update sharding

.ci-mgmt.yaml

@@ -1,29 +0,0 @@
-template: native
-provider: docker-build
-major-version: 0
-providerDefaultBranch: main
-providerVersion: github.com/pulumi/pulumi-docker-build/provider.Version
-aws: true
-modulePath: .
-gcp: true
-sdkModuleDir: sdk/go/dockerbuild
-parallel: 3
-esc:
-    enabled: true
-envOverride:
-    AWS_REGION: us-west-2
-    PULUMI_API: "https://api.pulumi-staging.io"
-    ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
-    ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
-    ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
-    ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
-    AZURE_LOCATION: westus
-    DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
-    GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
-    GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
-    GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
-    GOOGLE_PROJECT: pulumi-ci-gcp-provider
-    GOOGLE_PROJECT_NUMBER: 895284651812
-    GOOGLE_REGION: us-central1
-    GOOGLE_ZONE: us-central1-a
-    DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}

.config/mise.test.toml

@@ -1,11 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-
-# Overrides for test workflows
-
-[env]
-# Acceptance (specifically providertest) tests require that PULUMI_HOME be the default
-PULUMI_HOME = "{{ env.HOME }}/.pulumi"
-
-[tools]
-# always use pulumi latest for tests
-pulumi = "latest"

.config/mise.toml

@@ -1,29 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-# You can create your own root-level mise.toml file to override/augment this. See https://mise.jdx.dev/configuration.html
-
-[env]
-_.source = "{{config_root}}/scripts/get-versions.sh"
-PULUMI_HOME = "{{config_root}}/.pulumi"
-
-[tools]
-
-# Runtimes
-# TODO: we may not need 'get_env' once https://github.com/jdx/mise/discussions/6339 is fixed
-go = "{{ get_env(name='GO_VERSION_MISE', default='latest') }}"
-node = '20.19.5'
-python = '3.11.8'
-dotnet = '8.0.414'
-# Corretto version used as Java SE/OpenJDK version no longer offered
-java = 'corretto-11'
-
-# Executable tools
-pulumi = "{{ get_env(name='PULUMI_VERSION_MISE', default='latest') }}"
-"github:pulumi/pulumictl" = '0.0.50'
-"github:pulumi/schema-tools" = "0.6.0"
-"aqua:gradle/gradle-distributions" = '7.6.6'
-golangci-lint = "1.64.8" # See note about about overrides if you need to customize this.
-"npm:yarn" = "1.22.22"
-
-[settings]
-experimental = true # Required for Go binaries (e.g. pulumictl).
-lockfile = false

.github/ISSUE_TEMPLATE/bug.yaml

@@ -1,69 +0,0 @@
-name: Bug Report
-description: Report something that's not working correctly
-labels: ["kind/bug", "needs-triage"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this bug report! 
-        You can also ask questions on our [Community Slack](https://slack.pulumi.com/).
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: Describe what happened
-      description: Please summarize what happened, including what Pulumi commands you ran, as well as
-        an inline snippet of any relevant error or console output.
-    validations:
-      required: true
-  - type: textarea
-    id: sample-program
-    attributes:
-      label: Sample program
-      description: |
-        <details><summary>Provide a reproducible sample program</summary>
-        If this is a bug you encountered while running a Pulumi command, please provide us with a minimal, 
-        self-contained Pulumi program that reproduces this behavior so that we can investigate on our end. 
-        Without a functional reproduction, we will not be able to prioritize this bug.
-        **Note:** If the program output is more than a few lines, please send us a Gist or a link to a file.
-        </details>
-    validations:
-      required: true
-  - type: textarea
-    id: log-output
-    attributes:
-      label: Log output
-      description: |
-        <details><summary>How to Submit Logs</summary>
-        If this is something that is dependent on your environment, please also provide us with the output of
-        `pulumi up --logtostderr --logflow -v=10` from the root of your project.
-        We may also ask you to supply us with debug output following [these steps](https://www.pulumi.com/docs/using-pulumi/pulumi-packages/debugging-provider-packages/).
-        **Note:** If the log output is more than a few lines, please send us a Gist or a link to a file.
-        </details>
-  - type: textarea
-    id: resources
-    attributes:
-      label: Affected Resource(s)
-      description: Please list the affected Pulumi Resource(s) or Function(s).
-    validations:
-      required: false
-  - type: textarea
-    id: versions
-    attributes:
-      label: Output of `pulumi about`
-      description: Provide the output of `pulumi about` from the root of your project.
-    validations:
-      required: true
-  - type: textarea
-    id: ctx
-    attributes:
-      label: Additional context
-      description: Anything else you would like to add?
-    validations:
-      required: false
-  - type: textarea
-    id: voting
-    attributes:
-      label: Contributing
-      value: |
-        Vote on this issue by adding a 👍 reaction. 
-        To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

.github/ISSUE_TEMPLATE/epic.md

@@ -1,35 +0,0 @@
----
-name: Epic
-about: Tracks a shippable unit of work
-title: '[Epic] {your-title-here}'
-labels: kind/epic
-projects: ['pulumi/32']
-assignees: ''
-type: Epic
----
-
-## Overview
-<!-- Start with a one- to three-sentence summary that should be understandable by any Pulumian or community member, even those without any context on the work. -->
-
-## Key KPIs
-<!-- What KPIs should this Epic will move; what could we measure to observe that this project was successful? -->
-
-## Key Stakeholders
-- Product and Engineering: <!-- Teams and individuals involved in the design and implementation -->
-- Documentation: <!-- Representative from the docs team -->
-- Marketing/Partnerships: <!-- Representative from the Marketing team -->
-- Customers: <!-- [Tracking Issue](add-link-and-uncomment) -->
-
-## Key Deliverables
-<!-- List any discrete chunks of work or milestones that are planned in the epic (eg. subcomponent A, dogfood release, beta, etc.) -->
-
-### References 📔
-
-<!-- Any project that is more than one iteration should have a Project Board using this [template](https://github.com/orgs/pulumi/projects/131).  -->
-- [ ] Project View <!-- [Link](add-link-and-uncomment) -->
-- [ ] PR/FAQ <!-- [Link](add-link-and-uncomment) -->
-- [ ] Design Doc <!-- [Link](add-link-and-uncomment) -->
-- [ ] UX Designs <!-- [Link](add-link-and-uncomment) -->
-- [ ] Decision Log <!-- [Link](add-link-and-uncomment) -->
-
-<!-- Work items should be added to the project board linked above  -->

.github/actions/download-provider/action.yml

@@ -1,19 +0,0 @@
-name: Download Provider Binary
-description: Downloads the provider binary artifact and restores executable permissions
-
-runs:
-  using: "composite"
-  steps:
-    - name: Download provider
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-      with:
-        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin
-
-    - name: UnTar provider binaries
-      shell: bash
-      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace}}/bin
-
-    - name: Restore Binary Permissions
-      shell: bash
-      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print -exec chmod +x {} \;

.github/actions/download-sdk/action.yml

@@ -1,20 +0,0 @@
-name: Download SDK
-description: Downloads and extracts SDK artifacts for a specific language
-
-inputs:
-  language:
-    description: 'The SDK language to download (nodejs, python, dotnet, java)'
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: Download SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-      with:
-        name: ${{ inputs.language }}-sdk.tar.gz
-        path: ${{ github.workspace }}/sdk/
-
-    - name: UnTar SDK folder
-      shell: bash
-      run: tar -zxf ${{ github.workspace }}/sdk/${{ inputs.language }}.tar.gz -C ${{ github.workspace }}/sdk/${{ inputs.language }}

.github/actions/esc-action/action.yaml

@@ -1,12 +0,0 @@
-name: "Load secrets"
-description: |
-  This is a temporary action which assists with our migration to ESC. Instead
-  of surrounding every step that references secrets with an "if ESC" block, we
-  instead modify those steps to consume their secrets from this step's outputs.
-  Then, later, we can replace this action with esc-action to actually load
-  secrets from ESC.
-inputs: {}
-outputs: {}
-runs:
-  using: "node20"
-  main: "index.js"

.github/actions/esc-action/index.js

@@ -1,14 +0,0 @@
-const fs = require("fs");
-
-const file = process.env["GITHUB_OUTPUT"];
-var stream = fs.createWriteStream(file, { flags: "a" });
-
-for (const [name, value] of Object.entries(process.env)) {
-  try {
-    stream.write(`${name}<<EEEOOOFFF\n${value}\nEEEOOOFFF\n`); // << syntax accommodates multiline strings.
-  } catch (err) {
-    console.log(`error: failed to set output for ${name}: ${err.message}`);
-  }
-}
-
-stream.end();

.github/actions/setup-tools/action.yml

@@ -1,41 +1,34 @@
-name: Setup Tools
-description: Installs all tools (Go, Node, Python, .NET, Java, Pulumi, etc.) using mise
-
-inputs:
-  cache:
-    description: Enable caching
-    required: false
-    default: "false"
-  github_token:
-    description: GitHub token
-    required: true
+name: Setup tools
+description: Installs all tools necessary for building and testing the project.
 
 runs:
   using: "composite"
   steps:
-    - name: Setup mise
-      uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # v3
+    - name: Collect workflow stats
+      uses: catchpoint/workflow-telemetry-action@v2
+      with:
+        comment_on_pr: false
       env:
-        MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
-      with:
-        version: 2025.11.6
-        cache_save: ${{ inputs.cache }}
-        github_token: ${{ inputs.github_token }}
+        GITHUB_TOKEN: ""
 
-    - name: Setup Go Cache
-      uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
-      with:
-        cache: ${{ inputs.cache }}
-        cache-dependency-path: |
-          provider/*.sum
-          upstream/*.sum
-          sdk/go/*.sum
-          sdk/*.sum
-          *.sum
+    - name: Setup mise
+      uses: jdx/mise-action@v2
 
-    - name: Setup Node
-      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
+    - name: Go cache paths
+      id: go-cache-paths
+      shell: sh
+      run: |
+        echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
+        echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
+
+    - name: Go build cache
+      uses: actions/cache@v2
       with:
-        # we don't set node-version because we install with mise.
-        # this step is needed to setup npm auth
-        registry-url: https://registry.npmjs.org
+        path: ${{ steps.go-cache-paths.outputs.go-build }}
+        key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
+
+    - name: Go mod cache
+      uses: actions/cache@v2
+      with:
+        path: ${{ steps.go-cache-paths.outputs.go-mod }}
+        key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: daily
+    groups:
+      pulumi:
+        patterns:
+          - "github.com/pulumi/*"
+      docker:
+        patterns:
+          - "github.com/distribution/*"
+          - "github.com/docker/*"
+          - "github.com/moby/*"
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+      other:
+        patterns:
+          - "*"
+    labels:
+      - dependencies
+      - impact/no-changelog-required

.github/workflows/build.yml

@@ -1,6 +1,6 @@
 # WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
-name: main # For consistency with bridged providers.
+name: build
 on:
   push:
     branches:
@@ -15,65 +15,74 @@ on:
     - "**"
   workflow_dispatch: {}
 env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
   JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
   ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
   ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
   ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
-  AWS_REGION: us-west-2
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
   AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 jobs:
   prerequisites:
     runs-on: ubuntu-latest
     name: prerequisites
-    permissions:
-      id-token: write # For ESC secrets.
-      pull-requests: write # For schema check comment.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        cache: 'true'
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
     - if: github.event_name == 'pull_request'
       name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
         repo: pulumi/schema-tools
     - name: Build codegen binaries
@@ -83,27 +92,25 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        {
-          echo 'SCHEMA_CHANGES<<EOF';
+        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
 
-          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
 
-          echo 'EOF';
-        } >> "$GITHUB_ENV"
+        echo 'EOF' >> $GITHUB_ENV
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-    - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+    - if: github.event_name == 'pull_request'
       name: Comment on PR with Details of Schema Check
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      uses: thollander/actions-comment-pull-request@v2
       with:
         message: |
           ${{ env.SCHEMA_CHANGES }}
-        comment-tag: schemaCheck
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        comment_tag: schemaCheck
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
         github.actor == 'pulumi-bot'
       name: Add label if no breaking changes
-      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+      uses: actions-ecosystem/action-add-labels@v1.1.0
       with:
         labels: impact/no-changelog-required
         number: ${{ github.event.issue.number }}
@@ -111,100 +118,42 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
-    - name: Commit SDK changes for Renovate
-      if: failure() && steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
         github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
         pulumi-gen-${{ env.PROVIDER}}
     - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
         path: ${{ github.workspace }}/bin/provider.tar.gz
     - name: Test Provider Library
       run: make test_provider
-      env:
-        ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
-        DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
-        DOCKER_HUB_PASSWORD: ${{ steps.esc-secrets.outputs.DOCKER_HUB_PASSWORD }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      uses: codecov/codecov-action@v4
       env:
-        CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in building provider prerequisites
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   build_sdks:
     needs: prerequisites
     runs-on: pulumi-ubuntu-8core
     strategy:
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
+      fail-fast: true
       matrix:
         language:
         - nodejs
@@ -213,153 +162,90 @@ jobs:
         - go
         - java
     name: build_sdks
-    permissions:
-      pull-requests: write # For Renovate SDK updates.
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Generate SDK
       run: make generate_${{ matrix.language }}
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
-    - name: Commit SDK changes for Renovate
-      if: failure() && steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
         retention-days: 30
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure while building SDKs
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
-
-  tag_release_if_labeled_needs_release:
-    name: Tag release if labeled as needs-release
-    needs: publish
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - name: check if this commit needs release
-      if: ${{ env.RELEASE_BOT_ENDPOINT != '' }}
-      uses: pulumi/action-release-by-pr-label@main
-      with:
-        command: "release-if-needed"
-        repo: ${{ github.repository }}
-        commit: ${{ github.sha }}
-        slack_channel: C02MGR8JVST
-      env:
-        RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }}
-        RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
   test:
     runs-on: pulumi-ubuntu-8core
     needs:
@@ -373,45 +259,75 @@ jobs:
         - dotnet
         - go
         - java
-        - yaml
     name: test
     permissions:
       contents: read
-      id-token: write # For ESC secrets and Pulumi access token OIDC.
+      id-token: write
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Download SDK
-      if: ${{ matrix.language != 'yaml' }}
-      uses: ./.github/actions/download-sdk
+      uses: actions/download-artifact@v4
       with:
-        language: ${{ matrix.language }}
+        name: ${{ matrix.language }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: UnTar SDK folder
+      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
+        github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
@@ -420,23 +336,18 @@ jobs:
         pip3 install virtualenv==20.0.23
         pip3 install pipenv
     - name: Install dependencies
-      if: ${{ matrix.language != 'yaml' }}
       run: make install_${{ matrix.language}}_sdk
-    - name: Generate Pulumi Access Token
-      id: generate_pulumi_token
-      uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        organization: pulumi
-        requested-token-type: urn:pulumi:token-type:access_token:organization
-        export-environment-variables: false
-    - name: Export AWS Credentials
-      uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
-      env:
-        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
-      with:
-        environment: logins/pulumi-ci
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-region: ${{ env.AWS_REGION }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        role-duration-seconds: 3600
+        role-session-name: ${{ env.PROVIDER }}@githubActions
+        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
     - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+      uses: google-github-actions/auth@v0
       with:
         workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
           }}/locations/global/workloadIdentityPools/${{
@@ -444,7 +355,7 @@ jobs:
           env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
         service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
     - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+      uses: google-github-actions/setup-gcloud@v2
       with:
         install_components: gke-gcloud-auth-plugin
     - name: Install gotestfmt
@@ -456,52 +367,35 @@ jobs:
       run: >-
         set -euo pipefail
 
-        cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        cd examples && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in SDK tests
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish:
     runs-on: ubuntu-latest
     needs: test
     name: publish
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
     - name: Clear GitHub Actions Ubuntu runner disk space
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         dotnet: false
@@ -509,78 +403,82 @@ jobs:
         haskell: true
         swap-storage: true
         large-packages: false
-    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
-        aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
         aws-region: us-east-2
-        aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         role-duration-seconds: 7200
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
-        role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
+        role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
+      uses: goreleaser/goreleaser-action@v5
       env:
         GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
-        AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
-        AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
-        AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
-        AZURE_SIGNING_KEY_VAULT_URI: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI }}
-        SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI == '' }}
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
       with:
         args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
         version: latest
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing binaries
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_sdk:
     runs-on: ubuntu-latest
     needs: publish
     name: publish_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Checkout Scripts Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
     - name: Download python SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: python-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -588,7 +486,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
         ${{github.workspace}}/sdk/python
     - name: Download dotnet SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: dotnet-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -596,7 +494,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
         ${{github.workspace}}/sdk/dotnet
     - name: Download nodejs SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: nodejs-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -608,46 +506,86 @@ jobs:
     - name: Publish SDKs
       run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
       env:
-        NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
-        NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         PYPI_PUBLISH_ARTIFACTS: all
-        PYPI_USERNAME: __token__
-        PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
-        SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
-        SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
-        SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
-        PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
-        PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing SDK
         fields: repo,commit,author,action
         status: ${{ job.status }}
+  publish_java_sdk:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    needs: publish
+    name: publish_java_sdk
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        lfs: true
+    - id: version
+      name: Set Provider Version
+      uses: pulumi/provider-version-action@v1
+      with:
+        set-env: PROVIDER_VERSION
+    - name: Install Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download java SDK
+      uses: actions/download-artifact@v4
+      with:
+        name: java-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: Uncompress java SDK
+      run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
+        ${{github.workspace}}/sdk/java
+    - name: Publish Java SDK
+      uses: gradle/gradle-build-action@v3
       env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
+        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
+      with:
+        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
+        build-root-directory: ./sdk/java
+        gradle-version: 7.4.1
   lint:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
         lfs: true
-        persist-credentials: false
         ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Disarm go:embed directives to enable linters that compile source code
-      run: git grep -l 'go:embed' -- provider | xargs --no-run-if-empty sed -i
-        's/go:embed/ goembed/g'
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
     - name: golangci-lint provider pkg
-      uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
+      uses: golangci/golangci-lint-action@v4
       with:
-        install-mode: none # Handled by mise.
-        working-directory: .
+        version: ${{ env.GOLANGCI_LINT_VERSION }}
+        args: -c ../.golangci.yml
+        working-directory: provider
     name: lint
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository

.github/workflows/command-dispatch.yml

@@ -1,54 +1,67 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
-env:
-  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
-  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
-  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
-  AWS_REGION: us-west-2
-  AZURE_LOCATION: westus
-  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
-  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
-  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
-  GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
-  GOOGLE_REGION: us-central1
-  GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-
-jobs:
-  command-dispatch-for-testing:
-    name: command-dispatch-for-testing
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        persist-credentials: false    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4
-      with:
-        commands: |
-          run-acceptance-tests
-          release
-        issue-type: pull-request
-        permission: write
-        reaction-token: ${{ secrets.GITHUB_TOKEN }}
-        repository: pulumi/pulumi-docker-build
-        token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
 name: command-dispatch
 on:
   issue_comment:
     types:
     - created
     - edited
+env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+  PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
+  JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
+  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
+  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
+  GOOGLE_PROJECT: pulumi-ci-gcp-provider
+  GOOGLE_PROJECT_NUMBER: 895284651812
+  GOOGLE_REGION: us-central1
+  GOOGLE_ZONE: us-central1-a
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
+jobs:
+  command-dispatch-for-testing:
+    runs-on: ubuntu-latest
+    name: command-dispatch-for-testing
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        lfs: true
+    - uses: peter-evans/slash-command-dispatch@v2
+      with:
+        token: ${{ secrets.PULUMI_BOT_TOKEN }}
+        reaction-token: ${{ secrets.GITHUB_TOKEN }}
+        commands: run-acceptance-tests
+        permission: write
+        issue-type: pull-request
+        repository: pulumi/pulumi-docker-build
+    if: ${{ github.event.issue.pull_request }}

.github/workflows/comment-on-stale-issues.yml

@@ -1,42 +0,0 @@
-name: "Comment on stale issues"
-
-on:
-  schedule:
-  - cron: "46 4 * * *" # run once per day
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-latest
-    name: Stale issue job
-    steps:
-    - uses: aws-actions/stale-issue-cleanup@5650b49bcd757a078f6ca06c373d7807b773f9bc # v7.1.0
-      with:
-        issue-types: issues # only look at issues (ignore pull-requests)
-
-        # Setting messages to an empty string causes the automation to skip that category
-        ancient-issue-message: "Unfortunately, it looks like this issue hasn't seen any updates in a while. If you're still experiencing this issue, could you leave a quick comment to let us know so we can prioritize it?"
-        ancient-pr-message: ""
-        stale-issue-message: ""
-        stale-pr-message: ""
-
-        # These labels are required
-        stale-issue-label: awaiting-feedback # somewhat confusingly, this is also used for when labeling "ancient" issues
-        exempt-issue-labels: kind/enhancement,kind/task,kind/epic,kind/engineering, awaiting-upstream # only run on kind/bug for now, ignore awaiting-upstream too.
-        stale-pr-label: no-pr-activity # unused because we aren't processing PRs
-        exempt-pr-labels: awaiting-approval # unused because we aren't processing PRs
-        response-requested-label: response-requested # unused because we don't set a "stale-issue-message" above
-
-        # Issue timing
-        days-before-close: 10000 # this action lacks the option not to close, so just set this indefinitly far in the future
-        days-before-ancient: 180 # 6 months
-
-        # If you don't want to mark a issue as being ancient based on a
-        # threshold of "upvotes", you can set this here. An "upvote" is
-        # the total number of +1, heart, hooray, and rocket reactions
-        # on an issue.
-        minimum-upvotes-to-exempt: 2
-
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        loglevel: DEBUG
-        # Set dry-run to true to not perform label or close actions.
-        dry-run: true

.github/workflows/community-moderation.yml

@@ -1,43 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-
-jobs:
-  warn_codegen:
-    name: warn_codegen
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        persist-credentials: false
-    - id: schema_changed
-      name: Check for diff in schema
-      uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
-      with:
-        filters: "changed: 'provider/cmd/**/schema.json'"
-    - id: sdk_changed
-      if: steps.schema_changed.outputs.changed == 'false'
-      name: Check for diff in sdk/**
-      uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
-      with:
-        filters: "changed: 'sdk/**'"
-    - if: steps.sdk_changed.outputs.changed == 'true' &&
-        github.event.pull_request.head.repo.full_name != github.repository
-      name: Send codegen warning as comment on PR
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
-      with:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        message: >
-          Hello and thank you for your pull request! :heart: :sparkles:
-
-          It looks like you're directly modifying files in the language SDKs, many of which are autogenerated.
-
-          Be sure any files you're editing do not begin with a code generation warning.
-
-          For generated files, you will need to make changes in `resources.go` instead, and [generate the code](https://github.com/pulumi/${{ github.event.repository.name }}/blob/master/CONTRIBUTING.md#committing-generated-code).
-name: warn-codegen
-on:
-  pull_request_target:
-    branches:
-    - main
-    types:
-    - opened

.github/workflows/export-repo-secrets.yml

@@ -1,25 +0,0 @@
-permissions: write-all # Equivalent to default permissions plus id-token: write
-name: Export secrets to ESC
-on: [workflow_dispatch]
-jobs:
-  export-to-esc:
-    runs-on: ubuntu-latest
-    name: export GitHub secrets to ESC
-    steps:
-      - name: Generate a GitHub token
-        id: generate-token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: 1256780 # Export Secrets GitHub App
-          private-key: ${{ secrets.EXPORT_SECRETS_PRIVATE_KEY }}
-      - name: Export secrets to ESC
-        uses: pulumi/esc-export-secrets-action@9d6485759b6adff2538ae91f1b77cc96265c9dad # v1
-        with:
-          organization: pulumi
-          org-environment: imports/github-secrets
-          exclude-secrets: EXPORT_SECRETS_PRIVATE_KEY
-          github-token: ${{ steps.generate-token.outputs.token }}
-          oidc-auth: true
-          oidc-requested-token-type: urn:pulumi:token-type:access_token:organization
-        env:
-          GITHUB_SECRETS: ${{ toJSON(secrets) }}

.github/workflows/prerelease.yml

@@ -6,63 +6,75 @@ on:
     tags:
     - v*.*.*-**
 env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
   JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
   ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
   ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
   ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
-  AWS_REGION: us-west-2
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
   AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
   IS_PRERELEASE: true
-
 jobs:
   prerequisites:
     runs-on: ubuntu-latest
     name: prerequisites
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        cache: 'true'
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
     - if: github.event_name == 'pull_request'
       name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
         repo: pulumi/schema-tools
     - name: Build codegen binaries
@@ -72,27 +84,25 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        {
-          echo 'SCHEMA_CHANGES<<EOF';
+        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
 
-          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
 
-          echo 'EOF';
-        } >> "$GITHUB_ENV"
+        echo 'EOF' >> $GITHUB_ENV
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-    - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+    - if: github.event_name == 'pull_request'
       name: Comment on PR with Details of Schema Check
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      uses: thollander/actions-comment-pull-request@v2
       with:
         message: |
           ${{ env.SCHEMA_CHANGES }}
-        comment-tag: schemaCheck
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        comment_tag: schemaCheck
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
         github.actor == 'pulumi-bot'
       name: Add label if no breaking changes
-      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+      uses: actions-ecosystem/action-add-labels@v1.1.0
       with:
         labels: impact/no-changelog-required
         number: ${{ github.event.issue.number }}
@@ -100,100 +110,42 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
-    - name: Commit SDK changes for Renovate
-      if: failure() && steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
         github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
         pulumi-gen-${{ env.PROVIDER}}
     - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
         path: ${{ github.workspace }}/bin/provider.tar.gz
     - name: Test Provider Library
       run: make test_provider
-      env:
-        ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
-        DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
-        DOCKER_HUB_PASSWORD: ${{ steps.esc-secrets.outputs.DOCKER_HUB_PASSWORD }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      uses: codecov/codecov-action@v4
       env:
-        CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in building provider prerequisites
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   build_sdks:
     needs: prerequisites
     runs-on: pulumi-ubuntu-8core
     strategy:
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
+      fail-fast: true
       matrix:
         language:
         - nodejs
@@ -202,117 +154,89 @@ jobs:
         - go
         - java
     name: build_sdks
-    permissions:
-      pull-requests: write # For Renovate SDK updates.
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Generate SDK
       run: make generate_${{ matrix.language }}
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
-    - name: Commit ${{ matrix.language }} SDK changes for Renovate
-      if: failure() && steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
-
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure while building SDKs
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   test:
     runs-on: pulumi-ubuntu-8core
     needs:
@@ -326,45 +250,75 @@ jobs:
         - dotnet
         - go
         - java
-        - yaml
     name: test
     permissions:
       contents: read
-      id-token: write # For ESC secrets and Pulumi access token OIDC.
+      id-token: write
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Download SDK
-      if: ${{ matrix.language != 'yaml' }}
-      uses: ./.github/actions/download-sdk
+      uses: actions/download-artifact@v4
       with:
-        language: ${{ matrix.language }}
+        name: ${{ matrix.language }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: UnTar SDK folder
+      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
+        github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
@@ -373,23 +327,18 @@ jobs:
         pip3 install virtualenv==20.0.23
         pip3 install pipenv
     - name: Install dependencies
-      if: ${{ matrix.language != 'yaml' }}
       run: make install_${{ matrix.language}}_sdk
-    - name: Generate Pulumi Access Token
-      id: generate_pulumi_token
-      uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        organization: pulumi
-        requested-token-type: urn:pulumi:token-type:access_token:organization
-        export-environment-variables: false
-    - name: Export AWS Credentials
-      uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
-      env:
-        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
-      with:
-        environment: logins/pulumi-ci
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-region: ${{ env.AWS_REGION }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        role-duration-seconds: 3600
+        role-session-name: ${{ env.PROVIDER }}@githubActions
+        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
     - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+      uses: google-github-actions/auth@v0
       with:
         workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
           }}/locations/global/workloadIdentityPools/${{
@@ -397,7 +346,7 @@ jobs:
           env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
         service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
     - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+      uses: google-github-actions/setup-gcloud@v2
       with:
         install_components: gke-gcloud-auth-plugin
     - name: Install gotestfmt
@@ -409,52 +358,35 @@ jobs:
       run: >-
         set -euo pipefail
 
-        cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        cd examples && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in SDK tests
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish:
     runs-on: ubuntu-latest
     needs: test
     name: publish
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
     - name: Clear GitHub Actions Ubuntu runner disk space
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         dotnet: false
@@ -462,78 +394,82 @@ jobs:
         haskell: true
         swap-storage: true
         large-packages: false
-    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
-        aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
         aws-region: us-east-2
-        aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         role-duration-seconds: 7200
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
-        role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
+        role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
+      uses: goreleaser/goreleaser-action@v5
       env:
         GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
-        AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
-        AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
-        AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
-        AZURE_SIGNING_KEY_VAULT_URI: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI }}
-        SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI == '' }}
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
       with:
         args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
         version: latest
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing binaries
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_sdk:
     runs-on: ubuntu-latest
     needs: publish
     name: publish_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Checkout Scripts Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
     - name: Download python SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: python-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -541,7 +477,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
         ${{github.workspace}}/sdk/python
     - name: Download dotnet SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: dotnet-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -549,7 +485,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
         ${{github.workspace}}/sdk/dotnet
     - name: Download nodejs SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: nodejs-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -561,92 +497,83 @@ jobs:
     - name: Publish SDKs
       run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
       env:
-        NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
-        NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         PYPI_PUBLISH_ARTIFACTS: all
-        PYPI_USERNAME: __token__
-        PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing SDK
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_java_sdk:
     runs-on: ubuntu-latest
     continue-on-error: true
     needs: publish
     name: publish_java_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
     - name: Download java SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: java-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
-    - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-      with:
-        gradle-version: "7.6"
     - name: Publish Java SDK
-      run: gradle -p ./sdk/java publishToSonatype closeAndReleaseSonatypeStagingRepository
+      uses: gradle/gradle-build-action@v3
       env:
         PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
-        SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
-        SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
-        SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
-        PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
-        PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
+      with:
+        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
+        build-root-directory: ./sdk/java
+        gradle-version: 7.4.1
   publish_go_sdk:
     runs-on: ubuntu-latest
     name: publish-go-sdk
     needs: publish_sdk
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
         lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Download go SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: go-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/

.github/workflows/pull-request.yml

@@ -3,22 +3,62 @@
 name: pull-request
 on:
   pull_request_target: {}
-
+env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+  PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
+  JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
+  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
+  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
+  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
+  AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
+  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
+  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
+  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
+  GOOGLE_PROJECT: pulumi-ci-gcp-provider
+  GOOGLE_PROJECT_NUMBER: 895284651812
+  GOOGLE_REGION: us-central1
+  GOOGLE_ZONE: us-central1-a
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 jobs:
   comment-on-pr:
     runs-on: ubuntu-latest
     name: comment-on-pr
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
         lfs: true
     - name: Comment PR
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      uses: thollander/actions-comment-pull-request@v2
       with:
         message: >
           PR is now waiting for a maintainer to run the acceptance tests.
 
           **Note for the maintainer:** To run the acceptance tests, please comment */run-acceptance-tests* on the PR
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     if: github.event.pull_request.head.repo.full_name != github.repository

.github/workflows/release.yml

@@ -7,65 +7,74 @@ on:
     - v*.*.*
     - "!v*.*.*-**"
 env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
   JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
   ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
   ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
   ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
-  AWS_REGION: us-west-2
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
   AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 jobs:
   prerequisites:
     runs-on: ubuntu-latest
     name: prerequisites
-    permissions:
-      id-token: write # For ESC secrets.
-      pull-requests: write # For schema check comment.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        cache: 'true'
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
     - if: github.event_name == 'pull_request'
       name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
         repo: pulumi/schema-tools
     - name: Build codegen binaries
@@ -75,27 +84,25 @@ jobs:
     - if: github.event_name == 'pull_request'
       name: Check Schema is Valid
       run: >-
-        {
-          echo 'SCHEMA_CHANGES<<EOF';
+        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
 
-          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
+        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
 
-          echo 'EOF';
-        } >> "$GITHUB_ENV"
+        echo 'EOF' >> $GITHUB_ENV
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-    - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+    - if: github.event_name == 'pull_request'
       name: Comment on PR with Details of Schema Check
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
+      uses: thollander/actions-comment-pull-request@v2
       with:
         message: |
           ${{ env.SCHEMA_CHANGES }}
-        comment-tag: schemaCheck
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        comment_tag: schemaCheck
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
         github.actor == 'pulumi-bot'
       name: Add label if no breaking changes
-      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
+      uses: actions-ecosystem/action-add-labels@v1.1.0
       with:
         labels: impact/no-changelog-required
         number: ${{ github.event.issue.number }}
@@ -103,100 +110,42 @@ jobs:
     - name: Build Provider
       run: make provider
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
-    - name: Commit SDK changes for Renovate
-      if: failure() && steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
     - run: git status --porcelain
     - name: Tar provider binaries
       run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
         github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
         pulumi-gen-${{ env.PROVIDER}}
     - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
         path: ${{ github.workspace }}/bin/provider.tar.gz
     - name: Test Provider Library
       run: make test_provider
-      env:
-        ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
-        DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
-        DOCKER_HUB_PASSWORD: ${{ steps.esc-secrets.outputs.DOCKER_HUB_PASSWORD }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      uses: codecov/codecov-action@v4
       env:
-        CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in building provider prerequisites
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   build_sdks:
     needs: prerequisites
     runs-on: pulumi-ubuntu-8core
     strategy:
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
+      fail-fast: true
       matrix:
         language:
         - nodejs
@@ -205,117 +154,89 @@ jobs:
         - go
         - java
     name: build_sdks
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Generate SDK
       run: make generate_${{ matrix.language }}
     - name: Build SDK
       run: make build_${{ matrix.language }}
     - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
+      uses: pulumi/git-status-check-action@v1
       with:
         allowed-changes: |-
           sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
+          sdk/dotnet/Pulumi.*.csproj
           sdk/go/**/pulumiUtilities.go
           sdk/nodejs/package.json
           sdk/python/pyproject.toml
-          sdk/java/build.gradle
-    - name: Commit SDK changes for Renovate
-      if: failure() && steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
     - run: git status --porcelain
     - name: Tar SDK folder
       run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@v4
       with:
         name: ${{ matrix.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure while building SDKs
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   test:
     runs-on: pulumi-ubuntu-8core
     needs:
@@ -329,45 +250,75 @@ jobs:
         - dotnet
         - go
         - java
-        - yaml
     name: test
     permissions:
       contents: read
-      id-token: write # For ESC secrets.
+      id-token: write
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Download Provider Binary
-      uses: ./.github/actions/download-provider
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: UnTar provider binaries
+      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+        github.workspace}}/bin
+    - name: Restore Binary Permissions
+      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+        -exec chmod +x {} \;
     - name: Download SDK
-      if: ${{ matrix.language != 'yaml' }}
-      uses: ./.github/actions/download-sdk
+      uses: actions/download-artifact@v4
       with:
-        language: ${{ matrix.language }}
+        name: ${{ matrix.language }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: UnTar SDK folder
+      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
+        github.workspace}}/sdk/${{ matrix.language}}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
     - name: Install Node dependencies
       run: yarn global add typescript
     - run: dotnet nuget add source ${{ github.workspace }}/nuget
@@ -376,23 +327,18 @@ jobs:
         pip3 install virtualenv==20.0.23
         pip3 install pipenv
     - name: Install dependencies
-      if: ${{ matrix.language != 'yaml' }}
       run: make install_${{ matrix.language}}_sdk
-    - name: Generate Pulumi Access Token
-      id: generate_pulumi_token
-      uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
       with:
-        organization: pulumi
-        requested-token-type: urn:pulumi:token-type:access_token:organization
-        export-environment-variables: false
-    - name: Export AWS Credentials
-      uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
-      env:
-        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
-      with:
-        environment: logins/pulumi-ci
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-region: ${{ env.AWS_REGION }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        role-duration-seconds: 3600
+        role-session-name: ${{ env.PROVIDER }}@githubActions
+        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
     - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+      uses: google-github-actions/auth@v0
       with:
         workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
           }}/locations/global/workloadIdentityPools/${{
@@ -400,7 +346,7 @@ jobs:
           env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
         service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
     - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+      uses: google-github-actions/setup-gcloud@v2
       with:
         install_components: gke-gcloud-auth-plugin
     - name: Install gotestfmt
@@ -412,52 +358,35 @@ jobs:
       run: >-
         set -euo pipefail
 
-        cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
-      env:
-        GTIHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        cd examples && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in SDK tests
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish:
     runs-on: ubuntu-latest
     needs: test
     name: publish
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
     - name: Clear GitHub Actions Ubuntu runner disk space
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
         tool-cache: false
         dotnet: false
@@ -465,78 +394,82 @@ jobs:
         haskell: true
         swap-storage: true
         large-packages: false
-    - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
-        aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
         aws-region: us-east-2
-        aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
         role-duration-seconds: 7200
         role-session-name: ${{ env.PROVIDER }}@githubActions
         role-external-id: upload-pulumi-release
-        role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
+        role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
+      uses: goreleaser/goreleaser-action@v5
       env:
         GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
-        AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
-        AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
-        AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
-        AZURE_SIGNING_KEY_VAULT_URI: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI }}
-        SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI == '' }}
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
       with:
         args: -p 3 release --clean --timeout 60m0s
         version: latest
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing binaries
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_sdk:
     runs-on: ubuntu-latest
     needs: publish
     name: publish_sdks
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Checkout Scripts Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
         path: ci-scripts
         repository: pulumi/scripts
     - run: echo "ci-scripts" >> .git/info/exclude
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
     - name: Download python SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: python-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -544,7 +477,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
         ${{github.workspace}}/sdk/python
     - name: Download dotnet SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: dotnet-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -552,7 +485,7 @@ jobs:
       run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
         ${{github.workspace}}/sdk/dotnet
     - name: Download nodejs SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: nodejs-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -564,92 +497,83 @@ jobs:
     - name: Publish SDKs
       run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
       env:
-        NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
-        NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         PYPI_PUBLISH_ARTIFACTS: all
-        PYPI_USERNAME: __token__
-        PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
     - if: failure() && github.event_name == 'push'
       name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
+      uses: 8398a7/action-slack@v3
       with:
         author_name: Failure in publishing SDK
         fields: repo,commit,author,action
         status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
   publish_java_sdk:
     runs-on: ubuntu-latest
     continue-on-error: true
     needs: publish
     name: publish_java_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
+        lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        java-version: ${{ env.JAVAVERSION }}
+        distribution: temurin
+        cache: gradle
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: "7.6"
     - name: Download java SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: java-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
     - name: Uncompress java SDK
       run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
         ${{github.workspace}}/sdk/java
-    - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
-      with:
-        gradle-version: "7.6"
     - name: Publish Java SDK
-      run: gradle -p ./sdk/java publishToSonatype closeAndReleaseSonatypeStagingRepository
+      uses: gradle/gradle-build-action@v3
       env:
         PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
-        SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
-        SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
-        SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
-        PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
-        PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
+      with:
+        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
+        build-root-directory: ./sdk/java
+        gradle-version: 7.4.1
   publish_go_sdk:
     runs-on: ubuntu-latest
     name: publish-go-sdk
     needs: publish_sdk
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
         lfs: true
     - id: version
       name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
+      uses: pulumi/provider-version-action@v1
       with:
         set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Download go SDK
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@v4
       with:
         name: go-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/
@@ -669,30 +593,14 @@ jobs:
   dispatch_docs_build:
     runs-on: ubuntu-latest
     needs: publish_go_sdk
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
     - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
       with:
         repo: pulumi/pulumictl
     - name: Dispatch Event
       run: pulumictl create docs-build pulumi-${{ env.PROVIDER }}
-        "${GITHUB_REF#refs/tags/}"
+        ${GITHUB_REF#refs/tags/}
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     name: dispatch_docs_build

.github/workflows/release_command.yml

@@ -1,54 +0,0 @@
-# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
-
-name: release-command
-on:
-  repository_dispatch:
-    types:
-    - release-command
-jobs:
-  should_release:
-    name: Should release PR
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        persist-credentials: false    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - name: Should release PR
-      uses: pulumi/action-release-by-pr-label@main
-      with:
-        command: "should-release"
-        repo: ${{ github.repository }}
-        pr: ${{ github.event.client_payload.pull_request.number }}
-        version: ${{ github.event.client_payload.slash_command.args.all }}
-        slack_channel: ${{ steps.esc-secrets.outputs.RELEASE_OPS_STAGING_SLACK_CHANNEL }}
-      env:
-        RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }}
-        RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - if: failure()
-      name: Notify failure
-      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
-        issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
-        body: |
-          "release command failed: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-    - if: success()
-      name: Notify success
-      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
-        comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
-        reaction-type: hooray

