 }
 
 func convert(language, tempDir, programFile string) (string, error) {
@@ -188,10 +186,6 @@ func processYaml(path, mdDir string) error {
 			if err != nil {
 				return false, err
 			}
-			hcl, err := convert("hcl", dir, "program.hcl")
-			if err != nil {
-				return false, err
-			}
 
 			yamlContent, err := os.ReadFile(filepath.Clean(filepath.Join(dir, "Pulumi.yaml")))
 			if err != nil {
@@ -199,9 +193,7 @@ func processYaml(path, mdDir string) error {
 			}
 			yaml := string(yamlContent)
 
-			exampleStrings = append(exampleStrings, markdownExample(
-				description, typescript, python, csharp, golang, yaml, hcl, java,
-			))
+			exampleStrings = append(exampleStrings, markdownExample(description, typescript, python, csharp, golang, yaml, java))
 
 			return true, nil
 		}()

docs/installation-configuration.md

@@ -1,33 +0,0 @@
----
-title: Docker-Build Installation & Configuration
-meta_desc: Provides an overview on how to configure the Pulumi Docker-Build Provider.
-layout: package
----
-
-The Pulumi Docker-build provider builds modern Docker images with [buildx](https://docs.docker.com/reference/cli/docker/buildx/) and [BuildKit](https://docs.docker.com/build/buildkit/).
-
-## Installation
-
-The Docker-Build provider is available as a package in all Pulumi languages:
-
-* JavaScript/TypeScript: [`@pulumi/docker-build`](https://www.npmjs.com/package/@pulumi/docker-build)
-* Python: [`pulumi-docker-build`](https://pypi.org/project/pulumi-docker-build/)
-* Go: [`github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild`](https://github.com/pulumi/pulumi-docker-build)
-* .NET: [`Pulumi.DockerBuild`](https://www.nuget.org/packages/Pulumi.DockerBuild)
-* Java: [`com.pulumi/docker-build`](https://central.sonatype.com/artifact/com.pulumi/docker-build)
-
-## Configuring The Provider
-
-### Host
-
-The `DOCKER_HOST` environment variable can be used to specify a custom build daemon's location.
-
-```bash
-$ export DOCKER_HOST=tcp://127.0.0.1:2376/
-```
-
-This can also be specified in your stack's configuration:
-
-```bash
-$ pulumi config set docker-build:host tcp://127.0.0.1:2376/
-```

docs/yaml/image-examples.yaml

@@ -62,7 +62,7 @@ resources:
           username: pulumibot
           password: ${dockerHubPassword}
 outputs:
-  ref: ${image.ref}
+  ref: ${my-image.ref}
 ---
 name: caching
 runtime: yaml

examples/dotnet/provider-docker-build.csproj

@@ -2,7 +2,7 @@
 
 	<PropertyGroup>
 		<OutputType>Exe</OutputType>
-		<TargetFramework>net8.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<Nullable>enable</Nullable>
 	</PropertyGroup>
 

examples/dotnet_test.go

@@ -10,9 +10,8 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/stretchr/testify/require"
-
 	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
+	"github.com/stretchr/testify/require"
 )
 
 func TestDotNetExample(t *testing.T) {

examples/go/go.mod

@@ -1,119 +1,95 @@
 module provider-docker-build
 
-go 1.25.8
+go 1.21.7
+
+toolchain go1.21.9
 
 require (
-	github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.18
-	github.com/pulumi/pulumi/sdk/v3 v3.242.0
+	github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.0-20240425180359-26c144c916b7
+	github.com/pulumi/pulumi/sdk/v3 v3.128.0
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.2.0 // indirect
+	dario.cat/mergo v1.0.0 // indirect
+	github.com/BurntSushi/toml v1.2.1 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/ProtonMail/go-crypto v1.0.0 // indirect
+	github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
-	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/bubbles v1.0.0 // indirect
-	github.com/charmbracelet/bubbletea v1.3.10 // indirect
-	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.11.7 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
-	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/charmbracelet/bubbles v0.16.1 // indirect
+	github.com/charmbracelet/bubbletea v0.25.0 // indirect
+	github.com/charmbracelet/lipgloss v0.7.1 // indirect
 	github.com/cheggaaa/pb v1.0.29 // indirect
-	github.com/clipperhouse/displaywidth v0.11.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
-	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
-	github.com/djherbis/times v1.6.0 // indirect
+	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/containerd/console v1.0.4 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
+	github.com/djherbis/times v1.5.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.9.0 // indirect
-	github.com/go-git/go-git/v5 v5.19.1 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-git/go-billy/v5 v5.5.0 // indirect
+	github.com/go-git/go-git/v5 v5.12.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.2.5 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/glog v1.2.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-version v1.9.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.19.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
-	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.23 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/muesli/reflow v0.3.0 // indirect
+	github.com/muesli/termenv v0.15.2 // indirect
 	github.com/opentracing/basictracer-go v1.1.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pgavlin/fx v0.1.6 // indirect
-	github.com/pgavlin/fx/v2 v2.0.12 // indirect
-	github.com/pjbgf/sha1cd v0.6.0 // indirect
+	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.24.0 // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/pulumi/esc v0.9.1 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/rogpeppe/go-internal v1.12.0 // indirect
+	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
-	github.com/sergi/go-diff v1.4.0 // indirect
-	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/skeema/knownhosts v1.2.2 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
-	github.com/spf13/cobra v1.10.2 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/cobra v1.8.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/texttheater/golang-levenshtein v1.0.1 // indirect
+	github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 // indirect
 	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
 	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zclconf/go-cty v1.17.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/collector/featuregate v1.58.0 // indirect
-	go.opentelemetry.io/collector/pdata v1.58.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
-	go.opentelemetry.io/otel/metric v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
-	go.uber.org/atomic v1.11.0 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.54.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260519071638-aa98bba5eb94 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260519071638-aa98bba5eb94 // indirect
-	google.golang.org/grpc v1.81.1 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	github.com/zclconf/go-cty v1.14.1 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
+	golang.org/x/crypto v0.24.0 // indirect
+	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 // indirect
+	golang.org/x/mod v0.18.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/term v0.21.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/tools v0.22.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 // indirect
+	google.golang.org/grpc v1.63.2 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	lukechampine.com/frand v1.5.1 // indirect
+	lukechampine.com/frand v1.4.2 // indirect
 )

examples/go/go.sum

@@ -1,12 +1,16 @@
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
+github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/ProtonMail/go-crypto v1.2.0 h1:+PhXXn4SPGd+qk76TlEePBfOfivE0zkWFenhGhFLzWs=
-github.com/ProtonMail/go-crypto v1.2.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
+github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da h1:KjTM2ks9d14ZYCvmHS9iAKVt9AyzRSqNU1qabPih5BY=
+github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da/go.mod h1:eHEWzANqSiWQsof+nXEI9bUVUyV6F53Fp89EuCh2EAA=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
@@ -21,83 +25,60 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/bubbles v1.0.0 h1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=
-github.com/charmbracelet/bubbles v1.0.0/go.mod h1:9d/Zd5GdnauMI5ivUIVisuEm3ave1XwXtD1ckyV6r3E=
-github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
-github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
-github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=
-github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q=
-github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
-github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI=
-github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ=
-github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=
-github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q=
-github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=
-github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/charmbracelet/bubbles v0.16.1 h1:6uzpAAaT9ZqKssntbvZMlksWHruQLNxg49H5WdeuYSY=
+github.com/charmbracelet/bubbles v0.16.1/go.mod h1:2QCp9LFlEsBQMvIYERr7Ww2H2bA7xen1idUDIzm/+Xc=
+github.com/charmbracelet/bubbletea v0.25.0 h1:bAfwk7jRz7FKFl9RzlIULPkStffg5k6pNt5dywy4TcM=
+github.com/charmbracelet/bubbletea v0.25.0/go.mod h1:EN3QDR1T5ZdWmdfDzYcqOCAps45+QIJbLOBxmVNWNNg=
+github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZpc5Kc1E=
+github.com/charmbracelet/lipgloss v0.7.1/go.mod h1:yG0k3giv8Qj8edTCbbg6AlQ5e8KNWpFujkNawKNhE2c=
 github.com/cheggaaa/pb v1.0.29 h1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo=
 github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30=
-github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=
-github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0=
-github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=
-github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
-github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
-github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
-github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
-github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
+github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
+github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
+github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
+github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
-github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
-github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
+github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU=
+github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0=
+github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU=
+github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE=
-github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps=
-github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
-github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/gliderlabs/ssh v0.3.7 h1:iV3Bqi942d9huXnzEF2Mt+CY9gLu8DNM4Obd+8bODRE=
+github.com/gliderlabs/ssh v0.3.7/go.mod h1:zpHEXBstFnQYtGnB8k8kQLol82umzn/2/snG7alWVD8=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
-github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
+github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
+github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
-github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
-github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
+github.com/go-git/go-git/v5 v5.12.0/go.mod h1:FTM9VKtnI2m65hNI/TenDDDnUf2Q9FHnXYjuz9i5OEY=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I=
-github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
+github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
+github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -105,25 +86,17 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
-github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
-github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
+github.com/hashicorp/hcl/v2 v2.19.1 h1://i05Jqznmb2EXqa39Nsvyan2o5XyMowW5fnCKW5RPI=
+github.com/hashicorp/hcl/v2 v2.19.1/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
@@ -131,38 +104,35 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4=
-github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
-github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
-github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4=
-github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw=
-github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
+github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
-github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
-github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
-github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
-github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
+github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
+github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
+github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
+github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
+github.com/onsi/gomega v1.31.1 h1:KYppCUK+bUgAZwHOu7EXVBKyQA6ILvOESHkn/tgoqvo=
+github.com/onsi/gomega v1.31.1/go.mod h1:y40C95dwAD1Nz36SsEnxvfFe8FFfNxzI5eJ0EYGyAy0=
 github.com/opentracing/basictracer-go v1.1.0 h1:Oa1fTSBvAl8pa3U+IJYqrKm0NALwH9OsgwOqDv4xJW0=
 github.com/opentracing/basictracer-go v1.1.0/go.mod h1:V2HZueSJEp879yv285Aap1BS69fQMD+MNP1mRs6mBQc=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
@@ -170,134 +140,113 @@ github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pgavlin/fx v0.1.6 h1:r9jEg69DhNoCd3Xh0+5mIbdbS3PqWrVWujkY76MFRTU=
 github.com/pgavlin/fx v0.1.6/go.mod h1:KWZJ6fqBBSh8GxHYqwYCf3rYE7Gp2p0N8tJp8xv9u9M=
-github.com/pgavlin/fx/v2 v2.0.12 h1:SjjaJ68Dt8Z4zHwOpY/RPijd7lShs6xYupJbF9ra00M=
-github.com/pgavlin/fx/v2 v2.0.12/go.mod h1:M/nF/ooAOy+NUBooYYXl2REARzJ/giPJxfMs8fINfKc=
-github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU=
-github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM=
+github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
+github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
 github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.24.0 h1:sCtiB0qbyrlU1ZNzJn4dTLYiChl8xeCBFbHWl1YoXJg=
-github.com/pulumi/esc v0.24.0/go.mod h1:eCOOkcDJS6eooGwdE4/E0+pOsvUWG254+KBmPCFwJpA=
-github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.18 h1:emkSEfjXfz7i2vNDi43WTqABhP9TY2mQnO2zdL683hw=
-github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.18/go.mod h1:BriBqoV2I/58/AZy4/4oJfoiJYX7Nf/NxsAmGXDgvgo=
-github.com/pulumi/pulumi/sdk/v3 v3.242.0 h1:gQIZ1ALbT5gCMuRoBscGzk7Rdbx9mbOc+YwDFxvRyss=
-github.com/pulumi/pulumi/sdk/v3 v3.242.0/go.mod h1:P9VS6pQws3YBu67uszFRHn24n5AwzeMlyC2hIiHGWHg=
-github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
-github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/pulumi/esc v0.9.1 h1:HH5eEv8sgyxSpY5a8yePyqFXzA8cvBvapfH8457+mIs=
+github.com/pulumi/esc v0.9.1/go.mod h1:oEJ6bOsjYlQUpjf70GiX+CXn3VBmpwFDxUTlmtUN84c=
+github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.0-20240425180359-26c144c916b7 h1:elp7Ar01zvIJtRQv+megjeGSfpxxzPYyKBGfDDtWFBA=
+github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.0-20240425180359-26c144c916b7/go.mod h1:48lEA1mq2tRC4SfASAJmLYG1hRWM5sP5VPFeoZEM54U=
+github.com/pulumi/pulumi/sdk/v3 v3.128.0 h1:5VPFfygxt6rva0bEYVQZXxsGAo2/D1wsb9erGOtXxzk=
+github.com/pulumi/pulumi/sdk/v3 v3.128.0/go.mod h1:p1U24en3zt51agx+WlNboSOV8eLlPWYAkxMzVEXKbnY=
+github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
+github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
+github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
-github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
-github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
-github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
+github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
+github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
-github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
-github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
-github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0 h1:4G4v2dO3VZwixGIRoQ5Lfboy6nUhCyYzaqnIAPPhYs4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/texttheater/golang-levenshtein v1.0.1 h1:+cRNoVrfiwufQPhoMzB6N0Yf/Mqajr6t1lOv8GyGE2U=
 github.com/texttheater/golang-levenshtein v1.0.1/go.mod h1:PYAKrbF5sAiq9wd+H82hs7gNaen0CplQ9uvm6+enD/8=
+github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 h1:X9dsIWPuuEJlPX//UmRKophhOKCGXc46RVIGuttks68=
+github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7/go.mod h1:UxoP3EypF8JfGEjAII8jx1q8rQyDnX8qdTCs/UQBVIE=
 github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaOOb6ThwMmTEbhRwtKR97o=
 github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
 github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg=
 github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
-github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/collector/featuregate v1.58.0 h1:Kh6Dpgbxywv/Q3D6qPehaSxNCxvr/U/ki7CL4y3udCo=
-go.opentelemetry.io/collector/featuregate v1.58.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU=
-go.opentelemetry.io/collector/internal/testutil v0.152.0 h1:8LGwekR7mLcUDhT1ofLmdnrHRFuUa3U7PBd95ZvJEjQ=
-go.opentelemetry.io/collector/internal/testutil v0.152.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE=
-go.opentelemetry.io/collector/pdata v1.58.0 h1:5Lxut3NxKp87066Pzt+3q7+JUuFI5B3teCyLZIF8wIs=
-go.opentelemetry.io/collector/pdata v1.58.0/go.mod h1:4vZtODINbC/JF3eGocnatdImzbRHseOywIcr+aULjCg=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
-go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
-go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
-go.opentelemetry.io/proto/slim/otlp v1.10.0 h1:iR97Vs/ZDR+y9TfuP9b1XBtdPWeC+OMslIBmhcLU7jM=
-go.opentelemetry.io/proto/slim/otlp v1.10.0/go.mod h1:lV9250stpjYLPNA5viFabIgP2QlUGRT1GdTgAf8SIUk=
-go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.3.0 h1:RUF5rO0hAlgiJt1fzQVzcVs3vZVNHIcMLgOgG4rWNcQ=
-go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.3.0/go.mod h1:I89cynRj8y+383o7tEQVg2SVA6SRgDVIouWPUVXjx0U=
-go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.3.0 h1:CQvJSldHRUN6Z8jsUeYv8J0lXRvygALXIzsmAeCcZE0=
-go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.3.0/go.mod h1:xSQ+mEfJe/GjK1LXEyVOoSI1N9JV9ZI923X5kup43W4=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
-go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zclconf/go-cty v1.14.1 h1:t9fyA35fwjjUMcmL5hLER+e/rEPqrbCK1/OSE4SI9KA=
+github.com/zclconf/go-cty v1.14.1/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
+go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
-golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
+golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 h1:LoYXNGAShUG3m/ehNk4iFctuhGX/+R1ZpfJ4/ia80JM=
+golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0=
+golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -306,41 +255,52 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA=
+golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
-gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/api v0.0.0-20260519071638-aa98bba5eb94 h1:DddG61lE5LkX6144z22i0gma9BMBs5aZ9B8lZLobxyw=
-google.golang.org/genproto/googleapis/api v0.0.0-20260519071638-aa98bba5eb94/go.mod h1:1dCETSCY2YKZNXQE3h4fun3TYwF5p8jejRKZgfWAgAY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260519071638-aa98bba5eb94 h1:eZCjr/aAF8c5ccm5pb6T4EXgIei5MlAAPWPJk+5ArfY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260519071638-aa98bba5eb94/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 h1:8EeVk1VKMD+GD/neyEHGmz7pFblqPjHoi+PGQIlLx2s=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
+google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
+google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -350,9 +310,10 @@ gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRN
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-lukechampine.com/frand v1.5.1 h1:fg0eRtdmGFIxhP5zQJzM1lFDbD6CUfu/f+7WgAZd5/w=
-lukechampine.com/frand v1.5.1/go.mod h1:4VstaWc2plN4Mjr10chUD46RAVGWhpkZ5Nja8+Azp0Q=
-pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
-pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
+lukechampine.com/frand v1.4.2 h1:RzFIpOvkMXuPMBb9maa4ND4wjBn71E1Jpf8BzJHMaVw=
+lukechampine.com/frand v1.4.2/go.mod h1:4S/TM2ZgrKejMcKMbeLjISpJMO+/eZ1zu3vYX9dtj3s=
+pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw=
+pgregory.net/rapid v1.1.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=