.github/workflows/run-acceptance-tests.yml

@@ -4,544 +4,296 @@ name: run-acceptance-tests
 on:
   repository_dispatch:
     types:
-    - run-acceptance-tests-command
+      - run-acceptance-tests-command
   pull_request:
     paths-ignore:
-    - CHANGELOG.md
+      - CHANGELOG.md
   workflow_dispatch: {}
 env:
+  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
-  JAVAVERSION: "11"
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
   ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
   ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
   ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
-  AWS_REGION: us-west-2
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
   AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
   PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
 jobs:
   comment-notification:
-    if: github.event_name == 'repository_dispatch'
     runs-on: ubuntu-latest
     name: comment-notification
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Create URL to the run output
-      id: vars
-      run: echo
-        "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-        >> "$GITHUB_OUTPUT"
-    - name: Update with Result
-      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
-      with:
-        token: ${{ secrets.GITHUB_TOKEN }}
-        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
-        issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
-        body: "Please view the PR build: ${{ steps.vars.outputs.run-url }}"
+      - name: Create URL to the run output
+        id: vars
+        run: echo
+          run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID
+          >> "$GITHUB_OUTPUT"
+      - name: Update with Result
+        uses: peter-evans/create-or-update-comment@v1
+        with:
+          token: ${{ secrets.PULUMI_BOT_TOKEN }}
+          repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
+          issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
+          body: "Please view the PR build: ${{ steps.vars.outputs.run-url }}"
+    if: github.event_name == 'repository_dispatch'
   prerequisites:
+    if: github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
-    name: prerequisites
-    permissions:
-      id-token: write # For ESC secrets.
-      pull-requests: write # For schema check comment.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
-      with:
-        set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
-      with:
-        cache: 'true'
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - if: github.event_name == 'pull_request'
-      name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
-      with:
-        repo: pulumi/schema-tools
-    - name: Build codegen binaries
-      run: make codegen
-    - name: Build Schema
-      run: make generate_schema
-    - if: github.event_name == 'pull_request'
-      name: Check Schema is Valid
-      run: >-
-        {
-          echo 'SCHEMA_CHANGES<<EOF';
-
-          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
-
-          echo 'EOF';
-        } >> "$GITHUB_ENV"
-      env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
-    - if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
-      name: Comment on PR with Details of Schema Check
-      uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
-      with:
-        message: |
-          ${{ env.SCHEMA_CHANGES }}
-        comment-tag: schemaCheck
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-    - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
-        github.actor == 'pulumi-bot'
-      name: Add label if no breaking changes
-      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
-      with:
-        labels: impact/no-changelog-required
-        number: ${{ github.event.issue.number }}
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Build Provider
-      run: make provider
-    - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
-          sdk/go/**/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
-          sdk/java/build.gradle
-    - name: Commit SDK changes for Renovate
-      if: failure() && steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
-    - run: git status --porcelain
-    - name: Tar provider binaries
-      run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
-        github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
-        pulumi-gen-${{ env.PROVIDER}}
-    - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-      with:
-        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin/provider.tar.gz
-    - name: Test Provider Library
-      run: make test_provider
-      env:
-        ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
-        DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
-        DOCKER_HUB_PASSWORD: ${{ steps.esc-secrets.outputs.DOCKER_HUB_PASSWORD }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
-      env:
-        CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
-    - if: failure() && github.event_name == 'push'
-      name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
-      with:
-        author_name: Failure in building provider prerequisites
-        fields: repo,commit,author,action
-        status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
-    if: github.event_name == 'repository_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-  build_sdks:
-    needs: prerequisites
-    runs-on: pulumi-ubuntu-8core
-    strategy:
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
-      matrix:
-        language:
-        - nodejs
-        - python
-        - dotnet
-        - go
-        - java
-    name: build_sdks
-    permissions:
-      contents: read
-      id-token: write # For ESC secrets.
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
-      with:
-        set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Download provider
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-      with:
-        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin
-    - name: UnTar provider binaries
-      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
-        github.workspace}}/bin
-    - name: Restore Binary Permissions
-      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-        -exec chmod +x {} \;
-    - name: Generate SDK
-      run: make generate_${{ matrix.language }}
-    - name: Build SDK
-      run: make build_${{ matrix.language }}
-    - name: Check worktree clean
-      id: worktreeClean
-      uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
-      with:
-        allowed-changes: |-
-          sdk/**/pulumi-plugin.json
-          sdk/dotnet/*.*.csproj
-          sdk/dotnet/version.txt
-          sdk/go/**/pulumiUtilities.go
-          sdk/nodejs/package.json
-          sdk/python/pyproject.toml
-          sdk/java/build.gradle
-    - name: Commit SDK changes for Renovate
-      if: failure() && steps.worktreeClean.outcome == 'failure' &&
-        contains(github.actor, 'renovate') && github.event_name ==
-        'pull_request'
-      shell: bash
-      run: >
-        git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-        git config --global user.email "bot@pulumi.com"
-
-        git config --global user.name "pulumi-bot"
-
-        # Stash local changes and check out the PR's branch directly.
-
-        git stash
-
-        git fetch
-
-        git checkout "origin/$HEAD_REF"
-
-
-        # Apply and add our changes, but don't commit any files we expect to
-
-        # always change due to versioning.
-
-        git stash pop
-
-        git add sdk
-
-        git reset sdk/python/*/pulumi-plugin.json \
-            sdk/python/pyproject.toml \
-            sdk/dotnet/pulumi-plugin.json \
-            sdk/dotnet/*.*.csproj \
-            sdk/dotnet/version.txt \
-            sdk/go/*/pulumi-plugin.json \
-            sdk/go/*/internal/pulumiUtilities.go \
-            sdk/nodejs/package.json
-
-        git commit -m 'Commit SDK for Renovate'
-
-        # Push with pulumi-bot credentials to trigger a re-run of the
-
-        # workflow. https://github.com/orgs/community/discussions/25702
-
-        git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-      env:
-        HEAD_REF: ${{ github.head_ref }}
-    - run: git status --porcelain
-    - name: Tar SDK folder
-      run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
-    - name: Upload artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
-      with:
-        name: ${{ matrix.language  }}-sdk.tar.gz
-        path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
-        retention-days: 30
-    - if: failure() && github.event_name == 'push'
-      name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
-      with:
-        author_name: Failure while building SDKs
-        fields: repo,commit,author,action
-        status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
-    if: github.event_name == 'repository_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-  test:
-    runs-on: pulumi-ubuntu-8core
-    needs:
-    - build_sdks
-    strategy:
-      fail-fast: true
-      matrix:
-        language:
-        - nodejs
-        - python
-        - dotnet
-        - go
-        - java
-        - yaml
-    name: test
     permissions:
       contents: read
       id-token: write
+      actions: write # For telemetry.
+      pull-requests: write # For schema comment.
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - id: version
-      name: Set Provider Version
-      uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
-      with:
-        set-env: PROVIDER_VERSION
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Download provider
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-      with:
-        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin
-    - name: UnTar provider binaries
-      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
-        github.workspace}}/bin
-    - name: Restore Binary Permissions
-      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-        -exec chmod +x {} \;
-    - name: Download SDK
-      if: ${{ matrix.language != 'yaml' }}
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
-      with:
-        name: ${{ matrix.language }}-sdk.tar.gz
-        path: ${{ github.workspace}}/sdk/
-    - name: UnTar SDK folder
-      if: ${{ matrix.language != 'yaml' }}
-      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
-        github.workspace}}/sdk/${{ matrix.language}}
-    - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
-    - name: Install Node dependencies
-      run: yarn global add typescript
-    - run: dotnet nuget add source ${{ github.workspace }}/nuget
-    - name: Install Python deps
-      run: |-
-        pip3 install virtualenv==20.0.23
-        pip3 install pipenv
-    - name: Install dependencies
-      if: ${{ matrix.language != 'yaml' }}
-      run: make install_${{ matrix.language}}_sdk
-    - name: Generate Pulumi Access Token
-      id: generate_pulumi_token
-      uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
-      with:
-        organization: pulumi
-        requested-token-type: urn:pulumi:token-type:access_token:organization
-        export-environment-variables: false
-    - name: Export AWS Credentials
-      uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
-      env:
-        PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
-      with:
-        environment: logins/pulumi-ci
-    - name: Authenticate to Google Cloud
-      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
-      with:
-        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
-          }}/locations/global/workloadIdentityPools/${{
-          env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
-          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
-        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
-    - name: Setup gcloud auth
-      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
-      with:
-        install_components: gke-gcloud-auth-plugin
-    - name: Install gotestfmt
-      uses: GoTestTools/gotestfmt-action@v2
-      with:
-        version: v2.5.0
-        token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Run tests
-      run: >-
-        set -euo pipefail
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          lfs: true
+          ref: ${{ env.PR_COMMIT_SHA }}
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+      - id: version
+        name: Set Provider Version
+        uses: pulumi/provider-version-action@v1
+        with:
+          set-env: PROVIDER_VERSION
+      - name: Build codegen binaries
+        run: make codegen
+      - name: Build Schema
+        run: make generate_schema
+      - if: github.event_name == 'pull_request'
+        name: Check Schema is Valid
+        run: >-
+          echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
 
-        cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - if: failure() && github.event_name == 'push'
-      name: Notify Slack
-      uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e # v3.19.0
-      with:
-        author_name: Failure in SDK tests
-        fields: repo,commit,author,action
-        status: ${{ job.status }}
-      env:
-        SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
+          schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
+
+          echo 'EOF' >> $GITHUB_ENV
+        env:
+          GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
+      - if: github.event_name == 'pull_request'
+        name: Comment on PR with Details of Schema Check
+        uses: thollander/actions-comment-pull-request@v2
+        with:
+          message: |
+            ${{ env.SCHEMA_CHANGES }}
+          comment_tag: schemaCheck
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - if:
+          contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
+          github.actor == 'pulumi-bot'
+        name: Add label if no breaking changes
+        uses: actions-ecosystem/action-add-labels@v1.1.0
+        with:
+          labels: impact/no-changelog-required
+          number: ${{ github.event.issue.number }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build Provider
+        run: make provider
+      - name: Check worktree clean
+        uses: pulumi/git-status-check-action@v1
+        with:
+          allowed-changes: |-
+            sdk/**/pulumi-plugin.json
+            sdk/dotnet/Pulumi.*.csproj
+            sdk/go/**/pulumiUtilities.go
+            sdk/nodejs/package.json
+            sdk/python/pyproject.toml
+      - run: git status --porcelain
+      - name: Tar provider binaries
+        run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+          github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
+          pulumi-gen-${{ env.PROVIDER}}
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+          path: ${{ github.workspace }}/bin/provider.tar.gz
+      - name: Test Provider Library
+        run: make test_provider
+      - name: Upload coverage reports to Codecov
+        uses: codecov/codecov-action@v4
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      - if: failure() && github.event_name == 'push'
+        name: Notify Slack
+        uses: 8398a7/action-slack@v3
+        with:
+          author_name: Failure in building provider prerequisites
+          fields: repo,commit,author,action
+          status: ${{ job.status }}
+
+      - name: Generate & Build SDK
+        run: mise run sdk
+      - name: Check worktree clean
+        uses: pulumi/git-status-check-action@v1
+        with:
+          allowed-changes: |-
+            sdk/**/pulumi-plugin.json
+            sdk/dotnet/Pulumi.*.csproj
+            sdk/go/**/pulumiUtilities.go
+            sdk/nodejs/package.json
+            sdk/python/pyproject.toml
+      - run: git status --porcelain
+      - name: Tar SDK folder
+        run: tar -zcf sdk.tar.gz -C sdk .
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdk.tar.gz
+          path: ${{ github.workspace}}/sdk.tar.gz
+          retention-days: 30
+      - if: failure() && github.event_name == 'push'
+        name: Notify Slack
+        uses: 8398a7/action-slack@v3
+        with:
+          author_name: Failure while building SDKs
+          fields: repo,commit,author,action
+          status: ${{ job.status }}
+
+  test:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      actions: write # For telemetry.
+    needs:
+      - prerequisites
+    strategy:
+      fail-fast: true
+      matrix:
+        shard: [0, 1, 2, 3, 4, 5, 6, 7]
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          lfs: true
+          ref: ${{ env.PR_COMMIT_SHA }}
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+      - id: version
+        name: Set Provider Version
+        uses: pulumi/provider-version-action@v1
+        with:
+          set-env: PROVIDER_VERSION
+      - name: Download provider + tfgen binaries
+        uses: actions/download-artifact@v4
+        with:
+          name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
+          path: ${{ github.workspace }}/bin
+      - name: UnTar provider binaries
+        run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
+          github.workspace}}/bin
+      - name: Restore Binary Permissions
+        run:
+          find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
+          -exec chmod +x {} \;
+      - name: Download SDK
+        uses: actions/download-artifact@v4
+        with:
+          name: sdk.tar.gz
+          path: ${{ github.workspace}}
+      - name: UnTar SDK folder
+        run: tar -zxf ${{ github.workspace}}/sdk.tar.gz -C ${{github.workspace}}/sdk
+      - name: Update path
+        run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      - name: Install Node dependencies
+        run: yarn global add typescript
+      - run: dotnet nuget add source ${{ github.workspace }}/nuget
+      - name: Install dependencies
+        run: mise run install
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-region: ${{ env.AWS_REGION }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-duration-seconds: 3600
+          role-session-name: ${{ env.PROVIDER }}@githubActions
+          role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v0
+        with:
+          workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
+            }}/locations/global/workloadIdentityPools/${{
+            env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
+            env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
+      - name: Setup gcloud auth
+        uses: google-github-actions/setup-gcloud@v2
+        with:
+          skip_install: true
+      - name: Shard tests
+        run: mise run "test:examples:shard" -- --total ${{ strategy.job-total }} --index ${{ strategy.job-index }} > go-test
+      - name: Run tests
+        run: mise run "test:examples" $(cat go-test) 2>&1 | tee /tmp/gotest.log | gotestfmt
+      - if: failure() && github.event_name == 'push'
+        name: Notify Slack
+        uses: 8398a7/action-slack@v3
+        with:
+          author_name: Failure in SDK tests
+          fields: repo,commit,author,action
+          status: ${{ job.status }}
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
   sentinel:
     runs-on: ubuntu-latest
     name: sentinel
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - name: Mark workflow as successful
-      uses: guibranco/github-status-action-v2@631f55ea0251f0fb284525ad86c30e9f7a8dd284 # v1.1.14
-      with:
-        authToken: ${{ secrets.GITHUB_TOKEN }}
-        context: Sentinel
-        state: success
-        description: Sentinel checks passed
-        sha: ${{ github.event.pull_request.head.sha || github.sha }}
-    permissions:
-      statuses: write
-      id-token: write # For ESC secrets.
+      - name: Mark workflow as successful
+        uses: guibranco/github-status-action-v2@0849440ec82c5fa69b2377725b9b7852a3977e76
+        with:
+          authToken: ${{ secrets.GITHUB_TOKEN }}
+          context: Sentinel
+          state: success
+          description: Sentinel checks passed
+          sha: ${{ github.event.pull_request.head.sha || github.sha }}
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
     needs:
-    - test
-    - prerequisites
-    - lint
+      - test
+      - lint
   lint:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
-      with:
-        lfs: true
-        persist-credentials: false
-        ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Disarm go:embed directives to enable linters that compile source code
-      run: git grep -l 'go:embed' -- provider | xargs --no-run-if-empty sed -i
-        's/go:embed/ goembed/g'
-    - name: golangci-lint provider pkg
-      uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
-      with:
-        install-mode: none # Handled by mise.
-        working-directory: .
-    name: lint
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      actions: write # For telemetry.
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          lfs: true
+          ref: ${{ env.PR_COMMIT_SHA }}
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+      - run: make lint

.github/workflows/weekly-pulumi-update.yml

@@ -8,50 +8,76 @@ on:
 env:
   GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
   PROVIDER: docker-build
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PYPI_USERNAME: __token__
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
   TRAVIS_OS_NAME: linux
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  GOVERSION: "1.21.x"
-  NODEVERSION: "20.x"
-  PYTHONVERSION: "3.11.8"
-  DOTNETVERSION: "8.0.x"
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  GOVERSION: 1.21.x
+  NODEVERSION: 20.x
+  PYTHONVERSION: "3.11"
+  DOTNETVERSION: |
+    6.0.x
+    3.1.301
   JAVAVERSION: "11"
+  AWS_REGION: us-west-2
+  PULUMI_API: https://api.pulumi-staging.io
   ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
   ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
   ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
-  AWS_REGION: us-west-2
+  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
   AZURE_LOCATION: westus
+  DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
   GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
   GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
   GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
   GOOGLE_PROJECT: pulumi-ci-gcp-provider
-  GOOGLE_PROJECT_NUMBER: "895284651812"
+  GOOGLE_PROJECT_NUMBER: 895284651812
   GOOGLE_REGION: us-central1
   GOOGLE_ZONE: us-central1-a
-  PULUMI_API: https://api.pulumi-staging.io
-
+  DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
 jobs:
   weekly-pulumi-update:
     runs-on: ubuntu-latest
-    permissions: write-all
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      uses: actions/checkout@v4
       with:
-        lfs: true    
-    - env:
-        ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
-        ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: "false"
-        ESC_ACTION_OIDC_AUTH: "true"
-        ESC_ACTION_OIDC_ORGANIZATION: pulumi
-        ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
-      id: esc-secrets
-      name: Fetch secrets from ESC
-      uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
-    - name: Setup Tools
-      uses: ./.github/actions/setup-tools
+        lfs: true
+    - name: Install Go
+      uses: actions/setup-go@v5
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
+        go-version: ${{ env.GOVERSION }}
+        cache-dependency-path: "**/*.sum"
+    - name: Install pulumictl
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/pulumictl
+    - name: Install Pulumi CLI
+      uses: pulumi/actions@v5
+    - name: Setup DotNet
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: ${{ env.DOTNETVERSION }}
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ env.NODEVERSION }}
+        registry-url: https://registry.npmjs.org
+    - name: Setup Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: ${{ env.PYTHONVERSION }}
     - name: Update Pulumi/Pulumi
       id: gomod
       run: >-
@@ -61,7 +87,7 @@ jobs:
 
         git checkout -b update-pulumi/${{ github.run_id }}-${{ github.run_number }}
 
-        find . -name go.mod -execdir sh -c 'go get github.com/pulumi/pulumi/pkg/v3 github.com/pulumi/pulumi/sdk/v3; go mod tidy' \;
+        for MODFILE in $(find . -name go.mod); do pushd $(dirname $MODFILE); go get github.com/pulumi/pulumi/pkg/v3 github.com/pulumi/pulumi/sdk/v3; go mod tidy; popd; done
 
         gh repo view pulumi/pulumi --json latestRelease --jq .latestRelease.tagName | sed 's/^v//' > .pulumi.version
 
@@ -101,14 +127,12 @@ jobs:
     - name: Create PR
       id: create-pr
       if: steps.gomod.outputs.changes != 0
-      run: >
-        ver=$(cat .pulumi.version)
-
-        msg="Automated upgrade: bump pulumi/pulumi to ${ver}"
-
-        # See https://github.com/cli/cli/issues/6485#issuecomment-2560935183 for --head workaround
-
-        gh pr create -t "$msg" -b "$msg" --head "$(git branch --show-current)"
+      uses: repo-sync/pull-request@v2.6.2
+      with:
+        source_branch: update-pulumi/${{ github.run_id }}-${{ github.run_number }}
+        destination_branch: main
+        pr_title: Automated Pulumi/Pulumi upgrade
+        github_token: ${{ secrets.PULUMI_BOT_TOKEN }}
       env:
-        GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
     name: weekly-pulumi-update

.gitignore

@@ -2,6 +2,7 @@
 **/bin/
 **/obj/
 **/node_modules/
+**/venv
 **/.vs
 **/.idea
 **/.ionide
@@ -18,4 +19,7 @@ sdk/dotnet/version.txt
 sdk/java/.gradle
 sdk/java/build/
 sdk/java/build.gradle
-sdk/python/venv
+
+# Allow local mise overrides.
+.mise.*.local.toml
+.mise.local.toml

.golangci.yml

@@ -7,7 +7,7 @@ linters:
     - depguard
     - errcheck
     - exhaustive
-    - copyloopvar
+    - exportloopref
     - gci
     - gocritic
     - gofumpt

.goreleaser.prerelease.yml

@@ -2,43 +2,24 @@
 
 project_name: pulumi-docker-build
 builds:
-- id: build-provider
-  dir: provider
+- dir: provider
   env:
   - CGO_ENABLED=0
   - GO111MODULE=on
   goos:
   - darwin
+  - windows
   - linux
   goarch:
   - amd64
   - arm64
-  ignore: &a1 []
+  ignore: []
   main: ./cmd/pulumi-resource-docker-build/
-  ldflags: &a2
-    - -s
-    - -w
-    - -X
-      github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
-    - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
+  ldflags:
+  - -X
+    github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
+  - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
   binary: pulumi-resource-docker-build
-- id: build-provider-sign-windows
-  dir: provider
-  env:
-  - CGO_ENABLED=0
-  - GO111MODULE=on
-  goos:
-  - windows
-  goarch:
-  - amd64
-  - arm64
-  ignore: *a1
-  main: ./cmd/pulumi-resource-docker-build/
-  ldflags: *a2
-  binary: pulumi-resource-docker-build
-  hooks:
-    post:
-    - make sign-goreleaser-exe-{{ .Arch }}
 archives:
 - name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
   id: archive

.goreleaser.yml

@@ -2,43 +2,24 @@
 
 project_name: pulumi-docker-build
 builds:
-- id: build-provider
-  dir: provider
+- dir: provider
   env:
   - CGO_ENABLED=0
   - GO111MODULE=on
   goos:
   - darwin
+  - windows
   - linux
   goarch:
   - amd64
   - arm64
-  ignore: &a1 []
+  ignore: []
   main: ./cmd/pulumi-resource-docker-build/
-  ldflags: &a2
-    - -s
-    - -w
-    - -X
-      github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
-    - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
+  ldflags:
+  - -X
+    github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
+  - -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
   binary: pulumi-resource-docker-build
-- id: build-provider-sign-windows
-  dir: provider
-  env:
-  - CGO_ENABLED=0
-  - GO111MODULE=on
-  goos:
-  - windows
-  goarch:
-  - amd64
-  - arm64
-  ignore: *a1
-  main: ./cmd/pulumi-resource-docker-build/
-  ldflags: *a2
-  binary: pulumi-resource-docker-build
-  hooks:
-    post:
-    - make sign-goreleaser-exe-{{ .Arch }}
 archives:
 - name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
   id: archive

.mise.toml

@@ -0,0 +1,133 @@
+[tasks.provider]
+run = ["make provider"]
+sources = ["provider/**/*.go", "go.mod"]
+outputs = ["bin/pulumi-resource-docker-build"]
+
+# Generate
+
+[tasks."generate:nodejs"]
+depends = ["provider"]
+run = "make generate_nodejs"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/nodejs/**/*.ts"]
+
+[tasks."generate:python"]
+run = "make generate_python"
+depends = ["provider"]
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/python/**/*.py"]
+
+[tasks."generate:dotnet"]
+depends = ["provider"]
+run = "make generate_dotnet"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/dotnet/**/*.cs"]
+
+[tasks."generate:go"]
+depends = ["provider"]
+run = "make generate_go"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/go/**/*.go"]
+
+[tasks."generate:java"]
+depends = ["provider"]
+run = "make generate_java"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["sdk/java/**/*.java"]
+
+# Build
+
+[tasks."build:nodejs"]
+depends = ["generate:nodejs"]
+run = "make build_nodejs"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+[tasks."build:python"]
+depends = ["generate:python"]
+run = "make build_python"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+[tasks."build:dotnet"]
+depends = ["generate:dotnet"]
+run = "make build_dotnet"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+[tasks."build:go"]
+depends = ["generate:go"]
+run = "make build_go"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+[tasks."build:java"]
+depends = ["generate:java"]
+run = "make build_java"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["*"]
+
+# TODO: Might be able to link these directly?
+[tasks."install:dotnet"]
+run = "make install_dotnet_sdk"
+
+[tasks."install:nodejs"]
+run = "make install_nodejs_sdk"
+
+[tasks.sdk]
+depends = ["generate:*", "build:*"]
+
+[tasks.install]
+depends = ["install:*"]
+
+[tasks.test]
+sources = ["**/*.go"]
+outputs = ["*"]
+run = "make test_provider"
+
+[tasks."test:examples"]
+run = "go test -v -json -cover -timeout 2h -tags=all -parallel 4"
+
+[tasks."test:examples:shard"]
+run = "go run github.com/blampe/shard@latest --root ./examples"
+
+[tasks.schema]
+run = "pulumi package get-schema bin/pulumi-resource-docker-build | jq 'del(.version)' > provider/cmd/pulumi-resource-docker-build/schema.json"
+sources = ["bin/pulumi-resource-docker-build"]
+outputs = ["provider/cmd/pulumi-resource-docker-build/schema.json"]
+
+[tasks.docs]
+run = "go generate docs/generate.go"
+depends = ["schema"]
+sources = ["docs/yaml/*.yaml"]
+outputs= ["provider/internal/embed/*.md"]
+
+# TODO: tasks.examples
+
+[tools]
+# Development tooling.
+go = "latest" # Will read version from go.mod.
+lefthook = "1.7.12"
+golangci-lint = "1.58.1"
+
+# Build and test tools.
+pulumi = "3.128.0"
+node = "22"
+dotnet = "6"
+python = "3.11.9"
+java = "temurin-11"
+gradle = "7.6"
+"go:github.com/pulumi/schema-tools" = "v0.6.0"
+"go:github.com/gotesttools/gotestfmt/v2/cmd/gotestfmt" = "v2.5.0"
+"go:github.com/pulumi/pulumictl/cmd/pulumictl" = "a1b89aaf4299fe5bc78e140fc60eba79088b3dc5" # blampe/replace branch doesn't work?
+yarn = "1.22.19"
+gcloud = "455.0.0"
+
+[env]
+# TODO(https://github.com/jdx/mise/issues/1898): create = true
+_.python.venv = { path = "venv", create = false }
+CGO_ENABLED = "0"
+
+[settings]
+experimental = true    # Enable Go backend.
+python_compile = false # Don't build Python from source.

.pulumi.version

@@ -1 +1 @@
-3.192.0
+3.128.0

CHANGELOG.md

@@ -1,99 +1,14 @@
 ## Unreleased
 
-## Changed
-
-- Arguments `CacheFromGitHubActions.URL` and `CacheFromGitHubActions.Token` have been removed. If the previous behaviour is desired, set the `ACTIONS_CACHE_URL` and `ACTIONS_RUNTIME_TOKEN` environment variables. (https://github.com/pulumi/pulumi-docker-build/issues/75)
-
-## 0.0.14 (2025-09-30)
-
-### Fixed
-
-- A warning is no longer emitted for the reserved `__internal` key. (https://github.com/pulumi/pulumi-docker-build/issues/579)
-
-## 0.0.13 (2025-08-27)
-
-### Changed
-
-- Docker Build Cloud and `exec` errors are more helpful. (https://github.com/pulumi/pulumi-docker-build/issues/549)
-
-### Fixed
-
-- The provider is no longer replaced on version changes. (https://github.com/pulumi/pulumi-docker-build/issues/581)
-
-## 0.0.12 (2025-05-16)
-
-### Changed
-
-- Upgraded pulumi-go-provider to v1.0.0-rc2.
-
-### Fixed
-
-- Builds now respect cancellation. (https://github.com/pulumi/pulumi-docker-build/issues/533, https://github.com/pulumi/pulumi-docker-build/pull/522)
-
-## 0.0.11 (2025-04-11)
-
-### Changed
-
-- Upgraded buildx from 0.18.0 to 0.20.1 to remain compatible with upcoming
-  changes to GitHub Actions. (https://github.com/pulumi/pulumi-docker-build/pull/519)
-
-### Fixed
-
-- Upgrading docker-build no longer causes resource replacements. (<https://github.com/pulumi/pulumi-docker-build/issues/404>)
-- Fixed a panic that could occur in `exec` mode. (https://github.com/pulumi/pulumi-docker-build/issues/482)
-- The default GitHub Actions cache scope is now correctly set as `buildkit`. (https://github.com/pulumi/pulumi-docker-build/issues/496)
-
-## 0.0.10 (2025-01-27)
-
-### Changed
-
-- Windows binaries are now signed. (https://github.com/pulumi/pulumi-docker-build/pull/429)
-
-## 0.0.9 (2025-01-16)
-
-### Changed
-
-- Upgraded pulumi-go-provider to v0.24.1. (https://github.com/pulumi/pulumi-docker-build/pull/413)
-
-### Fixed
-
-- `ACTIONS_RUNTIME_TOKEN` is now correctly marked as a secret. (https://github.com/pulumi/pulumi-docker-build/issues/403)
-
-## 0.0.8 (2024-12-10)
-
-### Added
-
-- Multiple exports are now allowed if the build daemon is detected to have
-  version 0.13 of Buildkit or newer.
-  (https://github.com/pulumi/pulumi-docker-build/issues/21)
-
-### Changed
-
-- Upgraded buildx from 0.16.0 to 0.18.0.
-
-### Fixed
-
-- Custom `# syntax=` directives no longer cause validation errors.
-  (https://github.com/pulumi/pulumi-docker-build/issues/300)
-
-## 0.0.7 (2024-10-16)
-
-### Fixed
-
-- Fixed an issue where registry authentication couldn't be specified on the
-  provider. (<https://github.com/pulumi/pulumi-docker-build/issues/262>)
-
-## 0.0.6 (2024-08-13)
-
 ### Fixed
 
 - Refreshing an `Index` resource will no longer fail if its stored credentials
-  have expired. (<https://github.com/pulumi/pulumi-docker-build/pull/194>)
+  have expired. (https://github.com/pulumi/pulumi-docker-build/pull/194)
 
 ### Changed
 
 - Local and tar exporters will now trigger an update if an export doesn't exist
-  at the expected path. (<https://github.com/pulumi/pulumi-docker-build/pull/195>)
+  at the expected path. (https://github.com/pulumi/pulumi-docker-build/pull/195)
 
 ## 0.0.5 (2024-08-08)
 
@@ -118,9 +33,9 @@
 
 ### Fixed
 
-- Fixed the default value for `ACTIONS_CACHE_URL` when using GitHub action caching. (<https://github.com/pulumi/pulumi-docker-build/pull/80>)
-- Fixed Java SDK publishing. (<https://github.com/pulumi/pulumi-docker-build/pull/89>)
-- Fixed a panic that could occur when `context` was omitted. (<https://github.com/pulumi/pulumi-docker-build/pull/83>)
+- Fixed the default value for `ACTIONS_CACHE_URL` when using GitHub action caching. (https://github.com/pulumi/pulumi-docker-build/pull/80)
+- Fixed Java SDK publishing. (https://github.com/pulumi/pulumi-docker-build/pull/89)
+- Fixed a panic that could occur when `context` was omitted. (https://github.com/pulumi/pulumi-docker-build/pull/83)
 
 ### Changed
 

Makefile

@@ -17,10 +17,6 @@ WORKING_DIR      := $(shell pwd)
 EXAMPLES_DIR     := ${WORKING_DIR}/examples/yaml
 TESTPARALLELISM  := 4
 
-PULUMI           := pulumi
-GOGLANGCILINT    := golangci-lint
-GOTEST           := go test
-
 # Override during CI using `make [TARGET] PROVIDER_VERSION=""` or by setting a PROVIDER_VERSION environment variable
 # Local & branch builds will just used this fixed default version unless specified
 PROVIDER_VERSION ?= 0.1.0-alpha.0+dev
@@ -47,10 +43,10 @@ provider_debug::
 	(cd provider && go build -o $(WORKING_DIR)/bin/${PROVIDER} -gcflags="all=-N -l" -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
 
 test_provider:: # Required by CI
-	${GOTEST} -short -v -coverprofile="coverage.txt" -coverpkg=./provider/... -timeout 2h -parallel ${TESTPARALLELISM} ./provider/...
+	go test -short -v -coverprofile="coverage.txt" -coverpkg=./provider/... -timeout 2h -parallel ${TESTPARALLELISM} ./provider/...
 
 test_examples: install_nodejs_sdk install_dotnet_sdk
-	${GOTEST} -short -v -cover -tags=all -timeout 2h -parallel ${TESTPARALLELISM} ./examples/...
+	go test -short -v -cover -tags=all -timeout 2h -parallel ${TESTPARALLELISM} ./examples/...
 
 test_all:: test_provider test_examples
 
@@ -130,7 +126,7 @@ only_build:: build
 
 .PHONY: lint
 lint:
-	${GOGLANGCILINT} run --fix -c .golangci.yml
+	golangci-lint run --fix -c .golangci.yml
 
 install:: install_nodejs_sdk install_dotnet_sdk
 	cp $(WORKING_DIR)/bin/${PROVIDER} ${GOPATH}/bin
@@ -176,7 +172,7 @@ generate_dotnet: sdk/dotnet # Required by CI
 build_dotnet: # Required by CI
 
 ${SCHEMA_PATH}: bin/${PROVIDER}
-	pulumi package get-schema ./bin/${PROVIDER} | jq 'del(.version)' > $(SCHEMA_PATH)
+	pulumi package get-schema bin/${PROVIDER} | jq 'del(.version)' > $(SCHEMA_PATH)
 
 bin/${PROVIDER}: $(shell find ./provider -name '*.go') go.mod
 	(cd provider && go build -o ../bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
@@ -184,7 +180,7 @@ bin/${PROVIDER}: $(shell find ./provider -name '*.go') go.mod
 bin/pulumi-gen-${PACK}: # Required by CI
 	touch bin/pulumi-gen-${PACK}
 
-go.mod: $(shell find . -name '*.go')
+go.mod: $(shell find provider -name '*.go')
 go.sum: go.mod
 
 sdk: $(shell mkdir -p sdk)
@@ -196,7 +192,7 @@ sdk: sdk/python sdk/nodejs sdk/java sdk/python sdk/go sdk/dotnet
 sdk/python: TMPDIR := $(shell mktemp -d)
 sdk/python: bin/${PROVIDER}
 	rm -rf sdk/python
-	$(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language python -o ${TMPDIR}
+	pulumi package gen-sdk bin/$(PROVIDER) --language python -o ${TMPDIR}
 	cp README.md ${TMPDIR}/python/
 	cd ${TMPDIR}/python/ && \
 		rm -rf ./bin/ ../python.bin/ && cp -R . ../python.bin && mv ../python.bin ./bin && \
@@ -209,7 +205,7 @@ sdk/python: bin/${PROVIDER}
 sdk/nodejs: TMPDIR := $(shell mktemp -d)
 sdk/nodejs: bin/${PROVIDER}
 	rm -rf sdk/nodejs
-	$(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language nodejs -o ${TMPDIR}
+	pulumi package gen-sdk bin/$(PROVIDER) --language nodejs -o ${TMPDIR}
 	cp README.md LICENSE ${TMPDIR}/nodejs
 	cd ${TMPDIR}/nodejs/ && \
 		yarn install && \
@@ -221,7 +217,7 @@ sdk/go: TMPDIR := $(shell mktemp -d)
 sdk/go: PATH := "$(WORKING_DIR)/bin:$(PATH)"
 sdk/go: bin/${PROVIDER}
 	rm -rf sdk/go
-	PATH=$(PATH) $(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language go -o ${TMPDIR}
+	PATH=$(PATH) pulumi package gen-sdk bin/$(PROVIDER) --language go -o ${TMPDIR}
 	cp go.mod ${TMPDIR}/go/dockerbuild/go.mod
 	cd ${TMPDIR}/go/dockerbuild && \
 		go mod edit -module=github.com/pulumi/pulumi-${PACK}/${PACKDIR}/go/dockerbuild && \
@@ -231,7 +227,7 @@ sdk/go: bin/${PROVIDER}
 sdk/dotnet: TMPDIR := $(shell mktemp -d)
 sdk/dotnet: bin/${PROVIDER}
 	rm -rf sdk/dotnet
-	$(PULUMI) package gen-sdk ./bin/${PROVIDER} --language dotnet -o ${TMPDIR}
+	pulumi package gen-sdk bin/${PROVIDER} --language dotnet -o ${TMPDIR}
 	cd ${TMPDIR}/dotnet/ && \
 		echo "$(VERSION_GENERIC)" > version.txt && \
 		dotnet build
@@ -241,65 +237,10 @@ sdk/java: PACKAGE_VERSION := $(shell pulumictl convert-version --language generi
 sdk/java: TMPDIR := $(shell mktemp -d)
 sdk/java: bin/${PROVIDER}
 	rm -rf sdk/java
-	$(PULUMI) package gen-sdk --language java ./bin/${PROVIDER} -o ${TMPDIR}
+	pulumi package gen-sdk --language java bin/${PROVIDER} -o ${TMPDIR}
 	cd ${TMPDIR}/java/ && gradle --console=plain build
 	mv -f ${TMPDIR}/java ${WORKING_DIR}/sdk/.
 
 docs: $(shell find docs/yaml -type f) $(shell find ./provider/internal/embed -name '*.md') ${SCHEMA_PATH}
 	go generate docs/generate.go
 	@touch docs
-
-# Set these variables to enable signing of the windows binary
-AZURE_SIGNING_CLIENT_ID ?=
-AZURE_SIGNING_CLIENT_SECRET ?=
-AZURE_SIGNING_TENANT_ID ?=
-AZURE_SIGNING_KEY_VAULT_URI ?=
-SKIP_SIGNING ?=
-
-bin/jsign-6.0.jar:
-	wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar --output-document=bin/jsign-6.0.jar
-
-sign-goreleaser-exe-amd64: GORELEASER_ARCH := amd64_v1
-sign-goreleaser-exe-arm64: GORELEASER_ARCH := arm64
-
-# Set the shell to bash to allow for the use of bash syntax.
-sign-goreleaser-exe-%: SHELL:=/bin/bash
-sign-goreleaser-exe-%: bin/jsign-6.0.jar
-	@# Only sign windows binary if fully configured.
-	@# Test variables set by joining with | between and looking for || showing at least one variable is empty.
-	@# Move the binary to a temporary location and sign it there to avoid the target being up-to-date if signing fails.
-	@set -e; \
-	if [[ "${SKIP_SIGNING}" != "true" ]]; then \
-		if [[ "|${AZURE_SIGNING_CLIENT_ID}|${AZURE_SIGNING_CLIENT_SECRET}|${AZURE_SIGNING_TENANT_ID}|${AZURE_SIGNING_KEY_VAULT_URI}|" == *"||"* ]]; then \
-			echo "Can't sign windows binaries as required configuration not set: AZURE_SIGNING_CLIENT_ID, AZURE_SIGNING_CLIENT_SECRET, AZURE_SIGNING_TENANT_ID, AZURE_SIGNING_KEY_VAULT_URI"; \
-			echo "To rebuild with signing delete the unsigned windows exe file and rebuild with the fixed configuration"; \
-			if [[ "${CI}" == "true" ]]; then exit 1; fi; \
-		else \
-			file=dist/build-provider-sign-windows_windows_${GORELEASER_ARCH}/pulumi-resource-docker-build.exe; \
-			mv $${file} $${file}.unsigned; \
-			az login --service-principal \
-				--username "${AZURE_SIGNING_CLIENT_ID}" \
-				--password "${AZURE_SIGNING_CLIENT_SECRET}" \
-				--tenant "${AZURE_SIGNING_TENANT_ID}" \
-				--output none; \
-			ACCESS_TOKEN=$$(az account get-access-token --resource "https://vault.azure.net" | jq -r .accessToken); \
-			java -jar bin/jsign-6.0.jar \
-				--storetype AZUREKEYVAULT \
-				--keystore "PulumiCodeSigning" \
-				--url "${AZURE_SIGNING_KEY_VAULT_URI}" \
-				--storepass "$${ACCESS_TOKEN}" \
-				$${file}.unsigned; \
-			mv $${file}.unsigned $${file}; \
-			az logout; \
-		fi; \
-	fi
-
-# To make an immediately observable change to .ci-mgmt.yaml:
-#
-# - Edit .ci-mgmt.yaml
-# - Run make ci-mgmt to apply the change locally.
-#
-ci-mgmt: .ci-mgmt.yaml
-	go run github.com/pulumi/ci-mgmt/provider-ci@master generate
-.PHONY: ci-mgmt
-	fi

bin/pulumi-language-python-exec

@@ -1,204 +0,0 @@
-#!/usr/bin/env python
-# Copyright 2016-2018, Pulumi Corporation.  All rights reserved.
-
-import argparse
-import asyncio
-from typing import Optional
-import logging
-import os
-import sys
-import traceback
-import runpy
-from concurrent.futures import ThreadPoolExecutor
-
-# The user might not have installed Pulumi yet in their environment - provide a high-quality error message in that case.
-try:
-    import pulumi
-    import pulumi.runtime
-except ImportError:
-    # For whatever reason, sys.stderr.write is not picked up by the engine as a message, but 'print' is. The Python
-    # langhost automatically flushes stdout and stderr on shutdown, so we don't need to do it here - just trust that
-    # Python does the sane thing when printing to stderr.
-    print(traceback.format_exc(), file=sys.stderr)
-    print("""
-It looks like the Pulumi SDK has not been installed. Have you run pip install?
-If you are running in a virtualenv, you must run pip install -r requirements.txt from inside the virtualenv.""", file=sys.stderr)
-    sys.exit(1)
-
-# use exit code 32 to signal to the language host that an error message was displayed to the user
-PYTHON_PROCESS_EXITED_AFTER_SHOWING_USER_ACTIONABLE_MESSAGE_CODE = 32
-
-def get_abs_module_path(mod_path):
-    path, ext = os.path.splitext(mod_path)
-    if not ext:
-        path = os.path.join(path, '__main__')
-    return os.path.abspath(path)
-
-
-def _get_user_stacktrace(user_program_abspath: str) -> str:
-    '''grabs the current stacktrace and truncates it to show the only stacks pertaining to a user's program'''
-    tb = traceback.extract_tb(sys.exc_info()[2])
-
-    for frame_index, frame in enumerate(tb):
-        # loop over stack frames until we reach the main program
-        # then return the traceback truncated to the user's code
-        cur_module = frame[0]
-        if get_abs_module_path(user_program_abspath) == get_abs_module_path(cur_module):
-            # we have detected the start of a user's stack trace
-            remaining_frames = len(tb)-frame_index
-
-            # include remaining frames from the bottom by negating
-            return traceback.format_exc(limit=-remaining_frames)
-
-    # we did not detect a __main__ program, return normal traceback
-    return traceback.format_exc()
-
-def _set_default_executor(loop, parallelism: Optional[int]):
-    '''configure this event loop to respect the settings provided.'''
-    if parallelism is None:
-        return
-    parallelism = max(parallelism, 1)
-    exec = ThreadPoolExecutor(max_workers=parallelism)
-    loop.set_default_executor(exec)
-
-if __name__ == "__main__":
-    # Parse the arguments, program name, and optional arguments.
-    ap = argparse.ArgumentParser(description='Execute a Pulumi Python program')
-    ap.add_argument('--project', help='Set the project name')
-    ap.add_argument('--stack', help='Set the stack name')
-    ap.add_argument('--parallel', help='Run P resource operations in parallel (default=none)')
-    ap.add_argument('--dry_run', help='Simulate resource changes, but without making them')
-    ap.add_argument('--pwd', help='Change the working directory before running the program')
-    ap.add_argument('--monitor', help='An RPC address for the resource monitor to connect to')
-    ap.add_argument('--engine', help='An RPC address for the engine to connect to')
-    ap.add_argument('--tracing', help='A Zipkin-compatible endpoint to send tracing data to')
-    ap.add_argument('--organization', help='Set the organization name')
-    ap.add_argument('PROGRAM', help='The Python program to run')
-    ap.add_argument('ARGS', help='Arguments to pass to the program', nargs='*')
-    args = ap.parse_args()
-
-    # If any config variables are present, parse and set them, so subsequent accesses are fast.
-    config_env = pulumi.runtime.get_config_env()
-    if hasattr(pulumi.runtime, "get_config_secret_keys_env") and hasattr(pulumi.runtime, "set_all_config"):
-        # If the pulumi SDK has `get_config_secret_keys_env` and `set_all_config`, use them
-        # to set the config and secret keys.
-        config_secret_keys_env = pulumi.runtime.get_config_secret_keys_env()
-        pulumi.runtime.set_all_config(config_env, config_secret_keys_env)
-    else:
-        # Otherwise, fallback to setting individual config values.
-        for k, v in config_env.items():
-            pulumi.runtime.set_config(k, v)
-
-    # Configure the runtime so that the user program hooks up to Pulumi as appropriate.
-    # New versions of pulumi python support setting organization, old versions do not
-    try:
-        settings = pulumi.runtime.Settings(
-            monitor=args.monitor,
-            engine=args.engine,
-            project=args.project,
-            stack=args.stack,
-            parallel=int(args.parallel),
-            dry_run=args.dry_run == "true",
-            organization=args.organization,
-        )
-    except TypeError:
-        settings = pulumi.runtime.Settings(
-            monitor=args.monitor,
-            engine=args.engine,
-            project=args.project,
-            stack=args.stack,
-            parallel=int(args.parallel),
-            dry_run=args.dry_run == "true"
-        )
-
-    pulumi.runtime.configure(settings)
-
-    # Finally, swap in the args, chdir if needed, and run the program as if it had been executed directly.
-    sys.argv = [args.PROGRAM] + args.ARGS
-    if args.pwd is not None:
-        os.chdir(args.pwd)
-
-    successful = False
-
-    try:
-        # The docs for get_running_loop are somewhat misleading because they state:
-        # This function can only be called from a coroutine or a callback. However, if the function is
-        # called from outside a coroutine or callback (the standard case when running `pulumi up`), the function
-        # raises a RuntimeError as expected and falls through to the exception clause below.
-        loop = asyncio.get_running_loop()
-    except RuntimeError:
-        loop = asyncio.new_event_loop()
-        asyncio.set_event_loop(loop)
-    
-    # Configure the event loop to respect the parallelism value provided as input.
-    _set_default_executor(loop, settings.parallel)
-
-    # We are (unfortunately) suppressing the log output of asyncio to avoid showing to users some of the bad things we
-    # do in our programming model.
-    #
-    # Fundamentally, Pulumi is a way for users to build asynchronous dataflow graphs that, as their deployments
-    # progress, resolve naturally and eventually result in the complete resolution of the graph. If one node in the
-    # graph fails (i.e. a resource fails to create, there's an exception in an apply, etc.), part of the graph remains
-    # unevaluated at the time that we exit.
-    #
-    # asyncio abhors this. It gets very upset if the process terminates without having observed every future that we
-    # have resolved. If we are terminating abnormally, it is highly likely that we are not going to observe every single
-    # future that we have created. Furthermore, it's *harmless* to do this - asyncio logs errors because it thinks it
-    # needs to tell users that they're doing bad things (which, to their credit, they are), but we are doing this
-    # deliberately.
-    #
-    # In order to paper over this for our users, we simply turn off the logger for asyncio. Users won't see any asyncio
-    # error messages, but if they stick to the Pulumi programming model, they wouldn't be seeing any anyway.
-    logging.getLogger("asyncio").setLevel(logging.CRITICAL)
-    exit_code = 1
-    try:
-        # record the location of the user's program to return user tracebacks
-        user_program_abspath = os.path.abspath(args.PROGRAM)
-        def run():
-            try:
-                runpy.run_path(args.PROGRAM, run_name='__main__')
-            except ImportError as e:
-                def fix_module_file(m: str) -> str:
-                    # Work around python 11 reporting "<frozen runpy>" rather
-                    # than runpy.__file__ in the traceback.
-                    return runpy.__file__ if m == "<frozen runpy>" else m
-
-                # detect if the main pulumi python program does not exist
-                stack_modules = [fix_module_file(f.filename) for f in traceback.extract_tb(e.__traceback__)]
-                unique_modules = set(module for module in stack_modules)
-                last_module_name = stack_modules[-1]
-
-                # we identify a missing program error if
-                # 1. the only modules in the stack trace are
-                #   - `pulumi-language-python-exec`
-                #   - `runpy`
-                # 2. the last function in the stack trace is in the `runpy` module
-                if unique_modules == {
-                            __file__, # the language runtime itself
-                            runpy.__file__,
-                        } and last_module_name == runpy.__file__ :
-                    # this error will only be hit when the user provides a directory
-                    # the engine has a check to determine if the `main` file exists and will fail early
-
-                    # if a language runtime receives a directory, it's the language's responsibility to determine
-                    # whether the provided directory has a pulumi program
-                    pulumi.log.error(f"unable to find main python program `__main__.py` in `{user_program_abspath}`")
-                    sys.exit(PYTHON_PROCESS_EXITED_AFTER_SHOWING_USER_ACTIONABLE_MESSAGE_CODE)
-                else:
-                    raise e
-
-        coro = pulumi.runtime.run_in_stack(run)
-        loop.run_until_complete(coro)
-        exit_code = 0
-    except pulumi.RunError as e:
-        pulumi.log.error(str(e))
-    except Exception:
-        error_msg = "Program failed with an unhandled exception:\n" + _get_user_stacktrace(user_program_abspath)
-        pulumi.log.error(error_msg)
-        exit_code = PYTHON_PROCESS_EXITED_AFTER_SHOWING_USER_ACTIONABLE_MESSAGE_CODE
-    finally:
-        loop.close()
-        sys.stdout.flush()
-        sys.stderr.flush()
-
-    sys.exit(exit_code)

docs/_index.md

@@ -1,428 +0,0 @@
----
-title: Docker Build
-meta_desc: Provides an overview of the Docker Build Provider for Pulumi.
-layout: package
----
-
-The Docker Build provider leverages [buildx and BuildKit](https://docs.docker.com/build/architecture/) to build modern Docker images with Pulumi.
-
-Not to be confused with the earlier
-[Docker](../docker) provider, which is still
-appropriate for managing resources unrelated to building images.
-
-| Provider               | Use cases                                                               |
-| ----------------       | ----------------------------------------------------------------------- |
-| `@pulumi/docker-build` | Anything related to building images with `docker build`.                |
-| `@pulumi/docker`       | Everything else -- including running containers and creating networks.  |
-
-## Example
-
-If your Pulumi program has a directory called `app` alongside it, containing a
-file named "Dockerfile" (which can be as simple as `FROM alpine` for the
-purpose of example), then the code below shows how to build a multi-platform
-image, publish it to a remote AWS ECR registry, and use an [inline
-cache](https://docs.docker.com/build/cache/backends/inline/) to speed up
-subsequent builds.
-
-{{< chooser language "typescript,python,csharp,go,yaml,java" / >}}
-
-{{% choosable language typescript %}}
-
-```typescript
-import * as aws from "@pulumi/aws";
-import * as docker_build from "@pulumi/docker-build";
-
-// Create an ECR repository for pushing.
-const ecrRepository = new aws.ecr.Repository("ecr-repository", {});
-
-// Grab auth credentials for ECR.
-const authToken = aws.ecr.getAuthorizationTokenOutput({
-    registryId: ecrRepository.registryId,
-});
-
-// Build and push an image to ECR with inline caching.
-const myImage = new docker_build.Image("my-image", {
-    // Tag our image with our ECR repository's address.
-    tags: [pulumi.interpolate`${ecrRepository.repositoryUrl}:latest`],
-    context: {
-        location: "./app",
-    },
-    // Use the pushed image as a cache source.
-    cacheFrom: [{
-        registry: {
-            ref: pulumi.interpolate`${ecrRepository.repositoryUrl}:latest`,
-        },
-    }],
-    // Include an inline cache with our pushed image.
-    cacheTo: [{
-        inline: {},
-    }],
-    // Build a multi-platform image manifest for ARM and AMD.
-    platforms: [
-        "linux/amd64",
-        "linux/arm64",
-    ],
-    // Push the final result to ECR.
-    push: true,
-    // Provide our ECR credentials.
-    registries: [{
-        address: ecrRepository.repositoryUrl,
-        password: authToken.password,
-        username: authToken.userName,
-    }],
-});
-
-// Export a ref for the pushed images so we can deploy it.
-export const ref = myImage.ref;
-```
-
-{{% /choosable %}}
-
-{{% choosable language python %}}
-
-```python
-import pulumi
-import pulumi_aws as aws
-import pulumi_docker_build as docker_build
-
-# Create an ECR repository for pushing.
-ecr_repository = aws.ecr.Repository("ecr-repository")
-
-# Grab auth credentials for ECR.
-auth_token = aws.ecr.get_authorization_token_output(registry_id=ecr_repository.registry_id)
-
-# Build and push an image to ECR with inline caching.
-my_image = docker_build.Image("my-image",
-    # Tag our image with our ECR repository's address.
-    tags=[ecr_repository.repository_url.apply(lambda repository_url: f"{repository_url}:latest")],
-    context=docker_build.BuildContextArgs(
-        location="./app",
-    ),
-    # Use the pushed image as a cache source.
-    cache_from=[docker_build.CacheFromArgs(
-        registry=docker_build.CacheFromRegistryArgs(
-            ref=ecr_repository.repository_url.apply(lambda repository_url: f"{repository_url}:latest"),
-        ),
-    )],
-    # Include an inline cache with our pushed image.
-    cache_to=[docker_build.CacheToArgs(
-        inline=docker_build.CacheToInlineArgs(),
-    )],
-    # Build a multi-platform image manifest for ARM and AMD.
-    platforms=[
-        docker_build.Platform.LINUX_AMD64,
-        docker_build.Platform.LINUX_ARM64,
-    ],
-    # Push the final result to ECR.
-    push=True,
-    # Provide our ECR credentials.
-    registries=[docker_build.RegistryArgs(
-        address=ecr_repository.repository_url,
-        password=auth_token.password,
-        username=auth_token.user_name,
-    )],
-)
-
-# Export a ref for the pushed images so we can deploy it.
-pulumi.export("ref", my_image.ref)
-```
-
-{{% /choosable %}}
-
-{{% choosable language csharp %}}
-
-```csharp
-using System.Collections.Generic;
-using System.Linq;
-using Pulumi;
-using Aws = Pulumi.Aws;
-using DockerBuild = Pulumi.DockerBuild;
-
-return await Deployment.RunAsync(() =>
-{
-    // Create an ECR repository for pushing.
-    var ecrRepository = new Aws.Ecr.Repository("ecr-repository");
-
-    // Grab auth credentials for ECR.
-    var authToken = Aws.Ecr.GetAuthorizationToken.Invoke(new()
-    {
-        RegistryId = ecrRepository.RegistryId,
-    });
-
-    // Build and push an image to ECR with inline caching.
-    var myImage = new DockerBuild.Image("my-image", new()
-    {
-        // Tag our image with our ECR repository's address.
-        Tags = new[]
-        {
-            ecrRepository.RepositoryUrl.Apply(repositoryUrl => $"{repositoryUrl}:latest"),
-        },
-        Context = new DockerBuild.Inputs.BuildContextArgs
-        {
-            Location = "./app",
-        },
-        // Use the pushed image as a cache source.
-        CacheFrom = new[]
-        {
-            new DockerBuild.Inputs.CacheFromArgs
-            {
-                Registry = new DockerBuild.Inputs.CacheFromRegistryArgs
-                {
-                    Ref = ecrRepository.RepositoryUrl.Apply(repositoryUrl => $"{repositoryUrl}:latest"),
-                },
-            },
-        },
-        // Include an inline cache with our pushed image.
-        CacheTo = new[]
-        {
-            new DockerBuild.Inputs.CacheToArgs
-            {
-                Inline = null,
-            },
-        },
-        // Build a multi-platform image manifest for ARM and AMD.
-        Platforms = new[]
-        {
-            DockerBuild.Platform.Linux_amd64,
-            DockerBuild.Platform.Linux_arm64,
-        },
-        // Push the final result to ECR.
-        Push = true,
-        // Provide our ECR credentials.
-        Registries = new[]
-        {
-            new DockerBuild.Inputs.RegistryArgs
-            {
-                Address = ecrRepository.RepositoryUrl,
-                Password = authToken.Apply(getAuthorizationTokenResult => getAuthorizationTokenResult.Password),
-                Username = authToken.Apply(getAuthorizationTokenResult => getAuthorizationTokenResult.UserName),
-            },
-        },
-    });
-
-    // Export a ref for the pushed images so we can deploy it.
-    return new Dictionary<string, object?>
-    {
-        ["ref"] = myImage.Ref,
-    };
-});
-
-```
-
-{{% /choosable %}}
-
-{{% choosable language go %}}
-
-```go
-package main
-
-import (
-    "fmt"
-
-    "github.com/pulumi/pulumi-aws/sdk/v6/go/aws/ecr"
-    "github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild"
-    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
-)
-
-func main() {
-    pulumi.Run(func(ctx *pulumi.Context) error {
-        // Create an ECR repository for pushing.
-        ecrRepository, err := ecr.NewRepository(ctx, "ecr-repository", nil)
-        if err != nil {
-            return err
-        }
-
-        // Grab auth credentials for ECR.
-        authToken := ecr.GetAuthorizationTokenOutput(ctx, ecr.GetAuthorizationTokenOutputArgs{
-            RegistryId: ecrRepository.RegistryId,
-        }, nil)
-
-        // Build and push an image to ECR with inline caching.
-        myImage, err := dockerbuild.NewImage(ctx, "my-image", &dockerbuild.ImageArgs{
-            // Tag our image with our ECR repository's address.
-            Tags: pulumi.StringArray{
-                ecrRepository.RepositoryUrl.ApplyT(func(repositoryUrl string) (string, error) {
-                    return fmt.Sprintf("%v:latest", repositoryUrl), nil
-                }).(pulumi.StringOutput),
-            },
-            Context: &dockerbuild.BuildContextArgs{
-                Location: pulumi.String("./app"),
-            },
-            // Use the pushed image as a cache source.
-            CacheFrom: dockerbuild.CacheFromArray{
-                &dockerbuild.CacheFromArgs{
-                    Registry: &dockerbuild.CacheFromRegistryArgs{
-                        Ref: ecrRepository.RepositoryUrl.ApplyT(func(repositoryUrl string) (string, error) {
-                            return fmt.Sprintf("%v:latest", repositoryUrl), nil
-                        }).(pulumi.StringOutput),
-                    },
-                },
-            },
-            // Include an inline cache with our pushed image.
-            CacheTo: dockerbuild.CacheToArray{
-                &dockerbuild.CacheToArgs{
-                    Inline: nil,
-                },
-            },
-            // Build a multi-platform image manifest for ARM and AMD.
-            Platforms: dockerbuild.PlatformArray{
-                dockerbuild.Platform_Linux_amd64,
-                dockerbuild.Platform_Linux_arm64,
-            },
-            // Push the final result to ECR.
-            Push: pulumi.Bool(true),
-            // Provide our ECR credentials.
-            Registries: dockerbuild.RegistryArray{
-                &dockerbuild.RegistryArgs{
-                    Address: ecrRepository.RepositoryUrl,
-                    Password: authToken.ApplyT(func(authToken ecr.GetAuthorizationTokenResult) (*string, error) {
-                        return &authToken.Password, nil
-                    }).(pulumi.StringPtrOutput),
-                    Username: authToken.ApplyT(func(authToken ecr.GetAuthorizationTokenResult) (*string, error) {
-                        return &authToken.UserName, nil
-                    }).(pulumi.StringPtrOutput),
-                },
-            },
-        })
-        if err != nil {
-            return err
-        }
-
-        // Export a ref for the pushed images so we can deploy it.
-        ctx.Export("ref", myImage.Ref)
-        return nil
-    })
-}
-```
-
-{{% /choosable %}}
-
-{{% choosable language yaml %}}
-
-```yaml
-description: Push to AWS ECR with caching
-name: ecr
-outputs:
-    ref: ${my-image.ref}
-resources:
-    # Create an ECR repository for pushing.
-    ecr-repository:
-        type: aws:ecr:Repository
-
-    # Build and push an image to ECR with inline caching.
-    my-image:
-        type: docker-build:Image
-        properties:
-            # Tag our image with our ECR repository's address.
-            tags:
-                - ${ecr-repository.repositoryUrl}:latest
-            context:
-                location: ./app
-            # Use the pushed image as a cache source.
-            cacheFrom:
-                - registry:
-                    ref: ${ecr-repository.repositoryUrl}:latest
-            # Include an inline cache with our pushed image.
-            cacheTo:
-                - inline: {}
-            # Build a multi-platform image manifest for ARM and AMD.
-            platforms:
-                - linux/amd64
-                - linux/arm64
-            # Push the final result to ECR.
-            push: true
-            # Provide our ECR credentials.
-            registries:
-                - address: ${ecr-repository.repositoryUrl}
-                  password: ${auth-token.password}
-                  username: ${auth-token.userName}
-
-runtime: yaml
-variables:
-    auth-token:
-        # Grab auth credentials for ECR.
-        fn::aws:ecr:getAuthorizationToken:
-            registryId: ${ecr-repository.registryId}
-```
-
-{{% /choosable %}}
-
-{{% choosable language java %}}
-
-```java
-package myapp;
-
-import com.pulumi.Context;
-import com.pulumi.Pulumi;
-import com.pulumi.core.Output;
-import com.pulumi.aws.ecr.Repository;
-import com.pulumi.aws.ecr.EcrFunctions;
-import com.pulumi.aws.ecr.inputs.GetAuthorizationTokenArgs;
-import com.pulumi.dockerbuild.Image;
-import com.pulumi.dockerbuild.ImageArgs;
-import com.pulumi.dockerbuild.inputs.CacheFromArgs;
-import com.pulumi.dockerbuild.inputs.CacheFromRegistryArgs;
-import com.pulumi.dockerbuild.inputs.CacheToArgs;
-import com.pulumi.dockerbuild.inputs.CacheToInlineArgs;
-import com.pulumi.dockerbuild.inputs.BuildContextArgs;
-import com.pulumi.dockerbuild.inputs.RegistryArgs;
-import java.util.List;
-import java.util.ArrayList;
-import java.util.Map;
-import java.io.File;
-import java.nio.file.Files;
-import java.nio.file.Paths;
-
-public class App {
-    public static void main(String[] args) {
-        Pulumi.run(App::stack);
-    }
-
-    public static void stack(Context ctx) {
-        // Create an ECR repository for pushing.
-        var ecrRepository = new Repository("ecrRepository");
-
-        // Grab auth credentials for ECR.
-        final var authToken = EcrFunctions.getAuthorizationToken(GetAuthorizationTokenArgs.builder()
-            .registryId(ecrRepository.registryId())
-            .build());
-
-        // Build and push an image to ECR with inline caching.
-        var myImage = new Image("myImage", ImageArgs.builder()
-            // Tag our image with our ECR repository's address.
-            .tags(ecrRepository.repositoryUrl().applyValue(repositoryUrl -> String.format("%s:latest", repositoryUrl)))
-            .context(BuildContextArgs.builder()
-                .location("./app")
-                .build())
-            // Use the pushed image as a cache source.
-            .cacheFrom(CacheFromArgs.builder()
-                .registry(CacheFromRegistryArgs.builder()
-                    .ref(ecrRepository.repositoryUrl().applyValue(repositoryUrl -> String.format("%s:latest", repositoryUrl)))
-                    .build())
-                .build())
-            // Include an inline cache with our pushed image.
-            .cacheTo(CacheToArgs.builder()
-                .inline()
-                .build())
-            // Build a multi-platform image manifest for ARM and AMD.
-            .platforms(
-                "linux/amd64",
-                "linux/arm64")
-            // Push the final result to ECR.
-            .push(true)
-            // Provide our ECR credentials.
-            .registries(RegistryArgs.builder()
-                .address(ecrRepository.repositoryUrl())
-                .password(authToken.applyValue(getAuthorizationTokenResult -> getAuthorizationTokenResult).applyValue(authToken -> authToken.applyValue(getAuthorizationTokenResult -> getAuthorizationTokenResult.password())))
-                .username(authToken.applyValue(getAuthorizationTokenResult -> getAuthorizationTokenResult).applyValue(authToken -> authToken.applyValue(getAuthorizationTokenResult -> getAuthorizationTokenResult.userName())))
-                .build())
-            .build());
-
-        ctx.export("ref", myImage.ref());
-    }
-}
-```
-
-{{% /choosable %}}
-
-{{< /chooser >}}

docs/installation-configuration.md

@@ -1,33 +0,0 @@
----
-title: Docker-Build Installation & Configuration
-meta_desc: Provides an overview on how to configure the Pulumi Docker-Build Provider.
-layout: package
----
-
-The Pulumi Docker-build provider builds modern Docker images with [buildx](https://docs.docker.com/reference/cli/docker/buildx/) and [BuildKit](https://docs.docker.com/build/buildkit/).
-
-## Installation
-
-The Docker-Build provider is available as a package in all Pulumi languages:
-
-* JavaScript/TypeScript: [`@pulumi/docker-build`](https://www.npmjs.com/package/@pulumi/docker-build)
-* Python: [`pulumi-docker-build`](https://pypi.org/project/pulumi-docker-build/)
-* Go: [`github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild`](https://github.com/pulumi/pulumi-docker-build)
-* .NET: [`Pulumi.DockerBuild`](https://www.nuget.org/packages/Pulumi.DockerBuild)
-* Java: [`com.pulumi/docker-build`](https://central.sonatype.com/artifact/com.pulumi/docker-build)
-
-## Configuring The Provider
-
-### Host
-
-The `DOCKER_HOST` environment variable can be used to specify a custom build daemon's location.
-
-```bash
-$ export DOCKER_HOST=tcp://127.0.0.1:2376/
-```
-
-This can also be specified in your stack's configuration:
-
-```bash
-$ pulumi config set docker-build:host tcp://127.0.0.1:2376/
-```

examples/dotnet/provider-docker-build.csproj

@@ -2,7 +2,7 @@
 
 	<PropertyGroup>
 		<OutputType>Exe</OutputType>
-		<TargetFramework>net8.0</TargetFramework>
+		<TargetFramework>net6.0</TargetFramework>
 		<Nullable>enable</Nullable>
 	</PropertyGroup>
 

examples/go/go.mod

@@ -1,99 +1,95 @@
 module provider-docker-build
 
-go 1.24.1
+go 1.21.7
 
-toolchain go1.24.5
+toolchain go1.21.9
 
 require (
-	github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12
-	github.com/pulumi/pulumi/sdk/v3 v3.192.0
+	github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.0-20240425180359-26c144c916b7
+	github.com/pulumi/pulumi/sdk/v3 v3.128.0
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.2.0 // indirect
+	dario.cat/mergo v1.0.0 // indirect
+	github.com/BurntSushi/toml v1.2.1 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/ProtonMail/go-crypto v1.0.0 // indirect
+	github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/blang/semver v3.5.1+incompatible // indirect
-	github.com/charmbracelet/bubbles v0.21.0 // indirect
-	github.com/charmbracelet/bubbletea v1.3.4 // indirect
-	github.com/charmbracelet/colorprofile v0.3.0 // indirect
-	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.8.0 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/charmbracelet/bubbles v0.16.1 // indirect
+	github.com/charmbracelet/bubbletea v0.25.0 // indirect
+	github.com/charmbracelet/lipgloss v0.7.1 // indirect
 	github.com/cheggaaa/pb v1.0.29 // indirect
-	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
-	github.com/djherbis/times v1.6.0 // indirect
+	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/containerd/console v1.0.4 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
+	github.com/djherbis/times v1.5.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-git/go-git/v5 v5.16.0 // indirect
+	github.com/go-git/go-billy/v5 v5.5.0 // indirect
+	github.com/go-git/go-git/v5 v5.12.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.2.4 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang/glog v1.2.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/hcl/v2 v2.23.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.19.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/muesli/reflow v0.3.0 // indirect
+	github.com/muesli/termenv v0.15.2 // indirect
 	github.com/opentracing/basictracer-go v1.1.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pgavlin/fx v0.1.6 // indirect
-	github.com/pgavlin/fx/v2 v2.0.3 // indirect
-	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.20.0 // indirect
-	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/pulumi/esc v0.9.1 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
-	github.com/skeema/knownhosts v1.3.1 // indirect
+	github.com/skeema/knownhosts v1.2.2 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
-	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/cobra v1.8.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/texttheater/golang-levenshtein v1.0.1 // indirect
+	github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 // indirect
 	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
 	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zclconf/go-cty v1.16.2 // indirect
-	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
-	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
-	golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 // indirect
-	golang.org/x/mod v0.29.0 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/term v0.37.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
-	golang.org/x/tools v0.38.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 // indirect
-	google.golang.org/grpc v1.72.1 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	github.com/zclconf/go-cty v1.14.1 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
+	golang.org/x/crypto v0.24.0 // indirect
+	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 // indirect
+	golang.org/x/mod v0.18.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/term v0.21.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/tools v0.22.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 // indirect
+	google.golang.org/grpc v1.63.2 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	lukechampine.com/frand v1.5.1 // indirect
+	lukechampine.com/frand v1.4.2 // indirect
 )

examples/go/go.sum

@@ -1,14 +1,16 @@
-dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
-dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
-github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
+github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM=
 github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/ProtonMail/go-crypto v1.2.0 h1:+PhXXn4SPGd+qk76TlEePBfOfivE0zkWFenhGhFLzWs=
-github.com/ProtonMail/go-crypto v1.2.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
+github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da h1:KjTM2ks9d14ZYCvmHS9iAKVt9AyzRSqNU1qabPih5BY=
+github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da/go.mod h1:eHEWzANqSiWQsof+nXEI9bUVUyV6F53Fp89EuCh2EAA=
 github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
 github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
@@ -23,69 +25,58 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
-github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
-github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
-github.com/charmbracelet/bubbletea v1.3.4/go.mod h1:dtcUCyCGEX3g9tosuYiut3MXgY/Jsv9nKVdibKKRRXo=
-github.com/charmbracelet/colorprofile v0.3.0 h1:KtLh9uuu1RCt+Hml4s6Hz+kB1PfV3wi++1h5ia65yKQ=
-github.com/charmbracelet/colorprofile v0.3.0/go.mod h1:oHJ340RS2nmG1zRGPmhJKJ/jf4FPNNk0P39/wBPA1G0=
-github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
-github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
-github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
-github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
-github.com/charmbracelet/x/cellbuf v0.0.13/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
-github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
-github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/charmbracelet/bubbles v0.16.1 h1:6uzpAAaT9ZqKssntbvZMlksWHruQLNxg49H5WdeuYSY=
+github.com/charmbracelet/bubbles v0.16.1/go.mod h1:2QCp9LFlEsBQMvIYERr7Ww2H2bA7xen1idUDIzm/+Xc=
+github.com/charmbracelet/bubbletea v0.25.0 h1:bAfwk7jRz7FKFl9RzlIULPkStffg5k6pNt5dywy4TcM=
+github.com/charmbracelet/bubbletea v0.25.0/go.mod h1:EN3QDR1T5ZdWmdfDzYcqOCAps45+QIJbLOBxmVNWNNg=
+github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZpc5Kc1E=
+github.com/charmbracelet/lipgloss v0.7.1/go.mod h1:yG0k3giv8Qj8edTCbbg6AlQ5e8KNWpFujkNawKNhE2c=
 github.com/cheggaaa/pb v1.0.29 h1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo=
 github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30=
-github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
-github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
-github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
-github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
+github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
+github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
+github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
+github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
-github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
-github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
-github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
+github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU=
+github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0=
+github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU=
+github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
-github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
-github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
-github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
-github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
+github.com/gliderlabs/ssh v0.3.7 h1:iV3Bqi942d9huXnzEF2Mt+CY9gLu8DNM4Obd+8bODRE=
+github.com/gliderlabs/ssh v0.3.7/go.mod h1:zpHEXBstFnQYtGnB8k8kQLol82umzn/2/snG7alWVD8=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
-github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
+github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
+github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
-github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-git/go-git/v5 v5.12.0 h1:7Md+ndsjrzZxbddRDZjF14qK+NN56sy6wkqaVrjZtys=
+github.com/go-git/go-git/v5 v5.12.0/go.mod h1:FTM9VKtnI2m65hNI/TenDDDnUf2Q9FHnXYjuz9i5OEY=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang/glog v1.2.4 h1:CNNw5U8lSiiBk7druxtSHHTsRWcxKoac6kZKm2peBBc=
-github.com/golang/glog v1.2.4/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
-github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
+github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
+github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU=
@@ -95,8 +86,8 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/hcl/v2 v2.23.0 h1:Fphj1/gCylPxHutVSEOf2fBOh1VE4AuLV7+kbJf3qos=
-github.com/hashicorp/hcl/v2 v2.23.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
+github.com/hashicorp/hcl/v2 v2.19.1 h1://i05Jqznmb2EXqa39Nsvyan2o5XyMowW5fnCKW5RPI=
+github.com/hashicorp/hcl/v2 v2.19.1/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
@@ -125,8 +116,9 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
-github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
@@ -135,10 +127,12 @@ github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D
 github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
 github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
-github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
-github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
-github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
-github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
+github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
+github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
+github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
+github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
+github.com/onsi/gomega v1.31.1 h1:KYppCUK+bUgAZwHOu7EXVBKyQA6ILvOESHkn/tgoqvo=
+github.com/onsi/gomega v1.31.1/go.mod h1:y40C95dwAD1Nz36SsEnxvfFe8FFfNxzI5eJ0EYGyAy0=
 github.com/opentracing/basictracer-go v1.1.0 h1:Oa1fTSBvAl8pa3U+IJYqrKm0NALwH9OsgwOqDv4xJW0=
 github.com/opentracing/basictracer-go v1.1.0/go.mod h1:V2HZueSJEp879yv285Aap1BS69fQMD+MNP1mRs6mBQc=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
@@ -146,30 +140,28 @@ github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pgavlin/fx v0.1.6 h1:r9jEg69DhNoCd3Xh0+5mIbdbS3PqWrVWujkY76MFRTU=
 github.com/pgavlin/fx v0.1.6/go.mod h1:KWZJ6fqBBSh8GxHYqwYCf3rYE7Gp2p0N8tJp8xv9u9M=
-github.com/pgavlin/fx/v2 v2.0.3 h1:ZBVklTFjxcWvBVPE+ti5qwnmTIQ0Gq6nuj3J5RKDtKk=
-github.com/pgavlin/fx/v2 v2.0.3/go.mod h1:Cvnwqq0BopdHUJ7CU50h1XPeKrF4ZwdFj1nJLXbAjCE=
-github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
-github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
+github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
+github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
 github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.20.0 h1:LZn4sjAsI76x10ZuZXXyh2ExGcP7AHmjOzCi/p3/fpQ=
-github.com/pulumi/esc v0.20.0/go.mod h1:h1VjdedI0K84MhMzaR9ZKbEpU6SfZMOZF4ZrVgQyNLY=
-github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12 h1:uzmw+0iic764m0Yvh4I/jRV1x3q49dVh5Ctq9RllsQ8=
-github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12/go.mod h1:6zFMe786NvFDO03BVJwdw1R/Yms4F6vAU49iBHo8zbQ=
-github.com/pulumi/pulumi/sdk/v3 v3.192.0 h1:sfHuR3P02wSbV3xdSMEQ0+uC/HzlMz0YfKrVAXy1hSQ=
-github.com/pulumi/pulumi/sdk/v3 v3.192.0/go.mod h1:aV0+c5xpSYccWKmOjTZS9liYCqh7+peu3cQgSXu7CJw=
+github.com/pulumi/esc v0.9.1 h1:HH5eEv8sgyxSpY5a8yePyqFXzA8cvBvapfH8457+mIs=
+github.com/pulumi/esc v0.9.1/go.mod h1:oEJ6bOsjYlQUpjf70GiX+CXn3VBmpwFDxUTlmtUN84c=
+github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.0-20240425180359-26c144c916b7 h1:elp7Ar01zvIJtRQv+megjeGSfpxxzPYyKBGfDDtWFBA=
+github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.0-20240425180359-26c144c916b7/go.mod h1:48lEA1mq2tRC4SfASAJmLYG1hRWM5sP5VPFeoZEM54U=
+github.com/pulumi/pulumi/sdk/v3 v3.128.0 h1:5VPFfygxt6rva0bEYVQZXxsGAo2/D1wsb9erGOtXxzk=
+github.com/pulumi/pulumi/sdk/v3 v3.128.0/go.mod h1:p1U24en3zt51agx+WlNboSOV8eLlPWYAkxMzVEXKbnY=
+github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
-github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
+github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
@@ -178,82 +170,83 @@ github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPO
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
-github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
+github.com/skeema/knownhosts v1.2.2 h1:Iug2P4fLmDw9f41PB6thxUkNUkJzB5i+1/exaj40L3A=
+github.com/skeema/knownhosts v1.2.2/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0 h1:4G4v2dO3VZwixGIRoQ5Lfboy6nUhCyYzaqnIAPPhYs4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/texttheater/golang-levenshtein v1.0.1 h1:+cRNoVrfiwufQPhoMzB6N0Yf/Mqajr6t1lOv8GyGE2U=
 github.com/texttheater/golang-levenshtein v1.0.1/go.mod h1:PYAKrbF5sAiq9wd+H82hs7gNaen0CplQ9uvm6+enD/8=
+github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 h1:X9dsIWPuuEJlPX//UmRKophhOKCGXc46RVIGuttks68=
+github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7/go.mod h1:UxoP3EypF8JfGEjAII8jx1q8rQyDnX8qdTCs/UQBVIE=
 github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaOOb6ThwMmTEbhRwtKR97o=
 github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
 github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg=
 github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
 github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/zclconf/go-cty v1.16.2 h1:LAJSwc3v81IRBZyUVQDUdZ7hs3SYs9jv0eZJDWHD/70=
-github.com/zclconf/go-cty v1.16.2/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
-go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
-go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
-go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
-go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
-go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
-go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
-go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
-go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
-go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
-go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
-go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zclconf/go-cty v1.14.1 h1:t9fyA35fwjjUMcmL5hLER+e/rEPqrbCK1/OSE4SI9KA=
+github.com/zclconf/go-cty v1.14.1/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
+go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q=
-golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4=
-golang.org/x/exp v0.0.0-20250718183923-645b1fa84792 h1:R9PFI6EUdfVKgwKjZef7QIwGcBKu86OEFpJ9nUEP2l4=
-golang.org/x/exp v0.0.0-20250718183923-645b1fa84792/go.mod h1:A+z0yzpGtvnG90cToK5n2tu8UJVP2XUATh+r+sfOOOc=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
+golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 h1:LoYXNGAShUG3m/ehNk4iFctuhGX/+R1ZpfJ4/ia80JM=
+golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8/go.mod h1:jj3sYF3dwk5D+ghuXyeI3r5MFf+NT2An6/9dOA95KSI=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
-golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0=
+golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
-golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
-golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -262,38 +255,52 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
-golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
-golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
-golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
-golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA=
+golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
-google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
-google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 h1:8EeVk1VKMD+GD/neyEHGmz7pFblqPjHoi+PGQIlLx2s=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
+google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
+google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -306,7 +313,7 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-lukechampine.com/frand v1.5.1 h1:fg0eRtdmGFIxhP5zQJzM1lFDbD6CUfu/f+7WgAZd5/w=
-lukechampine.com/frand v1.5.1/go.mod h1:4VstaWc2plN4Mjr10chUD46RAVGWhpkZ5Nja8+Azp0Q=
+lukechampine.com/frand v1.4.2 h1:RzFIpOvkMXuPMBb9maa4ND4wjBn71E1Jpf8BzJHMaVw=
+lukechampine.com/frand v1.4.2/go.mod h1:4S/TM2ZgrKejMcKMbeLjISpJMO+/eZ1zu3vYX9dtj3s=
 pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw=
 pgregory.net/rapid v1.1.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=

examples/nodejs/package.json

@@ -5,6 +5,6 @@
   },
   "dependencies": {
     "typescript": "^4.0.0",
-    "@pulumi/pulumi": "3.209.0"
+    "@pulumi/pulumi": "^3.128.0"
   }
 }

examples/nodejs_test.go

@@ -9,18 +9,12 @@ import (
 	"math/rand"
 	"os"
 	"path"
-	"path/filepath"
 	"strings"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/ecr"
-	"github.com/pulumi/providertest"
-	"github.com/pulumi/providertest/optproviderupgrade"
-	"github.com/pulumi/providertest/pulumitest"
-	"github.com/pulumi/providertest/pulumitest/assertpreview"
-	"github.com/pulumi/providertest/pulumitest/opttest"
 	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -41,30 +35,6 @@ func TestNodeExample(t *testing.T) {
 	integration.ProgramTest(t, &test)
 }
 
-func TestNodeExampleUpgrade(t *testing.T) {
-	t.Parallel()
-	var (
-		providerName    string = "docker-build"
-		baselineVersion string = "0.0.7"
-	)
-
-	cwd, err := os.Getwd()
-	require.NoError(t, err)
-
-	options := []opttest.Option{
-		opttest.DownloadProviderVersion(providerName, baselineVersion),
-		opttest.LocalProviderPath(providerName, filepath.Join(cwd, "..", "bin")),
-		opttest.YarnLink("@pulumi/docker-build"),
-		opttest.TestInPlace(),
-	}
-
-	test := pulumitest.NewPulumiTest(t, filepath.Join(cwd, "upgrade-node"), options...)
-	result := providertest.PreviewProviderUpgrade(t, test, providerName, baselineVersion,
-		optproviderupgrade.DisableAttach())
-
-	assertpreview.HasNoReplacements(t, result)
-}
-
 // TestCaching simulates a slow build with --cache-to enabled. We aren't able
 // to directly detect cache hits, so we re-run the update and confirm it took
 // less time than the image originally took to build.
@@ -128,6 +98,7 @@ func TestCaching(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			if tt.skip {
 				t.Skip("Missing environment variables")
@@ -176,19 +147,6 @@ func TestCaching(t *testing.T) {
 	}
 }
 
-func TestConfig(t *testing.T) {
-	cwd, err := os.Getwd()
-	require.NoError(t, err)
-
-	test := integration.ProgramTestOptions{
-		Dir:                    path.Join(cwd, "tests", "config"),
-		Dependencies:           []string{"@pulumi/docker-build"},
-		SkipEmptyPreviewUpdate: true,
-	}
-
-	integration.ProgramTest(t, &test)
-}
-
 type ECR struct {
 	address  string
 	username string

examples/python/__main__.py

@@ -5,151 +5,151 @@ config = pulumi.Config()
 docker_hub_password = config.require("dockerHubPassword")
 multi_platform = docker_build.Image("multiPlatform",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.multiPlatform",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.multiPlatform",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     platforms=[
         docker_build.Platform.PLAN9_AMD64,
         docker_build.Platform.PLAN9_386,
     ])
 registry_push = docker_build.Image("registryPush",
     push=False,
-    context={
-        "location": "./app",
-    },
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     tags=["docker.io/pulumibot/buildkit-e2e:example"],
-    exports=[{
-        "registry": {
-            "oci_media_types": True,
-            "push": False,
-        },
-    }],
-    registries=[{
-        "address": "docker.io",
-        "username": "pulumibot",
-        "password": docker_hub_password,
-    }])
+    exports=[docker_build.ExportArgs(
+        registry=docker_build.ExportRegistryArgs(
+            oci_media_types=True,
+            push=False,
+        ),
+    )],
+    registries=[docker_build.RegistryArgs(
+        address="docker.io",
+        username="pulumibot",
+        password=docker_hub_password,
+    )])
 cached = docker_build.Image("cached",
     push=False,
-    context={
-        "location": "./app",
-    },
-    cache_to=[{
-        "local": {
-            "dest": "tmp/cache",
-            "mode": docker_build.CacheMode.MAX,
-        },
-    }],
-    cache_from=[{
-        "local": {
-            "src": "tmp/cache",
-        },
-    }])
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
+    cache_to=[docker_build.CacheToArgs(
+        local=docker_build.CacheToLocalArgs(
+            dest="tmp/cache",
+            mode=docker_build.CacheMode.MAX,
+        ),
+    )],
+    cache_from=[docker_build.CacheFromArgs(
+        local=docker_build.CacheFromLocalArgs(
+            src="tmp/cache",
+        ),
+    )])
 build_args = docker_build.Image("buildArgs",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.buildArgs",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.buildArgs",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     build_args={
         "SET_ME_TO_TRUE": "true",
     })
 extra_hosts = docker_build.Image("extraHosts",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.extraHosts",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.extraHosts",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     add_hosts=["metadata.google.internal:169.254.169.254"])
 ssh_mount = docker_build.Image("sshMount",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.sshMount",
-    },
-    context={
-        "location": "./app",
-    },
-    ssh=[{
-        "id": "default",
-    }])
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.sshMount",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
+    ssh=[docker_build.SSHArgs(
+        id="default",
+    )])
 secrets = docker_build.Image("secrets",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.secrets",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.secrets",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     secrets={
         "password": "hunter2",
     })
 labels = docker_build.Image("labels",
     push=False,
-    context={
-        "location": "./app",
-    },
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     labels={
         "description": "This image will get a descriptive label 👍",
     })
 target = docker_build.Image("target",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.target",
-    },
-    context={
-        "location": "./app",
-    },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.target",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
     target="build-me")
 named_contexts = docker_build.Image("namedContexts",
     push=False,
-    dockerfile={
-        "location": "./app/Dockerfile.namedContexts",
-    },
-    context={
-        "location": "./app",
-        "named": {
-            "golang:latest": {
-                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
-            },
+    dockerfile=docker_build.DockerfileArgs(
+        location="./app/Dockerfile.namedContexts",
+    ),
+    context=docker_build.BuildContextArgs(
+        location="./app",
+        named={
+            "golang:latest": docker_build.ContextArgs(
+                location="docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
+            ),
         },
-    })
+    ))
 remote_context = docker_build.Image("remoteContext",
     push=False,
-    context={
-        "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile",
-    })
+    context=docker_build.BuildContextArgs(
+        location="https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile",
+    ))
 remote_context_with_inline = docker_build.Image("remoteContextWithInline",
     push=False,
-    dockerfile={
-        "inline": """FROM busybox
+    dockerfile=docker_build.DockerfileArgs(
+        inline="""FROM busybox
 COPY hello.c ./
 """,
-    },
-    context={
-        "location": "https://github.com/docker-library/hello-world.git",
-    })
+    ),
+    context=docker_build.BuildContextArgs(
+        location="https://github.com/docker-library/hello-world.git",
+    ))
 inline = docker_build.Image("inline",
     push=False,
-    dockerfile={
-        "inline": """FROM alpine
+    dockerfile=docker_build.DockerfileArgs(
+        inline="""FROM alpine
 RUN echo "This uses an inline Dockerfile! 👍"
 """,
-    })
+    ))
 docker_load = docker_build.Image("dockerLoad",
     push=False,
-    context={
-        "location": "./app",
-    },
-    exports=[{
-        "docker": {
-            "tar": True,
-        },
-    }])
+    context=docker_build.BuildContextArgs(
+        location="./app",
+    ),
+    exports=[docker_build.ExportArgs(
+        docker=docker_build.ExportDockerArgs(
+            tar=True,
+        ),
+    )])
 pulumi.export("platforms", multi_platform.platforms)

examples/testdata/recorded/TestProviderUpgrade/upgrade-node/0.0.7/grpc.json

@@ -1,20 +0,0 @@
-{"method":"/pulumirpc.LanguageRuntime/GetPluginInfo","request":{},"response":{"version":"3.145.0-dev.0"}}
-{"method":"/pulumirpc.LanguageRuntime/GetRequiredPackages","request":{"info":{"entryPoint":".","options":{},"programDirectory":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node","rootDirectory":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node"}},"response":{"packages":[{"kind":"resource","name":"docker-build","version":"v0.1.0-alpha.0+dev"}]}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"transforms"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"deletedWith"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"invokeTransforms"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"resourceReferences"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"aliasSpecs"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"secrets"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"parameterization"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/SupportsFeature","request":{"id":"outputValues"},"response":{"hasSupport":true}}
-{"method":"/pulumirpc.ResourceMonitor/RegisterResource","request":{"acceptResources":true,"acceptSecrets":true,"aliasSpecs":true,"customTimeouts":{},"name":"provider-docker-build-test","object":{},"sourcePosition":{"column":23,"line":38,"uri":"file:///private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node/node_modules/@pulumi/runtime/stack.ts"},"supportsPartialValues":true,"supportsResultReporting":true,"type":"pulumi:pulumi:Stack"},"response":{"object":{},"urn":"urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test"}}
-{"method":"/pulumirpc.ResourceMonitor/RegisterResourceOutputs","request":{"outputs":{},"urn":"urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test"},"response":{}}
-{"method":"/pulumirpc.ResourceProvider/Handshake","request":{"engineAddress":"127.0.0.1:56051","programDirectory":"/Users/rquitales/.pulumi/plugins/resource-docker-build-v0.0.7","rootDirectory":"/Users/rquitales/.pulumi/plugins/resource-docker-build-v0.0.7"}}
-{"method":"/pulumirpc.ResourceProvider/GetPluginInfo","request":{},"response":{"version":"v0.0.7"}}
-{"method":"/pulumirpc.ResourceProvider/CheckConfig","request":{"name":"default_0_1_0_alpha_0_dev","news":{"version":"0.1.0-alpha.0+dev"},"olds":{},"type":"pulumi:providers:docker-build","urn":"urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default_0_1_0_alpha_0_dev"},"response":{"inputs":{"host":""}}}
-{"method":"/pulumirpc.ResourceProvider/Configure","request":{"acceptResources":true,"acceptSecrets":true,"args":{"host":""},"sendsOldInputs":true,"sendsOldInputsToDelete":true,"variables":{"docker-build:config:host":""}},"response":{"acceptOutputs":true,"acceptResources":true,"acceptSecrets":true,"supportsPreview":true}}
-{"method":"/pulumirpc.ResourceProvider/Check","request":{"name":"inline","news":{"buildOnPreview":true,"dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n"},"network":"default","push":false},"olds":{},"randomSeed":"gfcHtIMoX4qpk2cxRceOJcYDaSsHyPNBhhd8lYTFcqw=","type":"docker-build:index:Image","urn":"urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline"},"response":{"inputs":{"buildOnPreview":true,"context":{"location":"."},"dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n","location":""},"exec":false,"load":false,"network":"default","noCache":false,"pull":false,"push":false,"target":""}}}
-{"method":"/pulumirpc.ResourceProvider/Create","request":{"name":"inline","properties":{"buildOnPreview":true,"context":{"location":"."},"dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n","location":""},"exec":false,"load":false,"network":"default","noCache":false,"pull":false,"push":false,"target":""},"type":"docker-build:index:Image","urn":"urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline"},"response":{"id":"inline","properties":{"buildOnPreview":true,"context":{"location":"."},"contextHash":"a9db789a55c8ad91fe04e176aefcf0b74f86636ae12e7cd475421416672da8c1","digest":"","dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n","location":""},"exec":false,"load":false,"network":"default","noCache":false,"pull":false,"push":false,"ref":"","target":""}}}
-{"method":"/pulumirpc.ResourceMonitor/RegisterResource","request":{"acceptResources":true,"acceptSecrets":true,"aliasSpecs":true,"custom":true,"customTimeouts":{},"name":"inline","object":{"buildOnPreview":true,"dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n"},"network":"default","push":false},"parent":"urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test","propertyDependencies":{"buildOnPreview":{},"dockerfile":{},"network":{},"push":{}},"sourcePosition":{"column":16,"line":4,"uri":"file:///private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node/index.ts"},"supportsPartialValues":true,"supportsResultReporting":true,"type":"docker-build:index:Image","version":"0.1.0-alpha.0+dev"},"response":{"id":"inline","object":{"buildOnPreview":true,"context":{"location":"."},"contextHash":"a9db789a55c8ad91fe04e176aefcf0b74f86636ae12e7cd475421416672da8c1","digest":"","dockerfile":{"inline":"FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n","location":""},"exec":false,"load":false,"network":"default","noCache":false,"pull":false,"push":false,"ref":"","target":""},"urn":"urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline"}}
-{"method":"/pulumirpc.LanguageRuntime/Run","request":{"configPropertyMap":{},"info":{"entryPoint":".","options":{},"programDirectory":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node","rootDirectory":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node"},"loaderTarget":"127.0.0.1:56055","monitorAddress":"127.0.0.1:56054","organization":"organization","parallel":40,"program":".","project":"provider-docker-build","pwd":"/private/var/folders/xl/bqjwsf01315fs4yp20dj3x640000gn/T/TestNodeExampleUpgrade4279645683/006/upgrade-node","stack":"test"},"response":{}}