examples/go/main.go

@@ -1,10 +1,9 @@
 package main
 
 import (
+	"github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
-
-	"github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild"
 )
 
 func main() {

examples/go_test.go

@@ -8,9 +8,8 @@ import (
 	"path"
 	"testing"
 
-	"github.com/stretchr/testify/require"
-
 	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
+	"github.com/stretchr/testify/require"
 )
 
 func TestGoExample(t *testing.T) {

examples/hcl/.dockerignore

@@ -1,2 +0,0 @@
-command-output
-tmp

examples/hcl/Pulumi.yaml

@@ -1,10 +0,0 @@
-name: provider-docker-build
-runtime: hcl
-config:
-  dockerHubPassword:
-    type: string
-    secret: true
-plugins:
-  providers:
-    - name: docker-build
-      path: ../../bin

examples/hcl/app/Dockerfile

@@ -1,2 +0,0 @@
-FROM alpine
-RUN echo 👍

examples/hcl/app/Dockerfile.buildArgs

@@ -1,5 +0,0 @@
-FROM alpine
-
-ARG SET_ME_TO_TRUE
-RUN [ "$SET_ME_TO_TRUE" = "true" ]
-RUN echo "That's the correct build arg, thanks! 👍"

examples/hcl/app/Dockerfile.emptyContext

@@ -1,2 +0,0 @@
-FROM alpine
-RUN echo "This image doesn't use any local files, so it doesn't need a context parameter 👍"

examples/hcl/app/Dockerfile.extraHosts

@@ -1,3 +0,0 @@
-FROM bash AS base
-
-RUN getent hosts metadata.google.internal

examples/hcl/app/Dockerfile.multiPlatform

@@ -1,7 +0,0 @@
-FROM --platform=$BUILDPLATFORM alpine as build
-RUN echo ${BUILDPLATFORM} > buildplatform
-RUN echo ${TARGETPLATFORM} > targetplatform
-
-FROM build
-RUN cat buildplatform
-RUN cat targetplatform

examples/hcl/app/Dockerfile.namedContexts

@@ -1,5 +0,0 @@
-# syntax=docker/dockerfile:1.4
-FROM golang:latest
-
-RUN version="$(go version)" && echo $version && [ "$version" = "go version go1.21.7 linux/amd64" ]
-RUN echo "This image uses named contexts to pin golang:latest to a specific SHA 👍"

examples/hcl/app/Dockerfile.secrets

@@ -1,4 +0,0 @@
-FROM alpine
-
-RUN --mount=type=secret,id=password [ "$(cat /run/secrets/password)" = "hunter2" ]
-

examples/hcl/app/Dockerfile.sshMount

@@ -1,5 +0,0 @@
-FROM alpine
-
-RUN apk add openssh-client
-
-RUN --mount=type=ssh ssh-add -l

examples/hcl/app/Dockerfile.target

@@ -1,8 +0,0 @@
-FROM alpine as build-me
-RUN echo 👍
-
-FROM build-me as also-build-me
-RUN echo 🤙
-
-FROM build-me as dont-build-me
-RUN [ "true" = "false" ]

examples/hcl/program.hcl

@@ -1,171 +0,0 @@
-pulumi {
-  required_providers {
-    docker-build = {
-      source  = "pulumi/docker-build"
-      version = "0.1.0-alpha.0+dev"
-    }
-  }
-}
-
-resource "docker-build_image" "multiPlatform" {
-  push = false
-  dockerfile = {
-    location = "./app/Dockerfile.multiPlatform"
-  }
-  context = {
-    location = "./app"
-  }
-  platforms = ["plan9/amd64", "plan9/386"]
-}
-resource "docker-build_image" "registryPush" {
-  push = false
-  context = {
-    location = "./app"
-  }
-  tags = ["docker.io/pulumibot/buildkit-e2e:example"]
-  exports {
-    registry = {
-      oci_media_types = true
-      push            = false
-    }
-  }
-  registries {
-    address  = "docker.io"
-    username = "pulumibot"
-    password = var.dockerHubPassword
-  }
-}
-resource "docker-build_image" "cached" {
-  push = false
-  context = {
-    location = "./app"
-  }
-  cache_to {
-    local = {
-      dest = "tmp/cache"
-      mode = "max"
-    }
-  }
-  cache_from {
-    local = {
-      src = "tmp/cache"
-    }
-  }
-}
-resource "docker-build_image" "buildArgs" {
-  push = false
-  dockerfile = {
-    location = "./app/Dockerfile.buildArgs"
-  }
-  context = {
-    location = "./app"
-  }
-  build_args = {
-    "SET_ME_TO_TRUE" = "true"
-  }
-}
-resource "docker-build_image" "extraHosts" {
-  push = false
-  dockerfile = {
-    location = "./app/Dockerfile.extraHosts"
-  }
-  context = {
-    location = "./app"
-  }
-  add_hosts = ["metadata.google.internal:169.254.169.254"]
-}
-resource "docker-build_image" "sshMount" {
-  push = false
-  dockerfile = {
-    location = "./app/Dockerfile.sshMount"
-  }
-  context = {
-    location = "./app"
-  }
-  ssh {
-    id = "default"
-  }
-}
-resource "docker-build_image" "secrets" {
-  push = false
-  dockerfile = {
-    location = "./app/Dockerfile.secrets"
-  }
-  context = {
-    location = "./app"
-  }
-  secrets = {
-    "password" = "hunter2"
-  }
-}
-resource "docker-build_image" "labels" {
-  push = false
-  context = {
-    location = "./app"
-  }
-  labels = {
-    "description" = "This image will get a descriptive label 👍"
-  }
-}
-resource "docker-build_image" "target" {
-  push = false
-  dockerfile = {
-    location = "./app/Dockerfile.target"
-  }
-  context = {
-    location = "./app"
-  }
-  target = "build-me"
-}
-resource "docker-build_image" "namedContexts" {
-  push = false
-  dockerfile = {
-    location = "./app/Dockerfile.namedContexts"
-  }
-  context = {
-    location = "./app"
-    named = {
-      "golang:latest" = {
-        location = "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
-      }
-    }
-  }
-}
-resource "docker-build_image" "remoteContext" {
-  push = false
-  context = {
-    location = "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
-  }
-}
-resource "docker-build_image" "remoteContextWithInline" {
-  push = false
-  dockerfile = {
-    inline = "FROM busybox\nCOPY hello.c ./\n"
-  }
-  context = {
-    location = "https://github.com/docker-library/hello-world.git"
-  }
-}
-resource "docker-build_image" "inline" {
-  push = false
-  dockerfile = {
-    inline = "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n"
-  }
-}
-resource "docker-build_image" "dockerLoad" {
-  push = false
-  context = {
-    location = "./app"
-  }
-  exports {
-    docker = {
-      tar = true
-    }
-  }
-}
-variable "dockerHubPassword" {
-  type = string
-}
-output "platforms" {
-  value = docker-build_image.multiPlatform.platforms
-}

examples/java_test.go

@@ -8,9 +8,8 @@ import (
 	"path"
 	"testing"
 
-	"github.com/stretchr/testify/require"
-
 	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
+	"github.com/stretchr/testify/require"
 )
 
 func TestJavaExample(t *testing.T) {

examples/nodejs/package.json

@@ -5,6 +5,6 @@
   },
   "dependencies": {
     "typescript": "^4.0.0",
-    "@pulumi/pulumi": "3.244.0"
+    "@pulumi/pulumi": "^3.128.0"
   }
 }

examples/nodejs_test.go

@@ -9,22 +9,15 @@ import (
 	"math/rand"
 	"os"
 	"path"
-	"path/filepath"
 	"strings"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/ecr"
+	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/pulumi/providertest"
-	"github.com/pulumi/providertest/optproviderupgrade"
-	"github.com/pulumi/providertest/pulumitest"
-	"github.com/pulumi/providertest/pulumitest/assertpreview"
-	"github.com/pulumi/providertest/pulumitest/opttest"
-	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
 )
 
 func TestNodeExample(t *testing.T) {
@@ -42,30 +35,6 @@ func TestNodeExample(t *testing.T) {
 	integration.ProgramTest(t, &test)
 }
 
-func TestNodeExampleUpgrade(t *testing.T) {
-	t.Parallel()
-	var (
-		providerName    string = "docker-build"
-		baselineVersion string = "0.0.7"
-	)
-
-	cwd, err := os.Getwd()
-	require.NoError(t, err)
-
-	options := []opttest.Option{
-		opttest.DownloadProviderVersion(providerName, baselineVersion),
-		opttest.LocalProviderPath(providerName, filepath.Join(cwd, "..", "bin")),
-		opttest.YarnLink("@pulumi/docker-build"),
-		opttest.TestInPlace(),
-	}
-
-	test := pulumitest.NewPulumiTest(t, filepath.Join(cwd, "upgrade-node"), options...)
-	result := providertest.PreviewProviderUpgrade(t, test, providerName, baselineVersion,
-		optproviderupgrade.DisableAttach())
-
-	assertpreview.HasNoReplacements(t, result)
-}
-
 // TestCaching simulates a slow build with --cache-to enabled. We aren't able
 // to directly detect cache hits, so we re-run the update and confirm it took
 // less time than the image originally took to build.
@@ -129,6 +98,7 @@ func TestCaching(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			if tt.skip {
 				t.Skip("Missing environment variables")
@@ -177,19 +147,6 @@ func TestCaching(t *testing.T) {
 	}
 }
 
-func TestConfig(t *testing.T) {
-	cwd, err := os.Getwd()
-	require.NoError(t, err)
-
-	test := integration.ProgramTestOptions{
-		Dir:                    path.Join(cwd, "tests", "config"),
-		Dependencies:           []string{"@pulumi/docker-build"},
-		SkipEmptyPreviewUpdate: true,
-	}
-
-	integration.ProgramTest(t, &test)
-}
-
 type ECR struct {
 	address  string
 	username string

examples/python/__main__.py

@@ -5,151 +5,151 @@ config = pulumi.Config()
 docker_hub_password = config.require("dockerHubPassword")
 multi_platform = docker_build.Image("multiPlatform",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.multiPlatform",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.multiPlatform",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     platforms=[
         docker_build.Platform.PLAN9_AMD64,
         docker_build.Platform.PLAN9_386,
     ])
 registry_push = docker_build.Image("registryPush",
     push=False,
-    context={
-        "location": "./app",
-    },
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     tags=["docker.io/pulumibot/buildkit-e2e:example"],
-    exports=[{
-        "registry": {
-            "oci_media_types": True,
-            "push": False,
-        },
-    }],
-    registries=[{
-        "address": "docker.io",
-        "username": "pulumibot",
-        "password": docker_hub_password,
-    }])
+    exports=[docker_build.ExportArgs(
+        registry=docker_build.ExportRegistryArgs(
+            oci_media_types=True,
+            push=False,
+        ),
+    )],
+    registries=[docker_build.RegistryArgs(
+        address="docker.io",
+        username="pulumibot",
+        password=docker_hub_password,
+    )])
 cached = docker_build.Image("cached",
     push=False,
-    context={
-        "location": "./app",
-    },
-    cache_to=[{
-        "local": {
-            "dest": "tmp/cache",
-            "mode": docker_build.CacheMode.MAX,
-        },
-    }],
-    cache_from=[{
-        "local": {
-            "src": "tmp/cache",
-        },
-    }])
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
+    cache_to=[docker_build.CacheToArgs(
+        local=docker_build.CacheToLocalArgs(
+            dest="tmp/cache",
+            mode=docker_build.CacheMode.MAX,
+        ),
+    )],
+    cache_from=[docker_build.CacheFromArgs(
+        local=docker_build.CacheFromLocalArgs(
+            src="tmp/cache",
+        ),
+    )])
 build_args = docker_build.Image("buildArgs",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.buildArgs",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.buildArgs",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     build_args={
         "SET_ME_TO_TRUE": "true",
     })
 extra_hosts = docker_build.Image("extraHosts",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.extraHosts",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.extraHosts",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     add_hosts=["metadata.google.internal:169.254.169.254"])
 ssh_mount = docker_build.Image("sshMount",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.sshMount",
-    },
-    context={
-        "location": "./app",
-    },
-    ssh=[{
-        "id": "default",
-    }])
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.sshMount",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
+    ssh=[docker_build.SSHArgs(
+        id="default",
+    )])
 secrets = docker_build.Image("secrets",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.secrets",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.secrets",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     secrets={
         "password": "hunter2",
     })
 labels = docker_build.Image("labels",
     push=False,
-    context={
-        "location": "./app",
-    },
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     labels={
         "description": "This image will get a descriptive label 👍",
     })
 target = docker_build.Image("target",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.target",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.target",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     target="build-me")
 named_contexts = docker_build.Image("namedContexts",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.namedContexts",
-    },
-    context={
-        "location": "./app",
-        "named": {
-            "golang:latest": {
-                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
-            },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.namedContexts",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+        named={
+            "golang:latest": docker_build.ContextArgs(
+                location="docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
+            ),
         },
-    })
+    ))
 remote_context = docker_build.Image("remoteContext",
     push=False,
-    context={
-        "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile",
-    })
+    context=docker_build.BuildContextArgs(
+        location="https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile",
+    ))
 remote_context_with_inline = docker_build.Image("remoteContextWithInline",
     push=False,
-    dockerfile={
-        "inline": """FROM busybox
+    dockerfile=docker_build.DockerfileArgs(
+        inline="""FROM busybox
 COPY hello.c ./
 """,
-    },
-    context={
-        "location": "https://github.com/docker-library/hello-world.git",
-    })
+    ),
+    context=docker_build.BuildContextArgs(
+        location="https://github.com/docker-library/hello-world.git",
+    ))
 inline = docker_build.Image("inline",
     push=False,
-    dockerfile={
-        "inline": """FROM alpine
+    dockerfile=docker_build.DockerfileArgs(
+        inline="""FROM alpine
 RUN echo "This uses an inline Dockerfile! 👍"
 """,
-    })
+    ))
 docker_load = docker_build.Image("dockerLoad",
     push=False,
-    context={
-        "location": "./app",
-    },
-    exports=[{
-        "docker": {
-            "tar": True,
-        },
-    }])
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
+    exports=[docker_build.ExportArgs(
+        docker=docker_build.ExportDockerArgs(
+            tar=True,
+        ),
+    )])
 pulumi.export("platforms", multi_platform.platforms)

examples/python_test.go

@@ -8,9 +8,8 @@ import (
 	"path"
 	"testing"
 
-	"github.com/stretchr/testify/require"
-
 	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
+	"github.com/stretchr/testify/require"
 )
 
 func TestPythonExample(t *testing.T) {

examples/testdata/recorded/TestProviderUpgrade/upgrade-node/0.0.7/grpc.json

@@ -1,20 +0,0 @@
-{"method":"/pulumirpc.LanguageRuntime/GetPluginInfo","request":{},"response":{"version":"3.145.0-dev.0"}}
-{"method":"/pulumirpc.LanguageRuntime/GetRequiredPackages","request":{"info":{"entryPoint":".","options":{},"programDirectory":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node","rootDirectory":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node"}},"response":{"packages":[{"kind":"resource","name":"docker-build","version":"v0.1.0-alpha.0+dev"}]}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"transforms"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"deletedWith"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"invokeTransforms"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"resourceReferences"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"aliasSpecs"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"secrets"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"parameterization"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"outputValues"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/RegisterResource","request":{"acceptResources":true,"acceptSecrets":true,"aliasSpecs":true,"customTimeouts":{},"name":"provider-docker-build-test","object":{},"sourcePosition":{"column":23,"line":38,"uri":"file:///private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node/node_modules/@pulumi/runtime/stack.ts"},"supportsPartialValues":true,"supportsResultReporting":true,"type":"pulumi:pulumi:Stack"},"response":{"object":{},"urn":"urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test"}}
-{"method":"/pulumirpc.ResourceMonitor/RegisterResourceOutputs","request":{"outputs":{},"urn":"urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test"},"response":{}}
-{"method":"/pulumirpc.ResourceProvider/Handshake","request":{"engineAddress":"127.0.0.1:56051","programDirectory":"/Users/rquitales/.pulumi/plugins/resource-docker-build-v0.0.7","rootDirectory":"/Users/rquitales/.pulumi/plugins/resource-docker-build-v0.0.7"}}
-{"method":"/pulumirpc.ResourceProvider/GetPluginInfo","request":{},"response":{"version":"v0.0.7"}}
-{"method":"/pulumirpc.ResourceProvider/CheckConfig","request":{"name":"default_0_1_0_alpha_0_dev","news":{"version":"0.1.0-alpha.0+dev"},"olds":{},"type":"pulumi:providers:docker-build","urn":"urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default_0_1_0_alpha_0_dev"},"response":{"inputs":{"host":""}}}
-{"method":"/pulumirpc.ResourceProvider/Configure","request":{"acceptResources":true,"acceptSecrets":true,"args":{"host":""},"sendsOldInputs":true,"sendsOldInputsToDelete":true,"variables":{"docker-build:config:host":""}},"response":{"acceptOutputs":true,"acceptResources":true,"acceptSecrets":true,"supportsPreview":true}}
-{"method":"/pulumirpc.ResourceProvider/Check","request":{"name":"inline","news":{"buildOnPreview":true,"dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n"},"network":"default","push":false},"olds":{},"randomSeed":"gfcHtIMoX4qpk2cxRceOJcYDaSsHyPNBhhd8lYTFcqw=","type":"docker-build:index:Image","urn":"urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline"},"response":{"inputs":{"buildOnPreview":true,"context":{"location":"."},"dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n","location":""},"exec":false,"load":false,"network":"default","noCache":false,"pull":false,"push":false,"target":""}}}
-{"method":"/pulumirpc.ResourceProvider/Create","request":{"name":"inline","properties":{"buildOnPreview":true,"context":{"location":"."},"dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n","location":""},"exec":false,"load":false,"network":"default","noCache":false,"pull":false,"push":false,"target":""},"type":"docker-build:index:Image","urn":"urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline"},"response":{"id":"inline","properties":{"buildOnPreview":true,"context":{"location":"."},"contextHash":"a9db789a55c8ad91fe04e176aefcf0b74f86636ae12e7cd475421416672da8c1","digest":"","dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n","location":""},"exec":false,"load":false,"network":"default","noCache":false,"pull":false,"push":false,"ref":"","target":""}}}
-{"method":"/pulumirpc.ResourceMonitor/RegisterResource","request":{"acceptResources":true,"acceptSecrets":true,"aliasSpecs":true,"custom":true,"customTimeouts":{},"name":"inline","object":{"buildOnPreview":true,"dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n"},"network":"default","push":false},"parent":"urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test","propertyDependencies":{"buildOnPreview":{},"dockerfile":{},"network":{},"push":{}},"sourcePosition":{"column":16,"line":4,"uri":"file:///private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node/index.ts"},"supportsPartialValues":true,"supportsResultReporting":true,"type":"docker-build:index:Image","version":"0.1.0-alpha.0+dev"},"response":{"id":"inline","object":{"buildOnPreview":true,"context":{"location":"."},"contextHash":"a9db789a55c8ad91fe04e176aefcf0b74f86636ae12e7cd475421416672da8c1","digest":"","dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n","location":""},"exec":false,"load":false,"network":"default","noCache":false,"pull":false,"push":false,"ref":"","target":""},"urn":"urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline"}}
-{"method":"/pulumirpc.LanguageRuntime/Run","request":{"configPropertyMap":{},"info":{"entryPoint":".","options":{},"programDirectory":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node","rootDirectory":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node"},"loaderTarget":"127.0.0.1:56055","monitorAddress":"127.0.0.1:56054","organization":"organization","parallel":40,"program":".","project":"provider-docker-build","pwd":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node","stack":"test"},"response":{}}

examples/testdata/recorded/TestProviderUpgrade/upgrade-node/0.0.7/stack.json

@@ -1,96 +0,0 @@
-{
-  "version": 3,
-  "deployment": {
-    "manifest": {
-      "time": "2025-01-14T12:40:32.429451-08:00",
-      "magic": "7c53c69df7094e39d5562ed2abf1e12099c2c54a7b9b411faca1dcb7ec1fef8a",
-      "version": "v3.145.0"
-    },
-    "secrets_providers": {
-      "type": "passphrase",
-      "state": {
-        "salt": "v1:EuqbHY9lEXg=:v1:xNv8Pt7D2Pf/iDkg:tOvHbUIXPITf+BgbbjqPZaWIqKD8jQ=="
-      }
-    },
-    "resources": [
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "custom": false,
-        "type": "pulumi:pulumi:Stack",
-        "created": "2025-01-14T20:40:27.082534Z",
-        "modified": "2025-01-14T20:40:27.082534Z",
-        "sourcePosition": "project:///node_modules/@pulumi/runtime/stack.ts#38,23"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default_0_1_0_alpha_0_dev",
-        "custom": true,
-        "id": "04f4e431-4d74-43f1-86d5-52d410f3f6e8",
-        "type": "pulumi:providers:docker-build",
-        "inputs": {
-          "__internal": {},
-          "host": ""
-        },
-        "outputs": {
-          "host": ""
-        },
-        "created": "2025-01-14T20:40:28.862159Z",
-        "modified": "2025-01-14T20:40:28.862159Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline",
-        "custom": true,
-        "id": "inline",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "."
-          },
-          "dockerfile": {
-            "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "."
-          },
-          "contextHash": "a9db789a55c8ad91fe04e176aefcf0b74f86636ae12e7cd475421416672da8c1",
-          "digest": "",
-          "dockerfile": {
-            "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default_0_1_0_alpha_0_dev::04f4e431-4d74-43f1-86d5-52d410f3f6e8",
-        "propertyDependencies": {
-          "buildOnPreview": [],
-          "dockerfile": [],
-          "network": [],
-          "push": []
-        },
-        "created": "2025-01-14T20:40:32.357012Z",
-        "modified": "2025-01-14T20:40:32.357012Z",
-        "sourcePosition": "project:///index.ts#4,16"
-      }
-    ],
-    "metadata": {}
-  }
-}

examples/testdata/recorded/TestProviderUpgrade/upgrade/0.0.1/stack.json

@@ -1,944 +0,0 @@
-{
-  "version": 3,
-  "deployment": {
-    "manifest": {
-      "time": "2024-06-18T15:10:50.439881-07:00",
-      "magic": "",
-      "version": ""
-    },
-    "secrets_providers": {
-      "type": "passphrase",
-      "state": {
-        "salt": "v1:uRYnzeN15MA=:v1:rpAZ+oxUTuiNyCpF:KQmWj5xMhsTrE2XhW35Gd1XoMW7RDg=="
-      }
-    },
-    "resources": [
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "custom": false,
-        "type": "pulumi:pulumi:Stack",
-        "outputs": {
-          "platforms": [
-            "plan9/amd64",
-            "plan9/386"
-          ]
-        },
-        "created": "2024-06-18T22:10:48.091797Z",
-        "modified": "2024-06-18T22:10:48.091797Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default",
-        "custom": true,
-        "id": "b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "type": "pulumi:providers:docker-build",
-        "inputs": {
-          "host": ""
-        },
-        "outputs": {
-          "host": ""
-        },
-        "created": "2024-06-18T22:10:48.187658Z",
-        "modified": "2024-06-18T22:10:48.187658Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::secrets",
-        "custom": true,
-        "id": "secrets",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.secrets"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "secrets": {
-            "password": "hunter2"
-          },
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "5c1561571a60aa3b5a234a9c26f69e2ba5d9a18624f426109d36a1d729b23a21",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.secrets"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "secrets": {
-            "password": "hunter2"
-          },
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": [],
-          "secrets": []
-        },
-        "created": "2024-06-18T22:10:50.181453Z",
-        "modified": "2024-06-18T22:10:50.181453Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::buildArgs",
-        "custom": true,
-        "id": "buildArgs",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildArgs": {
-            "SET_ME_TO_TRUE": "true"
-          },
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.buildArgs"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildArgs": {
-            "SET_ME_TO_TRUE": "true"
-          },
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "55695ddcfb4d08a0d78d1a74c7b0141dada73ed05bc4b056ba29a51e42c83381",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.buildArgs"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "buildArgs": [],
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.182348Z",
-        "modified": "2024-06-18T22:10:50.182348Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::sshMount",
-        "custom": true,
-        "id": "sshMount",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.sshMount"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ssh": [
-            {
-              "id": "default"
-            }
-          ],
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "71d21b382ab9ee0324ad820ce57a0a4318342a0a244931f51fc46b791f1b37e9",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.sshMount"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "ssh": [
-            {
-              "id": "default"
-            }
-          ],
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": [],
-          "ssh": []
-        },
-        "created": "2024-06-18T22:10:50.182807Z",
-        "modified": "2024-06-18T22:10:50.182807Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::remoteContext",
-        "custom": true,
-        "id": "remoteContext",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
-          },
-          "contextHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.18341Z",
-        "modified": "2024-06-18T22:10:50.18341Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::registryPush",
-        "custom": true,
-        "id": "sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "exports": [
-            {
-              "disabled": false,
-              "raw": "",
-              "registry": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "danglingNamePrefix": "",
-                "forceCompression": false,
-                "ociMediaTypes": true,
-                "push": false,
-                "store": true
-              }
-            }
-          ],
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "tags": [
-            "docker.io/pulumibot/buildkit-e2e:example"
-          ],
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
-          "digest": "sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "exports": [
-            {
-              "disabled": false,
-              "raw": "",
-              "registry": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "danglingNamePrefix": "",
-                "forceCompression": false,
-                "ociMediaTypes": true,
-                "push": false,
-                "store": true
-              }
-            }
-          ],
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "docker.io/pulumibot/buildkit-e2e:example@sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
-          "tags": [
-            "docker.io/pulumibot/buildkit-e2e:example"
-          ],
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "exports": [],
-          "push": [],
-          "tags": []
-        },
-        "created": "2024-06-18T22:10:50.183668Z",
-        "modified": "2024-06-18T22:10:50.183668Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::dockerLoad",
-        "custom": true,
-        "id": "sha256:ec5d5c149823f61d56f5666d494d19c4edca42cfe4b578e640f57bf2429716a4",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "exports": [
-            {
-              "disabled": false,
-              "docker": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "dest": "",
-                "forceCompression": false,
-                "ociMediaTypes": false,
-                "tar": true
-              },
-              "raw": ""
-            }
-          ],
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
-          "digest": "sha256:ec5d5c149823f61d56f5666d494d19c4edca42cfe4b578e640f57bf2429716a4",
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "exports": [
-            {
-              "disabled": false,
-              "docker": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "dest": "",
-                "forceCompression": false,
-                "ociMediaTypes": false,
-                "tar": true
-              },
-              "raw": ""
-            }
-          ],
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "exports": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.183874Z",
-        "modified": "2024-06-18T22:10:50.183874Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::labels",
-        "custom": true,
-        "id": "labels",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "labels": {
-            "description": "This image will get a descriptive label 👍"
-          },
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "labels": {
-            "description": "This image will get a descriptive label 👍"
-          },
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "labels": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.183996Z",
-        "modified": "2024-06-18T22:10:50.183996Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline",
-        "custom": true,
-        "id": "inline",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "36c67969e6700e87bde75fcf604a7db1fa9593194718fc0ae1c498df43228aec",
-          "digest": "",
-          "dockerfile": {
-            "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.184088Z",
-        "modified": "2024-06-18T22:10:50.184088Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::target",
-        "custom": true,
-        "id": "target",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.target"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": "build-me"
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "fefadf795b6b4b119e97a87067a25f52a16cc3375223acad7b3f642fdcd413fc",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.target"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": "build-me"
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": [],
-          "target": []
-        },
-        "created": "2024-06-18T22:10:50.18426Z",
-        "modified": "2024-06-18T22:10:50.18426Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::cached",
-        "custom": true,
-        "id": "cached",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "cacheFrom": [
-            {
-              "disabled": false,
-              "local": {
-                "digest": "",
-                "src": "tmp/cache"
-              },
-              "raw": ""
-            }
-          ],
-          "cacheTo": [
-            {
-              "disabled": false,
-              "local": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "dest": "tmp/cache",
-                "forceCompression": false,
-                "ignoreError": false,
-                "mode": "max"
-              },
-              "raw": ""
-            }
-          ],
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "cacheFrom": [
-            {
-              "disabled": false,
-              "local": {
-                "digest": "",
-                "src": "tmp/cache"
-              },
-              "raw": ""
-            }
-          ],
-          "cacheTo": [
-            {
-              "disabled": false,
-              "local": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "dest": "tmp/cache",
-                "forceCompression": false,
-                "ignoreError": false,
-                "mode": "max"
-              },
-              "raw": ""
-            }
-          ],
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "cacheFrom": [],
-          "cacheTo": [],
-          "context": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.206842Z",
-        "modified": "2024-06-18T22:10:50.206842Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::multiPlatform",
-        "custom": true,
-        "id": "multiPlatform",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.multiPlatform"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "platforms": [
-            "plan9/amd64",
-            "plan9/386"
-          ],
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "c7ecf546ed2402de04f2dfa56ca4adb6fd490eed4219d7f1b2e559cd475f1755",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.multiPlatform"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "platforms": [
-            "plan9/amd64",
-            "plan9/386"
-          ],
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "platforms": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.257528Z",
-        "modified": "2024-06-18T22:10:50.257528Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::extraHosts",
-        "custom": true,
-        "id": "extraHosts",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "addHosts": [
-            "metadata.google.internal:169.254.169.254"
-          ],
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.extraHosts"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "addHosts": [
-            "metadata.google.internal:169.254.169.254"
-          ],
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e5d510d9ce39d91260e3aa7f8c81d7517a76165eb35e7134cae2f3e4e9fcb712",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.extraHosts"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "addHosts": [],
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.274264Z",
-        "modified": "2024-06-18T22:10:50.274264Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::remoteContextWithInline",
-        "custom": true,
-        "id": "remoteContextWithInline",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "https://github.com/docker-library/hello-world.git"
-          },
-          "dockerfile": {
-            "inline": "FROM busybox\nCOPY hello.c ./\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "https://github.com/docker-library/hello-world.git"
-          },
-          "contextHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-          "digest": "",
-          "dockerfile": {
-            "inline": "FROM busybox\nCOPY hello.c ./\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.332506Z",
-        "modified": "2024-06-18T22:10:50.332506Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::namedContexts",
-        "custom": true,
-        "id": "namedContexts",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app",
-            "named": {
-              "golang:latest": {
-                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
-              }
-            }
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.namedContexts"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app",
-            "named": {
-              "golang:latest": {
-                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
-              }
-            }
-          },
-          "contextHash": "3adfaaf17fbb548f06310e76d2826bccb223b49463504d0cc4fe86b0eef5d47d",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.namedContexts"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.422524Z",
-        "modified": "2024-06-18T22:10:50.422524Z"
-      }
-    ]
-  }
-}