examples/testdata/recorded/TestProviderUpgrade/upgrade-node/0.0.7/stack.json

@@ -1,96 +0,0 @@
-{
-  "version": 3,
-  "deployment": {
-    "manifest": {
-      "time": "2025-01-14T12:40:32.429451-08:00",
-      "magic": "7c53c69df7094e39d5562ed2abf1e12099c2c54a7b9b411faca1dcb7ec1fef8a",
-      "version": "v3.145.0"
-    },
-    "secrets_providers": {
-      "type": "passphrase",
-      "state": {
-        "salt": "v1:EuqbHY9lEXg=:v1:xNv8Pt7D2Pf/iDkg:tOvHbUIXPITf+BgbbjqPZaWIqKD8jQ=="
-      }
-    },
-    "resources": [
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "custom": false,
-        "type": "pulumi:pulumi:Stack",
-        "created": "2025-01-14T20:40:27.082534Z",
-        "modified": "2025-01-14T20:40:27.082534Z",
-        "sourcePosition": "project:///node_modules/@pulumi/runtime/stack.ts#38,23"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default_0_1_0_alpha_0_dev",
-        "custom": true,
-        "id": "04f4e431-4d74-43f1-86d5-52d410f3f6e8",
-        "type": "pulumi:providers:docker-build",
-        "inputs": {
-          "__internal": {},
-          "host": ""
-        },
-        "outputs": {
-          "host": ""
-        },
-        "created": "2025-01-14T20:40:28.862159Z",
-        "modified": "2025-01-14T20:40:28.862159Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline",
-        "custom": true,
-        "id": "inline",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "."
-          },
-          "dockerfile": {
-            "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "."
-          },
-          "contextHash": "a9db789a55c8ad91fe04e176aefcf0b74f86636ae12e7cd475421416672da8c1",
-          "digest": "",
-          "dockerfile": {
-            "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default_0_1_0_alpha_0_dev::04f4e431-4d74-43f1-86d5-52d410f3f6e8",
-        "propertyDependencies": {
-          "buildOnPreview": [],
-          "dockerfile": [],
-          "network": [],
-          "push": []
-        },
-        "created": "2025-01-14T20:40:32.357012Z",
-        "modified": "2025-01-14T20:40:32.357012Z",
-        "sourcePosition": "project:///index.ts#4,16"
-      }
-    ],
-    "metadata": {}
-  }
-}

examples/testdata/recorded/TestProviderUpgrade/upgrade/0.0.1/stack.json

@@ -1,944 +0,0 @@
-{
-  "version": 3,
-  "deployment": {
-    "manifest": {
-      "time": "2024-06-18T15:10:50.439881-07:00",
-      "magic": "",
-      "version": ""
-    },
-    "secrets_providers": {
-      "type": "passphrase",
-      "state": {
-        "salt": "v1:uRYnzeN15MA=:v1:rpAZ+oxUTuiNyCpF:KQmWj5xMhsTrE2XhW35Gd1XoMW7RDg=="
-      }
-    },
-    "resources": [
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "custom": false,
-        "type": "pulumi:pulumi:Stack",
-        "outputs": {
-          "platforms": [
-            "plan9/amd64",
-            "plan9/386"
-          ]
-        },
-        "created": "2024-06-18T22:10:48.091797Z",
-        "modified": "2024-06-18T22:10:48.091797Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default",
-        "custom": true,
-        "id": "b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "type": "pulumi:providers:docker-build",
-        "inputs": {
-          "host": ""
-        },
-        "outputs": {
-          "host": ""
-        },
-        "created": "2024-06-18T22:10:48.187658Z",
-        "modified": "2024-06-18T22:10:48.187658Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::secrets",
-        "custom": true,
-        "id": "secrets",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.secrets"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "secrets": {
-            "password": "hunter2"
-          },
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "5c1561571a60aa3b5a234a9c26f69e2ba5d9a18624f426109d36a1d729b23a21",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.secrets"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "secrets": {
-            "password": "hunter2"
-          },
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": [],
-          "secrets": []
-        },
-        "created": "2024-06-18T22:10:50.181453Z",
-        "modified": "2024-06-18T22:10:50.181453Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::buildArgs",
-        "custom": true,
-        "id": "buildArgs",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildArgs": {
-            "SET_ME_TO_TRUE": "true"
-          },
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.buildArgs"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildArgs": {
-            "SET_ME_TO_TRUE": "true"
-          },
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "55695ddcfb4d08a0d78d1a74c7b0141dada73ed05bc4b056ba29a51e42c83381",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.buildArgs"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "buildArgs": [],
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.182348Z",
-        "modified": "2024-06-18T22:10:50.182348Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::sshMount",
-        "custom": true,
-        "id": "sshMount",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.sshMount"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ssh": [
-            {
-              "id": "default"
-            }
-          ],
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "71d21b382ab9ee0324ad820ce57a0a4318342a0a244931f51fc46b791f1b37e9",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.sshMount"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "ssh": [
-            {
-              "id": "default"
-            }
-          ],
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": [],
-          "ssh": []
-        },
-        "created": "2024-06-18T22:10:50.182807Z",
-        "modified": "2024-06-18T22:10:50.182807Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::remoteContext",
-        "custom": true,
-        "id": "remoteContext",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
-          },
-          "contextHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.18341Z",
-        "modified": "2024-06-18T22:10:50.18341Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::registryPush",
-        "custom": true,
-        "id": "sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "exports": [
-            {
-              "disabled": false,
-              "raw": "",
-              "registry": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "danglingNamePrefix": "",
-                "forceCompression": false,
-                "ociMediaTypes": true,
-                "push": false,
-                "store": true
-              }
-            }
-          ],
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "tags": [
-            "docker.io/pulumibot/buildkit-e2e:example"
-          ],
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
-          "digest": "sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "exports": [
-            {
-              "disabled": false,
-              "raw": "",
-              "registry": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "danglingNamePrefix": "",
-                "forceCompression": false,
-                "ociMediaTypes": true,
-                "push": false,
-                "store": true
-              }
-            }
-          ],
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "docker.io/pulumibot/buildkit-e2e:example@sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
-          "tags": [
-            "docker.io/pulumibot/buildkit-e2e:example"
-          ],
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "exports": [],
-          "push": [],
-          "tags": []
-        },
-        "created": "2024-06-18T22:10:50.183668Z",
-        "modified": "2024-06-18T22:10:50.183668Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::dockerLoad",
-        "custom": true,
-        "id": "sha256:ec5d5c149823f61d56f5666d494d19c4edca42cfe4b578e640f57bf2429716a4",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "exports": [
-            {
-              "disabled": false,
-              "docker": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "dest": "",
-                "forceCompression": false,
-                "ociMediaTypes": false,
-                "tar": true
-              },
-              "raw": ""
-            }
-          ],
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
-          "digest": "sha256:ec5d5c149823f61d56f5666d494d19c4edca42cfe4b578e640f57bf2429716a4",
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "exports": [
-            {
-              "disabled": false,
-              "docker": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "dest": "",
-                "forceCompression": false,
-                "ociMediaTypes": false,
-                "tar": true
-              },
-              "raw": ""
-            }
-          ],
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "exports": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.183874Z",
-        "modified": "2024-06-18T22:10:50.183874Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::labels",
-        "custom": true,
-        "id": "labels",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "labels": {
-            "description": "This image will get a descriptive label 👍"
-          },
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "labels": {
-            "description": "This image will get a descriptive label 👍"
-          },
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "labels": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.183996Z",
-        "modified": "2024-06-18T22:10:50.183996Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::inline",
-        "custom": true,
-        "id": "inline",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "36c67969e6700e87bde75fcf604a7db1fa9593194718fc0ae1c498df43228aec",
-          "digest": "",
-          "dockerfile": {
-            "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.184088Z",
-        "modified": "2024-06-18T22:10:50.184088Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::target",
-        "custom": true,
-        "id": "target",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.target"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": "build-me"
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "fefadf795b6b4b119e97a87067a25f52a16cc3375223acad7b3f642fdcd413fc",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.target"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": "build-me"
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": [],
-          "target": []
-        },
-        "created": "2024-06-18T22:10:50.18426Z",
-        "modified": "2024-06-18T22:10:50.18426Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::cached",
-        "custom": true,
-        "id": "cached",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "cacheFrom": [
-            {
-              "disabled": false,
-              "local": {
-                "digest": "",
-                "src": "tmp/cache"
-              },
-              "raw": ""
-            }
-          ],
-          "cacheTo": [
-            {
-              "disabled": false,
-              "local": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "dest": "tmp/cache",
-                "forceCompression": false,
-                "ignoreError": false,
-                "mode": "max"
-              },
-              "raw": ""
-            }
-          ],
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "cacheFrom": [
-            {
-              "disabled": false,
-              "local": {
-                "digest": "",
-                "src": "tmp/cache"
-              },
-              "raw": ""
-            }
-          ],
-          "cacheTo": [
-            {
-              "disabled": false,
-              "local": {
-                "compression": "gzip",
-                "compressionLevel": 0,
-                "dest": "tmp/cache",
-                "forceCompression": false,
-                "ignoreError": false,
-                "mode": "max"
-              },
-              "raw": ""
-            }
-          ],
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "app/Dockerfile"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "cacheFrom": [],
-          "cacheTo": [],
-          "context": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.206842Z",
-        "modified": "2024-06-18T22:10:50.206842Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::multiPlatform",
-        "custom": true,
-        "id": "multiPlatform",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.multiPlatform"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "platforms": [
-            "plan9/amd64",
-            "plan9/386"
-          ],
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "c7ecf546ed2402de04f2dfa56ca4adb6fd490eed4219d7f1b2e559cd475f1755",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.multiPlatform"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "platforms": [
-            "plan9/amd64",
-            "plan9/386"
-          ],
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "platforms": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.257528Z",
-        "modified": "2024-06-18T22:10:50.257528Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::extraHosts",
-        "custom": true,
-        "id": "extraHosts",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "addHosts": [
-            "metadata.google.internal:169.254.169.254"
-          ],
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.extraHosts"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "addHosts": [
-            "metadata.google.internal:169.254.169.254"
-          ],
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app"
-          },
-          "contextHash": "e5d510d9ce39d91260e3aa7f8c81d7517a76165eb35e7134cae2f3e4e9fcb712",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.extraHosts"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "addHosts": [],
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.274264Z",
-        "modified": "2024-06-18T22:10:50.274264Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::remoteContextWithInline",
-        "custom": true,
-        "id": "remoteContextWithInline",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "https://github.com/docker-library/hello-world.git"
-          },
-          "dockerfile": {
-            "inline": "FROM busybox\nCOPY hello.c ./\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "https://github.com/docker-library/hello-world.git"
-          },
-          "contextHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-          "digest": "",
-          "dockerfile": {
-            "inline": "FROM busybox\nCOPY hello.c ./\n",
-            "location": ""
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.332506Z",
-        "modified": "2024-06-18T22:10:50.332506Z"
-      },
-      {
-        "urn": "urn:pulumi:test::provider-docker-build::docker-build:index:Image::namedContexts",
-        "custom": true,
-        "id": "namedContexts",
-        "type": "docker-build:index:Image",
-        "inputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app",
-            "named": {
-              "golang:latest": {
-                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
-              }
-            }
-          },
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.namedContexts"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "target": ""
-        },
-        "outputs": {
-          "buildOnPreview": true,
-          "context": {
-            "location": "./app",
-            "named": {
-              "golang:latest": {
-                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
-              }
-            }
-          },
-          "contextHash": "3adfaaf17fbb548f06310e76d2826bccb223b49463504d0cc4fe86b0eef5d47d",
-          "digest": "",
-          "dockerfile": {
-            "inline": "",
-            "location": "./app/Dockerfile.namedContexts"
-          },
-          "exec": false,
-          "load": false,
-          "network": "default",
-          "noCache": false,
-          "pull": false,
-          "push": false,
-          "ref": "",
-          "target": ""
-        },
-        "parent": "urn:pulumi:test::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-test",
-        "provider": "urn:pulumi:test::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
-        "propertyDependencies": {
-          "context": [],
-          "dockerfile": [],
-          "push": []
-        },
-        "created": "2024-06-18T22:10:50.422524Z",
-        "modified": "2024-06-18T22:10:50.422524Z"
-      }
-    ]
-  }
-}

examples/testdata/recorded/TestProviderUpgrade/upgrade/0.0.1/state.json

@@ -0,0 +1,944 @@
+{
+    "version": 3,
+    "deployment": {
+        "manifest": {
+            "time": "2024-06-18T15:10:50.439881-07:00",
+            "magic": "",
+            "version": ""
+        },
+        "secrets_providers": {
+            "type": "passphrase",
+            "state": {
+                "salt": "v1:uRYnzeN15MA=:v1:rpAZ+oxUTuiNyCpF:KQmWj5xMhsTrE2XhW35Gd1XoMW7RDg=="
+            }
+        },
+        "resources": [
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "custom": false,
+                "type": "pulumi:pulumi:Stack",
+                "outputs": {
+                    "platforms": [
+                        "plan9/amd64",
+                        "plan9/386"
+                    ]
+                },
+                "created": "2024-06-18T22:10:48.091797Z",
+                "modified": "2024-06-18T22:10:48.091797Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default",
+                "custom": true,
+                "id": "b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "type": "pulumi:providers:docker-build",
+                "inputs": {
+                    "host": ""
+                },
+                "outputs": {
+                    "host": ""
+                },
+                "created": "2024-06-18T22:10:48.187658Z",
+                "modified": "2024-06-18T22:10:48.187658Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::secrets",
+                "custom": true,
+                "id": "secrets",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.secrets"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "secrets": {
+                        "password": "hunter2"
+                    },
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "5c1561571a60aa3b5a234a9c26f69e2ba5d9a18624f426109d36a1d729b23a21",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.secrets"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "secrets": {
+                        "password": "hunter2"
+                    },
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": [],
+                    "secrets": []
+                },
+                "created": "2024-06-18T22:10:50.181453Z",
+                "modified": "2024-06-18T22:10:50.181453Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::buildArgs",
+                "custom": true,
+                "id": "buildArgs",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildArgs": {
+                        "SET_ME_TO_TRUE": "true"
+                    },
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.buildArgs"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildArgs": {
+                        "SET_ME_TO_TRUE": "true"
+                    },
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "55695ddcfb4d08a0d78d1a74c7b0141dada73ed05bc4b056ba29a51e42c83381",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.buildArgs"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "buildArgs": [],
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.182348Z",
+                "modified": "2024-06-18T22:10:50.182348Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::sshMount",
+                "custom": true,
+                "id": "sshMount",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.sshMount"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ssh": [
+                        {
+                            "id": "default"
+                        }
+                    ],
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "71d21b382ab9ee0324ad820ce57a0a4318342a0a244931f51fc46b791f1b37e9",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.sshMount"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "ssh": [
+                        {
+                            "id": "default"
+                        }
+                    ],
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": [],
+                    "ssh": []
+                },
+                "created": "2024-06-18T22:10:50.182807Z",
+                "modified": "2024-06-18T22:10:50.182807Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::remoteContext",
+                "custom": true,
+                "id": "remoteContext",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
+                    },
+                    "contextHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.18341Z",
+                "modified": "2024-06-18T22:10:50.18341Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::registryPush",
+                "custom": true,
+                "id": "sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "exports": [
+                        {
+                            "disabled": false,
+                            "raw": "",
+                            "registry": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "danglingNamePrefix": "",
+                                "forceCompression": false,
+                                "ociMediaTypes": true,
+                                "push": false,
+                                "store": true
+                            }
+                        }
+                    ],
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "tags": [
+                        "docker.io/pulumibot/buildkit-e2e:example"
+                    ],
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
+                    "digest": "sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "exports": [
+                        {
+                            "disabled": false,
+                            "raw": "",
+                            "registry": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "danglingNamePrefix": "",
+                                "forceCompression": false,
+                                "ociMediaTypes": true,
+                                "push": false,
+                                "store": true
+                            }
+                        }
+                    ],
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "docker.io/pulumibot/buildkit-e2e:example@sha256:0d286c8339e2bc4e166585dcda28a501fb08c8f991c2293209faa78a13bfb79a",
+                    "tags": [
+                        "docker.io/pulumibot/buildkit-e2e:example"
+                    ],
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "exports": [],
+                    "push": [],
+                    "tags": []
+                },
+                "created": "2024-06-18T22:10:50.183668Z",
+                "modified": "2024-06-18T22:10:50.183668Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::dockerLoad",
+                "custom": true,
+                "id": "sha256:ec5d5c149823f61d56f5666d494d19c4edca42cfe4b578e640f57bf2429716a4",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "exports": [
+                        {
+                            "disabled": false,
+                            "docker": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "dest": "",
+                                "forceCompression": false,
+                                "ociMediaTypes": false,
+                                "tar": true
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
+                    "digest": "sha256:ec5d5c149823f61d56f5666d494d19c4edca42cfe4b578e640f57bf2429716a4",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "exports": [
+                        {
+                            "disabled": false,
+                            "docker": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "dest": "",
+                                "forceCompression": false,
+                                "ociMediaTypes": false,
+                                "tar": true
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "exports": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.183874Z",
+                "modified": "2024-06-18T22:10:50.183874Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::labels",
+                "custom": true,
+                "id": "labels",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "labels": {
+                        "description": "This image will get a descriptive label 👍"
+                    },
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "labels": {
+                        "description": "This image will get a descriptive label 👍"
+                    },
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "labels": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.183996Z",
+                "modified": "2024-06-18T22:10:50.183996Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::inline",
+                "custom": true,
+                "id": "inline",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "36c67969e6700e87bde75fcf604a7db1fa9593194718fc0ae1c498df43228aec",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.184088Z",
+                "modified": "2024-06-18T22:10:50.184088Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::target",
+                "custom": true,
+                "id": "target",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.target"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": "build-me"
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "fefadf795b6b4b119e97a87067a25f52a16cc3375223acad7b3f642fdcd413fc",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.target"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": "build-me"
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": [],
+                    "target": []
+                },
+                "created": "2024-06-18T22:10:50.18426Z",
+                "modified": "2024-06-18T22:10:50.18426Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::cached",
+                "custom": true,
+                "id": "cached",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "cacheFrom": [
+                        {
+                            "disabled": false,
+                            "local": {
+                                "digest": "",
+                                "src": "tmp/cache"
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "cacheTo": [
+                        {
+                            "disabled": false,
+                            "local": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "dest": "tmp/cache",
+                                "forceCompression": false,
+                                "ignoreError": false,
+                                "mode": "max"
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "cacheFrom": [
+                        {
+                            "disabled": false,
+                            "local": {
+                                "digest": "",
+                                "src": "tmp/cache"
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "cacheTo": [
+                        {
+                            "disabled": false,
+                            "local": {
+                                "compression": "gzip",
+                                "compressionLevel": 0,
+                                "dest": "tmp/cache",
+                                "forceCompression": false,
+                                "ignoreError": false,
+                                "mode": "max"
+                            },
+                            "raw": ""
+                        }
+                    ],
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e569495ad1cfde07d0e769ab9b5ed56b889508f299d2e7a90400caf9e12795d5",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "app/Dockerfile"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "cacheFrom": [],
+                    "cacheTo": [],
+                    "context": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.206842Z",
+                "modified": "2024-06-18T22:10:50.206842Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::multiPlatform",
+                "custom": true,
+                "id": "multiPlatform",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.multiPlatform"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "platforms": [
+                        "plan9/amd64",
+                        "plan9/386"
+                    ],
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "c7ecf546ed2402de04f2dfa56ca4adb6fd490eed4219d7f1b2e559cd475f1755",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.multiPlatform"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "platforms": [
+                        "plan9/amd64",
+                        "plan9/386"
+                    ],
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "platforms": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.257528Z",
+                "modified": "2024-06-18T22:10:50.257528Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::extraHosts",
+                "custom": true,
+                "id": "extraHosts",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "addHosts": [
+                        "metadata.google.internal:169.254.169.254"
+                    ],
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.extraHosts"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "addHosts": [
+                        "metadata.google.internal:169.254.169.254"
+                    ],
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app"
+                    },
+                    "contextHash": "e5d510d9ce39d91260e3aa7f8c81d7517a76165eb35e7134cae2f3e4e9fcb712",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.extraHosts"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "addHosts": [],
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.274264Z",
+                "modified": "2024-06-18T22:10:50.274264Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::remoteContextWithInline",
+                "custom": true,
+                "id": "remoteContextWithInline",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "https://github.com/docker-library/hello-world.git"
+                    },
+                    "dockerfile": {
+                        "inline": "FROM busybox\nCOPY hello.c ./\n",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "https://github.com/docker-library/hello-world.git"
+                    },
+                    "contextHash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "FROM busybox\nCOPY hello.c ./\n",
+                        "location": ""
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.332506Z",
+                "modified": "2024-06-18T22:10:50.332506Z"
+            },
+            {
+                "urn": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::docker-build:index:Image::namedContexts",
+                "custom": true,
+                "id": "namedContexts",
+                "type": "docker-build:index:Image",
+                "inputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app",
+                        "named": {
+                            "golang:latest": {
+                                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
+                            }
+                        }
+                    },
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.namedContexts"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "target": ""
+                },
+                "outputs": {
+                    "buildOnPreview": true,
+                    "context": {
+                        "location": "./app",
+                        "named": {
+                            "golang:latest": {
+                                "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
+                            }
+                        }
+                    },
+                    "contextHash": "3adfaaf17fbb548f06310e76d2826bccb223b49463504d0cc4fe86b0eef5d47d",
+                    "digest": "",
+                    "dockerfile": {
+                        "inline": "",
+                        "location": "./app/Dockerfile.namedContexts"
+                    },
+                    "exec": false,
+                    "load": false,
+                    "network": "default",
+                    "noCache": false,
+                    "pull": false,
+                    "push": false,
+                    "ref": "",
+                    "target": ""
+                },
+                "parent": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:pulumi:Stack::provider-docker-build-p-it-bryces-wor-upgrade-7b788721",
+                "provider": "urn:pulumi:p-it-bryces-wor-upgrade-7b788721::provider-docker-build::pulumi:providers:docker-build::default::b62bb809-b83b-42cb-889c-46d524de5fe7",
+                "propertyDependencies": {
+                    "context": [],
+                    "dockerfile": [],
+                    "push": []
+                },
+                "created": "2024-06-18T22:10:50.422524Z",
+                "modified": "2024-06-18T22:10:50.422524Z"
+            }
+        ]
+    }
+}

examples/tests/caching/package.json

@@ -4,6 +4,6 @@
     "@types/node": "^20.0.0"
   },
   "dependencies": {
-    "@pulumi/pulumi": "3.209.0"
+    "@pulumi/pulumi": "^3.128.0"
   }
 }

examples/tests/caching/yarn.lock

@@ -204,112 +204,107 @@
     proc-log "^4.0.0"
     which "^4.0.0"
 
-"@opentelemetry/api-logs@0.55.0":
-  version "0.55.0"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/api-logs/-/api-logs-0.55.0.tgz#5cd7461820d864600250deb3803c32367a6bb2d2"
-  integrity sha512-3cpa+qI45VHYcA5c0bHM6VHo9gicv3p5mlLHNG3rLyjQU8b7e0st1rWtrUn3JbZ3DwwCfhKop4eQ9UuYlC6Pkg==
+"@opentelemetry/api-logs@0.52.1":
+  version "0.52.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/api-logs/-/api-logs-0.52.1.tgz#52906375da4d64c206b0c4cb8ffa209214654ecc"
+  integrity sha512-qnSqB2DQ9TPP96dl8cDubDvrUyWc0/sK81xHTK8eSUspzDM3bsewX903qclQFvVhgStjRWdC5bLb3kQqMkfV5A==
   dependencies:
-    "@opentelemetry/api" "^1.3.0"
+    "@opentelemetry/api" "^1.0.0"
 
-"@opentelemetry/api@^1.3.0", "@opentelemetry/api@^1.9":
+"@opentelemetry/api@^1.0.0", "@opentelemetry/api@^1.9":
   version "1.9.0"
   resolved "https://registry.yarnpkg.com/@opentelemetry/api/-/api-1.9.0.tgz#d03eba68273dc0f7509e2a3d5cba21eae10379fe"
   integrity sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==
 
-"@opentelemetry/context-async-hooks@1.30.1":
-  version "1.30.1"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/context-async-hooks/-/context-async-hooks-1.30.1.tgz#4f76280691a742597fd0bf682982126857622948"
-  integrity sha512-s5vvxXPVdjqS3kTLKMeBMvop9hbWkwzBpu+mUO2M7sZtlkyDJGwFe33wRKnbaYDo8ExRVBIIdwIGrqpxHuKttA==
+"@opentelemetry/context-async-hooks@1.25.1":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/context-async-hooks/-/context-async-hooks-1.25.1.tgz#810bff2fcab84ec51f4684aff2d21f6c057d9e73"
+  integrity sha512-UW/ge9zjvAEmRWVapOP0qyCvPulWU6cQxGxDbWEFfGOj1VBBZAuOqTo3X6yWmDTD3Xe15ysCZChHncr2xFMIfQ==
 
-"@opentelemetry/core@1.30.1":
-  version "1.30.1"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/core/-/core-1.30.1.tgz#a0b468bb396358df801881709ea38299fc30ab27"
-  integrity sha512-OOCM2C/QIURhJMuKaekP3TRBxBKxG/TWWA0TL2J6nXUtDnuCtccy49LUJF8xPFXMX+0LMcxFpCo8M9cGY1W6rQ==
+"@opentelemetry/core@1.25.1":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/core/-/core-1.25.1.tgz#ff667d939d128adfc7c793edae2f6bca177f829d"
+  integrity sha512-GeT/l6rBYWVQ4XArluLVB6WWQ8flHbdb6r2FCHC3smtdOAbrJBIv35tpV/yp9bmYUJf+xmZpu9DRTIeJVhFbEQ==
   dependencies:
-    "@opentelemetry/semantic-conventions" "1.28.0"
+    "@opentelemetry/semantic-conventions" "1.25.1"
 
-"@opentelemetry/exporter-zipkin@^1.28":
-  version "1.30.1"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/exporter-zipkin/-/exporter-zipkin-1.30.1.tgz#d96213a38d201ef2d50c3ba29faeb6e579f70e77"
-  integrity sha512-6S2QIMJahIquvFaaxmcwpvQQRD/YFaMTNoIxrfPIPOeITN+a8lfEcPDxNxn8JDAaxkg+4EnXhz8upVDYenoQjA==
+"@opentelemetry/exporter-zipkin@^1.25":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/exporter-zipkin/-/exporter-zipkin-1.25.1.tgz#81bb3b3aa16500676277c2fd6d50159eaf6c081a"
+  integrity sha512-RmOwSvkimg7ETwJbUOPTMhJm9A9bG1U8s7Zo3ajDh4zM7eYcycQ0dM7FbLD6NXWbI2yj7UY4q8BKinKYBQksyw==
   dependencies:
-    "@opentelemetry/core" "1.30.1"
-    "@opentelemetry/resources" "1.30.1"
-    "@opentelemetry/sdk-trace-base" "1.30.1"
-    "@opentelemetry/semantic-conventions" "1.28.0"
+    "@opentelemetry/core" "1.25.1"
+    "@opentelemetry/resources" "1.25.1"
+    "@opentelemetry/sdk-trace-base" "1.25.1"
+    "@opentelemetry/semantic-conventions" "1.25.1"
 
-"@opentelemetry/instrumentation-grpc@^0.55":
-  version "0.55.0"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/instrumentation-grpc/-/instrumentation-grpc-0.55.0.tgz#b5161359060999f7ccbef26d6550beef021572fa"
-  integrity sha512-n2ZH4pRwOy0Vhag/3eKqiyDBwcpUnGgJI9iiIRX7vivE0FMncaLazWphNFezRRaM/LuKwq1TD8pVUvieP68mow==
+"@opentelemetry/instrumentation-grpc@^0.52":
+  version "0.52.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/instrumentation-grpc/-/instrumentation-grpc-0.52.1.tgz#906ce4756a0eb1b050cd89b6b97dc09efe3ae3e3"
+  integrity sha512-EdSDiDSAO+XRXk/ZN128qQpBo1I51+Uay/LUPcPQhSRGf7fBPIEUBeOLQiItguGsug5MGOYjql2w/1wCQF3fdQ==
   dependencies:
-    "@opentelemetry/instrumentation" "0.55.0"
-    "@opentelemetry/semantic-conventions" "1.27.0"
+    "@opentelemetry/instrumentation" "0.52.1"
+    "@opentelemetry/semantic-conventions" "1.25.1"
 
-"@opentelemetry/instrumentation@0.55.0", "@opentelemetry/instrumentation@^0.55":
-  version "0.55.0"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/instrumentation/-/instrumentation-0.55.0.tgz#ecac8afd8706f6e99b3bb6951b9e07c4c81533f0"
-  integrity sha512-YDCMlaQRZkziLL3t6TONRgmmGxDx6MyQDXRD0dknkkgUZtOK5+8MWft1OXzmNu6XfBOdT12MKN5rz+jHUkafKQ==
+"@opentelemetry/instrumentation@0.52.1", "@opentelemetry/instrumentation@^0.52":
+  version "0.52.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/instrumentation/-/instrumentation-0.52.1.tgz#2e7e46a38bd7afbf03cf688c862b0b43418b7f48"
+  integrity sha512-uXJbYU/5/MBHjMp1FqrILLRuiJCs3Ofk0MeRDk8g1S1gD47U8X3JnSwcMO1rtRo1x1a7zKaQHaoYu49p/4eSKw==
   dependencies:
-    "@opentelemetry/api-logs" "0.55.0"
-    "@types/shimmer" "^1.2.0"
+    "@opentelemetry/api-logs" "0.52.1"
+    "@types/shimmer" "^1.0.2"
     import-in-the-middle "^1.8.1"
     require-in-the-middle "^7.1.1"
     semver "^7.5.2"
     shimmer "^1.2.1"
 
-"@opentelemetry/propagator-b3@1.30.1":
-  version "1.30.1"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/propagator-b3/-/propagator-b3-1.30.1.tgz#b73321e5f30f062a9229887a4aa80c771107fdd2"
-  integrity sha512-oATwWWDIJzybAZ4pO76ATN5N6FFbOA1otibAVlS8v90B4S1wClnhRUk7K+2CHAwN1JKYuj4jh/lpCEG5BAqFuQ==
+"@opentelemetry/propagator-b3@1.25.1":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/propagator-b3/-/propagator-b3-1.25.1.tgz#653ee5f3f0f223c000907c1559c89c0a208819f7"
+  integrity sha512-p6HFscpjrv7//kE+7L+3Vn00VEDUJB0n6ZrjkTYHrJ58QZ8B3ajSJhRbCcY6guQ3PDjTbxWklyvIN2ojVbIb1A==
   dependencies:
-    "@opentelemetry/core" "1.30.1"
+    "@opentelemetry/core" "1.25.1"
 
-"@opentelemetry/propagator-jaeger@1.30.1":
-  version "1.30.1"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/propagator-jaeger/-/propagator-jaeger-1.30.1.tgz#c06c9dacbe818b80cfb13c4dbf0b57df1ad26b71"
-  integrity sha512-Pj/BfnYEKIOImirH76M4hDaBSx6HyZ2CXUqk+Kj02m6BB80c/yo4BdWkn/1gDFfU+YPY+bPR2U0DKBfdxCKwmg==
+"@opentelemetry/propagator-jaeger@1.25.1":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/propagator-jaeger/-/propagator-jaeger-1.25.1.tgz#7eae165921e65dce6f8d87339379880125dab765"
+  integrity sha512-nBprRf0+jlgxks78G/xq72PipVK+4or9Ypntw0gVZYNTCSK8rg5SeaGV19tV920CMqBD/9UIOiFr23Li/Q8tiA==
   dependencies:
-    "@opentelemetry/core" "1.30.1"
+    "@opentelemetry/core" "1.25.1"
 
-"@opentelemetry/resources@1.30.1", "@opentelemetry/resources@^1.28":
-  version "1.30.1"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/resources/-/resources-1.30.1.tgz#a4eae17ebd96947fdc7a64f931ca4b71e18ce964"
-  integrity sha512-5UxZqiAgLYGFjS4s9qm5mBVo433u+dSPUFWVWXmLAD4wB65oMCoXaJP1KJa9DIYYMeHu3z4BZcStG3LC593cWA==
+"@opentelemetry/resources@1.25.1", "@opentelemetry/resources@^1.25":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/resources/-/resources-1.25.1.tgz#bb9a674af25a1a6c30840b755bc69da2796fefbb"
+  integrity sha512-pkZT+iFYIZsVn6+GzM0kSX+u3MSLCY9md+lIJOoKl/P+gJFfxJte/60Usdp8Ce4rOs8GduUpSPNe1ddGyDT1sQ==
   dependencies:
-    "@opentelemetry/core" "1.30.1"
-    "@opentelemetry/semantic-conventions" "1.28.0"
+    "@opentelemetry/core" "1.25.1"
+    "@opentelemetry/semantic-conventions" "1.25.1"
 
-"@opentelemetry/sdk-trace-base@1.30.1", "@opentelemetry/sdk-trace-base@^1.28":
-  version "1.30.1"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/sdk-trace-base/-/sdk-trace-base-1.30.1.tgz#41a42234096dc98e8f454d24551fc80b816feb34"
-  integrity sha512-jVPgBbH1gCy2Lb7X0AVQ8XAfgg0pJ4nvl8/IiQA6nxOsPvS+0zMJaFSs2ltXe0J6C8dqjcnpyqINDJmU30+uOg==
+"@opentelemetry/sdk-trace-base@1.25.1", "@opentelemetry/sdk-trace-base@^1.25":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/sdk-trace-base/-/sdk-trace-base-1.25.1.tgz#cbc1e60af255655d2020aa14cde17b37bd13df37"
+  integrity sha512-C8k4hnEbc5FamuZQ92nTOp8X/diCY56XUTnMiv9UTuJitCzaNNHAVsdm5+HLCdI8SLQsLWIrG38tddMxLVoftw==
   dependencies:
-    "@opentelemetry/core" "1.30.1"
-    "@opentelemetry/resources" "1.30.1"
-    "@opentelemetry/semantic-conventions" "1.28.0"
+    "@opentelemetry/core" "1.25.1"
+    "@opentelemetry/resources" "1.25.1"
+    "@opentelemetry/semantic-conventions" "1.25.1"
 
-"@opentelemetry/sdk-trace-node@^1.28":
-  version "1.30.1"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/sdk-trace-node/-/sdk-trace-node-1.30.1.tgz#bd7d68fcfb4d4ae76ea09810df9668b7dd09a2e5"
-  integrity sha512-cBjYOINt1JxXdpw1e5MlHmFRc5fgj4GW/86vsKFxJCJ8AL4PdVtYH41gWwl4qd4uQjqEL1oJVrXkSy5cnduAnQ==
+"@opentelemetry/sdk-trace-node@^1.25":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/sdk-trace-node/-/sdk-trace-node-1.25.1.tgz#856063bef1167ae74139199338c24fb958838ff3"
+  integrity sha512-nMcjFIKxnFqoez4gUmihdBrbpsEnAX/Xj16sGvZm+guceYE0NE00vLhpDVK6f3q8Q4VFI5xG8JjlXKMB/SkTTQ==
   dependencies:
-    "@opentelemetry/context-async-hooks" "1.30.1"
-    "@opentelemetry/core" "1.30.1"
-    "@opentelemetry/propagator-b3" "1.30.1"
-    "@opentelemetry/propagator-jaeger" "1.30.1"
-    "@opentelemetry/sdk-trace-base" "1.30.1"
+    "@opentelemetry/context-async-hooks" "1.25.1"
+    "@opentelemetry/core" "1.25.1"
+    "@opentelemetry/propagator-b3" "1.25.1"
+    "@opentelemetry/propagator-jaeger" "1.25.1"
+    "@opentelemetry/sdk-trace-base" "1.25.1"
     semver "^7.5.2"
 
-"@opentelemetry/semantic-conventions@1.27.0":
-  version "1.27.0"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/semantic-conventions/-/semantic-conventions-1.27.0.tgz#1a857dcc95a5ab30122e04417148211e6f945e6c"
-  integrity sha512-sAay1RrB+ONOem0OZanAR1ZI/k7yDpnOQSQmTMuGImUQb2y8EbSaCJ94FQluM74xoU03vlb2d2U90hZluL6nQg==
-
-"@opentelemetry/semantic-conventions@1.28.0":
-  version "1.28.0"
-  resolved "https://registry.yarnpkg.com/@opentelemetry/semantic-conventions/-/semantic-conventions-1.28.0.tgz#337fb2bca0453d0726696e745f50064411f646d6"
-  integrity sha512-lp4qAiMTD4sNWW4DbKLBkfiMZ4jbAboJIGOQr5DvciMRI494OapieI9qiODpOt0XBr1LjIDy1xAGAnVs5supTA==
+"@opentelemetry/semantic-conventions@1.25.1", "@opentelemetry/semantic-conventions@^1.25":
+  version "1.25.1"
+  resolved "https://registry.yarnpkg.com/@opentelemetry/semantic-conventions/-/semantic-conventions-1.25.1.tgz#0deecb386197c5e9c2c28f2f89f51fb8ae9f145e"
+  integrity sha512-ZDjMJJQRlyk8A1KZFCc+bCbsyrn1wTwdNt56F7twdfUfnHUZUq77/WfONCj8p72NZOyP7pNTdUWSTYC3GTbuuQ==
 
 "@pkgjs/parseargs@^0.11.0":
   version "0.11.0"
@@ -369,30 +364,32 @@
   resolved "https://registry.yarnpkg.com/@protobufjs/utf8/-/utf8-1.1.0.tgz#a777360b5b39a1a2e5106f8e858f2fd2d060c570"
   integrity sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==
 
-"@pulumi/pulumi@3.209.0":
-  version "3.209.0"
-  resolved "https://registry.yarnpkg.com/@pulumi/pulumi/-/pulumi-3.209.0.tgz#b65e45d11ee66ca235f85b9474a130bdc2eae4b8"
-  integrity sha512-rGEYl+EO1deSFBbkymNc3/pWH5IFU1195zcxAqj6YTCaF0Wf1Y5Kx4A8TxULpa1gUCKESOQyv01OAY5HXtpBGg==
+"@pulumi/pulumi@^3.128.0":
+  version "3.128.0"
+  resolved "https://registry.yarnpkg.com/@pulumi/pulumi/-/pulumi-3.128.0.tgz#cb44cb904e9be1e36c7697215c2f91d4e58c0031"
+  integrity sha512-Xqe5uYp1RpDihK3VbdBFR4q1h+ICg/2Xgg1d7aYWmPqBCIUG4jWddLS0REQO60EsgKBNarXhLeQSmaWXLgiq9w==
   dependencies:
     "@grpc/grpc-js" "^1.10.1"
     "@logdna/tail-file" "^2.0.6"
     "@npmcli/arborist" "^7.3.1"
     "@opentelemetry/api" "^1.9"
-    "@opentelemetry/exporter-zipkin" "^1.28"
-    "@opentelemetry/instrumentation" "^0.55"
-    "@opentelemetry/instrumentation-grpc" "^0.55"
-    "@opentelemetry/resources" "^1.28"
-    "@opentelemetry/sdk-trace-base" "^1.28"
-    "@opentelemetry/sdk-trace-node" "^1.28"
+    "@opentelemetry/exporter-zipkin" "^1.25"
+    "@opentelemetry/instrumentation" "^0.52"
+    "@opentelemetry/instrumentation-grpc" "^0.52"
+    "@opentelemetry/resources" "^1.25"
+    "@opentelemetry/sdk-trace-base" "^1.25"
+    "@opentelemetry/sdk-trace-node" "^1.25"
+    "@opentelemetry/semantic-conventions" "^1.25"
+    "@pulumi/query" "^0.3.0"
     "@types/google-protobuf" "^3.15.5"
     "@types/semver" "^7.5.6"
     "@types/tmp" "^0.2.6"
     execa "^5.1.0"
     fdir "^6.1.1"
-    google-protobuf "^3.21.4"
+    google-protobuf "^3.5.0"
     got "^11.8.6"
     ini "^2.0.0"
-    js-yaml "^3.14.2"
+    js-yaml "^3.14.0"
     minimist "^1.2.6"
     normalize-package-data "^6.0.0"
     picomatch "^3.0.1"
@@ -400,9 +397,14 @@
     require-from-string "^2.0.1"
     semver "^7.5.2"
     source-map-support "^0.5.6"
-    tmp "^0.2.4"
+    tmp "^0.2.1"
     upath "^1.1.0"
 
+"@pulumi/query@^0.3.0":
+  version "0.3.0"
+  resolved "https://registry.yarnpkg.com/@pulumi/query/-/query-0.3.0.tgz#f496608e86a18c3dd31b6c533408e2441c29071d"
+  integrity sha512-xfo+yLRM2zVjVEA4p23IjQWzyWl1ZhWOGobsBqRpIarzLvwNH/RAGaoehdxlhx4X92302DrpdIFgTICMN4P38w==
+
 "@sigstore/bundle@^2.3.2":
   version "2.3.2"
   resolved "https://registry.yarnpkg.com/@sigstore/bundle/-/bundle-2.3.2.tgz#ad4dbb95d665405fd4a7a02c8a073dbd01e4e95e"
@@ -527,7 +529,7 @@
   resolved "https://registry.yarnpkg.com/@types/semver/-/semver-7.5.8.tgz#8268a8c57a3e4abd25c165ecd36237db7948a55e"
   integrity sha512-I8EUhyrgfLrcTkzV3TSsGyl1tSuPrEDzr0yd5m90UgNxQkyDXULk3b6MlQqTCpZpNtWe1K0hzclnZkTcLBe2UQ==
 
-"@types/shimmer@^1.2.0":
+"@types/shimmer@^1.0.2":
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/@types/shimmer/-/shimmer-1.2.0.tgz#9b706af96fa06416828842397a70dfbbf1c14ded"
   integrity sha512-UE7oxhQLLd9gub6JKIAhDq06T0F6FnztwMNRvYgjeQSBeMc1ZG/tA47EwfduvkuQS8apbkM/lpLpWsaCeYsXVg==
@@ -883,7 +885,7 @@ glob@^10.2.2, glob@^10.3.10:
     package-json-from-dist "^1.0.0"
     path-scurry "^1.11.1"
 
-google-protobuf@^3.21.4:
+google-protobuf@^3.5.0:
   version "3.21.4"
   resolved "https://registry.yarnpkg.com/google-protobuf/-/google-protobuf-3.21.4.tgz#2f933e8b6e5e9f8edde66b7be0024b68f77da6c9"
   integrity sha512-MnG7N936zcKTco4Jd2PX2U96Kf9PxygAPKBug+74LHzmHXmceN16MmRcdgZv+DGef/S9YvQAfRsNCn4cjf9yyQ==
@@ -1051,10 +1053,10 @@ jackspeak@^3.1.2:
   optionalDependencies:
     "@pkgjs/parseargs" "^0.11.0"
 
-js-yaml@^3.14.2:
-  version "3.14.2"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.14.2.tgz#77485ce1dd7f33c061fd1b16ecea23b55fcb04b0"
-  integrity sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==
+js-yaml@^3.14.0:
+  version "3.14.1"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.14.1.tgz#dae812fdb3825fa306609a8717383c50c36a0537"
+  integrity sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==
   dependencies:
     argparse "^1.0.7"
     esprima "^4.0.0"
@@ -1735,16 +1737,7 @@ ssri@^10.0.0, ssri@^10.0.6:
   dependencies:
     minipass "^7.0.3"
 
-"string-width-cjs@npm:string-width@^4.2.0":
-  version "4.2.3"
-  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
-  integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
-  dependencies:
-    emoji-regex "^8.0.0"
-    is-fullwidth-code-point "^3.0.0"
-    strip-ansi "^6.0.1"
-
-string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
+"string-width-cjs@npm:string-width@^4.2.0", string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
   version "4.2.3"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
   integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
@@ -1762,14 +1755,7 @@ string-width@^5.0.1, string-width@^5.1.2:
     emoji-regex "^9.2.2"
     strip-ansi "^7.0.1"
 
-"strip-ansi-cjs@npm:strip-ansi@^6.0.1":
-  version "6.0.1"
-  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
-  integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
-  dependencies:
-    ansi-regex "^5.0.1"
-
-strip-ansi@^6.0.0, strip-ansi@^6.0.1:
+"strip-ansi-cjs@npm:strip-ansi@^6.0.1", strip-ansi@^6.0.0, strip-ansi@^6.0.1:
   version "6.0.1"
   resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
   integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
@@ -1805,10 +1791,10 @@ tar@^6.1.11, tar@^6.2.1:
     mkdirp "^1.0.3"
     yallist "^4.0.0"
 