examples/testdata/recorded/TestProviderUpgrade/upgrade/0.0.1/state.json

@@ -0,0 +1,944 @@
+{
+    "version": 3,
+    "deployment": {
+        "manifest": {
+            "time": "2024-06-18T15:10:50.439881-07:00",
+            "magic": "",
+            "version": ""
+        },
+        "secrets_providers": {
+            "type": "passphrase",
+            "state": {
+                "salt": "v1:uRYnzeN15MA=:v1:rpAZ+oxUTuiNyCpF:KQmWj5xMhsTrE2XhW35Gd1XoMW7RDg=="
+            }
+        },
+        "resources": [
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "custom": false,
+                "type": "pulumi:pulumi:Stack",
+                "outputs": {
+                    "platforms": [
+                        "plan9/amd64",
+                        "plan9/386"
+                    ]
+                },
+                "created": "2024-06-18T22:10:48.091797Z",
+                "modified": "2024-06-18T22:10:48.091797Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default",
+                "custom": true,
+                "id": "b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "type": "pulumi:providers:docker-build",
+                "inputs": {
+                    "host": ""
+                },
+                "outputs": {
+                    "host": ""
+                },
+                "created": "2024-06-18T22:10:48.187658Z",
+                "modified": "2024-06-18T22:10:48.187658Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::secrets",
+                "custom": true,
+                "id": "secrets",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.secrets"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "secrets": {
+                        "password": "hunter2"
+                    },
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "5c1561571a60aa3b5a234a9c26f69e2ba5d9a18624f426109d36a1d729b23a21",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.secrets"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "secrets": {
+                        "password": "hunter2"
+                    },
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": [],
+                    "secrets": []
+                },
+                "created": "2024-06-18T22:10:50.181453Z",
+                "modified": "2024-06-18T22:10:50.181453Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::buildArgs",
+                "custom": true,
+                "id": "buildArgs",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildArgs": {
+                        "SET_ME_TO_TRUE": "true"
+                    },
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.buildArgs"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildArgs": {
+                        "SET_ME_TO_TRUE": "true"
+                    },
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "55695ddcfb4d08a0d78d1a74c7b0141dada73ed05bc4b056ba29a51e42c83381",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.buildArgs"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "buildArgs": [],
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.182348Z",
+                "modified": "2024-06-18T22:10:50.182348Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::sshMount",
+                "custom": true,
+                "id": "sshMount",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.sshMount"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ssh": [
+                        {
+                            "id": "default"
+                        }
+                    ],
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "71d21b382ab9ee0324ad820ce57a0a4318342a0a244931f51fc46b791f1b37e9",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.sshMount"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "ssh": [
+                        {
+                            "id": "default"
+                        }
+                    ],
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": [],
+                    "ssh": []
+                },
+                "created": "2024-06-18T22:10:50.182807Z",
+                "modified": "2024-06-18T22:10:50.182807Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::remoteContext",
+                "custom": true,
+                "id": "remoteContext",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
+                    },
+                    "contextHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.18341Z",
+                "modified": "2024-06-18T22:10:50.18341Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::registryPush",
+                "custom": true,
+                "id": "sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "exports": [
+                        {
+                            "disabled": false,
+                            "raw": "",
+                            "registry": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "danglingNamePrefix": "",
+                                "forceCompression": false,
+                                "ociMediaTypes": true,
+                                "push": false,
+                                "store": true
+                            }
+                        }
+                    ],
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "tags": [
+                        "docker.io/pulumibot/buildkit-e2e:example"
+                    ],
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
+                    "digest": "sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "exports": [
+                        {
+                            "disabled": false,
+                            "raw": "",
+                            "registry": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "danglingNamePrefix": "",
+                                "forceCompression": false,
+                                "ociMediaTypes": true,
+                                "push": false,
+                                "store": true
+                            }
+                        }
+                    ],
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "docker.io/pulumibot/buildkit-e2e:example@sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
+                    "tags": [
+                        "docker.io/pulumibot/buildkit-e2e:example"
+                    ],
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "exports": [],
+                    "push": [],
+                    "tags": []
+                },
+                "created": "2024-06-18T22:10:50.183668Z",
+                "modified": "2024-06-18T22:10:50.183668Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::dockerLoad",
+                "custom": true,
+                "id": "sha256:ec5d5c149823f61d56f5666d494d19c4edca42cfe4b578e640f57bf2429716a4",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "exports": [
+                        {
+                            "disabled": false,
+                            "docker": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "dest": "",
+                                "forceCompression": false,
+                                "ociMediaTypes": false,
+                                "tar": true
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
+                    "digest": "sha256:ec5d5c149823f61d56f5666d494d19c4edca42cfe4b578e640f57bf2429716a4",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "exports": [
+                        {
+                            "disabled": false,
+                            "docker": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "dest": "",
+                                "forceCompression": false,
+                                "ociMediaTypes": false,
+                                "tar": true
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "exports": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.183874Z",
+                "modified": "2024-06-18T22:10:50.183874Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::labels",
+                "custom": true,
+                "id": "labels",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "labels": {
+                        "description": "This image will get a descriptive label 👍"
+                    },
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "labels": {
+                        "description": "This image will get a descriptive label 👍"
+                    },
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "labels": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.183996Z",
+                "modified": "2024-06-18T22:10:50.183996Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::inline",
+                "custom": true,
+                "id": "inline",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "36c67969e6700e87bde75fcf604a7db1fa9593194718fc0ae1c498df43228aec",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.184088Z",
+                "modified": "2024-06-18T22:10:50.184088Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::target",
+                "custom": true,
+                "id": "target",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.target"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": "build-me"
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "fefadf795b6b4b119e97a87067a25f52a16cc3375223acad7b3f642fdcd413fc",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.target"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": "build-me"
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": [],
+                    "target": []
+                },
+                "created": "2024-06-18T22:10:50.18426Z",
+                "modified": "2024-06-18T22:10:50.18426Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::cached",
+                "custom": true,
+                "id": "cached",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "cacheFrom": [
+                        {
+                            "disabled": false,
+                            "local": {
+                                "digest": "",
+                                "src": "tmp/cache"
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "cacheTo": [
+                        {
+                            "disabled": false,
+                            "local": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "dest": "tmp/cache",
+                                "forceCompression": false,
+                                "ignoreError": false,
+                                "mode": "max"
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "cacheFrom": [
+                        {
+                            "disabled": false,
+                            "local": {
+                                "digest": "",
+                                "src": "tmp/cache"
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "cacheTo": [
+                        {
+                            "disabled": false,
+                            "local": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "dest": "tmp/cache",
+                                "forceCompression": false,
+                                "ignoreError": false,
+                                "mode": "max"
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "cacheFrom": [],
+                    "cacheTo": [],
+                    "context": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.206842Z",
+                "modified": "2024-06-18T22:10:50.206842Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::multiPlatform",
+                "custom": true,
+                "id": "multiPlatform",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.multiPlatform"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "platforms": [
+                        "plan9/amd64",
+                        "plan9/386"
+                    ],
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "c7ecf546ed2402de04f2dfa56ca4adb6fd490eed4219d7f1b2e559cd475f1755",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.multiPlatform"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "platforms": [
+                        "plan9/amd64",
+                        "plan9/386"
+                    ],
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "platforms": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.257528Z",
+                "modified": "2024-06-18T22:10:50.257528Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::extraHosts",
+                "custom": true,
+                "id": "extraHosts",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "addHosts": [
+                        "metadata.google.internal:169.254.169.254"
+                    ],
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.extraHosts"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "addHosts": [
+                        "metadata.google.internal:169.254.169.254"
+                    ],
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e5d510d9ce39d91260e3aa7f8c81d7517a76165eb35e7134cae2f3e4e9fcb712",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.extraHosts"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "addHosts": [],
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.274264Z",
+                "modified": "2024-06-18T22:10:50.274264Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::remoteContextWithInline",
+                "custom": true,
+                "id": "remoteContextWithInline",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "https://github.com/docker-library/hello-world.git"
+                    },
+                    "dockerfile": {
+                        "inline": "FROM busybox\nCOPY hello.c ./\n",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "https://github.com/docker-library/hello-world.git"
+                    },
+                    "contextHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "FROM busybox\nCOPY hello.c ./\n",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.332506Z",
+                "modified": "2024-06-18T22:10:50.332506Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::namedContexts",
+                "custom": true,
+                "id": "namedContexts",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app",
+                        "named": {
+                            "golang:latest": {
+                                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
+                            }
+                        }
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.namedContexts"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app",
+                        "named": {
+                            "golang:latest": {
+                                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
+                            }
+                        }
+                    },
+                    "contextHash": "3adfaaf17fbb548f06310e76d2826bccb223b49463504d0cc4fe86b0eef5d47d",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.namedContexts"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.422524Z",
+                "modified": "2024-06-18T22:10:50.422524Z"
+            }
+        ]
+    }
+}

examples/tests/caching/package.json

@@ -4,6 +4,6 @@
     "@types/node": "^20.0.0"
   },
   "dependencies": {
-    "@pulumi/pulumi": "3.244.0"
+    "@pulumi/pulumi": "^3.128.0"
   }
 }

examples/tests/config/Pulumi.yaml

@@ -1,3 +0,0 @@
-name: test-buildx-config
-runtime: nodejs
-description: A minimal TypeScript Pulumi program

examples/tests/config/index.ts

@@ -1,5 +0,0 @@
-import * as buildx from "@pulumi/docker-build";
-
-new buildx.Provider("with-structured-config", {
-  registries: [{ username: "foo", password: "bar", address: "docker.io" }],
-});

examples/tests/config/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "test-buildx-caching",
-  "devDependencies": {
-    "@types/node": "^20.0.0"
-  },
-  "dependencies": {
-    "@pulumi/pulumi": "3.244.0"
-  }
-}

examples/tests/ecr/Pulumi.yaml

@@ -38,5 +38,3 @@ variables:
   auth-token:
     fn::aws:ecr:getAuthorizationToken:
       registryId: ${ecr-repository.registryId}
-config:
-  aws:region: us-west-2

examples/upgrade-node/Pulumi.yaml

@@ -1,6 +0,0 @@
-name: provider-docker-build
-runtime: nodejs
-plugins:
-  providers:
-    - name: docker-build
-      path: ../../bin

examples/upgrade-node/index.ts

@@ -1,11 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as docker_build from "@pulumi/docker-build";
-
-const inline = new docker_build.Image("inline", {
-  push: false,
-  dockerfile: {
-    inline: `FROM alpine
-RUN echo "This uses an inline Dockerfile! 👍"
-`,
-  },
-});

examples/upgrade-node/package.json

@@ -1,10 +0,0 @@
-{
-  "name": "provider-docker-build",
-  "devDependencies": {
-    "@types/node": "^18"
-  },
-  "dependencies": {
-    "typescript": "^4.0.0",
-    "@pulumi/pulumi": "3.244.0"
-  }
-}

examples/upgrade-node/tsconfig.json

@@ -1,18 +0,0 @@
-{
-	"compilerOptions": {
-		"strict": true,
-		"outDir": "bin",
-		"target": "es2016",
-		"module": "commonjs",
-		"moduleResolution": "node",
-		"sourceMap": true,
-		"experimentalDecorators": true,
-		"pretty": true,
-		"noFallthroughCasesInSwitch": true,
-		"noImplicitReturns": true,
-		"forceConsistentCasingInFileNames": true
-	},
-	"files": [
-		"index.ts",
-	]
-}

examples/upgrade/Pulumi.yaml

@@ -1,5 +1,9 @@
 name: provider-docker-build
 runtime: yaml
+plugins:
+  providers:
+    - name: docker-build
+      path: ../../bin
 
 resources:
   # docker buildx build -f app/Dockerfile.multiPlatform --platform plan9/amd64,plan9/386 app

examples/yaml_test.go

@@ -1,24 +1,18 @@
-//go:build yaml || all
-// +build yaml all
+//go:build java || all
+// +build java all
 
 package examples
 
 import (
 	"os"
 	"path"
+	"path/filepath"
 	"testing"
 
-	"github.com/stretchr/testify/require"
-
 	"github.com/pulumi/providertest"
-	"github.com/pulumi/providertest/providers"
-	"github.com/pulumi/providertest/pulumitest"
-	"github.com/pulumi/providertest/pulumitest/assertpreview"
-	"github.com/pulumi/providertest/pulumitest/opttest"
-	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
-	pulumirpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
-
 	"github.com/pulumi/pulumi-docker-build/provider"
+	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
+	"github.com/stretchr/testify/require"
 )
 
 func TestYAMLExample(t *testing.T) {
@@ -35,30 +29,26 @@ func TestYAMLExample(t *testing.T) {
 	integration.ProgramTest(t, &test)
 }
 
-func TestHCLExample(t *testing.T) {
+func TestYAMLExampleUpgrade(t *testing.T) {
+	// t.Setenv("PULUMI_PROVIDER_TEST_MODE", "snapshot")
+
 	cwd, err := os.Getwd()
 	require.NoError(t, err)
 
-	test := integration.ProgramTestOptions{
-		Dir: path.Join(cwd, "hcl"),
-		Secrets: map[string]string{
-			"dockerHubPassword": os.Getenv("DOCKER_HUB_PASSWORD"),
-		},
-	}
+	bin, err := filepath.Abs("../bin")
+	require.NoError(t, err)
 
-	integration.ProgramTest(t, &test)
-}
+	t.Setenv("PATH", bin+":"+os.Getenv("PATH"))
+	p, err := provider.New(nil)
+	require.NoError(t, err)
 
-func TestYAMLExampleUpgrade(t *testing.T) {
-	pt := pulumitest.NewPulumiTest(t, "upgrade",
-		opttest.AttachProviderServer("docker-build", providerServerFactory))
-	previewResult := providertest.PreviewProviderUpgrade(t, pt, "docker-build", "0.0.1")
-
-	assertpreview.HasNoChanges(t, previewResult)
-}
-
-func providerServerFactory(pt providers.PulumiTest) (pulumirpc.ResourceProviderServer, error) {
-	return provider.New(nil)
+	test := providertest.NewProviderTest(path.Join(cwd, "upgrade"),
+		providertest.WithProviderName("docker-build"),
+		providertest.WithBaselineVersion("0.0.1"),
+		providertest.WithResourceProviderServer(p),
+		// providertest.WithConfig("dockerHubPassword", os.Getenv("DOCKER_HUB_PASSWORD")), // Doesn't support secrets yet.
+	)
+	test.Run(t)
 }
 
 func TestECR(t *testing.T) {

go.mod

@@ -1,198 +1,183 @@
 module github.com/pulumi/pulumi-docker-build
 
-go 1.25.8
+go 1.21.7
 
 require (
-	github.com/aws/aws-sdk-go v1.55.5
+	github.com/aws/aws-sdk-go v1.54.18
 	github.com/blang/semver v3.5.1+incompatible
-	github.com/containerd/errdefs v1.0.0
 	github.com/distribution/reference v0.6.0
-	github.com/docker/buildx v0.22.0
-	github.com/docker/cli v29.2.1+incompatible
-	github.com/docker/docker v28.0.1+incompatible
-	github.com/moby/buildkit v0.28.1
-	github.com/moby/patternmatcher v0.6.1
+	github.com/docker/buildx v0.16.0
+	github.com/docker/cli v27.0.3+incompatible
+	github.com/docker/docker v27.1.1+incompatible
+	github.com/moby/buildkit v0.15.0
+	github.com/moby/patternmatcher v0.6.0
 	github.com/muesli/reflow v0.3.0
 	github.com/otiai10/copy v1.14.0
-	github.com/pulumi/providertest v0.7.0
-	github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.106.2
-	github.com/pulumi/pulumi-go-provider v1.3.2
-	github.com/pulumi/pulumi-java v1.28.0
-	github.com/pulumi/pulumi/pkg/v3 v3.243.0
-	github.com/pulumi/pulumi/sdk/v3 v3.243.0
+	github.com/pulumi/providertest v0.0.13
+	github.com/pulumi/pulumi-go-provider v0.21.0
+	github.com/pulumi/pulumi-java/pkg v0.13.0
+	github.com/pulumi/pulumi/pkg/v3 v3.128.0
+	github.com/pulumi/pulumi/sdk/v3 v3.128.0
 	github.com/regclient/regclient v0.7.1
-	github.com/sirupsen/logrus v1.9.4
-	github.com/spf13/afero v1.14.0
-	github.com/stretchr/testify v1.11.1
-	github.com/tonistiigi/fsutil v0.0.0-20251211185533-a2aa163d723f
-	github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0
-	go.opentelemetry.io/otel/metric v1.43.0
-	go.opentelemetry.io/otel/sdk v1.43.0
-	go.opentelemetry.io/otel/trace v1.43.0
-	go.uber.org/mock v0.6.0
-	golang.org/x/crypto v0.51.0
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
-	google.golang.org/protobuf v1.36.11
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/afero v1.11.0
+	github.com/stretchr/testify v1.9.0
+	github.com/theupdateframework/notary v0.7.0
+	github.com/tonistiigi/fsutil v0.0.0-20240424095704-91a3fc46842c
+	go.uber.org/mock v0.4.0
+	golang.org/x/crypto v0.25.0
+	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8
+	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	cloud.google.com/go v0.112.1 // indirect
-	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	cloud.google.com/go/compute v1.25.1 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	cloud.google.com/go/iam v1.1.6 // indirect
 	cloud.google.com/go/kms v1.15.7 // indirect
 	cloud.google.com/go/logging v1.9.0 // indirect
 	cloud.google.com/go/longrunning v0.5.5 // indirect
 	cloud.google.com/go/storage v1.39.1 // indirect
-	dario.cat/mergo v1.0.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect
+	dario.cat/mergo v1.0.0 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
-	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.3.0 // indirect
+	github.com/ProtonMail/go-crypto v1.0.0 // indirect
+	github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
-	github.com/apparentlymart/go-cidr v1.0.1 // indirect
+	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.32.7 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.7 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.17 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.26.1 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.11 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/kms v1.30.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.0.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.30.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.41.6 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 // indirect
+	github.com/aws/smithy-go v1.20.2 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
-	github.com/bazelbuild/buildtools v0.0.0-20260211083412-859bfffeef82 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
-	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/bubbles v1.0.0 // indirect
-	github.com/charmbracelet/bubbletea v1.3.10 // indirect
-	github.com/charmbracelet/colorprofile v0.4.3 // indirect
-	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.11.7 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.15 // indirect
-	github.com/charmbracelet/x/term v0.2.2 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/charmbracelet/bubbles v0.18.0 // indirect
+	github.com/charmbracelet/bubbletea v0.26.4 // indirect
+	github.com/charmbracelet/lipgloss v0.11.0 // indirect
+	github.com/charmbracelet/x/ansi v0.1.2 // indirect
+	github.com/charmbracelet/x/input v0.1.0 // indirect
+	github.com/charmbracelet/x/term v0.1.1 // indirect
+	github.com/charmbracelet/x/windows v0.1.0 // indirect
 	github.com/cheggaaa/pb v1.0.29 // indirect
-	github.com/clipperhouse/displaywidth v0.11.0 // indirect
-	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
-	github.com/cloudflare/circl v1.6.3 // indirect
-	github.com/compose-spec/compose-go/v2 v2.4.8 // indirect
-	github.com/containerd/console v1.0.5 // indirect
-	github.com/containerd/containerd/api v1.10.0 // indirect
-	github.com/containerd/containerd/v2 v2.2.1 // indirect
-	github.com/containerd/continuity v0.4.5 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/cloudflare/circl v1.3.8 // indirect
+	github.com/compose-spec/compose-go/v2 v2.1.3 // indirect
+	github.com/containerd/console v1.0.4 // indirect
+	github.com/containerd/containerd v1.7.19 // indirect
+	github.com/containerd/containerd/api v1.7.19 // indirect
+	github.com/containerd/continuity v0.4.3 // indirect
+	github.com/containerd/errdefs v0.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v1.0.0-rc.2 // indirect
-	github.com/containerd/ttrpc v1.2.7 // indirect
-	github.com/containerd/typeurl/v2 v2.2.3 // indirect
-	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/containerd/ttrpc v1.2.5 // indirect
+	github.com/containerd/typeurl/v2 v2.1.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.5 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/deckarep/golang-set/v2 v2.5.0 // indirect
 	github.com/djherbis/times v1.6.0 // indirect
-	github.com/docker/cli-docs-tool v0.9.0 // indirect
-	github.com/docker/docker-credential-helpers v0.9.5 // indirect
-	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/docker/cli-docs-tool v0.8.0 // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
-	github.com/edsrzf/mmap-go v1.2.0 // indirect
-	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
+	github.com/edsrzf/mmap-go v1.1.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
+	github.com/fatih/color v1.17.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fvbommel/sortorder v1.0.1 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
-	github.com/git-pkgs/manifests v0.4.1 // indirect
-	github.com/git-pkgs/packageurl-go v0.3.1 // indirect
-	github.com/git-pkgs/purl v0.1.10 // indirect
-	github.com/git-pkgs/vers v0.2.4 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.9.0 // indirect
-	github.com/go-git/go-git/v5 v5.19.1 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-git/go-billy/v5 v5.5.0 // indirect
+	github.com/go-git/go-git/v5 v5.12.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.22.4 // indirect
-	github.com/go-openapi/jsonreference v0.21.4 // indirect
-	github.com/go-openapi/swag v0.25.4 // indirect
-	github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
-	github.com/go-openapi/swag/conv v0.25.4 // indirect
-	github.com/go-openapi/swag/fileutils v0.25.4 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
-	github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
-	github.com/go-openapi/swag/loading v0.25.4 // indirect
-	github.com/go-openapi/swag/mangling v0.25.4 // indirect
-	github.com/go-openapi/swag/netutils v0.25.4 // indirect
-	github.com/go-openapi/swag/stringutils v0.25.4 // indirect
-	github.com/go-openapi/swag/typeutils v0.25.4 // indirect
-	github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
-	github.com/go-test/deep v1.1.1 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
-	github.com/gofrs/flock v0.13.0 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
+	github.com/gofrs/flock v0.12.0 // indirect
 	github.com/gofrs/uuid v4.2.0+incompatible // indirect
+	github.com/gogo/googleapis v1.4.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.0 // indirect
-	github.com/golang/glog v1.2.5 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
+	github.com/golang/glog v1.2.1 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/google/wire v0.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.2 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/gorilla/mux v1.8.0 // indirect
+	github.com/gorilla/websocket v1.5.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-cty-funcs v0.0.0-20241120183456-c51673e0b3dd // indirect
+	github.com/hashicorp/go-cty-funcs v0.0.0-20230405223818-a090f58aa992 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.6 // indirect
-	github.com/hashicorp/go-version v1.9.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.20.1 // indirect
 	github.com/hashicorp/vault/api v1.12.0 // indirect
-	github.com/iancoleman/strcase v0.3.0 // indirect
-	github.com/in-toto/attestation v1.1.2 // indirect
-	github.com/in-toto/in-toto-golang v0.11.0 // indirect
+	github.com/iancoleman/strcase v0.2.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/in-toto/in-toto-golang v0.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/iwdgo/sigintwindows v0.2.2 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.18.4 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/klauspost/compress v1.17.9 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
-	github.com/mattn/go-isatty v0.0.22 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.23 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
@@ -202,126 +187,124 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/moby/api v1.54.2 // indirect
-	github.com/moby/moby/client v0.4.1 // indirect
-	github.com/moby/spdystream v0.5.1 // indirect
-	github.com/moby/sys/atomicwriter v0.1.0 // indirect
-	github.com/moby/sys/mountinfo v0.7.2 // indirect
-	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/moby/sys/signal v0.7.1 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
-	github.com/moby/term v0.5.2 // indirect
+	github.com/moby/spdystream v0.2.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.1 // indirect
+	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/sys/signal v0.7.0 // indirect
+	github.com/moby/sys/user v0.1.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/morikuni/aec v1.1.0 // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/muesli/termenv v0.15.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/natefinch/atomic v1.0.1 // indirect
 	github.com/nxadm/tail v1.4.11 // indirect
+	github.com/onsi/ginkgo/v2 v2.17.3 // indirect
+	github.com/onsi/gomega v1.33.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/opentracing/basictracer-go v1.1.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
 	github.com/pgavlin/fx v0.1.6 // indirect
-	github.com/pgavlin/fx/v2 v2.0.12 // indirect
 	github.com/pgavlin/goldmark v1.1.33-0.20200616210433-b5eb04559386 // indirect
-	github.com/pjbgf/sha1cd v0.6.0 // indirect
+	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
-	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.17.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.44.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.24.0 // indirect
-	github.com/pulumi/inflector v0.2.1 // indirect
+	github.com/pulumi/esc v0.9.1 // indirect
+	github.com/pulumi/inflector v0.1.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect
-	github.com/segmentio/asm v1.2.0 // indirect
-	github.com/segmentio/encoding v0.4.1 // indirect
-	github.com/sergi/go-diff v1.4.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
+	github.com/segmentio/asm v1.1.3 // indirect
+	github.com/segmentio/encoding v0.3.5 // indirect
+	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
-	github.com/sigstore/sigstore v1.10.4 // indirect
-	github.com/sigstore/sigstore-go v1.1.4 // indirect
-	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/skeema/knownhosts v1.2.2 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
-	github.com/spf13/cobra v1.10.2 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/cobra v1.8.1 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/viper v1.12.0 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/texttheater/golang-levenshtein v1.0.1 // indirect
-	github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
-	github.com/tonistiigi/jaeger-ui-rest v0.0.0-20250211190051-7d4944a45bb6 // indirect
+	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 // indirect
 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
+	github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 // indirect
 	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
 	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zclconf/go-cty v1.17.0 // indirect
+	github.com/zclconf/go-cty v1.14.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/collector/featuregate v1.58.0 // indirect
-	go.opentelemetry.io/collector/pdata v1.58.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
-	go.opentelemetry.io/otel v1.43.0 // indirect
-	go.opentelemetry.io/otel/bridge/opentracing v1.33.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.38.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
+	go.opentelemetry.io/otel v1.24.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric v0.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.24.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.22.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.24.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	gocloud.dev v0.37.0 // indirect
 	gocloud.dev/secrets/hashivault v0.37.0 // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/mod v0.18.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/oauth2 v0.18.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.24.0 // indirect
+	golang.org/x/term v0.22.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/tools v0.22.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/api v0.169.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20240311173647-c811ad7063a7 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9 // indirect
-	google.golang.org/grpc v1.81.1 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 // indirect
+	google.golang.org/grpc v1.64.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	k8s.io/api v0.34.1 // indirect
-	k8s.io/apimachinery v0.34.1 // indirect
-	k8s.io/client-go v0.34.1 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
-	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
-	lukechampine.com/frand v1.5.1 // indirect
-	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	k8s.io/api v0.29.2 // indirect
+	k8s.io/apimachinery v0.29.2 // indirect
+	k8s.io/client-go v0.29.2 // indirect
+	k8s.io/klog/v2 v2.110.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
+	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	lukechampine.com/frand v1.4.2 // indirect
+	mvdan.cc/gofumpt v0.6.0 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )

provider/cmd/pulumi-resource-docker-build/main.go

@@ -16,9 +16,8 @@
 package main
 
 import (
-	"github.com/pulumi/pulumi/sdk/v3/go/common/util/cmdutil"
-
 	"github.com/pulumi/pulumi-docker-build/provider"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/util/cmdutil"
 )
 
 func main() {

provider/internal/cache.go

@@ -17,7 +17,6 @@ package internal
 import (
 	"errors"
 	"fmt"
-	"os"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
@@ -149,20 +148,33 @@ func (c CacheWithOCI) String() string {
 
 // CacheFromGitHubActions pulls cache manifests from the GitHub actions cache.
 type CacheFromGitHubActions struct {
+	URL   string `pulumi:"url,optional"`
+	Token string `pulumi:"token,optional" provider:"secret"`
 	Scope string `pulumi:"scope,optional"`
 }
 
 // Annotate sets docstrings on CacheFromGitHubActions.
 func (c *CacheFromGitHubActions) Annotate(a infer.Annotator) {
-	a.Describe(&c, dedent(`
-		Recommended for use with GitHub Actions workflows.
+	a.SetDefault(&c.URL, "", "ACTIONS_CACHE_URL")
+	a.SetDefault(&c.Token, "", "ACTIONS_RUNTIME_TOKEN")
+	a.SetDefault(&c.Scope, "", "buildkit")
 
-		An action like "crazy-max/ghaction-github-runtime" is recommended to expose
-		appropriate credentials to your GitHub workflow.
+	a.Describe(&c.URL, dedent(`
+		The cache server URL to use for artifacts.
+
+		Defaults to "$ACTIONS_CACHE_URL", although a separate action like
+		"crazy-max/ghaction-github-runtime" is recommended to expose this
+		environment variable to your jobs.
 	`))
+	a.Describe(&c.Token, dedent(`
+		The GitHub Actions token to use. This is not a personal access tokens
+		and is typically generated automatically as part of each job.
 
-	a.SetDefault(&c.Scope, "buildkit")
+		Defaults to "$ACTIONS_RUNTIME_TOKEN", although a separate action like
+		"crazy-max/ghaction-github-runtime" is recommended to expose this
+		environment variable to your jobs.
 
+	`))
 	a.Describe(&c.Scope, dedent(`
 		The scope to use for cache keys. Defaults to "buildkit".
 
@@ -179,12 +191,11 @@ func (c *CacheFromGitHubActions) String() string {
 	if c.Scope != "" {
 		parts = append(parts, "scope="+c.Scope)
 	}
-	// Preserving backwards compatibility with the old behaviour.
-	if token := os.Getenv("ACTIONS_RUNTIME_TOKEN"); token != "" {
-		parts = append(parts, "token="+token)
+	if c.Token != "" {
+		parts = append(parts, "token="+c.Token)
 	}
-	if url := os.Getenv("ACTIONS_CACHE_URL"); url != "" {
-		parts = append(parts, "url="+url)
+	if c.URL != "" {
+		parts = append(parts, "url="+c.URL)
 	}
 	return strings.Join(parts, ",")
 }
@@ -448,7 +459,7 @@ func (c CacheFrom) String() string {
 	return join(c.Local, c.Registry, c.GHA, c.AZBlob, c.S3, c.Raw)
 }
 
-func (c CacheFrom) validate(_ bool) (*controllerapi.CacheOptionsEntry, error) {
+func (c CacheFrom) validate(preview bool) (*controllerapi.CacheOptionsEntry, error) {
 	if strings.Count(c.String(), "type=") > 1 {
 		return nil, errors.New("cacheFrom should only specify one cache type")
 	}
@@ -457,27 +468,12 @@ func (c CacheFrom) validate(_ bool) (*controllerapi.CacheOptionsEntry, error) {
 		return nil, err
 	}
 	if len(parsed) == 0 {
-		// This can happen for example if we have a GHA cache configuration but no GitHub
-		// environment variables set. Ignore the cacheFrom entry in this case.
+		// This can happen for example if we have a GHA cache but no GitHub
+		// environment variables set.
+		// Shouldn't happen...
 		return nil, nil
 	}
-
-	pb := parsed[0].ToPB()
-	if !isActive(pb) {
-		pb = nil
-	}
-
-	return pb, nil
-}
-
-// isActive checks if the GitHub token is set in the cache entry.
-// If it is not a GHA cache entry, it will return true.
-// This is to maintain backwards compatibility with the old buildx behaviour.
-func isActive(ci *controllerapi.CacheOptionsEntry) bool {
-	if ci.Type != "gha" {
-		return true
-	}
-	return ci.Attrs["token"] != "" && (ci.Attrs["url"] != "" || ci.Attrs["url_v2"] != "")
+	return parsed[0], nil
 }
 
 // CacheToInline embeds cache information directly into an image.
@@ -672,7 +668,7 @@ func (c CacheTo) String() string {
 	return join(c.Inline, c.Local, c.Registry, c.GHA, c.AZBlob, c.S3, c.Raw)
 }
 
-func (c CacheTo) validate(_ bool) (*controllerapi.CacheOptionsEntry, error) {
+func (c CacheTo) validate(preview bool) (*controllerapi.CacheOptionsEntry, error) {
 	if strings.Count(c.String(), "type=") > 1 {
 		return nil, errors.New("cacheTo should only specify one cache type")
 	}
@@ -681,27 +677,20 @@ func (c CacheTo) validate(_ bool) (*controllerapi.CacheOptionsEntry, error) {
 		return nil, err
 	}
 	if len(parsed) == 0 {
-		// This can happen for example if we have a GHA cache configuration but no GitHub
-		// environment variables set. Ignore the cacheTo entry in this case.
+		// This can happen for example if we have a GHA cache but no GitHub
+		// environment variables set.
+		// Shouldn't happen...
 		return nil, nil
 	}
-
-	pb := parsed[0].ToPB()
-	if !isActive(pb) {
-		pb = nil
-	}
-
-	return pb, nil
+	return parsed[0], nil
 }
 
 // CacheMode controls the complexity of exported cache manifests.
 type CacheMode string
 
 const (
-	// Min cache mode.
-	Min CacheMode = "min"
-	// Max cache mode.
-	Max CacheMode = "max"
+	Min CacheMode = "min" // Min cache mode.
+	Max CacheMode = "max" // Max cache mode.
 )
 
 // Values returns all valid CacheMode values for SDK generation.
@@ -722,12 +711,9 @@ func (CacheMode) Values() []infer.EnumValue[CacheMode] {
 type CompressionType string
 
 const (
-	// Gzip compression.
-	Gzip CompressionType = "gzip"
-	// Estargz compression.
-	Estargz CompressionType = "estargz"
-	// Zstd compression.
-	Zstd CompressionType = "zstd"
+	Gzip    CompressionType = "gzip"    // Gzip compression.
+	Estargz CompressionType = "estargz" // Estargz compression.
+	Zstd    CompressionType = "zstd"    // Zstd compression.
 )
 
 // Values returns all valid CompressionType values for SDK generation.

provider/internal/cache_test.go

@@ -24,15 +24,14 @@ import (
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )
 
-//nolint:paralleltest // We don't call t.Parallel here to prevent environment corruption.
 func TestCacheString(t *testing.T) {
+	t.Parallel()
 	gzip := Gzip
 
 	tests := []struct {
-		name    string
-		arrange func(t *testing.T)
-		given   fmt.Stringer
-		want    string
+		name  string
+		given fmt.Stringer
+		want  string
 	}{
 		{
 			name: "s3",
@@ -56,37 +55,7 @@ func TestCacheString(t *testing.T) {
 		{
 			name:  "gha",
 			given: CacheTo{GHA: &CacheToGitHubActions{}},
-			arrange: func(t *testing.T) {
-				t.Setenv("ACTIONS_CACHE_URL", "")
-				t.Setenv("ACTIONS_RUNTIME_TOKEN", "")
-			},
-			want: "type=gha",
-		},
-		{
-			name: "gha-default-envs",
-			arrange: func(t *testing.T) {
-				t.Setenv("ACTIONS_CACHE_URL", "https://example.com")
-				t.Setenv("ACTIONS_RUNTIME_TOKEN", "token")
-			},
-			given: CacheTo{GHA: &CacheToGitHubActions{
-				CacheFromGitHubActions: CacheFromGitHubActions{
-					Scope: "scope",
-				},
-			}},
-			want: "type=gha,scope=scope,token=token,url=https://example.com",
-		},
-		{
-			name: "gha-with-scope",
-			arrange: func(t *testing.T) {
-				t.Setenv("ACTIONS_CACHE_URL", "")
-				t.Setenv("ACTIONS_RUNTIME_TOKEN", "")
-			},
-			given: CacheTo{GHA: &CacheToGitHubActions{
-				CacheFromGitHubActions: CacheFromGitHubActions{
-					Scope: "scope",
-				},
-			}},
-			want: "type=gha,scope=scope",
+			want:  "type=gha",
 		},
 		{
 			name:  "from-local",
@@ -152,12 +121,10 @@ func TestCacheString(t *testing.T) {
 		},
 	}
 
-	//nolint:paralleltest // We don't call t.Parallel here to prevent environment corruption.
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			if tt.arrange != nil {
-				tt.arrange(t)
-			}
+			t.Parallel()
 
 			actual := tt.given.String()
 			assert.Equal(t, tt.want, actual)

provider/internal/cli.go

@@ -25,7 +25,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 
@@ -57,11 +56,11 @@ type cli struct {
 	auths map[string]cfgtypes.AuthConfig
 	host  *host
 
-	in       string       // stdin
-	r, w     *os.File     // stdout
-	err      bytes.Buffer // stderr
-	dumplogs bool         // if true then tail() will re-log status messages
-	builder  Builder      // for mocking build daemon responses
+	in       string        // stdin
+	r, w     *os.File      // stdout
+	err      bytes.Buffer  // stderr
+	dumplogs bool          // if true then tail() will re-log status messages
+	done     chan struct{} // signaled when all logs have been forwarded to the engine.
 }
 
 // Cli wraps the Docker interface for mock generation.
@@ -120,12 +119,11 @@ func wrap(host *host, registries ...Registry) (*cli, error) {
 	}
 
 	wrapped := &cli{
-		Cli:     docker,
-		host:    host,
-		auths:   auths,
-		r:       r,
-		w:       w,
-		builder: defaultBuilder{},
+		Cli:   docker,
+		host:  host,
+		auths: auths,
+		r:     r,
+		w:     w,
 	}
 
 	return wrapped, nil
@@ -143,10 +141,6 @@ func (c *cli) Err() *streams.Out {
 	return streams.NewOut(&c.err)
 }
 
-func (c *cli) SupportsMultipleExports() bool {
-	return c.host.supportsMultipleExports
-}
-
 // rc returns a registry client with matching auth.
 func (c *cli) rc() *regclient.RegClient {
 	hosts := []config.Host{}
@@ -164,6 +158,14 @@ func (c *cli) rc() *regclient.RegClient {
 // tail is meant to be called as a goroutine and will pipe output from the CLI
 // back to the Pulumi engine. Requires a corresponding call to close.
 func (c *cli) tail(ctx context.Context) {
+	c.done = make(chan struct{}, 1)
+	defer func() {
+		c.done <- struct{}{}
+		if err := recover(); err != nil {
+			fmt.Fprintf(os.Stderr, "recovered: %s\n", err)
+		}
+	}()
+
 	b := bytes.Buffer{}
 
 	s := bufio.NewScanner(c.r)
@@ -187,13 +189,17 @@ func (c *cli) tail(ctx context.Context) {
 
 // close flushes any outstanding logs and cleans up resources.
 func (c *cli) Close() error {
-	return errors.Join(c.w.Close(), c.r.Close())
+	err := errors.Join(c.w.Close(), c.r.Close())
+	if c.done != nil {
+		<-c.done
+	}
+	return err
 }
 
 // execBuild performs a build by os.Exec'ing the docker-buildx binary.
 // Credentials are communicated to docker-buildx via a temporary directory.
 // Secrets are communicated via dynamic environment variables.
-func (c *cli) execBuild(ctx context.Context, b Build) (*client.SolveResponse, error) {
+func (c *cli) execBuild(b Build) (*client.SolveResponse, error) {
 	// Setup a temporary directory for auth, and clean it up when we're done.
 	tmp, err := os.MkdirTemp("", "pulumi-docker-")
 	if err != nil {
@@ -203,7 +209,7 @@ func (c *cli) execBuild(ctx context.Context, b Build) (*client.SolveResponse, er
 
 	opts := b.BuildOptions()
 
-	builder, err := c.host.builderFor(ctx, b)
+	builder, err := c.host.builderFor(b)
 	if err != nil {
 		return nil, err
 	}
@@ -323,13 +329,13 @@ func (c *cli) execBuild(ctx context.Context, b Build) (*client.SolveResponse, er
 			return nil, err
 		}
 		// We abuse the pb.Secret proto by stuffing the secret's value in
-		// Env. We never serialize this proto so this is tolerable.
-		env = append(env, fmt.Sprintf("%s=%s", envvar, s.Env))
+		// XXX_unrecognized. We never serialize this proto so this is tolerable.
+		env = append(env, fmt.Sprintf("%s=%s", envvar, s.XXX_unrecognized))
 		args = append(args, "--secret", fmt.Sprintf("id=%s,env=%s", s.ID, envvar))
 	}
 