-tmp@^0.2.4:
-  version "0.2.5"
-  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.5.tgz#b06bcd23f0f3c8357b426891726d16015abfd8f8"
-  integrity sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==
+tmp@^0.2.1:
+  version "0.2.3"
+  resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.3.tgz#eb783cc22bc1e8bebd0671476d46ea4eb32a79ae"
+  integrity sha512-nZD7m9iCPC5g0pYmcaxogYKggSfLsdxl8of3Q/oIbqCqLLIO9IAF0GWjX1z9NZRHPiXv8Wex4yDCaZsgEw0Y8w==
 
 treeverse@^3.0.0:
   version "3.0.0"
@@ -1890,16 +1876,7 @@ which@^4.0.0:
   dependencies:
     isexe "^3.1.1"
 
-"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
-  version "7.0.0"
-  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
-  integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
-  dependencies:
-    ansi-styles "^4.0.0"
-    string-width "^4.1.0"
-    strip-ansi "^6.0.0"
-
-wrap-ansi@^7.0.0:
+"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0", wrap-ansi@^7.0.0:
   version "7.0.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
   integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==

examples/tests/config/Pulumi.yaml

@@ -1,3 +0,0 @@
-name: test-buildx-config
-runtime: nodejs
-description: A minimal TypeScript Pulumi program

examples/tests/config/index.ts

@@ -1,5 +0,0 @@
-import * as buildx from "@pulumi/docker-build";
-
-new buildx.Provider("with-structured-config", {
-  registries: [{ username: "foo", password: "bar", address: "docker.io" }],
-});

examples/tests/config/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "test-buildx-caching",
-  "devDependencies": {
-    "@types/node": "^20.0.0"
-  },
-  "dependencies": {
-    "@pulumi/pulumi": "3.209.0"
-  }
-}

examples/upgrade-node/Pulumi.yaml

@@ -1,6 +0,0 @@
-name: provider-docker-build
-runtime: nodejs
-plugins:
-  providers:
-    - name: docker-build
-      path: ../../bin

examples/upgrade-node/index.ts

@@ -1,11 +0,0 @@
-import * as pulumi from "@pulumi/pulumi";
-import * as docker_build from "@pulumi/docker-build";
-
-const inline = new docker_build.Image("inline", {
-  push: false,
-  dockerfile: {
-    inline: `FROM alpine
-RUN echo "This uses an inline Dockerfile! 👍"
-`,
-  },
-});

examples/upgrade-node/package.json

@@ -1,10 +0,0 @@
-{
-  "name": "provider-docker-build",
-  "devDependencies": {
-    "@types/node": "^18"
-  },
-  "dependencies": {
-    "typescript": "^4.0.0",
-    "@pulumi/pulumi": "3.209.0"
-  }
-}

examples/upgrade-node/tsconfig.json

@@ -1,18 +0,0 @@
-{
-	"compilerOptions": {
-		"strict": true,
-		"outDir": "bin",
-		"target": "es2016",
-		"module": "commonjs",
-		"moduleResolution": "node",
-		"sourceMap": true,
-		"experimentalDecorators": true,
-		"pretty": true,
-		"noFallthroughCasesInSwitch": true,
-		"noImplicitReturns": true,
-		"forceConsistentCasingInFileNames": true
-	},
-	"files": [
-		"index.ts",
-	]
-}

examples/upgrade/Pulumi.yaml

@@ -1,5 +1,9 @@
 name: provider-docker-build
 runtime: yaml
+plugins:
+  providers:
+    - name: docker-build
+      path: ../../bin
 
 resources:
   # docker buildx build -f app/Dockerfile.multiPlatform --platform plan9/amd64,plan9/386 app

examples/yaml_test.go

@@ -1,21 +1,17 @@
-//go:build yaml || all
-// +build yaml all
+//go:build java || all
+// +build java all
 
 package examples
 
 import (
 	"os"
 	"path"
+	"path/filepath"
 	"testing"
 
 	"github.com/pulumi/providertest"
-	"github.com/pulumi/providertest/providers"
-	"github.com/pulumi/providertest/pulumitest"
-	"github.com/pulumi/providertest/pulumitest/assertpreview"
-	"github.com/pulumi/providertest/pulumitest/opttest"
 	"github.com/pulumi/pulumi-docker-build/provider"
 	"github.com/pulumi/pulumi/pkg/v3/testing/integration"
-	pulumirpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
 	"github.com/stretchr/testify/require"
 )
 
@@ -34,15 +30,25 @@ func TestYAMLExample(t *testing.T) {
 }
 
 func TestYAMLExampleUpgrade(t *testing.T) {
-	pt := pulumitest.NewPulumiTest(t, "upgrade",
-		opttest.AttachProviderServer("docker-build", providerServerFactory))
-	previewResult := providertest.PreviewProviderUpgrade(t, pt, "docker-build", "0.0.1")
+	// t.Setenv("PULUMI_PROVIDER_TEST_MODE", "snapshot")
 
-	assertpreview.HasNoChanges(t, previewResult)
-}
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
 
-func providerServerFactory(pt providers.PulumiTest) (pulumirpc.ResourceProviderServer, error) {
-	return provider.New(nil)
+	bin, err := filepath.Abs("../bin")
+	require.NoError(t, err)
+
+	t.Setenv("PATH", bin+":"+os.Getenv("PATH"))
+	p, err := provider.New(nil)
+	require.NoError(t, err)
+
+	test := providertest.NewProviderTest(path.Join(cwd, "upgrade"),
+		providertest.WithProviderName("docker-build"),
+		providertest.WithBaselineVersion("0.0.1"),
+		providertest.WithResourceProviderServer(p),
+		// providertest.WithConfig("dockerHubPassword", os.Getenv("DOCKER_HUB_PASSWORD")), // Doesn't support secrets yet.
+	)
+	test.Run(t)
 }
 
 func TestECR(t *testing.T) {

go.mod

@@ -1,304 +1,183 @@
 module github.com/pulumi/pulumi-docker-build
 
-go 1.24.1
+go 1.21.7
 
 require (
-	github.com/aws/aws-sdk-go v1.55.5
+	github.com/aws/aws-sdk-go v1.54.18
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/distribution/reference v0.6.0
-	github.com/docker/buildx v0.22.0
-	github.com/docker/cli v28.0.4+incompatible
-	github.com/docker/docker v28.0.1+incompatible
-	github.com/golangci/golangci-lint v1.59.1
-	github.com/moby/buildkit v0.20.1
+	github.com/docker/buildx v0.16.0
+	github.com/docker/cli v27.0.3+incompatible
+	github.com/docker/docker v27.1.1+incompatible
+	github.com/moby/buildkit v0.15.0
 	github.com/moby/patternmatcher v0.6.0
 	github.com/muesli/reflow v0.3.0
 	github.com/otiai10/copy v1.14.0
-	github.com/pulumi/providertest v0.3.1
-	github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 v3.0.0-20250806132441-44ca9a522cef
-	github.com/pulumi/pulumi-go-provider v1.1.2
-	github.com/pulumi/pulumi-java/pkg v1.16.0
-	github.com/pulumi/pulumi-yaml v1.21.2
-	github.com/pulumi/pulumi/pkg/v3 v3.192.0
-	github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3 v3.0.0-20250806165243-bee5e4fa4815
-	github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3 v3.0.0-20250806165243-bee5e4fa4815
-	github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3 v3.0.0-20250806165243-bee5e4fa4815
-	github.com/pulumi/pulumi/sdk/v3 v3.192.0
+	github.com/pulumi/providertest v0.0.13
+	github.com/pulumi/pulumi-go-provider v0.21.0
+	github.com/pulumi/pulumi-java/pkg v0.13.0
+	github.com/pulumi/pulumi/pkg/v3 v3.128.0
+	github.com/pulumi/pulumi/sdk/v3 v3.128.0
 	github.com/regclient/regclient v0.7.1
 	github.com/sirupsen/logrus v1.9.3
-	github.com/spf13/afero v1.14.0
-	github.com/stretchr/testify v1.10.0
-	github.com/tonistiigi/fsutil v0.0.0-20250113203817-b14e27f4135a
-	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4
-	go.opentelemetry.io/otel/metric v1.36.0
-	go.opentelemetry.io/otel/sdk v1.36.0
-	go.opentelemetry.io/otel/trace v1.36.0
-	go.uber.org/mock v0.5.2
-	golang.org/x/crypto v0.45.0
-	golang.org/x/exp v0.0.0-20250718183923-645b1fa84792
-	google.golang.org/protobuf v1.36.6
+	github.com/spf13/afero v1.11.0
+	github.com/stretchr/testify v1.9.0
+	github.com/theupdateframework/notary v0.7.0
+	github.com/tonistiigi/fsutil v0.0.0-20240424095704-91a3fc46842c
+	go.uber.org/mock v0.4.0
+	golang.org/x/crypto v0.25.0
+	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8
+	google.golang.org/protobuf v1.34.2
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	4d63.com/gocheckcompilerdirectives v1.2.1 // indirect
-	4d63.com/gochecknoglobals v0.2.1 // indirect
 	cloud.google.com/go v0.112.1 // indirect
-	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	cloud.google.com/go/compute v1.25.1 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	cloud.google.com/go/iam v1.1.6 // indirect
 	cloud.google.com/go/kms v1.15.7 // indirect
 	cloud.google.com/go/logging v1.9.0 // indirect
 	cloud.google.com/go/longrunning v0.5.5 // indirect
 	cloud.google.com/go/storage v1.39.1 // indirect
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/4meepo/tagalign v1.3.4 // indirect
-	github.com/Abirdcfly/dupword v0.0.14 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
-	github.com/AlecAivazis/survey/v2 v2.3.7 // indirect
-	github.com/Antonboom/errname v0.1.13 // indirect
-	github.com/Antonboom/nilnil v0.1.9 // indirect
-	github.com/Antonboom/testifylint v1.3.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.17.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.8.2 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect
+	dario.cat/mergo v1.0.0 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.5.0 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.3.3 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
-	github.com/Crocmagnon/fatcontext v0.2.2 // indirect
-	github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
-	github.com/GaijinEntertainment/go-exhaustruct/v3 v3.2.0 // indirect
-	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/OpenPeeDeeP/depguard/v2 v2.2.0 // indirect
-	github.com/ProtonMail/go-crypto v1.2.0 // indirect
+	github.com/ProtonMail/go-crypto v1.0.0 // indirect
+	github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
-	github.com/alecthomas/chroma v0.10.0 // indirect
-	github.com/alecthomas/chroma/v2 v2.13.0 // indirect
-	github.com/alecthomas/go-check-sumtype v0.1.4 // indirect
-	github.com/alexkohler/nakedret/v2 v2.0.4 // indirect
-	github.com/alexkohler/prealloc v1.0.0 // indirect
-	github.com/alingse/asasalint v0.0.11 // indirect
-	github.com/apparentlymart/go-cidr v1.0.1 // indirect
+	github.com/apparentlymart/go-cidr v1.1.0 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
-	github.com/ashanbrown/forbidigo v1.6.0 // indirect
-	github.com/ashanbrown/makezero v1.1.1 // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.30.3 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.3 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.27.27 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.8 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.26.1 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.11 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/kms v1.30.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.58.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
-	github.com/aws/smithy-go v1.20.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 // indirect
+	github.com/aws/smithy-go v1.20.2 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
-	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bkielbasa/cyclop v1.2.1 // indirect
-	github.com/blizzy78/varnamelen v0.8.0 // indirect
-	github.com/bombsimon/wsl/v4 v4.2.1 // indirect
-	github.com/breml/bidichk v0.2.7 // indirect
-	github.com/breml/errchkjson v0.3.6 // indirect
-	github.com/butuzov/ireturn v0.3.0 // indirect
-	github.com/butuzov/mirror v1.2.0 // indirect
-	github.com/catenacyber/perfsprint v0.7.1 // indirect
-	github.com/ccojocar/zxcvbn-go v1.0.2 // indirect
 	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
-	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charithe/durationcheck v0.0.10 // indirect
-	github.com/charmbracelet/bubbles v0.21.0 // indirect
-	github.com/charmbracelet/bubbletea v1.3.4 // indirect
-	github.com/charmbracelet/colorprofile v0.3.0 // indirect
-	github.com/charmbracelet/glamour v0.6.0 // indirect
-	github.com/charmbracelet/lipgloss v1.1.0 // indirect
-	github.com/charmbracelet/x/ansi v0.8.0 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/chavacava/garif v0.1.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/charmbracelet/bubbles v0.18.0 // indirect
+	github.com/charmbracelet/bubbletea v0.26.4 // indirect
+	github.com/charmbracelet/lipgloss v0.11.0 // indirect
+	github.com/charmbracelet/x/ansi v0.1.2 // indirect
+	github.com/charmbracelet/x/input v0.1.0 // indirect
+	github.com/charmbracelet/x/term v0.1.1 // indirect
+	github.com/charmbracelet/x/windows v0.1.0 // indirect
 	github.com/cheggaaa/pb v1.0.29 // indirect
-	github.com/ckaznocha/intrange v0.1.2 // indirect
-	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/compose-spec/compose-go/v2 v2.4.8 // indirect
+	github.com/cloudflare/circl v1.3.8 // indirect
+	github.com/compose-spec/compose-go/v2 v2.1.3 // indirect
 	github.com/containerd/console v1.0.4 // indirect
-	github.com/containerd/containerd/api v1.8.0 // indirect
-	github.com/containerd/containerd/v2 v2.0.7 // indirect
-	github.com/containerd/continuity v0.4.5 // indirect
-	github.com/containerd/errdefs v1.0.0 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/containerd v1.7.19 // indirect
+	github.com/containerd/containerd/api v1.7.19 // indirect
+	github.com/containerd/continuity v0.4.3 // indirect
+	github.com/containerd/errdefs v0.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v1.0.0-rc.1 // indirect
-	github.com/containerd/ttrpc v1.2.7 // indirect
-	github.com/containerd/typeurl/v2 v2.2.3 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
-	github.com/curioswitch/go-reassign v0.2.0 // indirect
-	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
-	github.com/daixiang0/gci v0.13.4 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/containerd/ttrpc v1.2.5 // indirect
+	github.com/containerd/typeurl/v2 v2.1.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.5 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/deckarep/golang-set/v2 v2.5.0 // indirect
-	github.com/denis-tingaikin/go-header v0.5.0 // indirect
 	github.com/djherbis/times v1.6.0 // indirect
-	github.com/dlclark/regexp2 v1.11.0 // indirect
-	github.com/docker/cli-docs-tool v0.9.0 // indirect
+	github.com/docker/cli-docs-tool v0.8.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/edsrzf/mmap-go v1.2.0 // indirect
+	github.com/edsrzf/mmap-go v1.1.0 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/erikgeiser/promptkit v0.9.0 // indirect
-	github.com/ettle/strcase v0.2.0 // indirect
 	github.com/fatih/color v1.17.0 // indirect
-	github.com/fatih/structtag v1.2.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/firefart/nonamedreturns v1.0.5 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fvbommel/sortorder v1.0.1 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/fzipp/gocyclo v0.6.0 // indirect
-	github.com/ghostiam/protogetter v0.3.6 // indirect
-	github.com/go-critic/go-critic v0.11.4 // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
-	github.com/go-git/go-git/v5 v5.16.0 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.4 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-git/go-billy/v5 v5.5.0 // indirect
+	github.com/go-git/go-git/v5 v5.12.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
-	github.com/go-toolsmith/astcast v1.1.0 // indirect
-	github.com/go-toolsmith/astcopy v1.1.0 // indirect
-	github.com/go-toolsmith/astequal v1.2.0 // indirect
-	github.com/go-toolsmith/astfmt v1.1.0 // indirect
-	github.com/go-toolsmith/astp v1.1.0 // indirect
-	github.com/go-toolsmith/strparse v1.1.0 // indirect
-	github.com/go-toolsmith/typep v1.1.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
-	github.com/go-xmlfmt/xmlfmt v1.1.2 // indirect
-	github.com/gobwas/glob v0.2.3 // indirect
-	github.com/godbus/dbus/v5 v5.1.0 // indirect
-	github.com/gofrs/flock v0.12.1 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
+	github.com/gofrs/flock v0.12.0 // indirect
 	github.com/gofrs/uuid v4.2.0+incompatible // indirect
+	github.com/gogo/googleapis v1.4.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
-	github.com/golang/glog v1.2.4 // indirect
-	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
+	github.com/golang/glog v1.2.1 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/golangci/dupl v0.0.0-20180902072040-3e9179ac440a // indirect
-	github.com/golangci/gofmt v0.0.0-20231018234816-f50ced29576e // indirect
-	github.com/golangci/misspell v0.6.0 // indirect
-	github.com/golangci/modinfo v0.3.4 // indirect
-	github.com/golangci/plugin-module-register v0.1.1 // indirect
-	github.com/golangci/revgrep v0.5.3 // indirect
-	github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/google/wire v0.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.2 // indirect
-	github.com/gordonklaus/ineffassign v0.1.0 // indirect
-	github.com/gorilla/css v1.0.0 // indirect
-	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gorilla/mux v1.8.0 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
-	github.com/gostaticanalysis/comment v1.4.2 // indirect
-	github.com/gostaticanalysis/forcetypeassert v0.1.0 // indirect
-	github.com/gostaticanalysis/nilerr v0.1.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
 	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-cty-funcs v0.0.0-20241120183456-c51673e0b3dd // indirect
+	github.com/hashicorp/go-cty-funcs v0.0.0-20230405223818-a090f58aa992 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.6 // indirect
-	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/hashicorp/hcl/v2 v2.23.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.20.1 // indirect
 	github.com/hashicorp/vault/api v1.12.0 // indirect
-	github.com/hexops/gotextdiff v1.0.3 // indirect
-	github.com/iancoleman/strcase v0.3.0 // indirect
-	github.com/ijc/Gotty v0.0.0-20170406111628-a8b993ba6abd // indirect
+	github.com/iancoleman/strcase v0.2.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/in-toto/in-toto-golang v0.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/iwdgo/sigintwindows v0.2.2 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
-	github.com/jgautheron/goconst v1.7.1 // indirect
-	github.com/jingyugao/rowserrcheck v1.1.1 // indirect
-	github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af // indirect
-	github.com/jjti/go-spancheck v0.6.1 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/jonboulle/clockwork v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/julz/importas v0.1.0 // indirect
-	github.com/karamaru-alpha/copyloopvar v1.1.0 // indirect
-	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/kisielk/errcheck v1.7.0 // indirect
-	github.com/kkHAIKE/contextcheck v1.1.5 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
-	github.com/kulti/thelper v0.6.3 // indirect
-	github.com/kunwardeep/paralleltest v1.0.10 // indirect
+	github.com/klauspost/compress v1.17.9 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
-	github.com/kyoh86/exportloopref v0.1.11 // indirect
-	github.com/lasiar/canonicalheader v1.1.1 // indirect
-	github.com/ldez/gomoddirectives v0.2.4 // indirect
-	github.com/ldez/tagliatelle v0.5.0 // indirect
-	github.com/leonklingele/grouper v1.1.2 // indirect
-	github.com/lib/pq v1.10.9 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
-	github.com/lufeee/execinquery v1.2.1 // indirect
-	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
-	github.com/macabu/inamedparam v0.1.3 // indirect
-	github.com/magiconair/properties v1.8.6 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/maratori/testableexamples v1.0.0 // indirect
-	github.com/maratori/testpackage v1.1.1 // indirect
-	github.com/matoous/godox v0.0.0-20230222163458-006bad1f9d26 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
-	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/mattn/go-shellwords v1.0.12 // indirect
-	github.com/mgechev/revive v1.3.7 // indirect
-	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
-	github.com/microcosm-cc/bluemonday v1.0.21 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
@@ -308,192 +187,124 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/moby v28.3.3+incompatible // indirect
-	github.com/moby/spdystream v0.4.0 // indirect
-	github.com/moby/sys/mountinfo v0.7.2 // indirect
-	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/moby/sys/signal v0.7.1 // indirect
-	github.com/moby/sys/user v0.3.0 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
-	github.com/moby/term v0.5.2 // indirect
+	github.com/moby/spdystream v0.2.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.1 // indirect
+	github.com/moby/sys/sequential v0.5.0 // indirect
+	github.com/moby/sys/signal v0.7.0 // indirect
+	github.com/moby/sys/user v0.1.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/moricho/tparallel v0.3.1 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/muesli/termenv v0.15.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/nakabonne/nestif v0.3.1 // indirect
 	github.com/natefinch/atomic v1.0.1 // indirect
-	github.com/nbutton23/zxcvbn-go v0.0.0-20180912185939-ae427f1e4c1d // indirect
-	github.com/nishanths/exhaustive v0.12.0 // indirect
-	github.com/nishanths/predeclared v0.2.2 // indirect
-	github.com/nunnatsa/ginkgolinter v0.16.2 // indirect
 	github.com/nxadm/tail v1.4.11 // indirect
-	github.com/olekukonko/tablewriter v0.0.5 // indirect
+	github.com/onsi/ginkgo/v2 v2.17.3 // indirect
+	github.com/onsi/gomega v1.33.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/opentracing/basictracer-go v1.1.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
-	github.com/pgavlin/aho-corasick v0.5.1 // indirect
-	github.com/pgavlin/diff v0.0.0-20230503175810-113847418e2e // indirect
+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
 	github.com/pgavlin/fx v0.1.6 // indirect
-	github.com/pgavlin/fx/v2 v2.0.3 // indirect
 	github.com/pgavlin/goldmark v1.1.33-0.20200616210433-b5eb04559386 // indirect
-	github.com/pgavlin/text v0.0.0-20240821195002-b51d0990e284 // indirect
-	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
-	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/polyfloyd/go-errorlint v1.5.2 // indirect
-	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.55.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_golang v1.17.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.44.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.20.0 // indirect
-	github.com/pulumi/inflector v0.2.1 // indirect
-	github.com/quasilyte/go-ruleguard v0.4.2 // indirect
-	github.com/quasilyte/go-ruleguard/dsl v0.3.22 // indirect
-	github.com/quasilyte/gogrep v0.5.0 // indirect
-	github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect
-	github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
+	github.com/pulumi/esc v0.9.1 // indirect
+	github.com/pulumi/inflector v0.1.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
-	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/ryancurrah/gomodguard v1.3.2 // indirect
-	github.com/ryanrolds/sqlclosecheck v0.5.1 // indirect
+	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
-	github.com/sanposhiho/wastedassign/v2 v2.0.7 // indirect
 	github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
-	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
-	github.com/sashamelentyev/usestdlibvars v1.26.0 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
-	github.com/securego/gosec/v2 v2.20.1-0.20240525090044-5f0084eb01a9 // indirect
-	github.com/segmentio/asm v1.2.0 // indirect
-	github.com/segmentio/encoding v0.4.1 // indirect
+	github.com/segmentio/asm v1.1.3 // indirect
+	github.com/segmentio/encoding v0.3.5 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b // indirect
-	github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
-	github.com/shirou/gopsutil/v3 v3.24.5 // indirect
-	github.com/shoenig/go-m1cpu v0.1.6 // indirect
-	github.com/shurcooL/httpfs v0.0.0-20190707220628-8d4bc4ba7749 // indirect
-	github.com/shurcooL/vfsgen v0.0.0-20200824052919-0d455de96546 // indirect
-	github.com/sivchari/containedctx v1.0.3 // indirect
-	github.com/sivchari/tenv v1.7.1 // indirect
-	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/sonatard/noctx v0.0.2 // indirect
-	github.com/sourcegraph/appdash-data v0.0.0-20151005221446-73f23eafcf67 // indirect
-	github.com/sourcegraph/go-diff v0.7.0 // indirect
+	github.com/skeema/knownhosts v1.2.2 // indirect
 	github.com/spf13/cast v1.5.0 // indirect
-	github.com/spf13/cobra v1.9.1 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/cobra v1.8.1 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/spf13/viper v1.12.0 // indirect
-	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
-	github.com/stbenjam/no-sprintf-host-port v0.1.1 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/subosito/gotenv v1.4.1 // indirect
-	github.com/t-yuki/gocover-cobertura v0.0.0-20180217150009-aaee18c8195c // indirect
-	github.com/tdakkota/asciicheck v0.2.0 // indirect
-	github.com/tetafro/godot v1.4.16 // indirect
 	github.com/texttheater/golang-levenshtein v1.0.1 // indirect
-	github.com/timakin/bodyclose v0.0.0-20230421092635-574207250966 // indirect
-	github.com/timonwong/loggercheck v0.9.4 // indirect
-	github.com/tklauser/go-sysconf v0.3.12 // indirect
-	github.com/tklauser/numcpus v0.6.1 // indirect
-	github.com/tomarrell/wrapcheck/v2 v2.8.3 // indirect
-	github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
-	github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205 // indirect
-	github.com/tonistiigi/jaeger-ui-rest v0.0.0-20250211190051-7d4944a45bb6 // indirect
+	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 // indirect
 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
+	github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 // indirect
 	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
 	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
-	github.com/ulikunitz/xz v0.5.15 // indirect
-	github.com/ultraware/funlen v0.1.0 // indirect
-	github.com/ultraware/whitespace v0.1.1 // indirect
-	github.com/uudashr/gocognit v1.1.2 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
+	github.com/ulikunitz/xz v0.5.12 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xen0n/gosmopolitan v1.2.2 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/yagipy/maintidx v1.0.0 // indirect
-	github.com/yeya24/promlinter v0.3.0 // indirect
-	github.com/ykadowak/zerologlint v0.1.5 // indirect
-	github.com/yuin/goldmark v1.7.13 // indirect
-	github.com/yuin/goldmark-emoji v1.0.1 // indirect
-	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	github.com/zclconf/go-cty v1.16.3 // indirect
-	gitlab.com/bosi/decorder v0.4.2 // indirect
-	go-simpler.org/musttag v0.12.2 // indirect
-	go-simpler.org/sloglint v0.7.1 // indirect
+	github.com/zclconf/go-cty v1.14.4 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0 // indirect
-	go.opentelemetry.io/otel v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.31.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.31.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.34.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.6.0 // indirect
-	go.pennock.tech/tabular v1.1.3 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
+	go.opentelemetry.io/otel v1.24.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric v0.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v0.42.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.24.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.22.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.24.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
-	go.uber.org/automaxprocs v1.6.0 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.0 // indirect
 	gocloud.dev v0.37.0 // indirect
 	gocloud.dev/secrets/hashivault v0.37.0 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f // indirect
-	golang.org/x/mod v0.29.0 // indirect
-	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/term v0.37.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.38.0 // indirect
-	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
-	golang.org/x/tools/godoc v0.1.0-deprecated // indirect
+	golang.org/x/mod v0.18.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
+	golang.org/x/oauth2 v0.18.0 // indirect
+	golang.org/x/sync v0.7.0 // indirect
+	golang.org/x/sys v0.24.0 // indirect
+	golang.org/x/term v0.22.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	golang.org/x/tools v0.22.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 	google.golang.org/api v0.169.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20240311173647-c811ad7063a7 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 // indirect
-	google.golang.org/grpc v1.72.1 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 // indirect
+	google.golang.org/grpc v1.64.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	honnef.co/go/tools v0.4.7 // indirect
-	k8s.io/api v0.31.2 // indirect
-	k8s.io/apimachinery v0.31.2 // indirect
-	k8s.io/client-go v0.31.2 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
-	lukechampine.com/frand v1.5.1 // indirect
+	k8s.io/api v0.29.2 // indirect
+	k8s.io/apimachinery v0.29.2 // indirect
+	k8s.io/client-go v0.29.2 // indirect
+	k8s.io/klog/v2 v2.110.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
+	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	lukechampine.com/frand v1.4.2 // indirect
 	mvdan.cc/gofumpt v0.6.0 // indirect
-	mvdan.cc/unparam v0.0.0-20240528143540-8a5130ca722f // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )

provider/internal/cache.go

@@ -17,7 +17,6 @@ package internal
 import (
 	"errors"
 	"fmt"
-	"os"
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
@@ -149,20 +148,33 @@ func (c CacheWithOCI) String() string {
 
 // CacheFromGitHubActions pulls cache manifests from the GitHub actions cache.
 type CacheFromGitHubActions struct {
+	URL   string `pulumi:"url,optional"`
+	Token string `pulumi:"token,optional" provider:"secret"`
 	Scope string `pulumi:"scope,optional"`
 }
 
 // Annotate sets docstrings on CacheFromGitHubActions.
 func (c *CacheFromGitHubActions) Annotate(a infer.Annotator) {
-	a.Describe(&c, dedent(`
-		Recommended for use with GitHub Actions workflows.
+	a.SetDefault(&c.URL, "", "ACTIONS_CACHE_URL")
+	a.SetDefault(&c.Token, "", "ACTIONS_RUNTIME_TOKEN")
+	a.SetDefault(&c.Scope, "", "buildkit")
 
-		An action like "crazy-max/ghaction-github-runtime" is recommended to expose
-		appropriate credentials to your GitHub workflow.
+	a.Describe(&c.URL, dedent(`
+		The cache server URL to use for artifacts.
+
+		Defaults to "$ACTIONS_CACHE_URL", although a separate action like
+		"crazy-max/ghaction-github-runtime" is recommended to expose this
+		environment variable to your jobs.
 	`))
+	a.Describe(&c.Token, dedent(`
+		The GitHub Actions token to use. This is not a personal access tokens
+		and is typically generated automatically as part of each job.
 
-	a.SetDefault(&c.Scope, "buildkit")
+		Defaults to "$ACTIONS_RUNTIME_TOKEN", although a separate action like
+		"crazy-max/ghaction-github-runtime" is recommended to expose this
+		environment variable to your jobs.
 
+	`))
 	a.Describe(&c.Scope, dedent(`
 		The scope to use for cache keys. Defaults to "buildkit".
 
@@ -179,12 +191,11 @@ func (c *CacheFromGitHubActions) String() string {
 	if c.Scope != "" {
 		parts = append(parts, "scope="+c.Scope)
 	}
-	// Preserving backwards compatibility with the old behaviour.
-	if token := os.Getenv("ACTIONS_RUNTIME_TOKEN"); token != "" {
-		parts = append(parts, "token="+token)
+	if c.Token != "" {
+		parts = append(parts, "token="+c.Token)
 	}
-	if url := os.Getenv("ACTIONS_CACHE_URL"); url != "" {
-		parts = append(parts, "url="+url)
+	if c.URL != "" {
+		parts = append(parts, "url="+c.URL)
 	}
 	return strings.Join(parts, ",")
 }
@@ -457,27 +468,12 @@ func (c CacheFrom) validate(preview bool) (*controllerapi.CacheOptionsEntry, err
 		return nil, err
 	}
 	if len(parsed) == 0 {
-		// This can happen for example if we have a GHA cache configuration but no GitHub
-		// environment variables set. Ignore the cacheFrom entry in this case.
+		// This can happen for example if we have a GHA cache but no GitHub
+		// environment variables set.
+		// Shouldn't happen...
 		return nil, nil
 	}
-
-	pb := parsed[0].ToPB()
-	if !isActive(pb) {
-		pb = nil
-	}
-
-	return pb, nil
-}
-
-// isActive checks if the GitHub token is set in the cache entry.
-// If it is not a GHA cache entry, it will return true.
-// This is to maintain backwards compatibility with the old buildx behaviour.
-func isActive(ci *controllerapi.CacheOptionsEntry) bool {
-	if ci.Type != "gha" {
-		return true
-	}
-	return ci.Attrs["token"] != "" && (ci.Attrs["url"] != "" || ci.Attrs["url_v2"] != "")
+	return parsed[0], nil
 }
 
 // CacheToInline embeds cache information directly into an image.
@@ -681,27 +677,20 @@ func (c CacheTo) validate(preview bool) (*controllerapi.CacheOptionsEntry, error
 		return nil, err
 	}
 	if len(parsed) == 0 {
-		// This can happen for example if we have a GHA cache configuration but no GitHub
-		// environment variables set. Ignore the cacheTo entry in this case.
+		// This can happen for example if we have a GHA cache but no GitHub
+		// environment variables set.
+		// Shouldn't happen...
 		return nil, nil
 	}
-
-	pb := parsed[0].ToPB()
-	if !isActive(pb) {
-		pb = nil
-	}
-
-	return pb, nil
+	return parsed[0], nil
 }
 
 // CacheMode controls the complexity of exported cache manifests.
 type CacheMode string
 
 const (
-	// Min cache mode.
-	Min CacheMode = "min"
-	// Max cache mode.
-	Max CacheMode = "max"
+	Min CacheMode = "min" // Min cache mode.
+	Max CacheMode = "max" // Max cache mode.
 )
 
 // Values returns all valid CacheMode values for SDK generation.
@@ -722,12 +711,9 @@ func (CacheMode) Values() []infer.EnumValue[CacheMode] {
 type CompressionType string
 
 const (
-	// Gzip compression.
-	Gzip CompressionType = "gzip"
-	// Estargz compression.
-	Estargz CompressionType = "estargz"
-	// Zstd compression.
-	Zstd CompressionType = "zstd"
+	Gzip    CompressionType = "gzip"    // Gzip compression.
+	Estargz CompressionType = "estargz" // Estargz compression.
+	Zstd    CompressionType = "zstd"    // Zstd compression.
 )
 
 // Values returns all valid CompressionType values for SDK generation.

provider/internal/cache_test.go

@@ -24,15 +24,14 @@ import (
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )
 
-//nolint:paralleltest // We don't call t.Parallel here to prevent environment corruption.
 func TestCacheString(t *testing.T) {
+	t.Parallel()
 	gzip := Gzip
 
 	tests := []struct {
-		name    string
-		arrange func(t *testing.T)
-		given   fmt.Stringer
-		want    string
+		name  string
+		given fmt.Stringer
+		want  string
 	}{
 		{
 			name: "s3",
@@ -56,37 +55,7 @@ func TestCacheString(t *testing.T) {
 		{
 			name:  "gha",
 			given: CacheTo{GHA: &CacheToGitHubActions{}},
-			arrange: func(t *testing.T) {
-				t.Setenv("ACTIONS_CACHE_URL", "")
-				t.Setenv("ACTIONS_RUNTIME_TOKEN", "")
-			},
-			want: "type=gha",
-		},
-		{
-			name: "gha-default-envs",
-			arrange: func(t *testing.T) {
-				t.Setenv("ACTIONS_CACHE_URL", "https://example.com")
-				t.Setenv("ACTIONS_RUNTIME_TOKEN", "token")
-			},
-			given: CacheTo{GHA: &CacheToGitHubActions{
-				CacheFromGitHubActions: CacheFromGitHubActions{
-					Scope: "scope",
-				},
-			}},
-			want: "type=gha,scope=scope,token=token,url=https://example.com",
-		},
-		{
-			name: "gha-with-scope",
-			arrange: func(t *testing.T) {
-				t.Setenv("ACTIONS_CACHE_URL", "")
-				t.Setenv("ACTIONS_RUNTIME_TOKEN", "")
-			},
-			given: CacheTo{GHA: &CacheToGitHubActions{
-				CacheFromGitHubActions: CacheFromGitHubActions{
-					Scope: "scope",
-				},
-			}},
-			want: "type=gha,scope=scope",
+			want:  "type=gha",
 		},
 		{
 			name:  "from-local",
@@ -152,12 +121,10 @@ func TestCacheString(t *testing.T) {
 		},
 	}
 
-	//nolint:paralleltest // We don't call t.Parallel here to prevent environment corruption.
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
-			if tt.arrange != nil {
-				tt.arrange(t)
-			}
+			t.Parallel()
 
 			actual := tt.given.String()
 			assert.Equal(t, tt.want, actual)

provider/internal/cli.go

@@ -25,7 +25,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 
@@ -57,11 +56,11 @@ type cli struct {
 	auths map[string]cfgtypes.AuthConfig
 	host  *host
 
-	in       string       // stdin
-	r, w     *os.File     // stdout
-	err      bytes.Buffer // stderr
-	dumplogs bool         // if true then tail() will re-log status messages
-	builder  Builder      // for mocking build daemon responses
+	in       string        // stdin
+	r, w     *os.File      // stdout
+	err      bytes.Buffer  // stderr
+	dumplogs bool          // if true then tail() will re-log status messages
+	done     chan struct{} // signaled when all logs have been forwarded to the engine.
 }
 
 // Cli wraps the Docker interface for mock generation.
@@ -120,12 +119,11 @@ func wrap(host *host, registries ...Registry) (*cli, error) {
 	}
 
 	wrapped := &cli{
-		Cli:     docker,
-		host:    host,
-		auths:   auths,
-		r:       r,
-		w:       w,
-		builder: defaultBuilder{},
+		Cli:   docker,
+		host:  host,
+		auths: auths,
+		r:     r,
+		w:     w,
 	}
 
 	return wrapped, nil
@@ -143,10 +141,6 @@ func (c *cli) Err() *streams.Out {
 	return streams.NewOut(&c.err)
 }
 
-func (c *cli) SupportsMultipleExports() bool {
-	return c.host.supportsMultipleExports
-}
-
 // rc returns a registry client with matching auth.
 func (c *cli) rc() *regclient.RegClient {
 	hosts := []config.Host{}
@@ -164,6 +158,14 @@ func (c *cli) rc() *regclient.RegClient {
 // tail is meant to be called as a goroutine and will pipe output from the CLI
 // back to the Pulumi engine. Requires a corresponding call to close.
 func (c *cli) tail(ctx context.Context) {
+	c.done = make(chan struct{}, 1)
+	defer func() {
+		c.done <- struct{}{}
+		if err := recover(); err != nil {
+			fmt.Fprintf(os.Stderr, "recovered: %s\n", err)
+		}
+	}()
+
 	b := bytes.Buffer{}
 
 	s := bufio.NewScanner(c.r)
@@ -187,13 +189,17 @@ func (c *cli) tail(ctx context.Context) {
 
 // close flushes any outstanding logs and cleans up resources.
 func (c *cli) Close() error {
-	return errors.Join(c.w.Close(), c.r.Close())
+	err := errors.Join(c.w.Close(), c.r.Close())
+	if c.done != nil {
+		<-c.done
+	}
+	return err
 }
 
 // execBuild performs a build by os.Exec'ing the docker-buildx binary.
 // Credentials are communicated to docker-buildx via a temporary directory.
 // Secrets are communicated via dynamic environment variables.
-func (c *cli) execBuild(ctx context.Context, b Build) (*client.SolveResponse, error) {
+func (c *cli) execBuild(b Build) (*client.SolveResponse, error) {
 	// Setup a temporary directory for auth, and clean it up when we're done.
 	tmp, err := os.MkdirTemp("", "pulumi-docker-")
 	if err != nil {
@@ -203,7 +209,7 @@ func (c *cli) execBuild(ctx context.Context, b Build) (*client.SolveResponse, er
 
 	opts := b.BuildOptions()
 
-	builder, err := c.host.builderFor(ctx, b)
+	builder, err := c.host.builderFor(b)
 	if err != nil {
 		return nil, err
 	}
@@ -323,13 +329,13 @@ func (c *cli) execBuild(ctx context.Context, b Build) (*client.SolveResponse, er
 			return nil, err
 		}
 		// We abuse the pb.Secret proto by stuffing the secret's value in
-		// Env. We never serialize this proto so this is tolerable.
-		env = append(env, fmt.Sprintf("%s=%s", envvar, s.Env))
+		// XXX_unrecognized. We never serialize this proto so this is tolerable.
+		env = append(env, fmt.Sprintf("%s=%s", envvar, s.XXX_unrecognized))
 		args = append(args, "--secret", fmt.Sprintf("id=%s,env=%s", s.ID, envvar))
 	}
 
 	// Invoke docker-buildx.
-	err = c.exec(ctx, args, env)
+	err = c.exec(args, env)
 	if err != nil {
 		return nil, err
 	}
@@ -368,7 +374,7 @@ func (c *cli) execBuild(ctx context.Context, b Build) (*client.SolveResponse, er
 
 // exec invokes a Docker plugin binary. The first argument should be the name
 // of the plugin's subcommand, e.g. "buildx".
-func (c *cli) exec(ctx context.Context, args, extraEnv []string) error {
+func (c *cli) exec(args, extraEnv []string) error {
 	if len(args) == 0 {
 		return errors.New("args must be non-empty")
 	}
@@ -385,18 +391,16 @@ func (c *cli) exec(ctx context.Context, args, extraEnv []string) error {
 
 	defer contract.IgnoreClose(c.w)
 
-	runCmd, err := manager.PluginRunCommand(c, name, root)
+	cmd, err := manager.PluginRunCommand(c, name, root)
 	if err != nil {
 		return err
 	}
-	// Create a new command that inherits from ctx.
-	cmd := exec.CommandContext(ctx, //nolint:gosec // We take the first argument and binary from runCmd.
-		runCmd.Path, append([]string{runCmd.Args[1]}, args...)...,
-	)
+	cmd.Args = append([]string{cmd.Args[0]}, args...)
 	cmd.Stderr = c.Err()
 	cmd.Stdout = c.Out()
 	cmd.Stdin = c.In()
-	cmd.Env = append(runCmd.Env, extraEnv...) //nolint:gocritic // We are intentionally assigning from runCmd to cmd
+
+	cmd.Env = append(cmd.Env, extraEnv...)
 
 	return cmd.Run()
 }

provider/internal/cli_test.go

@@ -15,7 +15,6 @@
 package internal
 
 import (
-	"context"
 	"io"
 	"testing"
 
@@ -28,12 +27,12 @@ import (
 func TestExec(t *testing.T) {
 	t.Parallel()
 
-	h, err := newHost(t.Context(), nil)
+	h, err := newHost(nil)
 	require.NoError(t, err)
 	cli, err := wrap(h)
 	require.NoError(t, err)
 
-	err = cli.exec(t.Context(), []string{"buildx", "version"}, nil)
+	err = cli.exec([]string{"buildx", "version"}, nil)
 	assert.NoError(t, err)
 
 	out, err := io.ReadAll(cli.r)
@@ -45,7 +44,7 @@ func TestWrappedAuth(t *testing.T) {
 	t.Parallel()
 	ecr := "https://1234.dkr.ecr.us-west-2.amazonaws.com"
 
-	realhost, err := newHost(context.Background(), nil)
+	realhost, err := newHost(nil)
 	require.NoError(t, err)
 
 	h := &host{
@@ -103,7 +102,7 @@ func TestWrappedAuth(t *testing.T) {
 	assert.Len(t, h.auths, 2) // In-memory host auth is unchanged.
 