 	// Invoke docker-buildx.
-	err = c.exec(ctx, args, env)
+	err = c.exec(args, env)
 	if err != nil {
 		return nil, err
 	}
@@ -368,7 +374,7 @@ func (c *cli) execBuild(ctx context.Context, b Build) (*client.SolveResponse, er
 
 // exec invokes a Docker plugin binary. The first argument should be the name
 // of the plugin's subcommand, e.g. "buildx".
-func (c *cli) exec(ctx context.Context, args, extraEnv []string) error {
+func (c *cli) exec(args, extraEnv []string) error {
 	if len(args) == 0 {
 		return errors.New("args must be non-empty")
 	}
@@ -385,18 +391,16 @@ func (c *cli) exec(ctx context.Context, args, extraEnv []string) error {
 
 	defer contract.IgnoreClose(c.w)
 
-	runCmd, err := manager.PluginRunCommand(c, name, root)
+	cmd, err := manager.PluginRunCommand(c, name, root)
 	if err != nil {
 		return err
 	}
-	// Create a new command that inherits from ctx.
-	cmd := exec.CommandContext(ctx, //nolint:gosec // We take the first argument and binary from runCmd.
-		runCmd.Path, append([]string{runCmd.Args[1]}, args...)...,
-	)
+	cmd.Args = append([]string{cmd.Args[0]}, args...)
 	cmd.Stderr = c.Err()
 	cmd.Stdout = c.Out()
 	cmd.Stdin = c.In()
-	cmd.Env = append(runCmd.Env, extraEnv...) //nolint:gocritic // We are intentionally assigning from runCmd to cmd
+
+	cmd.Env = append(cmd.Env, extraEnv...)
 
 	return cmd.Run()
 }

provider/internal/cli_test.go

@@ -15,7 +15,6 @@
 package internal
 
 import (
-	"context"
 	"io"
 	"testing"
 
@@ -28,12 +27,12 @@ import (
 func TestExec(t *testing.T) {
 	t.Parallel()
 
-	h, err := newHost(t.Context(), nil)
+	h, err := newHost(nil)
 	require.NoError(t, err)
 	cli, err := wrap(h)
 	require.NoError(t, err)
 
-	err = cli.exec(t.Context(), []string{"buildx", "version"}, nil)
+	err = cli.exec([]string{"buildx", "version"}, nil)
 	assert.NoError(t, err)
 
 	out, err := io.ReadAll(cli.r)
@@ -45,7 +44,7 @@ func TestWrappedAuth(t *testing.T) {
 	t.Parallel()
 	ecr := "https://1234.dkr.ecr.us-west-2.amazonaws.com"
 
-	realhost, err := newHost(context.Background(), nil)
+	realhost, err := newHost(nil)
 	require.NoError(t, err)
 
 	h := &host{
@@ -103,7 +102,7 @@ func TestWrappedAuth(t *testing.T) {
 	assert.Len(t, h.auths, 2) // In-memory host auth is unchanged.
 
 	// Assert that our on-disk host's auth is untouched.
-	realhostRefreshed, err := newHost(context.Background(), nil)
+	realhostRefreshed, err := newHost(nil)
 	require.NoError(t, err)
 	assert.Equal(t, realhost.auths, realhostRefreshed.auths)
 }

provider/internal/client.go

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-//go:generate go run go.uber.org/mock/mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal -imports buildx=github.com/docker/buildx/build
+//go:generate go run go.uber.org/mock/mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal
 
 package internal
 
@@ -22,15 +22,13 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
-	"github.com/containerd/errdefs"
 	"github.com/distribution/reference"
 	buildx "github.com/docker/buildx/build"
-	"github.com/docker/buildx/builder"
 	"github.com/docker/buildx/commands"
 	controllerapi "github.com/docker/buildx/controller/pb"
-	"github.com/docker/buildx/util/confutil"
 	"github.com/docker/buildx/util/dockerutil"
 	"github.com/docker/buildx/util/platformutil"
 	"github.com/docker/buildx/util/progress"
@@ -60,38 +58,6 @@ type Client interface {
 	ManifestCreate(ctx context.Context, push bool, target string, refs ...string) error
 	ManifestInspect(ctx context.Context, target string) (string, error)
 	ManifestDelete(ctx context.Context, target string) error
-
-	SupportsMultipleExports() bool
-}
-
-// registryGetter is something that can return a list of [Registry].
-type registryGetter interface {
-	GetRegistries() []Registry
-}
-
-// clientF builds a Docker client. The order of registryGetters is significant.
-// We typically prefer credentials from args, then provider config, then the
-// host. Provide them to this function in order of increasing priority: host,
-// config, args.
-//
-// We ignore state because if its creds differ from those in args then they are
-// likely volatile and also likely expired.
-type clientF func(context.Context, *host, ...registryGetter) (Client, error)
-
-// RealClientF builds a real Docker client with auth layered on top of the
-// host's latent credentials.
-func RealClientF(_ context.Context, host *host, getters ...registryGetter) (Client, error) {
-	auths := []Registry{}
-	for _, rg := range getters {
-		auths = append(auths, rg.GetRegistries()...)
-	}
-	return wrap(host, auths...)
-}
-
-func mockClientF(c Client) clientF {
-	return func(context.Context, *host, ...registryGetter) (Client, error) {
-		return c, nil
-	}
 }
 
 // Build encapsulates all of the user-provider build parameters and options.
@@ -122,6 +88,8 @@ func newDockerCLI(config *Config) (*command.DockerCli, error) {
 		return nil, err
 	}
 
+	// TODO: Log some version information for debugging.
+
 	return cli, nil
 }
 
@@ -138,10 +106,10 @@ func (c *cli) Build(
 	defer contract.IgnoreClose(c)
 
 	if build.ShouldExec() {
-		return c.execBuild(ctx, build)
+		return c.execBuild(build)
 	}
 
-	b, err := c.host.builderFor(ctx, build)
+	b, err := c.host.builderFor(build)
 	if err != nil {
 		return nil, err
 	}
@@ -155,15 +123,9 @@ func (c *cli) Build(
 	if err != nil {
 		return nil, fmt.Errorf("creating printer: %w", err)
 	}
-
 	defer func() {
-		// Wait for logs to flush if the build finished, but not if we're
-		// exiting early.
-		if ctx.Err() == nil {
-			_ = printer.Wait()
-		}
-
-		// Log any warnings we got, separated by newlines.
+		// Log any warnings when we're done.
+		_ = printer.Wait()
 		for _, w := range printer.Warnings() {
 			b := &bytes.Buffer{}
 			_, _ = b.Write(w.Short)
@@ -235,7 +197,7 @@ func (c *cli) Build(
 				DockerfilePath:   opts.DockerfileName,
 				DockerfileInline: build.Inline(),
 				NamedContexts:    namedContexts,
-				InStream:         buildx.NewSyncMultiReader(strings.NewReader("")),
+				InStream:         strings.NewReader(""),
 			},
 			// Disable default provenance for now. Docker's `manifest create`
 			// doesn't handle manifests with provenance included; more reason
@@ -256,46 +218,27 @@ func (c *cli) Build(
 
 			Session: []session.Attachable{
 				ssh,
-				authprovider.NewDockerAuthProvider(authprovider.DockerAuthProviderConfig{ConfigFile: c.ConfigFile()}),
+				authprovider.NewDockerAuthProvider(c.ConfigFile(), nil),
 				build.Secrets(),
 			},
 		},
 	}
 
-	resultC := make(chan map[string]*client.SolveResponse)
-	errC := make(chan error)
-
-	// buildx.Build doesn't handle context cancellation, so we monitor it in a
-	// goroutine. cli.Close cleans up our file descriptors, so if we do exit
-	// early the remote build should terminate as soon as it sees the pipe has
-	// broken.
-	go func() {
-		defer close(resultC)
-		defer close(errC)
-		results, err := c.builder.Build(
-			ctx,
-			b.nodes,
-			payload,
-			dockerutil.NewClient(c),
-			confutil.NewConfig(c),
-			printer,
-		)
-		if err != nil {
-			errC <- err
-			return
-		}
-		resultC <- results
-	}()
-
-	select {
-	case results := <-resultC:
-		return results[target], nil
-	case err := <-errC:
+	// Perform the build.
+	results, err := buildx.Build(
+		ctx,
+		b.nodes,
+		payload,
+		dockerutil.NewClient(c),
+		filepath.Dir(c.ConfigFile().Filename),
+		printer,
+	)
+	if err != nil {
 		c.dumplogs = true
 		return nil, err
-	case <-ctx.Done():
-		return nil, ctx.Err()
 	}
+
+	return results[target], err
 }
 
 // BuildKitEnabled returns true if the client supports buildkit.
@@ -340,9 +283,6 @@ func (c *cli) ManifestInspect(ctx context.Context, target string) (string, error
 	}
 
 	m, err := rc.ManifestHead(ctx, ref)
-	if errors.Is(err, errs.ErrNotFound) {
-		return "", fmt.Errorf("fetching %q: %w", ref, errdefs.ErrNotFound)
-	}
 	if err != nil {
 		return "", fmt.Errorf("fetching %q: %w", ref, err)
 	}
@@ -363,9 +303,6 @@ func (c *cli) ManifestDelete(ctx context.Context, target string) error {
 		provider.GetLogger(ctx).Warning("this registry does not support deletions")
 		return nil
 	}
-	if errors.Is(err, errs.ErrNotFound) {
-		return nil
-	}
 	if err != nil {
 		return err
 	}
@@ -417,31 +354,6 @@ func (c *cli) Delete(ctx context.Context, r string) error {
 	return nil
 }
 
-// Builder allows injecting mock responses from the build daemon.
-type Builder interface {
-	Build(
-		ctx context.Context,
-		nodes []builder.Node,
-		opts map[string]buildx.Options,
-		docker *dockerutil.Client,
-		cfg *confutil.Config,
-		w progress.Writer,
-	) (resp map[string]*client.SolveResponse, err error)
-}
-
-type defaultBuilder struct{}
-
-func (defaultBuilder) Build(
-	ctx context.Context,
-	nodes []builder.Node,
-	opts map[string]buildx.Options,
-	docker *dockerutil.Client,
-	cfg *confutil.Config,
-	w progress.Writer,
-) (resp map[string]*client.SolveResponse, err error) {
-	return buildx.Build(ctx, nodes, opts, docker, cfg, w)
-}
-
 func normalizeReference(ref string) (reference.Named, error) {
 	namedRef, err := reference.ParseNormalizedNamed(ref)
 	if err != nil {

provider/internal/client_test.go

@@ -17,23 +17,15 @@ package internal
 import (
 	"bytes"
 	"context"
-	"errors"
 	"io"
 	"log/slog"
 	"os"
 	"path/filepath"
 	"testing"
 
-	buildx "github.com/docker/buildx/build"
-	"github.com/docker/buildx/builder"
-	"github.com/docker/buildx/util/confutil"
-	"github.com/docker/buildx/util/dockerutil"
-	"github.com/docker/buildx/util/progress"
 	"github.com/docker/docker/api/types/registry"
-	"github.com/moby/buildkit/client"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
 )
 
 func TestAuth(t *testing.T) {
@@ -63,7 +55,7 @@ func TestCustomHost(t *testing.T) {
 	t.Run("env", func(t *testing.T) {
 		t.Setenv("DOCKER_HOST", socket)
 
-		h, err := newHost(context.Background(), nil)
+		h, err := newHost(nil)
 		require.NoError(t, err)
 		cli, err := wrap(h)
 		require.NoError(t, err)
@@ -74,7 +66,7 @@ func TestCustomHost(t *testing.T) {
 
 	t.Run("config", func(t *testing.T) {
 		t.Parallel()
-		h, err := newHost(context.Background(), &Config{Host: socket})
+		h, err := newHost(&Config{Host: socket})
 		require.NoError(t, err)
 		cli, err := wrap(h)
 		require.NoError(t, err)
@@ -271,6 +263,7 @@ func TestBuild(t *testing.T) {
 
 	// Add an exec: true version for all of our test cases.
 	for _, tt := range tests {
+		tt := tt
 		tt.name = "exec-" + tt.name
 		tt.args.Exec = true
 		tmpdir := filepath.Join(t.TempDir(), "exec")
@@ -288,6 +281,7 @@ func TestBuild(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			if tt.skip {
@@ -296,7 +290,7 @@ func TestBuild(t *testing.T) {
 			ctx := context.Background()
 			cli := testcli(t, true, tt.auths...)
 
-			build, err := tt.args.toBuild(ctx, true, false)
+			build, err := tt.args.toBuild(ctx, false)
 			require.NoError(t, err)
 
 			_, err = cli.Build(ctx, build)
@@ -347,6 +341,7 @@ func TestNormalizeReference(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.ref, func(t *testing.T) {
 			t.Parallel()
 			ref, err := normalizeReference(tt.ref)
@@ -388,7 +383,7 @@ func TestBuildError(t *testing.T) {
 	ctx := context.Background()
 	cli := testcli(t, true)
 
-	build, err := args.toBuild(ctx, true, false)
+	build, err := args.toBuild(ctx, false)
 	require.NoError(t, err)
 
 	_, err = cli.Build(ctx, build)
@@ -423,7 +418,7 @@ func TestBuildExecError(t *testing.T) {
 	ctx := context.Background()
 	cli := testcli(t, true)
 
-	build, err := args.toBuild(ctx, true, false)
+	build, err := args.toBuild(ctx, false)
 	require.NoError(t, err)
 
 	_, err = cli.Build(ctx, build)
@@ -440,39 +435,10 @@ func TestBuildExecError(t *testing.T) {
 	}
 }
 
-func TestBuildCancelation(t *testing.T) {
-	t.Parallel()
-	cli := testcli(t, true)
-
-	ctrl := gomock.NewController(t)
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	b := NewMockBuilder(ctrl)
-	b.EXPECT().Build(
-		gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(),
-	).DoAndReturn(func(
-		_ context.Context,
-		_ []builder.Node,
-		_ map[string]buildx.Options,
-		_ *dockerutil.Client,
-		_ *confutil.Config,
-		_ progress.Writer,
-	) (map[string]*client.SolveResponse, error) {
-		cancel()
-		return nil, errors.New("cancel wasn't respected")
-	})
-	cli.builder = b
-
-	resp, err := cli.Build(ctx, &build{})
-	assert.ErrorIs(t, err, context.Canceled)
-	assert.Nil(t, resp)
-}
-
 // testcli returns a new standalone CLI instance. Set ping to true if a live
 // daemon is required -- the test will be skipped if the daemon is not available.
 func testcli(t *testing.T, ping bool, auths ...Registry) *cli {
-	h, err := newHost(context.Background(), nil)
+	h, err := newHost(nil)
 	require.NoError(t, err)
 
 	cli, err := wrap(h, auths...)

provider/internal/context.go

@@ -170,7 +170,7 @@ func hashFile(
 	if fileMode.IsDir() {
 		return nil
 	}
-	if !fileMode.IsRegular() && fileMode.Type() != os.ModeSymlink {
+	if !(fileMode.IsRegular() || fileMode.Type() == os.ModeSymlink) {
 		return nil
 	}
 

provider/internal/context_test.go

@@ -99,6 +99,7 @@ func TestValidateContext(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -406,6 +407,7 @@ func TestDockerIgnore(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			fs := afero.NewMemMapFs()

provider/internal/dedent_test.go

@@ -41,6 +41,7 @@ can be accessed like environment variables inside the ` + "`RUN`\n" + `instructi
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			actual := dedent(tt.given)

provider/internal/deprecated/configencoding.go

@@ -0,0 +1,191 @@
+// Copyright 2024, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package deprecated
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
+)
+
+// ConfigEncoding handles unmarshaling legacy JSON provider config.
+type ConfigEncoding struct {
+	schema schema.ConfigSpec
+}
+
+// New constructs a new config encoder for the provided spec.
+func New(s schema.ConfigSpec) *ConfigEncoding {
+	return &ConfigEncoding{schema: s}
+}
+
+func (*ConfigEncoding) tryUnwrapSecret(encoded any) (any, bool) {
+	m, ok := encoded.(map[string]any)
+	if !ok {
+		return nil, false
+	}
+	sig, ok := m["4dabf18193072939515e22adb298388d"]
+	if !ok {
+		return nil, false
+	}
+	ss, ok := sig.(string)
+	if !ok {
+		return nil, false
+	}
+	if ss != "1b47061264138c4ac30d75fd1eb44270" {
+		return nil, false
+	}
+	value, ok := m["value"]
+	return value, ok
+}
+
+func (enc *ConfigEncoding) convertStringToPropertyValue(s string, prop schema.PropertySpec) (
+	resource.PropertyValue, error,
+) {
+	// If the schema expects a string, we can just return this as-is.
+	if prop.Type == "string" {
+		return resource.NewStringProperty(s), nil
+	}
+
+	// Otherwise, we will attempt to deserialize the input string as JSON and convert the result into a Pulumi
+	// property. If the input string is empty, we will return an appropriate zero value.
+	if s == "" {
+		return enc.zeroValue(prop.Type), nil
+	}
+
+	var jsonValue interface{}
+	if err := json.Unmarshal([]byte(s), &jsonValue); err != nil {
+		return resource.PropertyValue{}, err
+	}
+
+	opts := enc.unmarshalOpts()
+
+	// Instead of using resource.NewPropertyValue, specialize it to detect nested json-encoded secrets.
+	var replv func(encoded any) (resource.PropertyValue, bool)
+	replv = func(encoded any) (resource.PropertyValue, bool) {
+		encodedSecret, isSecret := enc.tryUnwrapSecret(encoded)
+		if !isSecret {
+			return resource.NewNullProperty(), false
+		}
+
+		v := resource.NewPropertyValueRepl(encodedSecret, nil, replv)
+		if opts.KeepSecrets {
+			v = resource.MakeSecret(v)
+		}
+
+		return v, true
+	}
+
+	return resource.NewPropertyValueRepl(jsonValue, nil, replv), nil
+}
+
+func (*ConfigEncoding) zeroValue(typ string) resource.PropertyValue {
+	switch typ {
+	case "boolean":
+		return resource.NewPropertyValue(false)
+	case "integer", "number":
+		return resource.NewPropertyValue(0)
+	case "array":
+		return resource.NewPropertyValue([]interface{}{})
+	default:
+		return resource.NewPropertyValue(map[string]interface{}{})
+	}
+}
+
+func (enc *ConfigEncoding) unmarshalOpts() plugin.MarshalOptions {
+	return plugin.MarshalOptions{
+		Label:        "config",
+		KeepUnknowns: true,
+		KeepSecrets:  true,
+		SkipNulls:    true,
+		RejectAssets: true,
+	}
+}
+
+// Like plugin.UnmarshalPropertyValue but overrides string parsing with convertStringToPropertyValue.
+func (enc *ConfigEncoding) unmarshalPropertyValue(key resource.PropertyKey,
+	pv resource.PropertyValue,
+) (resource.PropertyValue, error) {
+	opts := enc.unmarshalOpts()
+
+	prop, ok := enc.schema.Variables[string(key)]
+
+	// Only apply JSON-encoded recognition for known fields.
+	if !ok {
+		return pv, nil
+	}
+
+	var (
+		jsonString                           string
+		jsonStringDetected, jsonStringSecret bool
+	)
+
+	if pv.IsString() {
+		jsonString = pv.StringValue()
+		jsonStringDetected = true
+	}
+
+	if opts.KeepSecrets && pv.IsSecret() && pv.SecretValue().Element.IsString() {
+		jsonString = pv.SecretValue().Element.StringValue()
+		jsonStringDetected = true
+		jsonStringSecret = true
+	}
+
+	if jsonStringDetected {
+		v, err := enc.convertStringToPropertyValue(jsonString, prop)
+		if err != nil {
+			return resource.PropertyValue{}, fmt.Errorf("error unmarshalling property %q: %w", key, err)
+		}
+		if jsonStringSecret {
+			return resource.MakeSecret(v), nil
+		}
+		return v, nil
+	}
+
+	// Computed sentinels are coming in as always having an empty string, but the encoding coerces them to a zero
+	// value of the appropriate type.
+	if pv.IsComputed() {
+		el := pv.V.(resource.Computed).Element
+		if el.IsString() && el.StringValue() == "" {
+			res := resource.MakeComputed(enc.zeroValue(prop.Type))
+			return res, nil
+		}
+	}
+
+	return pv, nil
+}
+
+// UnmarshalProperties is copied from plugin.UnmarshalProperties substituting plugin.UnmarshalPropertyValue.
+func (enc *ConfigEncoding) UnmarshalProperties(
+	props resource.PropertyMap,
+) (resource.PropertyMap, error) {
+	result := make(resource.PropertyMap)
+
+	// First sort the keys so we enumerate them in order (in case errors happen, we want determinism).
+	keys := props.StableKeys()
+
+	// And now unmarshal every field it into the map.
+	for _, key := range keys {
+		v, err := enc.unmarshalPropertyValue(key, props[key])
+		if err != nil {
+			return resource.PropertyMap{}, err
+		}
+		result[key] = v
+	}
+
+	return result, nil
+}

provider/internal/deprecated/configencoding_test.go

@@ -0,0 +1,274 @@
+// Copyright 2024, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package deprecated
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
+)
+
+func TestConfigEncoding(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		ty    schema.TypeSpec
+		given resource.PropertyValue
+		want  resource.PropertyValue
+	}
+
+	knownKey := "mykey"
+
+	makeEnc := func(typ schema.TypeSpec) *ConfigEncoding {
+		return New(
+			schema.ConfigSpec{
+				Variables: map[string]schema.PropertySpec{
+					knownKey: {
+						TypeSpec: typ,
+					},
+				},
+			},
+		)
+	}
+
+	checkUnmarshal := func(t *testing.T, tc testCase) {
+		enc := makeEnc(tc.ty)
+		key := resource.PropertyKey(knownKey)
+
+		actual, err := enc.unmarshalPropertyValue(key, tc.given)
+		require.NoError(t, err)
+		assert.Equal(t, tc.want, actual)
+	}
+
+	turnaroundTestCases := []testCase{
+		{
+			schema.TypeSpec{Type: "boolean"},
+			resource.NewPropertyValue(`true`),
+			resource.NewBoolProperty(true),
+		},
+		{
+			schema.TypeSpec{Type: "boolean"},
+			resource.NewPropertyValue(`false`),
+			resource.NewBoolProperty(false),
+		},
+		{
+			schema.TypeSpec{Type: "integer"},
+			resource.NewPropertyValue(`0`),
+			resource.NewNumberProperty(0),
+		},
+		{
+			schema.TypeSpec{Type: "integer"},
+			resource.NewPropertyValue(`42`),
+			resource.NewNumberProperty(42),
+		},
+		{
+			schema.TypeSpec{Type: "number"},
+			resource.NewPropertyValue(`0`),
+			resource.NewNumberProperty(0.0),
+		},
+		{
+			schema.TypeSpec{Type: "number"},
+			resource.NewPropertyValue(`42.5`),
+			resource.NewNumberProperty(42.5),
+		},
+		{
+			schema.TypeSpec{Type: "string"},
+			resource.NewStringProperty(""),
+			resource.NewStringProperty(""),
+		},
+		{
+			schema.TypeSpec{Type: "string"},
+			resource.NewStringProperty("hello"),
+			resource.NewStringProperty("hello"),
+		},
+		{
+			schema.TypeSpec{Type: "array"},
+			resource.NewPropertyValue(`[]`),
+			resource.NewArrayProperty([]resource.PropertyValue{}),
+		},
+		{
+			schema.TypeSpec{Type: "array"},
+			resource.NewPropertyValue(`["hello","there"]`),
+			resource.NewArrayProperty([]resource.PropertyValue{
+				resource.NewStringProperty("hello"),
+				resource.NewStringProperty("there"),
+			}),
+		},
+		{
+			schema.TypeSpec{Type: "object"},
+			resource.NewPropertyValue(`{}`),
+			resource.NewObjectProperty(resource.PropertyMap{}),
+		},
+		{
+			schema.TypeSpec{Type: "object"},
+			resource.NewPropertyValue(`{"key":"value"}`),
+			resource.NewObjectProperty(resource.PropertyMap{
+				"key": resource.NewStringProperty("value"),
+			}),
+		},
+	}
+
+	t.Run("turnaround", func(t *testing.T) {
+		for i, tc := range turnaroundTestCases {
+			tc := tc
+
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
+				t.Parallel()
+				checkUnmarshal(t, tc)
+			})
+		}
+	})
+
+	t.Run("zero_values", func(t *testing.T) {
+		// Historically the encoding was able to convert empty strings into type-appropriate zero values.
+		cases := []testCase{
+			{
+				schema.TypeSpec{Type: "boolean"},
+				resource.NewPropertyValue(""),
+				resource.NewBoolProperty(false),
+			},
+			{
+				schema.TypeSpec{Type: "number"},
+				resource.NewPropertyValue(""),
+				resource.NewNumberProperty(0.),
+			},
+			{
+				schema.TypeSpec{Type: "integer"},
+				resource.NewPropertyValue(""),
+				resource.NewNumberProperty(0),
+			},
+			{
+				schema.TypeSpec{Type: "string"},
+				resource.NewPropertyValue(""),
+				resource.NewStringProperty(""),
+			},
+			{
+				schema.TypeSpec{Type: "object"},
+				resource.NewPropertyValue(""),
+				resource.NewObjectProperty(make(resource.PropertyMap)),
+			},
+			{
+				schema.TypeSpec{Type: "array"},
+				resource.NewPropertyValue(""),
+				resource.NewArrayProperty([]resource.PropertyValue{}),
+			},
+		}
+		for _, tc := range cases {
+			tc := tc
+
+			t.Run(fmt.Sprintf("%v", tc.ty), func(t *testing.T) {
+				t.Parallel()
+				checkUnmarshal(t, tc)
+			})
+		}
+	})
+
+	t.Run("computed", func(t *testing.T) {
+		unk := resource.MakeComputed(resource.NewStringProperty(""))
+
+		for i, tc := range turnaroundTestCases {
+			tc := tc
+
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
+				t.Parallel()
+				// Unknown sentinel unmarshals to a Computed with a type-appropriate zero value.
+				checkUnmarshal(t, testCase{
+					ty:    tc.ty,
+					given: unk,
+					want:  resource.MakeComputed(makeEnc(tc.ty).zeroValue(tc.ty.Type)),
+				})
+			})
+		}
+	})
+
+	t.Run("secret", func(t *testing.T) {
+		// Unmarshalling happens with KeepSecrets=false, replacing them with the underlying values. This case
+		// does not need to be tested.
+		//
+		// Marhalling however supports sending secrets back to the engine, intending to mark values as secret
+		// that happen on paths that are declared as secret in the schema. Due to the limitation of the
+		// JSON-in-proto-encoding, secrets are communicated imprecisely as an approximation: if any nested
+		// element of a property is secret, the entire property is marshalled as secret.
+
+		var secretCases []testCase
+
+		for _, tc := range turnaroundTestCases {
+			secretCases = append(secretCases, testCase{
+				ty:    tc.ty,
+				given: resource.MakeSecret(tc.given),
+				want:  resource.MakeSecret(tc.want),
+			})
+		}
+
+		for i, tc := range secretCases {
+			tc := tc
+
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
+				t.Parallel()
+				checkUnmarshal(t, tc)
+			})
+		}
+
+		t.Run("nested secrets", func(t *testing.T) {
+			checkUnmarshal(t, testCase{
+				schema.TypeSpec{Type: "object"},
+				resource.MakeSecret(resource.NewPropertyValue(`{"key":"val"}`)),
+				resource.MakeSecret(resource.NewObjectProperty(resource.PropertyMap{
+					"key": resource.NewStringProperty("val"),
+				})),
+			})
+		})
+	})
+
+	regressUnmarshalTestCases := []testCase{
+		{
+			schema.TypeSpec{Type: "array"},
+			resource.NewPropertyValue(`
+			[
+			  {
+			    "address": "somewhere.org",
+			    "password": {
+			      "4dabf18193072939515e22adb298388d": "1b47061264138c4ac30d75fd1eb44270",
+			      "value": "some-password"
+			    },
+			    "username": "some-user"
+			  }
+			]`),
+			resource.NewArrayProperty([]resource.PropertyValue{
+				resource.NewObjectProperty(resource.PropertyMap{
+					"address":  resource.NewStringProperty("somewhere.org"),
+					"password": resource.MakeSecret(resource.NewStringProperty("some-password")),
+					"username": resource.NewStringProperty("some-user"),
+				}),
+			}),
+		},
+	}
+
+	t.Run("regress-unmarshal", func(t *testing.T) {
+		for i, tc := range regressUnmarshalTestCases {
+			tc := tc
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
+				t.Parallel()
+				checkUnmarshal(t, tc)
+			})
+		}
+	})
+}

provider/internal/deprecated/doc.go

@@ -0,0 +1,19 @@
+// Copyright 2024, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package deprecated vendors config parsing from pulumi-terraform-bridge.
+//
+// Originally taken from here:
+// https://github.com/pulumi/pulumi-terraform-bridge/blob/90733a0c7/pkg/tfbridge/config_encoding.go
+package deprecated