 	// Assert that our on-disk host's auth is untouched.
-	realhostRefreshed, err := newHost(context.Background(), nil)
+	realhostRefreshed, err := newHost(nil)
 	require.NoError(t, err)
 	assert.Equal(t, realhost.auths, realhostRefreshed.auths)
 }

provider/internal/client.go

@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-//go:generate go run go.uber.org/mock/mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal -imports buildx=github.com/docker/buildx/build
+//go:generate go run go.uber.org/mock/mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal
 
 package internal
 
@@ -22,14 +22,13 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/distribution/reference"
 	buildx "github.com/docker/buildx/build"
-	"github.com/docker/buildx/builder"
 	"github.com/docker/buildx/commands"
 	controllerapi "github.com/docker/buildx/controller/pb"
-	"github.com/docker/buildx/util/confutil"
 	"github.com/docker/buildx/util/dockerutil"
 	"github.com/docker/buildx/util/platformutil"
 	"github.com/docker/buildx/util/progress"
@@ -59,38 +58,6 @@ type Client interface {
 	ManifestCreate(ctx context.Context, push bool, target string, refs ...string) error
 	ManifestInspect(ctx context.Context, target string) (string, error)
 	ManifestDelete(ctx context.Context, target string) error
-
-	SupportsMultipleExports() bool
-}
-
-// registryGetter is something that can return a list of [Registry].
-type registryGetter interface {
-	GetRegistries() []Registry
-}
-
-// clientF builds a Docker client. The order of registryGetters is significant.
-// We typically prefer credentials from args, then provider config, then the
-// host. Provide them to this function in order of increasing priority: host,
-// config, args.
-//
-// We ignore state because if its creds differ from those in args then they are
-// likely volatile and also likely expired.
-type clientF func(context.Context, *host, ...registryGetter) (Client, error)
-
-// RealClientF builds a real Docker client with auth layered on top of the
-// host's latent credentials.
-func RealClientF(_ context.Context, host *host, getters ...registryGetter) (Client, error) {
-	auths := []Registry{}
-	for _, rg := range getters {
-		auths = append(auths, rg.GetRegistries()...)
-	}
-	return wrap(host, auths...)
-}
-
-func mockClientF(c Client) clientF {
-	return func(context.Context, *host, ...registryGetter) (Client, error) {
-		return c, nil
-	}
 }
 
 // Build encapsulates all of the user-provider build parameters and options.
@@ -121,6 +88,8 @@ func newDockerCLI(config *Config) (*command.DockerCli, error) {
 		return nil, err
 	}
 
+	// TODO: Log some version information for debugging.
+
 	return cli, nil
 }
 
@@ -137,10 +106,10 @@ func (c *cli) Build(
 	defer contract.IgnoreClose(c)
 
 	if build.ShouldExec() {
-		return c.execBuild(ctx, build)
+		return c.execBuild(build)
 	}
 
-	b, err := c.host.builderFor(ctx, build)
+	b, err := c.host.builderFor(build)
 	if err != nil {
 		return nil, err
 	}
@@ -154,15 +123,9 @@ func (c *cli) Build(
 	if err != nil {
 		return nil, fmt.Errorf("creating printer: %w", err)
 	}
-
 	defer func() {
-		// Wait for logs to flush if the build finished, but not if we're
-		// exiting early.
-		if ctx.Err() == nil {
-			_ = printer.Wait()
-		}
-
-		// Log any warnings we got, separated by newlines.
+		// Log any warnings when we're done.
+		_ = printer.Wait()
 		for _, w := range printer.Warnings() {
 			b := &bytes.Buffer{}
 			_, _ = b.Write(w.Short)
@@ -234,7 +197,7 @@ func (c *cli) Build(
 				DockerfilePath:   opts.DockerfileName,
 				DockerfileInline: build.Inline(),
 				NamedContexts:    namedContexts,
-				InStream:         buildx.NewSyncMultiReader(strings.NewReader("")),
+				InStream:         strings.NewReader(""),
 			},
 			// Disable default provenance for now. Docker's `manifest create`
 			// doesn't handle manifests with provenance included; more reason
@@ -255,46 +218,27 @@ func (c *cli) Build(
 
 			Session: []session.Attachable{
 				ssh,
-				authprovider.NewDockerAuthProvider(authprovider.DockerAuthProviderConfig{ConfigFile: c.ConfigFile()}),
+				authprovider.NewDockerAuthProvider(c.ConfigFile(), nil),
 				build.Secrets(),
 			},
 		},
 	}
 
-	resultC := make(chan map[string]*client.SolveResponse)
-	errC := make(chan error)
-
-	// buildx.Build doesn't handle context cancellation, so we monitor it in a
-	// goroutine. cli.Close cleans up our file descriptors, so if we do exit
-	// early the remote build should terminate as soon as it sees the pipe has
-	// broken.
-	go func() {
-		defer close(resultC)
-		defer close(errC)
-		results, err := c.builder.Build(
-			ctx,
-			b.nodes,
-			payload,
-			dockerutil.NewClient(c),
-			confutil.NewConfig(c),
-			printer,
-		)
-		if err != nil {
-			errC <- err
-			return
-		}
-		resultC <- results
-	}()
-
-	select {
-	case results := <-resultC:
-		return results[target], nil
-	case err := <-errC:
+	// Perform the build.
+	results, err := buildx.Build(
+		ctx,
+		b.nodes,
+		payload,
+		dockerutil.NewClient(c),
+		filepath.Dir(c.ConfigFile().Filename),
+		printer,
+	)
+	if err != nil {
 		c.dumplogs = true
 		return nil, err
-	case <-ctx.Done():
-		return nil, ctx.Err()
 	}
+
+	return results[target], err
 }
 
 // BuildKitEnabled returns true if the client supports buildkit.
@@ -410,31 +354,6 @@ func (c *cli) Delete(ctx context.Context, r string) error {
 	return nil
 }
 
-// Builder allows injecting mock responses from the build daemon.
-type Builder interface {
-	Build(
-		ctx context.Context,
-		nodes []builder.Node,
-		opts map[string]buildx.Options,
-		docker *dockerutil.Client,
-		cfg *confutil.Config,
-		w progress.Writer,
-	) (resp map[string]*client.SolveResponse, err error)
-}
-
-type defaultBuilder struct{}
-
-func (defaultBuilder) Build(
-	ctx context.Context,
-	nodes []builder.Node,
-	opts map[string]buildx.Options,
-	docker *dockerutil.Client,
-	cfg *confutil.Config,
-	w progress.Writer,
-) (resp map[string]*client.SolveResponse, err error) {
-	return buildx.Build(ctx, nodes, opts, docker, cfg, w)
-}
-
 func normalizeReference(ref string) (reference.Named, error) {
 	namedRef, err := reference.ParseNormalizedNamed(ref)
 	if err != nil {

provider/internal/client_test.go

@@ -17,23 +17,15 @@ package internal
 import (
 	"bytes"
 	"context"
-	"errors"
 	"io"
 	"log/slog"
 	"os"
 	"path/filepath"
 	"testing"
 
-	buildx "github.com/docker/buildx/build"
-	"github.com/docker/buildx/builder"
-	"github.com/docker/buildx/util/confutil"
-	"github.com/docker/buildx/util/dockerutil"
-	"github.com/docker/buildx/util/progress"
 	"github.com/docker/docker/api/types/registry"
-	"github.com/moby/buildkit/client"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.uber.org/mock/gomock"
 )
 
 func TestAuth(t *testing.T) {
@@ -63,7 +55,7 @@ func TestCustomHost(t *testing.T) {
 	t.Run("env", func(t *testing.T) {
 		t.Setenv("DOCKER_HOST", socket)
 
-		h, err := newHost(context.Background(), nil)
+		h, err := newHost(nil)
 		require.NoError(t, err)
 		cli, err := wrap(h)
 		require.NoError(t, err)
@@ -74,7 +66,7 @@ func TestCustomHost(t *testing.T) {
 
 	t.Run("config", func(t *testing.T) {
 		t.Parallel()
-		h, err := newHost(context.Background(), &Config{Host: socket})
+		h, err := newHost(&Config{Host: socket})
 		require.NoError(t, err)
 		cli, err := wrap(h)
 		require.NoError(t, err)
@@ -271,6 +263,7 @@ func TestBuild(t *testing.T) {
 
 	// Add an exec: true version for all of our test cases.
 	for _, tt := range tests {
+		tt := tt
 		tt.name = "exec-" + tt.name
 		tt.args.Exec = true
 		tmpdir := filepath.Join(t.TempDir(), "exec")
@@ -288,6 +281,7 @@ func TestBuild(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			if tt.skip {
@@ -296,7 +290,7 @@ func TestBuild(t *testing.T) {
 			ctx := context.Background()
 			cli := testcli(t, true, tt.auths...)
 
-			build, err := tt.args.toBuild(ctx, true, false)
+			build, err := tt.args.toBuild(ctx, false)
 			require.NoError(t, err)
 
 			_, err = cli.Build(ctx, build)
@@ -347,6 +341,7 @@ func TestNormalizeReference(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.ref, func(t *testing.T) {
 			t.Parallel()
 			ref, err := normalizeReference(tt.ref)
@@ -388,7 +383,7 @@ func TestBuildError(t *testing.T) {
 	ctx := context.Background()
 	cli := testcli(t, true)
 
-	build, err := args.toBuild(ctx, true, false)
+	build, err := args.toBuild(ctx, false)
 	require.NoError(t, err)
 
 	_, err = cli.Build(ctx, build)
@@ -423,7 +418,7 @@ func TestBuildExecError(t *testing.T) {
 	ctx := context.Background()
 	cli := testcli(t, true)
 
-	build, err := args.toBuild(ctx, true, false)
+	build, err := args.toBuild(ctx, false)
 	require.NoError(t, err)
 
 	_, err = cli.Build(ctx, build)
@@ -440,39 +435,10 @@ func TestBuildExecError(t *testing.T) {
 	}
 }
 
-func TestBuildCancelation(t *testing.T) {
-	t.Parallel()
-	cli := testcli(t, true)
-
-	ctrl := gomock.NewController(t)
-
-	ctx, cancel := context.WithCancel(context.Background())
-
-	b := NewMockBuilder(ctrl)
-	b.EXPECT().Build(
-		gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(),
-	).DoAndReturn(func(
-		_ context.Context,
-		_ []builder.Node,
-		_ map[string]buildx.Options,
-		_ *dockerutil.Client,
-		_ *confutil.Config,
-		_ progress.Writer,
-	) (map[string]*client.SolveResponse, error) {
-		cancel()
-		return nil, errors.New("cancel wasn't respected")
-	})
-	cli.builder = b
-
-	resp, err := cli.Build(ctx, &build{})
-	assert.ErrorIs(t, err, context.Canceled)
-	assert.Nil(t, resp)
-}
-
 // testcli returns a new standalone CLI instance. Set ping to true if a live
 // daemon is required -- the test will be skipped if the daemon is not available.
 func testcli(t *testing.T, ping bool, auths ...Registry) *cli {
-	h, err := newHost(context.Background(), nil)
+	h, err := newHost(nil)
 	require.NoError(t, err)
 
 	cli, err := wrap(h, auths...)

provider/internal/context_test.go

@@ -99,6 +99,7 @@ func TestValidateContext(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -406,6 +407,7 @@ func TestDockerIgnore(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			fs := afero.NewMemMapFs()

provider/internal/dedent_test.go

@@ -41,6 +41,7 @@ can be accessed like environment variables inside the ` + "`RUN`\n" + `instructi
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			actual := dedent(tt.given)

provider/internal/deprecated/configencoding.go

@@ -0,0 +1,191 @@
+// Copyright 2024, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package deprecated
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
+)
+
+// ConfigEncoding handles unmarshaling legacy JSON provider config.
+type ConfigEncoding struct {
+	schema schema.ConfigSpec
+}
+
+// New constructs a new config encoder for the provided spec.
+func New(s schema.ConfigSpec) *ConfigEncoding {
+	return &ConfigEncoding{schema: s}
+}
+
+func (*ConfigEncoding) tryUnwrapSecret(encoded any) (any, bool) {
+	m, ok := encoded.(map[string]any)
+	if !ok {
+		return nil, false
+	}
+	sig, ok := m["4dabf18193072939515e22adb298388d"]
+	if !ok {
+		return nil, false
+	}
+	ss, ok := sig.(string)
+	if !ok {
+		return nil, false
+	}
+	if ss != "1b47061264138c4ac30d75fd1eb44270" {
+		return nil, false
+	}
+	value, ok := m["value"]
+	return value, ok
+}
+
+func (enc *ConfigEncoding) convertStringToPropertyValue(s string, prop schema.PropertySpec) (
+	resource.PropertyValue, error,
+) {
+	// If the schema expects a string, we can just return this as-is.
+	if prop.Type == "string" {
+		return resource.NewStringProperty(s), nil
+	}
+
+	// Otherwise, we will attempt to deserialize the input string as JSON and convert the result into a Pulumi
+	// property. If the input string is empty, we will return an appropriate zero value.
+	if s == "" {
+		return enc.zeroValue(prop.Type), nil
+	}
+
+	var jsonValue interface{}
+	if err := json.Unmarshal([]byte(s), &jsonValue); err != nil {
+		return resource.PropertyValue{}, err
+	}
+
+	opts := enc.unmarshalOpts()
+
+	// Instead of using resource.NewPropertyValue, specialize it to detect nested json-encoded secrets.
+	var replv func(encoded any) (resource.PropertyValue, bool)
+	replv = func(encoded any) (resource.PropertyValue, bool) {
+		encodedSecret, isSecret := enc.tryUnwrapSecret(encoded)
+		if !isSecret {
+			return resource.NewNullProperty(), false
+		}
+
+		v := resource.NewPropertyValueRepl(encodedSecret, nil, replv)
+		if opts.KeepSecrets {
+			v = resource.MakeSecret(v)
+		}
+
+		return v, true
+	}
+
+	return resource.NewPropertyValueRepl(jsonValue, nil, replv), nil
+}
+
+func (*ConfigEncoding) zeroValue(typ string) resource.PropertyValue {
+	switch typ {
+	case "boolean":
+		return resource.NewPropertyValue(false)
+	case "integer", "number":
+		return resource.NewPropertyValue(0)
+	case "array":
+		return resource.NewPropertyValue([]interface{}{})
+	default:
+		return resource.NewPropertyValue(map[string]interface{}{})
+	}
+}
+
+func (enc *ConfigEncoding) unmarshalOpts() plugin.MarshalOptions {
+	return plugin.MarshalOptions{
+		Label:        "config",
+		KeepUnknowns: true,
+		KeepSecrets:  true,
+		SkipNulls:    true,
+		RejectAssets: true,
+	}
+}
+
+// Like plugin.UnmarshalPropertyValue but overrides string parsing with convertStringToPropertyValue.
+func (enc *ConfigEncoding) unmarshalPropertyValue(key resource.PropertyKey,
+	pv resource.PropertyValue,
+) (resource.PropertyValue, error) {
+	opts := enc.unmarshalOpts()
+
+	prop, ok := enc.schema.Variables[string(key)]
+
+	// Only apply JSON-encoded recognition for known fields.
+	if !ok {
+		return pv, nil
+	}
+
+	var (
+		jsonString                           string
+		jsonStringDetected, jsonStringSecret bool
+	)
+
+	if pv.IsString() {
+		jsonString = pv.StringValue()
+		jsonStringDetected = true
+	}
+
+	if opts.KeepSecrets && pv.IsSecret() && pv.SecretValue().Element.IsString() {
+		jsonString = pv.SecretValue().Element.StringValue()
+		jsonStringDetected = true
+		jsonStringSecret = true
+	}
+
+	if jsonStringDetected {
+		v, err := enc.convertStringToPropertyValue(jsonString, prop)
+		if err != nil {
+			return resource.PropertyValue{}, fmt.Errorf("error unmarshalling property %q: %w", key, err)
+		}
+		if jsonStringSecret {
+			return resource.MakeSecret(v), nil
+		}
+		return v, nil
+	}
+
+	// Computed sentinels are coming in as always having an empty string, but the encoding coerces them to a zero
+	// value of the appropriate type.
+	if pv.IsComputed() {
+		el := pv.V.(resource.Computed).Element
+		if el.IsString() && el.StringValue() == "" {
+			res := resource.MakeComputed(enc.zeroValue(prop.Type))
+			return res, nil
+		}
+	}
+
+	return pv, nil
+}
+
+// UnmarshalProperties is copied from plugin.UnmarshalProperties substituting plugin.UnmarshalPropertyValue.
+func (enc *ConfigEncoding) UnmarshalProperties(
+	props resource.PropertyMap,
+) (resource.PropertyMap, error) {
+	result := make(resource.PropertyMap)
+
+	// First sort the keys so we enumerate them in order (in case errors happen, we want determinism).
+	keys := props.StableKeys()
+
+	// And now unmarshal every field it into the map.
+	for _, key := range keys {
+		v, err := enc.unmarshalPropertyValue(key, props[key])
+		if err != nil {
+			return resource.PropertyMap{}, err
+		}
+		result[key] = v
+	}
+
+	return result, nil
+}

provider/internal/deprecated/configencoding_test.go

@@ -0,0 +1,274 @@
+// Copyright 2024, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package deprecated
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
+)
+
+func TestConfigEncoding(t *testing.T) {
+	t.Parallel()
+
+	type testCase struct {
+		ty    schema.TypeSpec
+		given resource.PropertyValue
+		want  resource.PropertyValue
+	}
+
+	knownKey := "mykey"
+
+	makeEnc := func(typ schema.TypeSpec) *ConfigEncoding {
+		return New(
+			schema.ConfigSpec{
+				Variables: map[string]schema.PropertySpec{
+					knownKey: {
+						TypeSpec: typ,
+					},
+				},
+			},
+		)
+	}
+
+	checkUnmarshal := func(t *testing.T, tc testCase) {
+		enc := makeEnc(tc.ty)
+		key := resource.PropertyKey(knownKey)
+
+		actual, err := enc.unmarshalPropertyValue(key, tc.given)
+		require.NoError(t, err)
+		assert.Equal(t, tc.want, actual)
+	}
+
+	turnaroundTestCases := []testCase{
+		{
+			schema.TypeSpec{Type: "boolean"},
+			resource.NewPropertyValue(`true`),
+			resource.NewBoolProperty(true),
+		},
+		{
+			schema.TypeSpec{Type: "boolean"},
+			resource.NewPropertyValue(`false`),
+			resource.NewBoolProperty(false),
+		},
+		{
+			schema.TypeSpec{Type: "integer"},
+			resource.NewPropertyValue(`0`),
+			resource.NewNumberProperty(0),
+		},
+		{
+			schema.TypeSpec{Type: "integer"},
+			resource.NewPropertyValue(`42`),
+			resource.NewNumberProperty(42),
+		},
+		{
+			schema.TypeSpec{Type: "number"},
+			resource.NewPropertyValue(`0`),
+			resource.NewNumberProperty(0.0),
+		},
+		{
+			schema.TypeSpec{Type: "number"},
+			resource.NewPropertyValue(`42.5`),
+			resource.NewNumberProperty(42.5),
+		},
+		{
+			schema.TypeSpec{Type: "string"},
+			resource.NewStringProperty(""),
+			resource.NewStringProperty(""),
+		},
+		{
+			schema.TypeSpec{Type: "string"},
+			resource.NewStringProperty("hello"),
+			resource.NewStringProperty("hello"),
+		},
+		{
+			schema.TypeSpec{Type: "array"},
+			resource.NewPropertyValue(`[]`),
+			resource.NewArrayProperty([]resource.PropertyValue{}),
+		},
+		{
+			schema.TypeSpec{Type: "array"},
+			resource.NewPropertyValue(`["hello","there"]`),
+			resource.NewArrayProperty([]resource.PropertyValue{
+				resource.NewStringProperty("hello"),
+				resource.NewStringProperty("there"),
+			}),
+		},
+		{
+			schema.TypeSpec{Type: "object"},
+			resource.NewPropertyValue(`{}`),
+			resource.NewObjectProperty(resource.PropertyMap{}),
+		},
+		{
+			schema.TypeSpec{Type: "object"},
+			resource.NewPropertyValue(`{"key":"value"}`),
+			resource.NewObjectProperty(resource.PropertyMap{
+				"key": resource.NewStringProperty("value"),
+			}),
+		},
+	}
+
+	t.Run("turnaround", func(t *testing.T) {
+		for i, tc := range turnaroundTestCases {
+			tc := tc
+
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
+				t.Parallel()
+				checkUnmarshal(t, tc)
+			})
+		}
+	})
+
+	t.Run("zero_values", func(t *testing.T) {
+		// Historically the encoding was able to convert empty strings into type-appropriate zero values.
+		cases := []testCase{
+			{
+				schema.TypeSpec{Type: "boolean"},
+				resource.NewPropertyValue(""),
+				resource.NewBoolProperty(false),
+			},
+			{
+				schema.TypeSpec{Type: "number"},
+				resource.NewPropertyValue(""),
+				resource.NewNumberProperty(0.),
+			},
+			{
+				schema.TypeSpec{Type: "integer"},
+				resource.NewPropertyValue(""),
+				resource.NewNumberProperty(0),
+			},
+			{
+				schema.TypeSpec{Type: "string"},
+				resource.NewPropertyValue(""),
+				resource.NewStringProperty(""),
+			},
+			{
+				schema.TypeSpec{Type: "object"},
+				resource.NewPropertyValue(""),
+				resource.NewObjectProperty(make(resource.PropertyMap)),
+			},
+			{
+				schema.TypeSpec{Type: "array"},
+				resource.NewPropertyValue(""),
+				resource.NewArrayProperty([]resource.PropertyValue{}),
+			},
+		}
+		for _, tc := range cases {
+			tc := tc
+
+			t.Run(fmt.Sprintf("%v", tc.ty), func(t *testing.T) {
+				t.Parallel()
+				checkUnmarshal(t, tc)
+			})
+		}
+	})
+
+	t.Run("computed", func(t *testing.T) {
+		unk := resource.MakeComputed(resource.NewStringProperty(""))
+
+		for i, tc := range turnaroundTestCases {
+			tc := tc
+
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
+				t.Parallel()
+				// Unknown sentinel unmarshals to a Computed with a type-appropriate zero value.
+				checkUnmarshal(t, testCase{
+					ty:    tc.ty,
+					given: unk,
+					want:  resource.MakeComputed(makeEnc(tc.ty).zeroValue(tc.ty.Type)),
+				})
+			})
+		}
+	})
+
+	t.Run("secret", func(t *testing.T) {
+		// Unmarshalling happens with KeepSecrets=false, replacing them with the underlying values. This case
+		// does not need to be tested.
+		//
+		// Marhalling however supports sending secrets back to the engine, intending to mark values as secret
+		// that happen on paths that are declared as secret in the schema. Due to the limitation of the
+		// JSON-in-proto-encoding, secrets are communicated imprecisely as an approximation: if any nested
+		// element of a property is secret, the entire property is marshalled as secret.
+
+		var secretCases []testCase
+
+		for _, tc := range turnaroundTestCases {
+			secretCases = append(secretCases, testCase{
+				ty:    tc.ty,
+				given: resource.MakeSecret(tc.given),
+				want:  resource.MakeSecret(tc.want),
+			})
+		}
+
+		for i, tc := range secretCases {
+			tc := tc
+
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
+				t.Parallel()
+				checkUnmarshal(t, tc)
+			})
+		}
+
+		t.Run("nested secrets", func(t *testing.T) {
+			checkUnmarshal(t, testCase{
+				schema.TypeSpec{Type: "object"},
+				resource.MakeSecret(resource.NewPropertyValue(`{"key":"val"}`)),
+				resource.MakeSecret(resource.NewObjectProperty(resource.PropertyMap{
+					"key": resource.NewStringProperty("val"),
+				})),
+			})
+		})
+	})
+
+	regressUnmarshalTestCases := []testCase{
+		{
+			schema.TypeSpec{Type: "array"},
+			resource.NewPropertyValue(`
+			[
+			  {
+			    "address": "somewhere.org",
+			    "password": {
+			      "4dabf18193072939515e22adb298388d": "1b47061264138c4ac30d75fd1eb44270",
+			      "value": "some-password"
+			    },
+			    "username": "some-user"
+			  }
+			]`),
+			resource.NewArrayProperty([]resource.PropertyValue{
+				resource.NewObjectProperty(resource.PropertyMap{
+					"address":  resource.NewStringProperty("somewhere.org"),
+					"password": resource.MakeSecret(resource.NewStringProperty("some-password")),
+					"username": resource.NewStringProperty("some-user"),
+				}),
+			}),
+		},
+	}
+
+	t.Run("regress-unmarshal", func(t *testing.T) {
+		for i, tc := range regressUnmarshalTestCases {
+			tc := tc
+			t.Run(strconv.Itoa(i), func(t *testing.T) {
+				t.Parallel()
+				checkUnmarshal(t, tc)
+			})
+		}
+	})
+}

provider/internal/deprecated/doc.go

@@ -0,0 +1,19 @@
+// Copyright 2024, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package deprecated vendors config parsing from pulumi-terraform-bridge.
+//
+// Originally taken from here:
+// https://github.com/pulumi/pulumi-terraform-bridge/blob/90733a0c7/pkg/tfbridge/config_encoding.go
+package deprecated

provider/internal/dockerfile.go

@@ -15,7 +15,6 @@
 package internal
 
 import (
-	"bytes"
 	"errors"
 	"io"
 	"os"
@@ -97,26 +96,13 @@ func (d *Dockerfile) validate(preview bool, c *Context) error {
 }
 
 func parseDockerfile(r io.Reader) error {
-	df, _ := io.ReadAll(r)
-	syntax, _, _, _ := parser.DetectSyntax(df)
-	if syntax == "" {
-		syntax = os.Getenv("BUILDKIT_SYNTAX")
-	}
-
-	// Disable validation if this uses a custom syntax.
-	if syntax != "" && syntax != "docker/dockerfile:1" {
-		return nil
-	}
-
-	parsed, err := parser.Parse(bytes.NewReader(df))
+	parsed, err := parser.Parse(r)
 	if err != nil {
 		return newCheckFailure(err, "dockerfile")
 	}
-
 	_, _, err = instructions.Parse(parsed.AST, nil)
 	if err != nil {
-		return newCheckFailure(err, "dockerfile")
+		return err
 	}
-
 	return nil
 }

provider/internal/dockerfile_test.go

@@ -57,31 +57,12 @@ func TestValidateDockerfile(t *testing.T) {
 			},
 			wantErr: "unknown instruction: RUNN",
 		},
-		{
-			name: "invalid syntax inline with default syntax directive",
-			d: Dockerfile{
-				Inline: `# syntax=docker/dockerfile:1
-				RUNN it`,
-			},
-			wantErr: "unknown instruction: RUNN",
-		},
 		{
 			name: "valid syntax inline",
 			d: Dockerfile{
 				Inline: "FROM scratch",
 			},
 		},
-		{
-			name: "valid custom syntax inline",
-			d: Dockerfile{
-				Inline: `# syntax=docker.io/docker/dockerfile:1.7-labs
-FROM public.ecr.aws/docker/library/node:22-alpine AS base
-
-WORKDIR /app
-COPY --parents ./package.json ./package-lock.json ./apps/*/package.json ./packages/*/package.json ./
-`,
-			},
-		},
 		{
 			name:    "unset",
 			d:       Dockerfile{},
@@ -105,6 +86,7 @@ COPY --parents ./package.json ./package-lock.json ./apps/*/package.json ./packag
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

provider/internal/embed/image-examples.md

@@ -1214,7 +1214,7 @@ image = docker_build.Image("image",
     context={
         "location": "app",
         "named": {
-            "golang:latest": {
+            "golang_latest": {
                 "location": "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
             },
         },

provider/internal/export.go

@@ -22,8 +22,7 @@ import (
 	"strings"
 
 	controllerapi "github.com/docker/buildx/controller/pb"
-	"github.com/moby/buildkit/client"
-	"github.com/tonistiigi/go-csvvalue"
+	"github.com/docker/buildx/util/buildflags"
 
 	"github.com/pulumi/pulumi-go-provider/infer"
 )
@@ -110,7 +109,7 @@ func (e Export) String() string {
 // pushed returns true if the export would result in a registry push.
 func (e Export) pushed() bool {
 	if e.Raw != "" {
-		exp, err := parseExports([]string{e.Raw.String()})
+		exp, err := buildflags.ParseExports([]string{e.Raw.String()})
 		if err != nil {
 			return false
 		}
@@ -125,86 +124,14 @@ func (e Export) pushed() bool {
 	return false
 }
 
-// parseExports is forked from docker/buildx@v0.18.0 from util/buildflags/export.go
-// to maintain the old logic. This is to get a working version of the provider with
-// the latest buildx while maintaining the old behaviour.
-//
-// TODO: Remove this fork and update existing logic/tests.
-func parseExports(inp []string) ([]*controllerapi.ExportEntry, error) {
-	if len(inp) == 0 {
-		return nil, nil
-	}
-	outs := make([]*controllerapi.ExportEntry, 0, len(inp))
-
-	for _, s := range inp {
-		fields, err := csvvalue.Fields(s, nil)
-		if err != nil {
-			return nil, err
-		}
-
-		out := controllerapi.ExportEntry{
-			Attrs: map[string]string{},
-		}
-		if len(fields) == 1 && fields[0] == s && !strings.HasPrefix(s, "type=") {
-			if s != "-" {
-				outs = append(outs, &controllerapi.ExportEntry{
-					Type:        client.ExporterLocal,
-					Destination: s,
-				})
-				continue
-			}
-			out = controllerapi.ExportEntry{
-				Type:        client.ExporterTar,
-				Destination: s,
-			}
-		}
-
-		if out.Type == "" {
-			for _, field := range fields {
-				parts := strings.SplitN(field, "=", 2)
-				if len(parts) != 2 {
-					return nil, fmt.Errorf("invalid value %s", field)
-				}
-				key := strings.TrimSpace(strings.ToLower(parts[0]))
-				value := parts[1]
-				switch key {
-				case "type":
-					out.Type = value
-				default:
-					out.Attrs[key] = value
-				}
-			}
-		}
-		if out.Type == "" {
-			return nil, errors.New("type is required for output")
-		}
-
-		if out.Type == "registry" {
-			out.Type = client.ExporterImage
-			if _, ok := out.Attrs["push"]; !ok {
-				out.Attrs["push"] = "true"
-			}
-		}
-
-		if dest, ok := out.Attrs["dest"]; ok {
-			out.Destination = dest
-			delete(out.Attrs, "dest")
-		}
-
-		outs = append(outs, &out)
-	}
-	return outs, nil
-}
-
 func (e Export) validate(preview bool, tags []string) (*controllerapi.ExportEntry, error) {
 	if strings.Count(e.String(), "type=") > 1 {
 		return nil, errors.New("exports should only specify one export type")
 	}
-	ee, err := parseExports([]string{e.String()})
+	ee, err := buildflags.ParseExports([]string{e.String()})
 	if err != nil {
 		return nil, err
 	}
-
 	exp := ee[0]
 	if len(tags) == 0 && isRegistryPush(exp) && exp.Attrs["name"] == "" {
 		return nil, errors.New(

provider/internal/export_test.go

@@ -74,6 +74,7 @@ func TestValidateExport(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			e, err := tt.e.validate(tt.preview, tt.givenTags)
@@ -180,6 +181,7 @@ func TestExportString(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			actual := tt.given.String()
@@ -234,6 +236,7 @@ func TestExportPushed(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			actual := tt.e.pushed()

provider/internal/host.go

@@ -16,14 +16,11 @@ package internal
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"path/filepath"
-	"strings"
 	"sync"
 	"time"
 
-	"github.com/blang/semver"
 	"github.com/docker/buildx/builder"
 	"github.com/docker/buildx/store/storeutil"
 	"github.com/docker/cli/cli/command"
@@ -38,12 +35,9 @@ type host struct {
 	config   *Config
 	builders map[string]*cachedBuilder
 	auths    map[string]cfgtypes.AuthConfig
-
-	// True if the buildkit daemon is at least v0.13.
-	supportsMultipleExports bool
 }
 
-func newHost(ctx context.Context, config *Config) (*host, error) {
+func newHost(config *Config) (*host, error) {
 	docker, err := newDockerCLI(config)
 	if err != nil {
 		return nil, err
@@ -53,13 +47,11 @@ func newHost(ctx context.Context, config *Config) (*host, error) {
 	if err != nil {
 		return nil, err
 	}
-
 	h := &host{
-		cli:                     docker,
-		config:                  config,
-		builders:                map[string]*cachedBuilder{},
-		auths:                   auths,
-		supportsMultipleExports: false, // Determined when we boot the builder.
+		cli:      docker,
+		config:   config,
+		builders: map[string]*cachedBuilder{},
+		auths:    auths,
 	}
 	return h, err
 }
@@ -70,7 +62,7 @@ func newHost(ctx context.Context, config *Config) (*host, error) {
 //
 // If the build doesn't specify a builder by name, we will iterate through all
 // available builders until we find one that we can connect to.
-func (h *host) builderFor(ctx context.Context, build Build) (*cachedBuilder, error) {
+func (h *host) builderFor(build Build) (*cachedBuilder, error) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
@@ -95,19 +87,6 @@ func (h *host) builderFor(ctx context.Context, build Build) (*cachedBuilder, err
 		builder.WithContextPathHash(contextPathHash),
 		builder.WithStore(txn),
 	)
-	if err != nil && build.ShouldExec() && strings.HasPrefix(opts.Builder, "cloud-") {
-		//nolint:revive // Human-readable.
-		err = errors.Join(err,
-			errors.New("Make sure you're logged in to Docker (`docker login`) if you're trying to use a cloud builder."),
-			errors.New("Make sure you have the correct buildx plugin installed (https://github.com/docker/buildx-desktop)."),
-		)
-	}
-	if err != nil && build.ShouldExec() {
-		//nolint:revive // Human-readable.
-		err = errors.Join(err, errors.New(
-			"Make sure your buildx plugin is executable (`docker buildx version`)"),
-		)
-	}
 	if err != nil {
 		return nil, fmt.Errorf("new builder: %w", err)
 	}
@@ -131,7 +110,7 @@ func (h *host) builderFor(ctx context.Context, build Build) (*cachedBuilder, err
 			if bb.Err() != nil {
 				continue
 			}
-			nodes, err := bb.LoadNodes(ctx)
+			nodes, err := bb.LoadNodes(context.Background())
 			if err != nil {
 				continue
 			}
@@ -140,7 +119,7 @@ func (h *host) builderFor(ctx context.Context, build Build) (*cachedBuilder, err
 				if n.Driver == nil {
 					continue nextbuilder
 				}
-				if _, err := n.Driver.Dial(ctx); err != nil {
+				if _, err := n.Driver.Dial(context.Background()); err != nil {
 					continue nextbuilder
 				}
 				// TODO: Confirm the builder supports the requested platforms.
@@ -154,7 +133,7 @@ func (h *host) builderFor(ctx context.Context, build Build) (*cachedBuilder, err
 
 		// If we STILL don't have a builder, create a docker-container instance.
 		b, err = builder.Create(
-			ctx,
+			context.Background(),
 			txn,
 			h.cli,
 			builder.CreateOpts{Driver: "docker-container"},
@@ -162,7 +141,7 @@ func (h *host) builderFor(ctx context.Context, build Build) (*cachedBuilder, err
 		if err != nil {
 			return nil, fmt.Errorf("creating builder: %w", err)
 		}
-		ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
 		if _, err := b.Boot(ctx); err != nil {
 			return nil, fmt.Errorf("booting builder: %w", err)
@@ -172,28 +151,10 @@ func (h *host) builderFor(ctx context.Context, build Build) (*cachedBuilder, err
 	// Attempt to load nodes in order to determine the builder's driver. Ignore
 	// errors for "exec" builds because it's possible to request builders with
 	// drivers that are unknown to us.
-	nodes, err := b.LoadNodes(ctx, builder.WithData())
+	nodes, err := b.LoadNodes(context.Background())
 	if err != nil && !build.ShouldExec() {
-		if strings.Contains(err.Error(), "failed to find driver") {
-			//nolint:revive // Human-readable.
-			err = errors.Join(err, errors.New(
-				"Use `exec: true` if you're trying to use Docker Build Cloud or other custom drivers.",
-			))
-		}
 		return nil, fmt.Errorf("loading nodes: %w", err)
 	}
-	// Attempt to determine our builder's buildkit version.
-	for idx := range nodes {
-		if nodes[idx].Version == "" {
-			continue
-		}
-		v, err := semver.ParseTolerant(nodes[idx].Version)
-		if err != nil {
-			return nil, fmt.Errorf("parsing buildkit version %q: %w", nodes[idx].Version, err)
-		}
-		h.supportsMultipleExports = v.GE(semver.MustParse("0.13.0"))
-		break
-	}
 
 	cached := &cachedBuilder{name: b.Name, driver: b.Driver, nodes: nodes}
 	h.builders[opts.Builder] = cached

provider/internal/image.go

@@ -38,7 +38,7 @@ import (
 
 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
-	"github.com/pulumi/pulumi/sdk/v3/go/property"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
 )
 
@@ -61,10 +61,7 @@ var _imageExamples string
 var _migration string
 
 // Image is a Docker image build using buildkit.
-type Image struct {
-	clientF clientF
-	config  *Config
-}
+type Image struct{}
 
 // Annotate provides a description of the Image resource.
 func (i *Image) Annotate(a infer.Annotator) {
@@ -284,11 +281,6 @@ func (ia *ImageArgs) Annotate(a infer.Annotator) {
 	a.SetDefault(&ia.Network, Default)
 }
 
-// GetRegistries returns the image's registries, if any.
-func (ia ImageArgs) GetRegistries() []Registry {
-	return ia.Registries
-}
-
 // ImageState is serialized to the program's state file.
 type ImageState struct {
 	ImageArgs
@@ -337,32 +329,40 @@ func (is *ImageState) Annotate(a infer.Annotator) {
 
 // client produces a CLI client scoped to this resource and layered on top of
 // any host-level credentials.
-func (i *Image) client(ctx context.Context, args ImageArgs) (Client, error) {
-	return i.clientF(ctx, i.config.getHost(), i.config, args)
+func (i *Image) client(ctx context.Context, state ImageState, args ImageArgs) (Client, error) {
+	cfg := infer.GetConfig[Config](ctx)
+
+	if cli, ok := ctx.Value(_mockClientKey).(Client); ok {
+		return cli, nil
+	}
+
+	// We prefer auth from args, the provider, and state in that order. We
+	// build a slice in reverse order because wrap() will overwrite earlier
+	// entries with later ones.
+	auths := []Registry{}
+	auths = append(auths, cfg.Registries...)
+	auths = append(auths, args.Registries...)
+
+	return wrap(cfg.host, auths...)
 }
 
 // Check validates ImageArgs, sets defaults, and ensures our client is
 // authenticated.
 func (i *Image) Check(
 	ctx context.Context,
-	req infer.CheckRequest,
-) (infer.CheckResponse[ImageArgs], error) {
-	args, failures, err := infer.DefaultCheck[ImageArgs](ctx, req.NewInputs)
+	_ string,
+	_ resource.PropertyMap,
+	news resource.PropertyMap,
+) (ImageArgs, []provider.CheckFailure, error) {
+	args, failures, err := infer.DefaultCheck[ImageArgs](ctx, news)
 	if err != nil || len(failures) != 0 {
-		return infer.CheckResponse[ImageArgs]{Failures: failures, Inputs: args}, err
+		return args, failures, err
 	}
 
-	// If the inputs aren't fully resolved we perform a weaker validation, for
-	// example we might not be able to check the Dockerfile for syntactic
-	// correctness.
-	preview := property.New(req.NewInputs).HasComputed()
+	// :(
+	preview := news.ContainsUnknowns()
 
-	cfg := infer.GetConfig[Config](ctx)
-	supportsMultipleExports := true
-	if cfg.host != nil {
-		supportsMultipleExports = cfg.host.supportsMultipleExports
-	}
-	if _, berr := args.validate(supportsMultipleExports, preview); berr != nil {
+	if _, berr := args.validate(preview); berr != nil {
 		errs := berr.(interface{ Unwrap() []error }).Unwrap()
 		for _, e := range errs {
 			if cf, ok := e.(checkFailure); ok {
@@ -371,7 +371,7 @@ func (i *Image) Check(
 		}
 	}
 
-	return infer.CheckResponse[ImageArgs]{Failures: failures, Inputs: args}, err
+	return args, failures, err
 }
 
 type checkFailure struct {
@@ -466,15 +466,15 @@ type build struct {
 	exec    bool
 }
 
-func (b *build) BuildOptions() controllerapi.BuildOptions {
-	return b.opts //nolint:govet // copylocks - not serialized.
+func (b build) BuildOptions() controllerapi.BuildOptions {
+	return b.opts
 }
 
-func (b *build) Inline() string {
+func (b build) Inline() string {
 	return b.inline
 }
 
-func (b *build) Secrets() session.Attachable {
+func (b build) Secrets() session.Attachable {
 	m := map[string][]byte{}
 	for k, v := range b.secrets {
 		m[k] = []byte(v)
@@ -482,16 +482,15 @@ func (b *build) Secrets() session.Attachable {
 	return secretsprovider.FromMap(m)
 }
 
-func (b *build) ShouldExec() bool {
+func (b build) ShouldExec() bool {
 	return b.exec
 }
 
 func (ia ImageArgs) toBuild(
 	ctx context.Context,
-	supportsMultipleExports bool,
 	preview bool,
 ) (Build, error) {
-	opts, err := ia.validate(supportsMultipleExports, preview)
+	opts, err := ia.validate(preview)
 	if err != nil {
 		return nil, err
 	}
@@ -508,8 +507,8 @@ func (ia ImageArgs) toBuild(
 				"Instead, perform one cached build per platform and create an Index to join them all together.")
 	}
 
-	return &build{
-		opts:    opts, //nolint:govet // copylocks - not serialized.
+	return build{
+		opts:    opts,
 		inline:  ia.Dockerfile.Inline,
 		secrets: ia.Secrets,
 		exec:    ia.Exec,
@@ -518,29 +517,27 @@ func (ia ImageArgs) toBuild(
 
 // validate confirms the ImageArgs are valid and returns BuildOptions
 // appropriate for passing to builders.
-func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controllerapi.BuildOptions, error) {
+func (ia *ImageArgs) validate(preview bool) (controllerapi.BuildOptions, error) {
 	var multierr error
 
-	if !supportsMultipleExports {
-		if len(ia.Exports) > 1 {
-			multierr = errors.Join(multierr,
-				newCheckFailure(errors.New("multiple exports require a v0.13 buildkit daemon or newer"), "exports"),
-			)
-		}
-		if ia.Push && ia.Load {
-			multierr = errors.Join(
-				multierr,
-				newCheckFailure(
-					errors.New("simultaneous push and load requires a v0.13 buildkit daemon or newer"),
-					"push",
-				),
-			)
-		}
-		if len(ia.Exports) > 0 && (ia.Push || ia.Load) {
-			multierr = errors.Join(multierr,
-				newCheckFailure(errors.New("multiple exports require a v0.13 buildkit daemon or newer"), "exports"),
-			)
-		}
+	if len(ia.Exports) > 1 {
+		multierr = errors.Join(multierr,
+			newCheckFailure(errors.New("multiple exports are currently unsupported"), "exports"),
+		)
+	}
+	if ia.Push && ia.Load {
+		multierr = errors.Join(
+			multierr,
+			newCheckFailure(
+				errors.New("push and load may not be set together at the moment"),
+				"push",
+			),
+		)
+	}
+	if len(ia.Exports) > 0 && (ia.Push || ia.Load) {
+		multierr = errors.Join(multierr,
+			newCheckFailure(errors.New("exports can't be provided with push or load"), "exports"),
+		)
 	}
 
 	dockerfile, context, err := ia.Context.validate(preview, ia.Dockerfile)
@@ -571,9 +568,7 @@ func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controller
 			multierr = errors.Join(multierr, newCheckFailure(err, "exports[%d]", idx))
 			continue
 		}
-		if exp != nil {
-			exports = append(exports, exp)
-		}
+		exports = append(exports, exp)
 	}
 
 	platforms := []string{}
@@ -583,9 +578,7 @@ func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controller
 			multierr = errors.Join(multierr, newCheckFailure(err, "platforms[%d]", idx))
 			continue
 		}
-		if platform != "" {
-			platforms = append(platforms, platform)
-		}
+		platforms = append(platforms, platform)
 	}
 
 	cacheFrom := []*controllerapi.CacheOptionsEntry{}
@@ -598,9 +591,7 @@ func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controller
 			multierr = errors.Join(multierr, newCheckFailure(err, "cacheFrom[%d]", idx))
 			continue
 		}
-		if cache != nil {
-			cacheFrom = append(cacheFrom, cache)
-		}
+		cacheFrom = append(cacheFrom, cache)
 	}
 
 	cacheTo := []*controllerapi.CacheOptionsEntry{}
@@ -613,9 +604,7 @@ func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controller
 			multierr = errors.Join(multierr, newCheckFailure(err, "cacheTo[%d]", idx))
 			continue
 		}
-		if cache != nil {
-			cacheTo = append(cacheTo, cache)
-		}
+		cacheTo = append(cacheTo, cache)
 	}
 
 	ssh := []*controllerapi.SSH{}
@@ -625,9 +614,7 @@ func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controller
 			multierr = errors.Join(multierr, newCheckFailure(err, "ssh[%d]", idx))
 			continue
 		}
-		if ss != nil {
-			ssh = append(ssh, ss)
-		}
+		ssh = append(ssh, ss)
 	}
 
 	for idx, t := range normalized.Tags {
@@ -639,10 +626,10 @@ func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controller
 	secrets := []*controllerapi.Secret{}
 	for k, v := range normalized.Secrets {
 		// We abuse the pb.Secret proto by stuffing the secret's value in
-		// Env. We never serialize this proto so this is tolerable.
+		// XXX_unrecognized. We never serialize this proto so this is tolerable.
 		secrets = append(secrets, &controllerapi.Secret{
-			ID:  k,
-			Env: v,
+			ID:               k,
+			XXX_unrecognized: []byte(v),
 		})
 	}
 
@@ -672,17 +659,18 @@ func (ia *ImageArgs) validate(supportsMultipleExports, preview bool) (controller
 		Target:         normalized.Target,
 	}
 
-	return opts, multierr //nolint:govet // copylocks - not serialized.
+	return opts, multierr
 }
 
 // Create builds an image using buildkit.
 func (i *Image) Create(
 	ctx context.Context,
-	req infer.CreateRequest[ImageArgs],
-) (infer.CreateResponse[ImageState], error) {
-	input := req.Inputs
+	name string,
+	input ImageArgs,
+	preview bool,
+) (string, ImageState, error) {
 	state := ImageState{ImageArgs: input}
-	id := req.Name
+	id := name
 
 	// Default our ref to one of our tags.
 	for _, tag := range state.Tags {
@@ -693,31 +681,22 @@ func (i *Image) Create(
 		break
 	}
 
-	cli, err := i.client(ctx, input)
+	cli, err := i.client(ctx, state, input)
 	if err != nil {
-		return infer.CreateResponse[ImageState]{ID: id, Output: state}, err
+		return id, state, err
 	}
 
 	ok, err := cli.BuildKitEnabled()
 	if err != nil {
-		return infer.CreateResponse[ImageState]{
-			ID:     id,
-			Output: state,
-		}, fmt.Errorf("checking buildkit compatibility: %w", err)
+		return id, state, fmt.Errorf("checking buildkit compatibility: %w", err)
 	}
 	if !ok {
-		return infer.CreateResponse[ImageState]{
-			ID:     id,
-			Output: state,
-		}, errors.New("buildkit is not supported on this host")
+		return id, state, errors.New("buildkit is not supported on this host")
 	}
 
-	build, err := input.toBuild(ctx, cli.SupportsMultipleExports(), req.DryRun)
+	build, err := input.toBuild(ctx, preview)
 	if err != nil {
-		return infer.CreateResponse[ImageState]{
-			ID:     id,
-			Output: state,
-		}, fmt.Errorf("preparing: %w", err)
+		return id, state, fmt.Errorf("preparing: %w", err)
 	}
 
 	hash, err := hashBuildContext(
@@ -726,24 +705,21 @@ func (i *Image) Create(
 		input.Context.Named.Map(),
 	)
 	if err != nil {
-		return infer.CreateResponse[ImageState]{
-			ID:     id,
-			Output: state,
-		}, fmt.Errorf("hashing build context: %w", err)
+		return id, state, fmt.Errorf("hashing build context: %w", err)
 	}
 	state.ContextHash = hash
 
-	if req.DryRun && !input.shouldBuildOnPreview() {
-		return infer.CreateResponse[ImageState]{ID: id, Output: state}, nil
+	if preview && !input.shouldBuildOnPreview() {
+		return id, state, nil
 	}
-	if req.DryRun && !input.buildable() {
+	if preview && !input.buildable() {
 		provider.GetLogger(ctx).Warning("Skipping preview build because some inputs are unknown.")
-		return infer.CreateResponse[ImageState]{ID: id, Output: state}, nil
+		return id, state, nil
 	}
 
 	result, err := cli.Build(ctx, build)
 	if err != nil {
-		return infer.CreateResponse[ImageState]{ID: id, Output: state}, err
+		return id, state, err
 	}
 
 	if d, ok := result.ExporterResponse[exptypes.ExporterImageDigestKey]; ok {
@@ -753,7 +729,7 @@ func (i *Image) Create(
 
 	if state.Digest == "" {
 		// Can't construct a ref, nothing else to do.
-		return infer.CreateResponse[ImageState]{ID: id, Output: state}, nil
+		return id, state, nil
 	}
 
 	// Take the first registry tag we find and add a digest to it. That becomes
@@ -768,7 +744,7 @@ func (i *Image) Create(
 		break
 	}
 
-	return infer.CreateResponse[ImageState]{ID: id, Output: state}, nil
+	return id, state, nil
 }
 
 // Update builds a new image. Normally we create-replace resources, but for
@@ -776,41 +752,36 @@ func (i *Image) Create(
 // updates and simply re-build the image without deleting anything.
 func (i *Image) Update(
 	ctx context.Context,
-	req infer.UpdateRequest[ImageArgs, ImageState],
-) (infer.UpdateResponse[ImageState], error) {
-	resp, err := i.Create(ctx,
-		infer.CreateRequest[ImageArgs]{Name: req.ID, Inputs: req.Inputs, DryRun: req.DryRun},
-	)
-	return infer.UpdateResponse[ImageState]{Output: resp.Output}, err
+	name string,
+	_ ImageState,
+	input ImageArgs,
+	preview bool,
+) (ImageState, error) {
+	_, state, err := i.Create(ctx, name, input, preview)
+	return state, err
 }
 
 // Read attempts to read manifests from an image's exports. An image without
 // exports will have no manifests.
 func (i *Image) Read(
 	ctx context.Context,
-	req infer.ReadRequest[ImageArgs, ImageState],
+	name string,
+	input ImageArgs,
+	state ImageState,
 ) (
-	infer.ReadResponse[ImageArgs, ImageState],
+	string, // id
+	ImageArgs, // normalized inputs
+	ImageState, // normalized state
 	error,
 ) {
-	state, input := req.State, req.Inputs
-
-	cli, err := i.client(ctx, input)
+	cli, err := i.client(ctx, state, input)
 	if err != nil {
-		return infer.ReadResponse[ImageArgs, ImageState]{
-			ID:     req.ID,
-			Inputs: input,
-			State:  state,
-		}, err
+		return name, input, state, err
 	}
 
 	if !state.isExported() {
 		// Nothing was pushed -- all done.
-		return infer.ReadResponse[ImageArgs, ImageState]{
-			ID:     req.ID,
-			Inputs: input,
-			State:  state,
-		}, nil
+		return name, input, state, nil
 	}
 
 	tagsToKeep := []string{}
@@ -846,29 +817,29 @@ func (i *Image) Read(
 	// If we couldn't find the tags we expected then return an empty ID to
 	// delete the resource.
 	if len(input.Tags) > 0 && len(tagsToKeep) == 0 {
-		return infer.ReadResponse[ImageArgs, ImageState]{ID: "", Inputs: input, State: state}, nil
+		return "", input, state, nil
 	}
 
 	state.Tags = tagsToKeep
 
-	return infer.ReadResponse[ImageArgs, ImageState]{ID: req.ID, Inputs: input, State: state}, nil
+	return name, input, state, nil
 }
 
 // Delete deletes an Image. If the Image was already deleted out-of-band it is
 // treated as a success.
 func (i *Image) Delete(
 	ctx context.Context,
-	req infer.DeleteRequest[ImageState],
-) (infer.DeleteResponse, error) {
-	state := req.State
-	cli, err := i.client(ctx, state.ImageArgs)
+	_ string,
+	state ImageState,
+) error {
+	cli, err := i.client(ctx, state, state.ImageArgs)
 	if err != nil {
-		return infer.DeleteResponse{}, err
+		return err
 	}
 
 	if state.Digest == "" {
 		// Nothing was exported. Just try to delete the local image.
-		return infer.DeleteResponse{}, cli.Delete(ctx, state.Ref)
+		return cli.Delete(ctx, state.Ref)
 	}
 
 	digests := []string{}
@@ -896,17 +867,17 @@ func (i *Image) Delete(
 		multierr = errors.Join(multierr, err)
 	}
 
-	return infer.DeleteResponse{}, multierr
+	return multierr
 }
 
 // Diff re-implements most of the default diff behavior, with the exception of
 // ignoring "password" changes on registry inputs.
 func (*Image) Diff(
 	_ context.Context,
-	req infer.DiffRequest[ImageArgs, ImageState],
+	_ string,
+	olds ImageState,
+	news ImageArgs,
 ) (provider.DiffResponse, error) {
-	olds, news := req.State, req.Inputs
-
 	diff := map[string]provider.PropertyDiff{}
 	update := provider.PropertyDiff{Kind: provider.Update}
 

provider/internal/index.go

@@ -28,6 +28,7 @@ import (
 
 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 )
 
 var (
@@ -46,10 +47,7 @@ var (
 var _indexExamples string
 
 // Index is an OCI index or manifest list on a remote registry.
-type Index struct {
-	clientF clientF
-	config  *Config
-}
+type Index struct{}
 
 // IndexArgs instantiate an Index.
 type IndexArgs struct {
@@ -66,14 +64,6 @@ func (i IndexArgs) isPushed() bool {
 	return *i.Push
 }
 
-// GetRegistries returns the index's registry.
-func (i IndexArgs) GetRegistries() []Registry {
-	if i.Registry == nil {
-		return nil
-	}
-	return []Registry{*i.Registry}
-}
-
 // IndexState captures the state of an Index.
 type IndexState struct {
 	IndexArgs
@@ -142,82 +132,66 @@ func (i *IndexState) Annotate(a infer.Annotator) {
 // Create is a passthrough to Update.
 func (i *Index) Create(
 	ctx context.Context,
-	req infer.CreateRequest[IndexArgs],
-) (infer.CreateResponse[IndexState], error) {
-	resp, err := i.Update(ctx,
-		infer.UpdateRequest[IndexArgs, IndexState]{
-			ID:     req.Name,
-			State:  IndexState{},
-			Inputs: req.Inputs,
-			DryRun: req.DryRun,
-		},
-	)
-	return infer.CreateResponse[IndexState]{ID: req.Name, Output: resp.Output}, err
+	name string,
+	input IndexArgs,
+	preview bool,
+) (string, IndexState, error) {
+	state, err := i.Update(ctx, name, IndexState{}, input, preview)
+	return name, state, err
 }
 
 // Update performs `buildx imagetools create` to create a new OCI index /
 // manifest list.
 func (i *Index) Update(
 	ctx context.Context,
-	req infer.UpdateRequest[IndexArgs, IndexState],
-) (infer.UpdateResponse[IndexState], error) {
-	state, input := req.State, req.Inputs
-
+	name string,
+	state IndexState,
+	input IndexArgs,
+	preview bool,
+) (IndexState, error) {
 	state.IndexArgs = input
 	state.Ref = input.Tag
 
-	cli, err := i.client(ctx, input)
+	cli, err := i.client(ctx, state, input)
 	if err != nil {
-		return infer.UpdateResponse[IndexState]{Output: state}, err
+		return state, err
 	}
 
-	if req.DryRun {
-		return infer.UpdateResponse[IndexState]{Output: state}, nil
+	if preview {
+		return state, nil
 	}
 
-	provider.GetLogger(ctx).
-		Debugf("creating index with tag %s and sources %s", input.Tag, input.Sources)
+	provider.GetLogger(ctx).Debugf("creating index with tag %s and sources %s", input.Tag, input.Sources)
 
 	err = cli.ManifestCreate(ctx, input.isPushed(), input.Tag, input.Sources...)
 	if err != nil {
-		return infer.UpdateResponse[IndexState]{Output: state}, fmt.Errorf("creating: %w", err)
+		return state, fmt.Errorf("creating: %w", err)
 	}
 
-	// Read remote manifest information, if it exists.
-	live, err := i.Read(ctx,
-		infer.ReadRequest[IndexArgs, IndexState]{ID: req.ID, Inputs: input, State: state},
-	)
+	_, _, state, err = i.Read(ctx, name, input, state)
 	if err != nil {
-		return infer.UpdateResponse[IndexState]{Output: state}, fmt.Errorf("reading: %w", err)
+		return state, fmt.Errorf("reading: %w", err)
 	}
-	return infer.UpdateResponse[IndexState]{Output: live.State}, nil
+	return state, nil
 }
 
 func (i *Index) Read(
 	ctx context.Context,
-	req infer.ReadRequest[IndexArgs, IndexState],
-) (infer.ReadResponse[IndexArgs, IndexState], error) {
-	state, input := req.State, req.Inputs
-
+	name string,
+	input IndexArgs,
+	state IndexState,
+) (string, IndexArgs, IndexState, error) {
 	state.IndexArgs = input
 	state.Ref = input.Tag
 
 	if !input.isPushed() {
 		provider.GetLogger(ctx).Debug("skipping read because index was not pushed")
-		return infer.ReadResponse[IndexArgs, IndexState]{
-			ID:     req.ID,
-			Inputs: input,
-			State:  state,
-		}, nil // Nothing to read.
+		return name, input, state, nil // Nothing to read.
 	}
 
-	cli, err := i.client(ctx, input)
+	cli, err := i.client(ctx, state, input)
 	if err != nil {
-		return infer.ReadResponse[IndexArgs, IndexState]{
-			ID:     req.ID,
-			Inputs: input,
-			State:  state,
-		}, err
+		return name, input, state, err
 	}
 
 	provider.GetLogger(ctx).Debug("reading index with tag " + input.Tag)
@@ -225,29 +199,21 @@ func (i *Index) Read(
 	digest, err := cli.ManifestInspect(ctx, input.Tag)
 	if errors.Is(err, errs.ErrNotFound) {
 		// A remote tag was expected but isn't there -- delete the resource.
-		return infer.ReadResponse[IndexArgs, IndexState]{ID: "", Inputs: input, State: state}, nil
+		return "", input, state, nil
 	}
 	if errors.Is(err, errs.ErrHTTPUnauthorized) {
 		provider.GetLogger(ctx).Warning("invalid credentials, skipping")
-		return infer.ReadResponse[IndexArgs, IndexState]{
-			ID:     req.ID,
-			Inputs: input,
-			State:  state,
-		}, nil
+		return name, input, state, nil
 	}
 	if err != nil {
-		return infer.ReadResponse[IndexArgs, IndexState]{
-			ID:     req.ID,
-			Inputs: input,
-			State:  state,
-		}, err
+		return name, input, state, err
 	}
 
 	if ref, ok := addDigest(input.Tag, digest); ok {
 		state.Ref = ref
 	}
 
-	return infer.ReadResponse[IndexArgs, IndexState]{ID: req.ID, Inputs: input, State: state}, nil
+	return name, input, state, nil
 }
 
 // Check confirms the Index's tag and source refs are all valid. This doesn't
@@ -256,11 +222,13 @@ func (i *Index) Read(
 // cases for now.
 func (i *Index) Check(
 	ctx context.Context,
-	req infer.CheckRequest,
-) (infer.CheckResponse[IndexArgs], error) {
-	args, failures, err := infer.DefaultCheck[IndexArgs](ctx, req.NewInputs)
+	_ string,
+	_ resource.PropertyMap,
+	news resource.PropertyMap,
+) (IndexArgs, []provider.CheckFailure, error) {
+	args, failures, err := infer.DefaultCheck[IndexArgs](ctx, news)
 	if err != nil {
-		return infer.CheckResponse[IndexArgs]{Failures: failures, Inputs: args}, err
+		return args, failures, err
 	}
 
 	if _, err := normalizeReference(args.Tag); args.Tag != "" && err != nil {
@@ -285,31 +253,27 @@ func (i *Index) Check(
 		}
 	}
 
-	return infer.CheckResponse[IndexArgs]{Failures: failures, Inputs: args}, nil
+	return args, failures, nil
 }
 
 // Delete attempts to delete the remote manifest.
-func (i *Index) Delete(
-	ctx context.Context,
-	req infer.DeleteRequest[IndexState],
-) (infer.DeleteResponse, error) {
-	state := req.State
+func (i *Index) Delete(ctx context.Context, _ string, state IndexState) error {
 	if !state.isPushed() {
-		return infer.DeleteResponse{}, nil // Nothing to delete.
+		return nil // Nothing to delete.
 	}
 
-	cli, err := i.client(ctx, state.IndexArgs)
+	cli, err := i.client(ctx, state, state.IndexArgs)
 	if err != nil {
-		return infer.DeleteResponse{}, err
+		return err
 	}
 
 	err = cli.ManifestDelete(ctx, state.Ref)
 	// TODO: Upstream buildx swallows the error types we'd like to test for
 	// here.
 	if err != nil && strings.Contains(err.Error(), "No such manifest:") {
-		return infer.DeleteResponse{}, nil
+		return nil
 	}
-	return infer.DeleteResponse{}, err
+	return err
 }
 
 // Diff returns a diff of proposed changes against current state. Ideally we
@@ -318,10 +282,10 @@ func (i *Index) Delete(
 // change all the time due to short-lived AWS credentials).
 func (i *Index) Diff(
 	_ context.Context,
-	req infer.DiffRequest[IndexArgs, IndexState],
+	_ string,
+	olds IndexState,
+	news IndexArgs,
 ) (provider.DiffResponse, error) {
-	olds, news := req.State, req.Inputs
-
 	diff := map[string]provider.PropertyDiff{}
 	update := provider.PropertyDiff{Kind: provider.Update}
 	replace := provider.PropertyDiff{Kind: provider.UpdateReplace}
@@ -359,7 +323,23 @@ func (i *Index) Diff(
 // any host-level credentials.
 func (i *Index) client(
 	ctx context.Context,
+	_ IndexState,
 	args IndexArgs,
 ) (Client, error) {
-	return i.clientF(ctx, i.config.getHost(), i.config, args)
+	cfg := infer.GetConfig[Config](ctx)
+
+	if cli, ok := ctx.Value(_mockClientKey).(Client); ok {
+		return cli, nil
+	}
+
+	// We prefer auth from args, the provider, and state in that order. We
+	// build a slice in reverse order because wrap() will overwrite earlier
+	// entries with later ones.
+	auths := []Registry{}
+	auths = append(auths, cfg.Registries...)
+	if args.Registry != nil {
+		auths = append(auths, *args.Registry)
+	}
+
+	return wrap(cfg.host, auths...)
 }

provider/internal/index_test.go

@@ -27,35 +27,34 @@ import (
 	"github.com/pulumi/pulumi-go-provider/integration"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/mapper"
-	"github.com/pulumi/pulumi/sdk/v3/go/property"
 )
 
 func TestIndexLifecycle(t *testing.T) {
 	t.Parallel()
-	realClient := func(t *testing.T) clientF { return RealClientF }
+	realClient := func(t *testing.T) Client { return nil }
 
 	tests := []struct {
 		name string
 		skip bool
 
 		op     func(t *testing.T) integration.Operation
-		client func(t *testing.T) clientF
+		client func(t *testing.T) Client
 	}{
 		{
 			name:   "not pushed",
 			client: realClient,
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: property.NewMap(map[string]property.Value{
-						"tag": property.New(
+					Inputs: resource.PropertyMap{
+						"tag": resource.NewStringProperty(
 							"docker.io/pulumibot/buildkit-e2e:manifest-unit",
 						),
-						"sources": property.New([]property.Value{
-							property.New("docker.io/pulumibot/buildkit-e2e:arm64"),
-							property.New("docker.io/pulumibot/buildkit-e2e:amd64"),
+						"sources": resource.NewArrayProperty([]resource.PropertyValue{
+							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:arm64"),
+							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:amd64"),
 						}),
-						"push": property.New(false),
-					}),
+						"push": resource.NewBoolProperty(false),
+					},
 				}
 			},
 		},
@@ -65,57 +64,66 @@ func TestIndexLifecycle(t *testing.T) {
 			client: realClient,
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: property.NewMap(map[string]property.Value{
-						"tag": property.New(
+					Inputs: resource.PropertyMap{
+						"tag": resource.NewStringProperty(
 							"docker.io/pulumibot/buildkit-e2e:manifest",
 						),
-						"sources": property.New([]property.Value{
-							property.New("docker.io/pulumibot/buildkit-e2e:arm64"),
-							property.New("docker.io/pulumibot/buildkit-e2e:amd64"),
+						"sources": resource.NewArrayProperty([]resource.PropertyValue{
+							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:arm64"),
+							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:amd64"),
 						}),
-						"push": property.New(true),
-						"registry": property.New(map[string]property.Value{
-							"address":  property.New("docker.io"),
-							"username": property.New("pulumibot"),
-							"password": property.New(os.Getenv("DOCKER_HUB_PASSWORD")).WithSecret(true),
+						"push": resource.NewBoolProperty(true),
+						"registry": resource.NewObjectProperty(resource.PropertyMap{
+							"address":  resource.NewStringProperty("docker.io"),
+							"username": resource.NewStringProperty("pulumibot"),
+							"password": resource.NewSecretProperty(&resource.Secret{
+								Element: resource.NewStringProperty(
+									os.Getenv("DOCKER_HUB_PASSWORD"),
+								),
+							}),
 						}),
-					}),
+					},
 				}
 			},
 		},
 		{
 			name: "expired credentials",
-			client: func(t *testing.T) clientF {
+			client: func(t *testing.T) Client {
 				ctrl := gomock.NewController(t)
 				c := NewMockClient(ctrl)
 				c.EXPECT().ManifestCreate(gomock.Any(), true, gomock.Any(), gomock.Any())
 				c.EXPECT().ManifestInspect(gomock.Any(), gomock.Any()).Return("", errs.ErrHTTPUnauthorized)
 				c.EXPECT().ManifestDelete(gomock.Any(), gomock.Any()).Return(nil)
-				return mockClientF(c)
+				return c
 			},
 			op: func(t *testing.T) integration.Operation {
 				return integration.Operation{
-					Inputs: property.NewMap(map[string]property.Value{
-						"tag": property.New(
+					Inputs: resource.PropertyMap{
+						"tag": resource.NewStringProperty(
 							"docker.io/pulumibot/buildkit-e2e:manifest",
 						),
-						"sources": property.New([]property.Value{
-							property.New("docker.io/pulumibot/buildkit-e2e:arm64"),
-							property.New("docker.io/pulumibot/buildkit-e2e:amd64"),
+						"sources": resource.NewArrayProperty([]resource.PropertyValue{
+							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:arm64"),
+							resource.NewStringProperty("docker.io/pulumibot/buildkit-e2e:amd64"),
 						}),
-						"push": property.New(true),
-						"registry": property.New(map[string]property.Value{
-							"address":  property.New("docker.io"),
-							"username": property.New("pulumibot"),
-							"password": property.New(os.Getenv("DOCKER_HUB_PASSWORD")).WithSecret(true),
+						"push": resource.NewBoolProperty(true),
+						"registry": resource.NewObjectProperty(resource.PropertyMap{
+							"address":  resource.NewStringProperty("docker.io"),
+							"username": resource.NewStringProperty("pulumibot"),
+							"password": resource.NewSecretProperty(&resource.Secret{
+								Element: resource.NewStringProperty(
+									os.Getenv("DOCKER_HUB_PASSWORD"),
+								),
+							}),
 						}),
-					}),
+					},
 				}
 			},
 		},
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			if tt.skip {
@@ -125,7 +133,7 @@ func TestIndexLifecycle(t *testing.T) {
 				Resource: "docker-build:index:Index",
 				Create:   tt.op(t),
 			}
-			s := newServer(t.Context(), t, tt.client(t))
+			s := newServer(tt.client(t))
 
 			err := s.Configure(provider.ConfigureRequest{})
 			require.NoError(t, err)
@@ -142,22 +150,22 @@ func TestIndexDiff(t *testing.T) {
 	baseState := IndexState{IndexArgs: baseArgs}
 
 	tests := []struct {
-		name   string
-		state  func(*testing.T, IndexState) IndexState
-		inputs func(*testing.T, IndexArgs) IndexArgs
+		name string
+		olds func(*testing.T, IndexState) IndexState
+		news func(*testing.T, IndexArgs) IndexArgs
 
 		wantChanges bool
 	}{
 		{
 			name:        "no diff if no changes",
-			state:       func(*testing.T, IndexState) IndexState { return baseState },
-			inputs:      func(*testing.T, IndexArgs) IndexArgs { return baseArgs },
+			olds:        func(*testing.T, IndexState) IndexState { return baseState },
+			news:        func(*testing.T, IndexArgs) IndexArgs { return baseArgs },
 			wantChanges: false,
 		},
 		{
-			name:  "diff if tag changes",
-			state: func(*testing.T, IndexState) IndexState { return baseState },
-			inputs: func(t *testing.T, a IndexArgs) IndexArgs {
+			name: "diff if tag changes",
+			olds: func(*testing.T, IndexState) IndexState { return baseState },
+			news: func(t *testing.T, a IndexArgs) IndexArgs {
 				a.Tag = "new-tag"
 				return a
 			},
@@ -165,7 +173,7 @@ func TestIndexDiff(t *testing.T) {
 		},
 		{
 			name: "no diff if registry password changes",
-			state: func(_ *testing.T, s IndexState) IndexState {
+			olds: func(_ *testing.T, s IndexState) IndexState {
 				s.Registry = &Registry{
 					Address:  "foo",
 					Username: "foo",
@@ -173,7 +181,7 @@ func TestIndexDiff(t *testing.T) {
 				}
 				return s
 			},
-			inputs: func(_ *testing.T, a IndexArgs) IndexArgs {
+			news: func(_ *testing.T, a IndexArgs) IndexArgs {
 				a.Registry = &Registry{
 					Address:  "foo",
 					Username: "foo",
@@ -184,9 +192,9 @@ func TestIndexDiff(t *testing.T) {
 			wantChanges: false,
 		},
 		{
-			name:  "diff if registry added",
-			state: func(*testing.T, IndexState) IndexState { return baseState },
-			inputs: func(_ *testing.T, a IndexArgs) IndexArgs {
+			name: "diff if registry added",
+			olds: func(*testing.T, IndexState) IndexState { return baseState },
+			news: func(_ *testing.T, a IndexArgs) IndexArgs {
 				a.Registry = &Registry{Address: "foo.com", Username: "foo", Password: "foo"}
 				return a
 			},
@@ -194,7 +202,7 @@ func TestIndexDiff(t *testing.T) {
 		},
 		{
 			name: "diff if registry user changes",
-			state: func(_ *testing.T, s IndexState) IndexState {
+			olds: func(_ *testing.T, s IndexState) IndexState {
 				s.Registry = &Registry{
 					Address:  "foo",
 					Username: "foo",
@@ -202,7 +210,7 @@ func TestIndexDiff(t *testing.T) {
 				}
 				return s
 			},
-			inputs: func(_ *testing.T, a IndexArgs) IndexArgs {
+			news: func(_ *testing.T, a IndexArgs) IndexArgs {
 				a.Registry = &Registry{
 					Address:  "DIFFERENT USER",
 					Username: "foo",
@@ -214,21 +222,22 @@ func TestIndexDiff(t *testing.T) {
 		},
 	}
 
-	s := newServer(t.Context(), t, nil)
+	s := newServer(nil)
 
-	encode := func(t *testing.T, x any) property.Map {
+	encode := func(t *testing.T, x any) resource.PropertyMap {
 		raw, err := mapper.New(&mapper.Opts{IgnoreMissing: true}).Encode(x)
 		require.NoError(t, err)
-		return resource.FromResourcePropertyMap(resource.NewPropertyMapFromMap(raw))
+		return resource.NewPropertyMapFromMap(raw)
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 			resp, err := s.Diff(provider.DiffRequest{
-				Urn:    urn,
-				State:  encode(t, tt.state(t, baseState)),
-				Inputs: encode(t, tt.inputs(t, baseArgs)),
+				Urn:  urn,
+				Olds: encode(t, tt.olds(t, baseState)),
+				News: encode(t, tt.news(t, baseArgs)),
 			})
 			assert.NoError(t, err)
 			assert.Equal(t, tt.wantChanges, resp.HasChanges, resp.DetailedDiff)

provider/internal/mockcli_test.go

@@ -5,22 +5,23 @@
 //
 //	mockgen -typed -package internal -source cli.go -destination mockcli_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal
 //
-
 // Package internal is a generated GoMock package.
 package internal
 
 import (
+	io "io"
 	reflect "reflect"
 
 	command "github.com/docker/cli/cli/command"
 	configfile "github.com/docker/cli/cli/config/configfile"
 	docker "github.com/docker/cli/cli/context/docker"
 	store "github.com/docker/cli/cli/context/store"
+	store0 "github.com/docker/cli/cli/manifest/store"
+	client "github.com/docker/cli/cli/registry/client"
 	streams "github.com/docker/cli/cli/streams"
-	client "github.com/docker/docker/client"
-	metric "go.opentelemetry.io/otel/metric"
-	resource "go.opentelemetry.io/otel/sdk/resource"
-	trace "go.opentelemetry.io/otel/trace"
+	trust "github.com/docker/cli/cli/trust"
+	client0 "github.com/docker/docker/client"
+	client1 "github.com/theupdateframework/notary/client"
 	gomock "go.uber.org/mock/gomock"
 )
 
@@ -28,7 +29,6 @@ import (
 type MockCli struct {
 	ctrl     *gomock.Controller
 	recorder *MockCliMockRecorder
-	isgomock struct{}
 }
 
 // MockCliMockRecorder is the mock recorder for MockCli.
@@ -61,31 +61,31 @@ func (m *MockCli) Apply(ops ...command.CLIOption) error {
 }
 
 // Apply indicates an expected call of Apply.
-func (mr *MockCliMockRecorder) Apply(ops ...any) *MockCliApplyCall {
+func (mr *MockCliMockRecorder) Apply(ops ...any) *CliApplyCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Apply", reflect.TypeOf((*MockCli)(nil).Apply), ops...)
-	return &MockCliApplyCall{Call: call}
+	return &CliApplyCall{Call: call}
 }
 
-// MockCliApplyCall wrap *gomock.Call
-type MockCliApplyCall struct {
+// CliApplyCall wrap *gomock.Call
+type CliApplyCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliApplyCall) Return(arg0 error) *MockCliApplyCall {
+func (c *CliApplyCall) Return(arg0 error) *CliApplyCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliApplyCall) Do(f func(...command.CLIOption) error) *MockCliApplyCall {
+func (c *CliApplyCall) Do(f func(...command.CLIOption) error) *CliApplyCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliApplyCall) DoAndReturn(f func(...command.CLIOption) error) *MockCliApplyCall {
+func (c *CliApplyCall) DoAndReturn(f func(...command.CLIOption) error) *CliApplyCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -100,69 +100,69 @@ func (m *MockCli) BuildKitEnabled() (bool, error) {
 }
 
 // BuildKitEnabled indicates an expected call of BuildKitEnabled.
-func (mr *MockCliMockRecorder) BuildKitEnabled() *MockCliBuildKitEnabledCall {
+func (mr *MockCliMockRecorder) BuildKitEnabled() *CliBuildKitEnabledCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BuildKitEnabled", reflect.TypeOf((*MockCli)(nil).BuildKitEnabled))
-	return &MockCliBuildKitEnabledCall{Call: call}
+	return &CliBuildKitEnabledCall{Call: call}
 }
 
-// MockCliBuildKitEnabledCall wrap *gomock.Call
-type MockCliBuildKitEnabledCall struct {
+// CliBuildKitEnabledCall wrap *gomock.Call
+type CliBuildKitEnabledCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliBuildKitEnabledCall) Return(arg0 bool, arg1 error) *MockCliBuildKitEnabledCall {
+func (c *CliBuildKitEnabledCall) Return(arg0 bool, arg1 error) *CliBuildKitEnabledCall {
 	c.Call = c.Call.Return(arg0, arg1)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliBuildKitEnabledCall) Do(f func() (bool, error)) *MockCliBuildKitEnabledCall {
+func (c *CliBuildKitEnabledCall) Do(f func() (bool, error)) *CliBuildKitEnabledCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliBuildKitEnabledCall) DoAndReturn(f func() (bool, error)) *MockCliBuildKitEnabledCall {
+func (c *CliBuildKitEnabledCall) DoAndReturn(f func() (bool, error)) *CliBuildKitEnabledCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
 
 // Client mocks base method.
-func (m *MockCli) Client() client.APIClient {
+func (m *MockCli) Client() client0.APIClient {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Client")
-	ret0, _ := ret[0].(client.APIClient)
+	ret0, _ := ret[0].(client0.APIClient)
 	return ret0
 }
 
 // Client indicates an expected call of Client.
-func (mr *MockCliMockRecorder) Client() *MockCliClientCall {
+func (mr *MockCliMockRecorder) Client() *CliClientCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Client", reflect.TypeOf((*MockCli)(nil).Client))
-	return &MockCliClientCall{Call: call}
+	return &CliClientCall{Call: call}
 }
 
-// MockCliClientCall wrap *gomock.Call
-type MockCliClientCall struct {
+// CliClientCall wrap *gomock.Call
+type CliClientCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliClientCall) Return(arg0 client.APIClient) *MockCliClientCall {
+func (c *CliClientCall) Return(arg0 client0.APIClient) *CliClientCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliClientCall) Do(f func() client.APIClient) *MockCliClientCall {
+func (c *CliClientCall) Do(f func() client0.APIClient) *CliClientCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliClientCall) DoAndReturn(f func() client.APIClient) *MockCliClientCall {
+func (c *CliClientCall) DoAndReturn(f func() client0.APIClient) *CliClientCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -176,31 +176,31 @@ func (m *MockCli) ConfigFile() *configfile.ConfigFile {
 }
 
 // ConfigFile indicates an expected call of ConfigFile.
-func (mr *MockCliMockRecorder) ConfigFile() *MockCliConfigFileCall {
+func (mr *MockCliMockRecorder) ConfigFile() *CliConfigFileCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ConfigFile", reflect.TypeOf((*MockCli)(nil).ConfigFile))
-	return &MockCliConfigFileCall{Call: call}
+	return &CliConfigFileCall{Call: call}
 }
 
-// MockCliConfigFileCall wrap *gomock.Call
-type MockCliConfigFileCall struct {
+// CliConfigFileCall wrap *gomock.Call
+type CliConfigFileCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliConfigFileCall) Return(arg0 *configfile.ConfigFile) *MockCliConfigFileCall {
+func (c *CliConfigFileCall) Return(arg0 *configfile.ConfigFile) *CliConfigFileCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliConfigFileCall) Do(f func() *configfile.ConfigFile) *MockCliConfigFileCall {
+func (c *CliConfigFileCall) Do(f func() *configfile.ConfigFile) *CliConfigFileCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliConfigFileCall) DoAndReturn(f func() *configfile.ConfigFile) *MockCliConfigFileCall {
+func (c *CliConfigFileCall) DoAndReturn(f func() *configfile.ConfigFile) *CliConfigFileCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -214,31 +214,31 @@ func (m *MockCli) ContentTrustEnabled() bool {
 }
 
 // ContentTrustEnabled indicates an expected call of ContentTrustEnabled.
-func (mr *MockCliMockRecorder) ContentTrustEnabled() *MockCliContentTrustEnabledCall {
+func (mr *MockCliMockRecorder) ContentTrustEnabled() *CliContentTrustEnabledCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ContentTrustEnabled", reflect.TypeOf((*MockCli)(nil).ContentTrustEnabled))
-	return &MockCliContentTrustEnabledCall{Call: call}
+	return &CliContentTrustEnabledCall{Call: call}
 }
 
-// MockCliContentTrustEnabledCall wrap *gomock.Call
-type MockCliContentTrustEnabledCall struct {
+// CliContentTrustEnabledCall wrap *gomock.Call
+type CliContentTrustEnabledCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliContentTrustEnabledCall) Return(arg0 bool) *MockCliContentTrustEnabledCall {
+func (c *CliContentTrustEnabledCall) Return(arg0 bool) *CliContentTrustEnabledCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliContentTrustEnabledCall) Do(f func() bool) *MockCliContentTrustEnabledCall {
+func (c *CliContentTrustEnabledCall) Do(f func() bool) *CliContentTrustEnabledCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliContentTrustEnabledCall) DoAndReturn(f func() bool) *MockCliContentTrustEnabledCall {
+func (c *CliContentTrustEnabledCall) DoAndReturn(f func() bool) *CliContentTrustEnabledCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -252,31 +252,31 @@ func (m *MockCli) ContextStore() store.Store {
 }
 
 // ContextStore indicates an expected call of ContextStore.
-func (mr *MockCliMockRecorder) ContextStore() *MockCliContextStoreCall {
+func (mr *MockCliMockRecorder) ContextStore() *CliContextStoreCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ContextStore", reflect.TypeOf((*MockCli)(nil).ContextStore))
-	return &MockCliContextStoreCall{Call: call}
+	return &CliContextStoreCall{Call: call}
 }
 
-// MockCliContextStoreCall wrap *gomock.Call
-type MockCliContextStoreCall struct {
+// CliContextStoreCall wrap *gomock.Call
+type CliContextStoreCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliContextStoreCall) Return(arg0 store.Store) *MockCliContextStoreCall {
+func (c *CliContextStoreCall) Return(arg0 store.Store) *CliContextStoreCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliContextStoreCall) Do(f func() store.Store) *MockCliContextStoreCall {
+func (c *CliContextStoreCall) Do(f func() store.Store) *CliContextStoreCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliContextStoreCall) DoAndReturn(f func() store.Store) *MockCliContextStoreCall {
+func (c *CliContextStoreCall) DoAndReturn(f func() store.Store) *CliContextStoreCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -290,31 +290,31 @@ func (m *MockCli) CurrentContext() string {
 }
 
 // CurrentContext indicates an expected call of CurrentContext.
-func (mr *MockCliMockRecorder) CurrentContext() *MockCliCurrentContextCall {
+func (mr *MockCliMockRecorder) CurrentContext() *CliCurrentContextCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CurrentContext", reflect.TypeOf((*MockCli)(nil).CurrentContext))
-	return &MockCliCurrentContextCall{Call: call}
+	return &CliCurrentContextCall{Call: call}
 }
 
-// MockCliCurrentContextCall wrap *gomock.Call
-type MockCliCurrentContextCall struct {
+// CliCurrentContextCall wrap *gomock.Call
+type CliCurrentContextCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliCurrentContextCall) Return(arg0 string) *MockCliCurrentContextCall {
+func (c *CliCurrentContextCall) Return(arg0 string) *CliCurrentContextCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliCurrentContextCall) Do(f func() string) *MockCliCurrentContextCall {
+func (c *CliCurrentContextCall) Do(f func() string) *CliCurrentContextCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliCurrentContextCall) DoAndReturn(f func() string) *MockCliCurrentContextCall {
+func (c *CliCurrentContextCall) DoAndReturn(f func() string) *CliCurrentContextCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -328,31 +328,31 @@ func (m *MockCli) CurrentVersion() string {
 }
 
 // CurrentVersion indicates an expected call of CurrentVersion.
-func (mr *MockCliMockRecorder) CurrentVersion() *MockCliCurrentVersionCall {
+func (mr *MockCliMockRecorder) CurrentVersion() *CliCurrentVersionCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CurrentVersion", reflect.TypeOf((*MockCli)(nil).CurrentVersion))
-	return &MockCliCurrentVersionCall{Call: call}
+	return &CliCurrentVersionCall{Call: call}
 }
 
-// MockCliCurrentVersionCall wrap *gomock.Call
-type MockCliCurrentVersionCall struct {
+// CliCurrentVersionCall wrap *gomock.Call
+type CliCurrentVersionCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliCurrentVersionCall) Return(arg0 string) *MockCliCurrentVersionCall {
+func (c *CliCurrentVersionCall) Return(arg0 string) *CliCurrentVersionCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliCurrentVersionCall) Do(f func() string) *MockCliCurrentVersionCall {
+func (c *CliCurrentVersionCall) Do(f func() string) *CliCurrentVersionCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliCurrentVersionCall) DoAndReturn(f func() string) *MockCliCurrentVersionCall {
+func (c *CliCurrentVersionCall) DoAndReturn(f func() string) *CliCurrentVersionCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -366,31 +366,31 @@ func (m *MockCli) DefaultVersion() string {
 }
 
 // DefaultVersion indicates an expected call of DefaultVersion.
-func (mr *MockCliMockRecorder) DefaultVersion() *MockCliDefaultVersionCall {
+func (mr *MockCliMockRecorder) DefaultVersion() *CliDefaultVersionCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DefaultVersion", reflect.TypeOf((*MockCli)(nil).DefaultVersion))
-	return &MockCliDefaultVersionCall{Call: call}
+	return &CliDefaultVersionCall{Call: call}
 }
 
-// MockCliDefaultVersionCall wrap *gomock.Call
-type MockCliDefaultVersionCall struct {
+// CliDefaultVersionCall wrap *gomock.Call
+type CliDefaultVersionCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliDefaultVersionCall) Return(arg0 string) *MockCliDefaultVersionCall {
+func (c *CliDefaultVersionCall) Return(arg0 string) *CliDefaultVersionCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliDefaultVersionCall) Do(f func() string) *MockCliDefaultVersionCall {
+func (c *CliDefaultVersionCall) Do(f func() string) *CliDefaultVersionCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliDefaultVersionCall) DoAndReturn(f func() string) *MockCliDefaultVersionCall {
+func (c *CliDefaultVersionCall) DoAndReturn(f func() string) *CliDefaultVersionCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -404,69 +404,69 @@ func (m *MockCli) DockerEndpoint() docker.Endpoint {
 }
 
 // DockerEndpoint indicates an expected call of DockerEndpoint.
-func (mr *MockCliMockRecorder) DockerEndpoint() *MockCliDockerEndpointCall {
+func (mr *MockCliMockRecorder) DockerEndpoint() *CliDockerEndpointCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DockerEndpoint", reflect.TypeOf((*MockCli)(nil).DockerEndpoint))
-	return &MockCliDockerEndpointCall{Call: call}
+	return &CliDockerEndpointCall{Call: call}
 }
 
-// MockCliDockerEndpointCall wrap *gomock.Call
-type MockCliDockerEndpointCall struct {
+// CliDockerEndpointCall wrap *gomock.Call
+type CliDockerEndpointCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliDockerEndpointCall) Return(arg0 docker.Endpoint) *MockCliDockerEndpointCall {
+func (c *CliDockerEndpointCall) Return(arg0 docker.Endpoint) *CliDockerEndpointCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliDockerEndpointCall) Do(f func() docker.Endpoint) *MockCliDockerEndpointCall {
+func (c *CliDockerEndpointCall) Do(f func() docker.Endpoint) *CliDockerEndpointCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliDockerEndpointCall) DoAndReturn(f func() docker.Endpoint) *MockCliDockerEndpointCall {
+func (c *CliDockerEndpointCall) DoAndReturn(f func() docker.Endpoint) *CliDockerEndpointCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
 
 // Err mocks base method.
-func (m *MockCli) Err() *streams.Out {
+func (m *MockCli) Err() io.Writer {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "Err")
-	ret0, _ := ret[0].(*streams.Out)
+	ret0, _ := ret[0].(io.Writer)
 	return ret0
 }
 
 // Err indicates an expected call of Err.
-func (mr *MockCliMockRecorder) Err() *MockCliErrCall {
+func (mr *MockCliMockRecorder) Err() *CliErrCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Err", reflect.TypeOf((*MockCli)(nil).Err))
-	return &MockCliErrCall{Call: call}
+	return &CliErrCall{Call: call}
 }
 
-// MockCliErrCall wrap *gomock.Call
-type MockCliErrCall struct {
+// CliErrCall wrap *gomock.Call
+type CliErrCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliErrCall) Return(arg0 *streams.Out) *MockCliErrCall {
+func (c *CliErrCall) Return(arg0 io.Writer) *CliErrCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliErrCall) Do(f func() *streams.Out) *MockCliErrCall {
+func (c *CliErrCall) Do(f func() io.Writer) *CliErrCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliErrCall) DoAndReturn(f func() *streams.Out) *MockCliErrCall {
+func (c *CliErrCall) DoAndReturn(f func() io.Writer) *CliErrCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -480,69 +480,108 @@ func (m *MockCli) In() *streams.In {
 }
 
 // In indicates an expected call of In.
-func (mr *MockCliMockRecorder) In() *MockCliInCall {
+func (mr *MockCliMockRecorder) In() *CliInCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "In", reflect.TypeOf((*MockCli)(nil).In))
-	return &MockCliInCall{Call: call}
+	return &CliInCall{Call: call}
 }
 
-// MockCliInCall wrap *gomock.Call
-type MockCliInCall struct {
+// CliInCall wrap *gomock.Call
+type CliInCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliInCall) Return(arg0 *streams.In) *MockCliInCall {
+func (c *CliInCall) Return(arg0 *streams.In) *CliInCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliInCall) Do(f func() *streams.In) *MockCliInCall {
+func (c *CliInCall) Do(f func() *streams.In) *CliInCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliInCall) DoAndReturn(f func() *streams.In) *MockCliInCall {
+func (c *CliInCall) DoAndReturn(f func() *streams.In) *CliInCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
 
-// MeterProvider mocks base method.
-func (m *MockCli) MeterProvider() metric.MeterProvider {
+// ManifestStore mocks base method.
+func (m *MockCli) ManifestStore() store0.Store {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "MeterProvider")
-	ret0, _ := ret[0].(metric.MeterProvider)
+	ret := m.ctrl.Call(m, "ManifestStore")
+	ret0, _ := ret[0].(store0.Store)
 	return ret0
 }
 
-// MeterProvider indicates an expected call of MeterProvider.
-func (mr *MockCliMockRecorder) MeterProvider() *MockCliMeterProviderCall {
+// ManifestStore indicates an expected call of ManifestStore.
+func (mr *MockCliMockRecorder) ManifestStore() *CliManifestStoreCall {
 	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MeterProvider", reflect.TypeOf((*MockCli)(nil).MeterProvider))
-	return &MockCliMeterProviderCall{Call: call}
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ManifestStore", reflect.TypeOf((*MockCli)(nil).ManifestStore))
+	return &CliManifestStoreCall{Call: call}
 }
 
-// MockCliMeterProviderCall wrap *gomock.Call
-type MockCliMeterProviderCall struct {
+// CliManifestStoreCall wrap *gomock.Call
+type CliManifestStoreCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliMeterProviderCall) Return(arg0 metric.MeterProvider) *MockCliMeterProviderCall {
+func (c *CliManifestStoreCall) Return(arg0 store0.Store) *CliManifestStoreCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliMeterProviderCall) Do(f func() metric.MeterProvider) *MockCliMeterProviderCall {
+func (c *CliManifestStoreCall) Do(f func() store0.Store) *CliManifestStoreCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliMeterProviderCall) DoAndReturn(f func() metric.MeterProvider) *MockCliMeterProviderCall {
+func (c *CliManifestStoreCall) DoAndReturn(f func() store0.Store) *CliManifestStoreCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// NotaryClient mocks base method.
+func (m *MockCli) NotaryClient(imgRefAndAuth trust.ImageRefAndAuth, actions []string) (client1.Repository, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NotaryClient", imgRefAndAuth, actions)
+	ret0, _ := ret[0].(client1.Repository)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// NotaryClient indicates an expected call of NotaryClient.
+func (mr *MockCliMockRecorder) NotaryClient(imgRefAndAuth, actions any) *CliNotaryClientCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NotaryClient", reflect.TypeOf((*MockCli)(nil).NotaryClient), imgRefAndAuth, actions)
+	return &CliNotaryClientCall{Call: call}
+}
+
+// CliNotaryClientCall wrap *gomock.Call
+type CliNotaryClientCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *CliNotaryClientCall) Return(arg0 client1.Repository, arg1 error) *CliNotaryClientCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *CliNotaryClientCall) Do(f func(trust.ImageRefAndAuth, []string) (client1.Repository, error)) *CliNotaryClientCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *CliNotaryClientCall) DoAndReturn(f func(trust.ImageRefAndAuth, []string) (client1.Repository, error)) *CliNotaryClientCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -556,69 +595,69 @@ func (m *MockCli) Out() *streams.Out {
 }
 
 // Out indicates an expected call of Out.
-func (mr *MockCliMockRecorder) Out() *MockCliOutCall {
+func (mr *MockCliMockRecorder) Out() *CliOutCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Out", reflect.TypeOf((*MockCli)(nil).Out))
-	return &MockCliOutCall{Call: call}
+	return &CliOutCall{Call: call}
 }
 
-// MockCliOutCall wrap *gomock.Call
-type MockCliOutCall struct {
+// CliOutCall wrap *gomock.Call
+type CliOutCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliOutCall) Return(arg0 *streams.Out) *MockCliOutCall {
+func (c *CliOutCall) Return(arg0 *streams.Out) *CliOutCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliOutCall) Do(f func() *streams.Out) *MockCliOutCall {
+func (c *CliOutCall) Do(f func() *streams.Out) *CliOutCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliOutCall) DoAndReturn(f func() *streams.Out) *MockCliOutCall {
+func (c *CliOutCall) DoAndReturn(f func() *streams.Out) *CliOutCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
 
-// Resource mocks base method.
-func (m *MockCli) Resource() *resource.Resource {
+// RegistryClient mocks base method.
+func (m *MockCli) RegistryClient(arg0 bool) client.RegistryClient {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Resource")
-	ret0, _ := ret[0].(*resource.Resource)
+	ret := m.ctrl.Call(m, "RegistryClient", arg0)
+	ret0, _ := ret[0].(client.RegistryClient)
 	return ret0
 }
 
-// Resource indicates an expected call of Resource.
-func (mr *MockCliMockRecorder) Resource() *MockCliResourceCall {
+// RegistryClient indicates an expected call of RegistryClient.
+func (mr *MockCliMockRecorder) RegistryClient(arg0 any) *CliRegistryClientCall {
 	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Resource", reflect.TypeOf((*MockCli)(nil).Resource))
-	return &MockCliResourceCall{Call: call}
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RegistryClient", reflect.TypeOf((*MockCli)(nil).RegistryClient), arg0)
+	return &CliRegistryClientCall{Call: call}
 }
 
-// MockCliResourceCall wrap *gomock.Call
-type MockCliResourceCall struct {
+// CliRegistryClientCall wrap *gomock.Call
+type CliRegistryClientCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliResourceCall) Return(arg0 *resource.Resource) *MockCliResourceCall {
+func (c *CliRegistryClientCall) Return(arg0 client.RegistryClient) *CliRegistryClientCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliResourceCall) Do(f func() *resource.Resource) *MockCliResourceCall {
+func (c *CliRegistryClientCall) Do(f func(bool) client.RegistryClient) *CliRegistryClientCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliResourceCall) DoAndReturn(f func() *resource.Resource) *MockCliResourceCall {
+func (c *CliRegistryClientCall) DoAndReturn(f func(bool) client.RegistryClient) *CliRegistryClientCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -632,31 +671,31 @@ func (m *MockCli) ServerInfo() command.ServerInfo {
 }
 
 // ServerInfo indicates an expected call of ServerInfo.
-func (mr *MockCliMockRecorder) ServerInfo() *MockCliServerInfoCall {
+func (mr *MockCliMockRecorder) ServerInfo() *CliServerInfoCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ServerInfo", reflect.TypeOf((*MockCli)(nil).ServerInfo))
-	return &MockCliServerInfoCall{Call: call}
+	return &CliServerInfoCall{Call: call}
 }
 
-// MockCliServerInfoCall wrap *gomock.Call
-type MockCliServerInfoCall struct {
+// CliServerInfoCall wrap *gomock.Call
+type CliServerInfoCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliServerInfoCall) Return(arg0 command.ServerInfo) *MockCliServerInfoCall {
+func (c *CliServerInfoCall) Return(arg0 command.ServerInfo) *CliServerInfoCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliServerInfoCall) Do(f func() command.ServerInfo) *MockCliServerInfoCall {
+func (c *CliServerInfoCall) Do(f func() command.ServerInfo) *CliServerInfoCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliServerInfoCall) DoAndReturn(f func() command.ServerInfo) *MockCliServerInfoCall {
+func (c *CliServerInfoCall) DoAndReturn(f func() command.ServerInfo) *CliServerInfoCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -668,69 +707,31 @@ func (m *MockCli) SetIn(in *streams.In) {
 }
 
 // SetIn indicates an expected call of SetIn.
-func (mr *MockCliMockRecorder) SetIn(in any) *MockCliSetInCall {
+func (mr *MockCliMockRecorder) SetIn(in any) *CliSetInCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetIn", reflect.TypeOf((*MockCli)(nil).SetIn), in)
-	return &MockCliSetInCall{Call: call}
+	return &CliSetInCall{Call: call}
 }
 
-// MockCliSetInCall wrap *gomock.Call
-type MockCliSetInCall struct {
+// CliSetInCall wrap *gomock.Call
+type CliSetInCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockCliSetInCall) Return() *MockCliSetInCall {
+func (c *CliSetInCall) Return() *CliSetInCall {
 	c.Call = c.Call.Return()
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockCliSetInCall) Do(f func(*streams.In)) *MockCliSetInCall {
+func (c *CliSetInCall) Do(f func(*streams.In)) *CliSetInCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliSetInCall) DoAndReturn(f func(*streams.In)) *MockCliSetInCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// TracerProvider mocks base method.
-func (m *MockCli) TracerProvider() trace.TracerProvider {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "TracerProvider")
-	ret0, _ := ret[0].(trace.TracerProvider)
-	return ret0
-}
-
-// TracerProvider indicates an expected call of TracerProvider.
-func (mr *MockCliMockRecorder) TracerProvider() *MockCliTracerProviderCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TracerProvider", reflect.TypeOf((*MockCli)(nil).TracerProvider))
-	return &MockCliTracerProviderCall{Call: call}
-}
-
-// MockCliTracerProviderCall wrap *gomock.Call
-type MockCliTracerProviderCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *MockCliTracerProviderCall) Return(arg0 trace.TracerProvider) *MockCliTracerProviderCall {
-	c.Call = c.Call.Return(arg0)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *MockCliTracerProviderCall) Do(f func() trace.TracerProvider) *MockCliTracerProviderCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockCliTracerProviderCall) DoAndReturn(f func() trace.TracerProvider) *MockCliTracerProviderCall {
+func (c *CliSetInCall) DoAndReturn(f func(*streams.In)) *CliSetInCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }

provider/internal/mockclient_test.go

@@ -3,9 +3,8 @@
 //
 // Generated by this command:
 //
-//	mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal -imports buildx=github.com/docker/buildx/build
+//	mockgen -typed -package internal -source client.go -destination mockclient_test.go --self_package github.com/pulumi/pulumi-docker-build/provider/internal
 //
-
 // Package internal is a generated GoMock package.
 package internal
 
@@ -13,12 +12,7 @@ import (
 	context "context"
 	reflect "reflect"
 
-	buildx "github.com/docker/buildx/build"
-	builder "github.com/docker/buildx/builder"
 	pb "github.com/docker/buildx/controller/pb"
-	confutil "github.com/docker/buildx/util/confutil"
-	dockerutil "github.com/docker/buildx/util/dockerutil"
-	progress "github.com/docker/buildx/util/progress"
 	client "github.com/moby/buildkit/client"
 	session "github.com/moby/buildkit/session"
 	descriptor "github.com/regclient/regclient/types/descriptor"
@@ -29,7 +23,6 @@ import (
 type MockClient struct {
 	ctrl     *gomock.Controller
 	recorder *MockClientMockRecorder
-	isgomock struct{}
 }
 
 // MockClientMockRecorder is the mock recorder for MockClient.
@@ -59,31 +52,31 @@ func (m *MockClient) Build(ctx context.Context, b Build) (*client.SolveResponse,
 }
 
 // Build indicates an expected call of Build.
-func (mr *MockClientMockRecorder) Build(ctx, b any) *MockClientBuildCall {
+func (mr *MockClientMockRecorder) Build(ctx, b any) *ClientBuildCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Build", reflect.TypeOf((*MockClient)(nil).Build), ctx, b)
-	return &MockClientBuildCall{Call: call}
+	return &ClientBuildCall{Call: call}
 }
 
-// MockClientBuildCall wrap *gomock.Call
-type MockClientBuildCall struct {
+// ClientBuildCall wrap *gomock.Call
+type ClientBuildCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockClientBuildCall) Return(arg0 *client.SolveResponse, arg1 error) *MockClientBuildCall {
+func (c *ClientBuildCall) Return(arg0 *client.SolveResponse, arg1 error) *ClientBuildCall {
 	c.Call = c.Call.Return(arg0, arg1)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockClientBuildCall) Do(f func(context.Context, Build) (*client.SolveResponse, error)) *MockClientBuildCall {
+func (c *ClientBuildCall) Do(f func(context.Context, Build) (*client.SolveResponse, error)) *ClientBuildCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockClientBuildCall) DoAndReturn(f func(context.Context, Build) (*client.SolveResponse, error)) *MockClientBuildCall {
+func (c *ClientBuildCall) DoAndReturn(f func(context.Context, Build) (*client.SolveResponse, error)) *ClientBuildCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -98,31 +91,31 @@ func (m *MockClient) BuildKitEnabled() (bool, error) {
 }
 
 // BuildKitEnabled indicates an expected call of BuildKitEnabled.
-func (mr *MockClientMockRecorder) BuildKitEnabled() *MockClientBuildKitEnabledCall {
+func (mr *MockClientMockRecorder) BuildKitEnabled() *ClientBuildKitEnabledCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BuildKitEnabled", reflect.TypeOf((*MockClient)(nil).BuildKitEnabled))
-	return &MockClientBuildKitEnabledCall{Call: call}
+	return &ClientBuildKitEnabledCall{Call: call}
 }
 
-// MockClientBuildKitEnabledCall wrap *gomock.Call
-type MockClientBuildKitEnabledCall struct {
+// ClientBuildKitEnabledCall wrap *gomock.Call
+type ClientBuildKitEnabledCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockClientBuildKitEnabledCall) Return(arg0 bool, arg1 error) *MockClientBuildKitEnabledCall {
+func (c *ClientBuildKitEnabledCall) Return(arg0 bool, arg1 error) *ClientBuildKitEnabledCall {
 	c.Call = c.Call.Return(arg0, arg1)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockClientBuildKitEnabledCall) Do(f func() (bool, error)) *MockClientBuildKitEnabledCall {
+func (c *ClientBuildKitEnabledCall) Do(f func() (bool, error)) *ClientBuildKitEnabledCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockClientBuildKitEnabledCall) DoAndReturn(f func() (bool, error)) *MockClientBuildKitEnabledCall {
+func (c *ClientBuildKitEnabledCall) DoAndReturn(f func() (bool, error)) *ClientBuildKitEnabledCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -136,31 +129,31 @@ func (m *MockClient) Delete(ctx context.Context, id string) error {
 }
 
 // Delete indicates an expected call of Delete.
-func (mr *MockClientMockRecorder) Delete(ctx, id any) *MockClientDeleteCall {
+func (mr *MockClientMockRecorder) Delete(ctx, id any) *ClientDeleteCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Delete", reflect.TypeOf((*MockClient)(nil).Delete), ctx, id)
-	return &MockClientDeleteCall{Call: call}
+	return &ClientDeleteCall{Call: call}
 }
 
-// MockClientDeleteCall wrap *gomock.Call
-type MockClientDeleteCall struct {
+// ClientDeleteCall wrap *gomock.Call
+type ClientDeleteCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockClientDeleteCall) Return(arg0 error) *MockClientDeleteCall {
+func (c *ClientDeleteCall) Return(arg0 error) *ClientDeleteCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockClientDeleteCall) Do(f func(context.Context, string) error) *MockClientDeleteCall {
+func (c *ClientDeleteCall) Do(f func(context.Context, string) error) *ClientDeleteCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockClientDeleteCall) DoAndReturn(f func(context.Context, string) error) *MockClientDeleteCall {
+func (c *ClientDeleteCall) DoAndReturn(f func(context.Context, string) error) *ClientDeleteCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -175,31 +168,31 @@ func (m *MockClient) Inspect(ctx context.Context, id string) ([]descriptor.Descr
 }
 
 // Inspect indicates an expected call of Inspect.
-func (mr *MockClientMockRecorder) Inspect(ctx, id any) *MockClientInspectCall {
+func (mr *MockClientMockRecorder) Inspect(ctx, id any) *ClientInspectCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Inspect", reflect.TypeOf((*MockClient)(nil).Inspect), ctx, id)
-	return &MockClientInspectCall{Call: call}
+	return &ClientInspectCall{Call: call}
 }
 
-// MockClientInspectCall wrap *gomock.Call
-type MockClientInspectCall struct {
+// ClientInspectCall wrap *gomock.Call
+type ClientInspectCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockClientInspectCall) Return(arg0 []descriptor.Descriptor, arg1 error) *MockClientInspectCall {
+func (c *ClientInspectCall) Return(arg0 []descriptor.Descriptor, arg1 error) *ClientInspectCall {
 	c.Call = c.Call.Return(arg0, arg1)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockClientInspectCall) Do(f func(context.Context, string) ([]descriptor.Descriptor, error)) *MockClientInspectCall {
+func (c *ClientInspectCall) Do(f func(context.Context, string) ([]descriptor.Descriptor, error)) *ClientInspectCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockClientInspectCall) DoAndReturn(f func(context.Context, string) ([]descriptor.Descriptor, error)) *MockClientInspectCall {
+func (c *ClientInspectCall) DoAndReturn(f func(context.Context, string) ([]descriptor.Descriptor, error)) *ClientInspectCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -217,32 +210,32 @@ func (m *MockClient) ManifestCreate(ctx context.Context, push bool, target strin
 }
 
 // ManifestCreate indicates an expected call of ManifestCreate.
-func (mr *MockClientMockRecorder) ManifestCreate(ctx, push, target any, refs ...any) *MockClientManifestCreateCall {
+func (mr *MockClientMockRecorder) ManifestCreate(ctx, push, target any, refs ...any) *ClientManifestCreateCall {
 	mr.mock.ctrl.T.Helper()
 	varargs := append([]any{ctx, push, target}, refs...)
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ManifestCreate", reflect.TypeOf((*MockClient)(nil).ManifestCreate), varargs...)
-	return &MockClientManifestCreateCall{Call: call}
+	return &ClientManifestCreateCall{Call: call}
 }
 
-// MockClientManifestCreateCall wrap *gomock.Call
-type MockClientManifestCreateCall struct {
+// ClientManifestCreateCall wrap *gomock.Call
+type ClientManifestCreateCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockClientManifestCreateCall) Return(arg0 error) *MockClientManifestCreateCall {
+func (c *ClientManifestCreateCall) Return(arg0 error) *ClientManifestCreateCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockClientManifestCreateCall) Do(f func(context.Context, bool, string, ...string) error) *MockClientManifestCreateCall {
+func (c *ClientManifestCreateCall) Do(f func(context.Context, bool, string, ...string) error) *ClientManifestCreateCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockClientManifestCreateCall) DoAndReturn(f func(context.Context, bool, string, ...string) error) *MockClientManifestCreateCall {
+func (c *ClientManifestCreateCall) DoAndReturn(f func(context.Context, bool, string, ...string) error) *ClientManifestCreateCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -256,31 +249,31 @@ func (m *MockClient) ManifestDelete(ctx context.Context, target string) error {
 }
 
 // ManifestDelete indicates an expected call of ManifestDelete.
-func (mr *MockClientMockRecorder) ManifestDelete(ctx, target any) *MockClientManifestDeleteCall {
+func (mr *MockClientMockRecorder) ManifestDelete(ctx, target any) *ClientManifestDeleteCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ManifestDelete", reflect.TypeOf((*MockClient)(nil).ManifestDelete), ctx, target)
-	return &MockClientManifestDeleteCall{Call: call}
+	return &ClientManifestDeleteCall{Call: call}
 }
 
-// MockClientManifestDeleteCall wrap *gomock.Call
-type MockClientManifestDeleteCall struct {
+// ClientManifestDeleteCall wrap *gomock.Call
+type ClientManifestDeleteCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockClientManifestDeleteCall) Return(arg0 error) *MockClientManifestDeleteCall {
+func (c *ClientManifestDeleteCall) Return(arg0 error) *ClientManifestDeleteCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockClientManifestDeleteCall) Do(f func(context.Context, string) error) *MockClientManifestDeleteCall {
+func (c *ClientManifestDeleteCall) Do(f func(context.Context, string) error) *ClientManifestDeleteCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockClientManifestDeleteCall) DoAndReturn(f func(context.Context, string) error) *MockClientManifestDeleteCall {
+func (c *ClientManifestDeleteCall) DoAndReturn(f func(context.Context, string) error) *ClientManifestDeleteCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -295,69 +288,31 @@ func (m *MockClient) ManifestInspect(ctx context.Context, target string) (string
 }
 
 // ManifestInspect indicates an expected call of ManifestInspect.
-func (mr *MockClientMockRecorder) ManifestInspect(ctx, target any) *MockClientManifestInspectCall {
+func (mr *MockClientMockRecorder) ManifestInspect(ctx, target any) *ClientManifestInspectCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ManifestInspect", reflect.TypeOf((*MockClient)(nil).ManifestInspect), ctx, target)
-	return &MockClientManifestInspectCall{Call: call}
+	return &ClientManifestInspectCall{Call: call}
 }
 
-// MockClientManifestInspectCall wrap *gomock.Call
-type MockClientManifestInspectCall struct {
+// ClientManifestInspectCall wrap *gomock.Call
+type ClientManifestInspectCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockClientManifestInspectCall) Return(arg0 string, arg1 error) *MockClientManifestInspectCall {
+func (c *ClientManifestInspectCall) Return(arg0 string, arg1 error) *ClientManifestInspectCall {
 	c.Call = c.Call.Return(arg0, arg1)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockClientManifestInspectCall) Do(f func(context.Context, string) (string, error)) *MockClientManifestInspectCall {
+func (c *ClientManifestInspectCall) Do(f func(context.Context, string) (string, error)) *ClientManifestInspectCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockClientManifestInspectCall) DoAndReturn(f func(context.Context, string) (string, error)) *MockClientManifestInspectCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// SupportsMultipleExports mocks base method.
-func (m *MockClient) SupportsMultipleExports() bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SupportsMultipleExports")
-	ret0, _ := ret[0].(bool)
-	return ret0
-}
-
-// SupportsMultipleExports indicates an expected call of SupportsMultipleExports.
-func (mr *MockClientMockRecorder) SupportsMultipleExports() *MockClientSupportsMultipleExportsCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SupportsMultipleExports", reflect.TypeOf((*MockClient)(nil).SupportsMultipleExports))
-	return &MockClientSupportsMultipleExportsCall{Call: call}
-}
-
-// MockClientSupportsMultipleExportsCall wrap *gomock.Call
-type MockClientSupportsMultipleExportsCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *MockClientSupportsMultipleExportsCall) Return(arg0 bool) *MockClientSupportsMultipleExportsCall {
-	c.Call = c.Call.Return(arg0)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *MockClientSupportsMultipleExportsCall) Do(f func() bool) *MockClientSupportsMultipleExportsCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockClientSupportsMultipleExportsCall) DoAndReturn(f func() bool) *MockClientSupportsMultipleExportsCall {
+func (c *ClientManifestInspectCall) DoAndReturn(f func(context.Context, string) (string, error)) *ClientManifestInspectCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -366,7 +321,6 @@ func (c *MockClientSupportsMultipleExportsCall) DoAndReturn(f func() bool) *Mock
 type MockBuild struct {
 	ctrl     *gomock.Controller
 	recorder *MockBuildMockRecorder
-	isgomock struct{}
 }
 
 // MockBuildMockRecorder is the mock recorder for MockBuild.
@@ -395,31 +349,31 @@ func (m *MockBuild) BuildOptions() pb.BuildOptions {
 }
 
 // BuildOptions indicates an expected call of BuildOptions.
-func (mr *MockBuildMockRecorder) BuildOptions() *MockBuildBuildOptionsCall {
+func (mr *MockBuildMockRecorder) BuildOptions() *BuildBuildOptionsCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BuildOptions", reflect.TypeOf((*MockBuild)(nil).BuildOptions))
-	return &MockBuildBuildOptionsCall{Call: call}
+	return &BuildBuildOptionsCall{Call: call}
 }
 
-// MockBuildBuildOptionsCall wrap *gomock.Call
-type MockBuildBuildOptionsCall struct {
+// BuildBuildOptionsCall wrap *gomock.Call
+type BuildBuildOptionsCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockBuildBuildOptionsCall) Return(arg0 pb.BuildOptions) *MockBuildBuildOptionsCall {
+func (c *BuildBuildOptionsCall) Return(arg0 pb.BuildOptions) *BuildBuildOptionsCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockBuildBuildOptionsCall) Do(f func() pb.BuildOptions) *MockBuildBuildOptionsCall {
+func (c *BuildBuildOptionsCall) Do(f func() pb.BuildOptions) *BuildBuildOptionsCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockBuildBuildOptionsCall) DoAndReturn(f func() pb.BuildOptions) *MockBuildBuildOptionsCall {
+func (c *BuildBuildOptionsCall) DoAndReturn(f func() pb.BuildOptions) *BuildBuildOptionsCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -433,31 +387,31 @@ func (m *MockBuild) Inline() string {
 }
 
 // Inline indicates an expected call of Inline.
-func (mr *MockBuildMockRecorder) Inline() *MockBuildInlineCall {
+func (mr *MockBuildMockRecorder) Inline() *BuildInlineCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Inline", reflect.TypeOf((*MockBuild)(nil).Inline))
-	return &MockBuildInlineCall{Call: call}
+	return &BuildInlineCall{Call: call}
 }
 
-// MockBuildInlineCall wrap *gomock.Call
-type MockBuildInlineCall struct {
+// BuildInlineCall wrap *gomock.Call
+type BuildInlineCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockBuildInlineCall) Return(arg0 string) *MockBuildInlineCall {
+func (c *BuildInlineCall) Return(arg0 string) *BuildInlineCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockBuildInlineCall) Do(f func() string) *MockBuildInlineCall {
+func (c *BuildInlineCall) Do(f func() string) *BuildInlineCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockBuildInlineCall) DoAndReturn(f func() string) *MockBuildInlineCall {
+func (c *BuildInlineCall) DoAndReturn(f func() string) *BuildInlineCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -471,31 +425,31 @@ func (m *MockBuild) Secrets() session.Attachable {
 }
 
 // Secrets indicates an expected call of Secrets.
-func (mr *MockBuildMockRecorder) Secrets() *MockBuildSecretsCall {
+func (mr *MockBuildMockRecorder) Secrets() *BuildSecretsCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Secrets", reflect.TypeOf((*MockBuild)(nil).Secrets))
-	return &MockBuildSecretsCall{Call: call}
+	return &BuildSecretsCall{Call: call}
 }
 
-// MockBuildSecretsCall wrap *gomock.Call
-type MockBuildSecretsCall struct {
+// BuildSecretsCall wrap *gomock.Call
+type BuildSecretsCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockBuildSecretsCall) Return(arg0 session.Attachable) *MockBuildSecretsCall {
+func (c *BuildSecretsCall) Return(arg0 session.Attachable) *BuildSecretsCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockBuildSecretsCall) Do(f func() session.Attachable) *MockBuildSecretsCall {
+func (c *BuildSecretsCall) Do(f func() session.Attachable) *BuildSecretsCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockBuildSecretsCall) DoAndReturn(f func() session.Attachable) *MockBuildSecretsCall {
+func (c *BuildSecretsCall) DoAndReturn(f func() session.Attachable) *BuildSecretsCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }
@@ -509,94 +463,31 @@ func (m *MockBuild) ShouldExec() bool {
 }
 
 // ShouldExec indicates an expected call of ShouldExec.
-func (mr *MockBuildMockRecorder) ShouldExec() *MockBuildShouldExecCall {
+func (mr *MockBuildMockRecorder) ShouldExec() *BuildShouldExecCall {
 	mr.mock.ctrl.T.Helper()
 	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ShouldExec", reflect.TypeOf((*MockBuild)(nil).ShouldExec))
-	return &MockBuildShouldExecCall{Call: call}
+	return &BuildShouldExecCall{Call: call}
 }
 
-// MockBuildShouldExecCall wrap *gomock.Call
-type MockBuildShouldExecCall struct {
+// BuildShouldExecCall wrap *gomock.Call
+type BuildShouldExecCall struct {
 	*gomock.Call
 }
 
 // Return rewrite *gomock.Call.Return
-func (c *MockBuildShouldExecCall) Return(arg0 bool) *MockBuildShouldExecCall {
+func (c *BuildShouldExecCall) Return(arg0 bool) *BuildShouldExecCall {
 	c.Call = c.Call.Return(arg0)
 	return c
 }
 
 // Do rewrite *gomock.Call.Do
-func (c *MockBuildShouldExecCall) Do(f func() bool) *MockBuildShouldExecCall {
+func (c *BuildShouldExecCall) Do(f func() bool) *BuildShouldExecCall {
 	c.Call = c.Call.Do(f)
 	return c
 }
 
 // DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockBuildShouldExecCall) DoAndReturn(f func() bool) *MockBuildShouldExecCall {
-	c.Call = c.Call.DoAndReturn(f)
-	return c
-}
-
-// MockBuilder is a mock of Builder interface.
-type MockBuilder struct {
-	ctrl     *gomock.Controller
-	recorder *MockBuilderMockRecorder
-	isgomock struct{}
-}
-
-// MockBuilderMockRecorder is the mock recorder for MockBuilder.
-type MockBuilderMockRecorder struct {
-	mock *MockBuilder
-}
-
-// NewMockBuilder creates a new mock instance.
-func NewMockBuilder(ctrl *gomock.Controller) *MockBuilder {
-	mock := &MockBuilder{ctrl: ctrl}
-	mock.recorder = &MockBuilderMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockBuilder) EXPECT() *MockBuilderMockRecorder {
-	return m.recorder
-}
-
-// Build mocks base method.
-func (m *MockBuilder) Build(ctx context.Context, nodes []builder.Node, opts map[string]buildx.Options, docker *dockerutil.Client, cfg *confutil.Config, w progress.Writer) (map[string]*client.SolveResponse, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Build", ctx, nodes, opts, docker, cfg, w)
-	ret0, _ := ret[0].(map[string]*client.SolveResponse)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// Build indicates an expected call of Build.
-func (mr *MockBuilderMockRecorder) Build(ctx, nodes, opts, docker, cfg, w any) *MockBuilderBuildCall {
-	mr.mock.ctrl.T.Helper()
-	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Build", reflect.TypeOf((*MockBuilder)(nil).Build), ctx, nodes, opts, docker, cfg, w)
-	return &MockBuilderBuildCall{Call: call}
-}
-
-// MockBuilderBuildCall wrap *gomock.Call
-type MockBuilderBuildCall struct {
-	*gomock.Call
-}
-
-// Return rewrite *gomock.Call.Return
-func (c *MockBuilderBuildCall) Return(resp map[string]*client.SolveResponse, err error) *MockBuilderBuildCall {
-	c.Call = c.Call.Return(resp, err)
-	return c
-}
-
-// Do rewrite *gomock.Call.Do
-func (c *MockBuilderBuildCall) Do(f func(context.Context, []builder.Node, map[string]buildx.Options, *dockerutil.Client, *confutil.Config, progress.Writer) (map[string]*client.SolveResponse, error)) *MockBuilderBuildCall {
-	c.Call = c.Call.Do(f)
-	return c
-}
-
-// DoAndReturn rewrite *gomock.Call.DoAndReturn
-func (c *MockBuilderBuildCall) DoAndReturn(f func(context.Context, []builder.Node, map[string]buildx.Options, *dockerutil.Client, *confutil.Config, progress.Writer) (map[string]*client.SolveResponse, error)) *MockBuilderBuildCall {
+func (c *BuildShouldExecCall) DoAndReturn(f func() bool) *BuildShouldExecCall {
 	c.Call = c.Call.DoAndReturn(f)
 	return c
 }

provider/internal/network.go

@@ -22,12 +22,9 @@ var _ = (infer.Enum[NetworkMode])((*NetworkMode)(nil))
 type NetworkMode string
 
 const (
-	// Default network mode.
-	Default NetworkMode = "default"
-	// Host network mode.
-	Host NetworkMode = "host"
-	// None or no network mode.
-	None NetworkMode = "none"
+	Default NetworkMode = "default" // Default network mode.
+	Host    NetworkMode = "host"    // Host network mode.
+	None    NetworkMode = "none"    // None or no network mode.
 )
 
 // Values returns all valid NetworkMode values for SDK generation.

provider/internal/provider.go

@@ -45,6 +45,9 @@ type Config struct {
 	host *host
 }
 
+// _mockClientKey is used by tests to inject a mock Docker client.
+var _mockClientKey any = "mock-client"
+
 // Annotate provides user-facing descriptions and defaults for Config's fields.
 func (c *Config) Annotate(a infer.Annotator) {
 	a.Describe(&c.Host, "The build daemon's address.")
@@ -52,8 +55,8 @@ func (c *Config) Annotate(a infer.Annotator) {
 }
 
 // Configure validates and processes user-provided configuration values.
-func (c *Config) Configure(ctx context.Context) error {
-	h, err := newHost(ctx, c)
+func (c *Config) Configure(_ context.Context) error {
+	h, err := newHost(c)
 	if err != nil {
 		return fmt.Errorf("getting host: %w", err)
 	}
@@ -61,24 +64,9 @@ func (c *Config) Configure(ctx context.Context) error {
 	return nil
 }
 
-// GetRegistries returns the config's registries, if any.
-func (c Config) GetRegistries() []Registry {
-	return c.Registries
-}
-
-// getHost returns the config's host, or nil if the config is also nil.
-func (c *Config) getHost() *host {
-	if c == nil {
-		return nil
-	}
-	return c.host
-}
-
 // NewBuildxProvider returns a new buildx provider.
-func NewBuildxProvider(clientF clientF) provider.Provider {
-	config := &Config{}
-
-	prov := infer.Provider(
+func NewBuildxProvider() provider.Provider {
+	return infer.Provider(
 		infer.Options{
 			Metadata: pschema.Metadata{
 				DisplayName: "docker-build",
@@ -108,39 +96,43 @@ func NewBuildxProvider(clientF clientF) provider.Provider {
 						BuildFiles:                      "gradle",
 						GradleNexusPublishPluginVersion: "1.1.0",
 						Dependencies: map[string]string{
-							"com.pulumi:pulumi":               "0.20.0",
+							"com.pulumi:pulumi":               "0.9.9",
 							"com.google.code.gson:gson":       "2.8.9",
 							"com.google.code.findbugs:jsr305": "3.0.2",
 						},
 					},
 					"nodejs": tsgen.NodePackageInfo{
 						RespectSchemaVersion: true,
+						Dependencies: map[string]string{
+							"@pulumi/pulumi": "^3.0.0",
+						},
 					},
 					"python": pygen.PackageInfo{
 						RespectSchemaVersion: true,
 						PyProject: struct {
 							Enabled bool `json:"enabled,omitempty"`
 						}{Enabled: true},
+						Requires: map[string]string{
+							"pulumi": ">=3.0.0,<4.0.0",
+						},
 					},
 				},
 			},
 			Resources: []infer.InferredResource{
-				infer.Resource(&Image{clientF: clientF, config: config}),
-				infer.Resource(&Index{clientF: clientF, config: config}),
+				infer.Resource[*Image](),
+				infer.Resource[*Index](),
 			},
 			ModuleMap: map[tokens.ModuleName]tokens.ModuleName{
 				"internal": "index",
 			},
-			Config: infer.Config(config),
+			Config: infer.Config[*Config](),
 		},
 	)
-
-	return prov
 }
 
 // Schema returns our package specification.
 func Schema(ctx context.Context, version string) schema.PackageSpec {
-	p := NewBuildxProvider(nil)
+	p := NewBuildxProvider()
 	spec, err := provider.GetSchema(ctx, "docker-build", version, p)
 	contract.AssertNoErrorf(err, "missing schema")
 	return spec

provider/internal/provider_test.go

@@ -20,18 +20,18 @@ import (
 
 	"github.com/blang/semver"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	provider "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
 	"github.com/pulumi/pulumi-go-provider/integration"
+	mwcontext "github.com/pulumi/pulumi-go-provider/middleware/context"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/tokens"
 )
 
 func TestConfigure(t *testing.T) {
 	t.Parallel()
 
-	s := newServer(t.Context(), t, nil)
+	s := newServer(nil)
 
 	err := s.Configure(
 		provider.ConfigureRequest{},
@@ -60,7 +60,7 @@ func TestAnnotate(t *testing.T) {
 func TestSchema(t *testing.T) {
 	t.Parallel()
 
-	s := newServer(t.Context(), t, nil)
+	s := newServer(nil)
 
 	_, err := s.GetSchema(provider.GetSchemaRequest{Version: 0})
 	assert.NoError(t, err)
@@ -68,27 +68,21 @@ func TestSchema(t *testing.T) {
 
 type annotator struct{}
 
-func (annotator) Deprecate(_ any, _ string)                   {}
 func (annotator) Describe(_ any, _ string)                    {}
 func (annotator) SetDefault(_, _ any, _ ...string)            {}
 func (annotator) SetToken(tokens.ModuleName, tokens.TypeName) {}
 func (annotator) AddAlias(tokens.ModuleName, tokens.TypeName) {}
 func (annotator) SetResourceDeprecationMessage(_ string)      {}
 
-func newServer(ctx context.Context, t *testing.T, clientF clientF) integration.Server {
-	t.Helper()
+func newServer(client Client) integration.Server {
+	p := NewBuildxProvider()
 
-	if clientF == nil {
-		clientF = RealClientF
+	// Inject a mock client if provided.
+	if client != nil {
+		p = mwcontext.Wrap(p, func(ctx context.Context) context.Context {
+			return context.WithValue(ctx, _mockClientKey, client)
+		})
 	}
 
-	p := NewBuildxProvider(clientF)
-
-	s, err := integration.NewServer(
-		ctx,
-		"docker-build", semver.Version{Major: 0},
-		integration.WithProvider(p),
-	)
-	require.NoError(t, err)
-	return s
+	return integration.NewServer("docker-build", semver.Version{Major: 0}, p)
 }

provider/internal/ssh_test.go

@@ -36,6 +36,7 @@ func TestValidateSSH(t *testing.T) {
 	}
 
 	for _, tt := range tests {
+		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 

provider/provider.go

@@ -15,8 +15,13 @@
 package provider
 
 import (
+	"context"
+	"encoding/json"
+
 	"github.com/pulumi/pulumi-docker-build/provider/internal"
+	"github.com/pulumi/pulumi-docker-build/provider/internal/deprecated"
 	gp "github.com/pulumi/pulumi-go-provider"
+	"github.com/pulumi/pulumi/pkg/v3/codegen/schema"
 	"github.com/pulumi/pulumi/pkg/v3/resource/provider"
 	rpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
 )
@@ -34,5 +39,37 @@ func Serve() error {
 
 // New creates a new provider.
 func New(host *provider.HostClient) (rpc.ResourceProviderServer, error) {
-	return gp.RawServer(Name, Version, internal.NewBuildxProvider(internal.RealClientF))(host)
+	return gp.RawServer(Name, Version, configurableProvider(internal.NewBuildxProvider()))(host)
+}
+
+// configurableProvider is a workaround for
+// https://github.com/pulumi/pulumi-go-provider/issues/171 and
+// In short, our SDKs send provider Configure requests as simple strings
+// instead of rich objects. We don't want to preserve this behavior in
+// pulumi-go-provider, but we also haven't updated SDKs yet to send rich types.
+//
+// If you find yourself in a position where you need to copy this -- STOP!
+// https://github.com/pulumi/pulumi/pull/15032 should be merged with this fix.
+func configurableProvider(p gp.Provider) gp.Provider {
+	configure := p.Configure
+
+	p.Configure = func(ctx context.Context, req gp.ConfigureRequest) error {
+		r, err := p.GetSchema(ctx, gp.GetSchemaRequest{Version: 0})
+		if err != nil {
+			return err
+		}
+		spec := schema.PackageSpec{}
+		err = json.Unmarshal([]byte(r.Schema), &spec)
+		if err != nil {
+			return err
+		}
+
+		ce := deprecated.New(spec.Config)
+		if props, err := ce.UnmarshalProperties(req.Args); err == nil {
+			req.Args = props
+		}
+		return configure(ctx, req)
+	}
+
+	return p
 }

provider/provider_test.go

@@ -22,8 +22,37 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	"google.golang.org/protobuf/types/known/structpb"
+
+	"github.com/pulumi/pulumi-docker-build/provider/internal"
+	provider "github.com/pulumi/pulumi-go-provider"
+	"github.com/pulumi/pulumi-go-provider/integration"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource/plugin"
 )
 
+// TestConfigure checks backwards-compatibility with SDKs that still send
+// provider config as JSON-encoded strings. This test can be removed once we
+// upgrade to a version of pulumi that no longer generates SDKs with that
+// behavior.
+func TestConfigure(t *testing.T) {
+	t.Parallel()
+
+	p := configurableProvider(internal.NewBuildxProvider())
+
+	args, err := structpb.NewStruct(map[string]any{
+		"registries": `[{"address": "docker.io"}]`,
+	})
+	require.NoError(t, err)
+	argsMap, err := plugin.UnmarshalProperties(args, plugin.MarshalOptions{})
+	require.NoError(t, err)
+
+	s := integration.NewServer("docker-build", semver.Version{Major: 0}, p)
+	err = s.Configure(provider.ConfigureRequest{
+		Args: argsMap,
+	})
+	assert.NoError(t, err)
+}
+
 func TestVersion(t *testing.T) {
 	t.Parallel()
 

renovate.json

@@ -0,0 +1,6 @@
+{
+  "postUpgradeTasks": {
+    "executionMode": "branch",
+    "commands": ["mise trust", "mise install --yes", "mise run sdk"]
+  }
+}

renovate.json5

@@ -1,23 +0,0 @@
-{
-  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
-  extends: [
-    'github>pulumi/renovate-config//default.json5',
-  ],
-  packageRules: [
-    {
-      matchDatasources: [
-        'go',
-      ],
-      matchPackageNames: [
-        'github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3',
-        'github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3',
-        'github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3',
-        'github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3',
-      ],
-      matchUpdateTypes: [
-        'pin',
-        'digest',
-      ],
-    },
-  ],
-}

scripts/get-versions.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# This script can be simplified to use go when https://github.com/jdx/mise/discussions/6374 is fixed
-# e.g. go list -m -f '{{.GoVersion}}'
-
-module_path="github.com/pulumi/pulumi/pkg/v3"
-go_mod_path="."
-gomod="go.mod"
-
-if [[ "$go_mod_path" != "" && "$go_mod_path" != "." ]]; then
-  gomod="$go_mod_path/$gomod"
-fi
-
-if [[ ! -f "$gomod" ]]; then
-  echo "missing $gomod" >&2
-  exit 1
-fi
-
-raw_version=$(awk -v module="$module_path" '
-    $1 == module || $2 == module {
-        for (i = 1; i <= NF; i++) {
-            if ($i ~ /^v[0-9]/) {
-                sub(/^v/, "", $i)
-                print $i
-                exit
-            }
-        }
-    }
-' "$gomod")
-
-if [[ -z "${raw_version:-}" ]]; then
-  echo "failed to determine Pulumi version from $gomod" >&2
-  exit 1
-fi
-
-echo "PULUMI_VERSION_MISE=$raw_version"
-export PULUMI_VERSION_MISE=$raw_version
-
-# Prefer the toolchain directive if present, otherwise fall back to the `go` version line
-go_toolchain=$(awk '/^toolchain[[:space:]]+go[0-9]/{ print $2; exit }' "$gomod")
-
-if [[ -n "${go_toolchain:-}" ]]; then
-  go_version=${go_toolchain#go}
-else
-  go_version=$(awk '/^go[[:space:]]+[0-9]/{ print $2; exit }' "$gomod")
-fi
-
-if [[ -z "${go_version:-}" ]]; then
-  echo "failed to determine Go version from $gomod" >&2
-  exit 1
-fi
-
-echo "GO_VERSION_MISE=$go_version"
-export GO_VERSION_MISE=$go_version

sdk/dotnet/Config/Config.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Enums.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Image.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Index.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Inputs/BuildContextArgs.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Inputs/BuilderConfigArgs.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Inputs/CacheFromArgs.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Inputs/CacheFromAzureBlobArgs.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Inputs/CacheFromGitHubActionsArgs.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;
@@ -10,12 +10,6 @@ using Pulumi.Serialization;
 namespace Pulumi.DockerBuild.Inputs
 {
 
-    /// <summary>
-    /// Recommended for use with GitHub Actions workflows.
-    /// 
-    /// An action like `crazy-max/ghaction-github-runtime` is recommended to expose
-    /// appropriate credentials to your GitHub workflow.
-    /// </summary>
     public sealed class CacheFromGitHubActionsArgs : global::Pulumi.ResourceArgs
     {
         /// <summary>
@@ -27,9 +21,42 @@ namespace Pulumi.DockerBuild.Inputs
         [Input("scope")]
         public Input<string>? Scope { get; set; }
 
+        [Input("token")]
+        private Input<string>? _token;
+
+        /// <summary>
+        /// The GitHub Actions token to use. This is not a personal access tokens
+        /// and is typically generated automatically as part of each job.
+        /// 
+        /// Defaults to `$ACTIONS_RUNTIME_TOKEN`, although a separate action like
+        /// `crazy-max/ghaction-github-runtime` is recommended to expose this
+        /// environment variable to your jobs.
+        /// </summary>
+        public Input<string>? Token
+        {
+            get => _token;
+            set
+            {
+                var emptySecret = Output.CreateSecret(0);
+                _token = Output.Tuple<Input<string>?, int>(value, emptySecret).Apply(t => t.Item1);
+            }
+        }
+
+        /// <summary>
+        /// The cache server URL to use for artifacts.
+        /// 
+        /// Defaults to `$ACTIONS_CACHE_URL`, although a separate action like
+        /// `crazy-max/ghaction-github-runtime` is recommended to expose this
+        /// environment variable to your jobs.
+        /// </summary>
+        [Input("url")]
+        public Input<string>? Url { get; set; }
+
         public CacheFromGitHubActionsArgs()
         {
-            Scope = "buildkit";
+            Scope = Utilities.GetEnv("buildkit") ?? "";
+            Token = Utilities.GetEnv("ACTIONS_RUNTIME_TOKEN") ?? "";
+            Url = Utilities.GetEnv("ACTIONS_CACHE_URL") ?? "";
         }
         public static new CacheFromGitHubActionsArgs Empty => new CacheFromGitHubActionsArgs();
     }

sdk/dotnet/Inputs/CacheFromLocalArgs.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;

sdk/dotnet/Inputs/CacheFromRegistryArgs.cs

@@ -1,4 +1,4 @@
-// *** WARNING: this file was generated by pulumi-language-dotnet. ***
+// *** WARNING: this file was generated by pulumi. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
 
 using System;