Compare commits

..

128 Commits

Author SHA1 Message Date
github-actions
0f1469d536 v0.0.16 2026-05-12 18:35:00 +00:00
Bryce Lampe
df2dcca9a8 Fix 404 handling when deleting a manifest (#850)
Upstream was previously using an internal notFound error, and we were
relying on fragile string matching to detect it. This broke when we
upgraded to Docker v28.

d25e260d2e (diff-a5e122cd2318f2dc156f373804a59d30355b0c308b9e64f48e0713344fcdba33L164)

Nowadays containerd exposes a public ErrNotFound which we can use
instead.

Fixes #849.
2026-05-12 10:46:54 -07:00
pulumi-provider-automation[bot]
9048892848 Update GitHub Actions workflows. (#851)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[daf8aba035d6ed8919db6089c780f56cb7fefc69](daf8aba035).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-05-12 06:35:37 +00:00
pulumi-provider-automation[bot]
d8c7696758 Update GitHub Actions workflows. (#848)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[4cbd027aa555ac5a576d57358400a2e24e329c2c](4cbd027aa5).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-05-10 06:31:10 +00:00
pulumi-provider-automation[bot]
0d1a1b4fd3 Update GitHub Actions workflows. (#847)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[97b5e096a3ec277f7b970353d7b048d4800cdb61](97b5e096a3).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-05-09 06:28:31 +00:00
pulumi-renovate[bot]
8dff8f0e21 Update first-party Pulumi dependencies (#846)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.236.0` ->
`3.237.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.236.0/3.237.0)
|
|
[github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3](https://redirect.github.com/pulumi/pulumi-dotnet)
| require | minor | `v3.105.0` -> `v3.106.1` |
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.236.0` -> `v3.237.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.237.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.237.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.236.0...v3.237.0)

##### 3.237.0 (2026-05-08)

##### Features

- \[cli] Include the running command name and detected AI agent (when
present) in the User-Agent header on Pulumi Cloud API requests
[#&#8203;22908](https://redirect.github.com/pulumi/pulumi/pull/22908)

-   \[engine] Include `result` on the summary engine event
[#&#8203;22883](https://redirect.github.com/pulumi/pulumi/pull/22883)

-   \[sdkgen] Eagerly error on schemas with unconstructable types
[#&#8203;22890](https://redirect.github.com/pulumi/pulumi/pull/22890)

- \[cli/cloud] Auto-fill `lang` and `os` query parameters on `pulumi
cloud api` GET/HEAD requests when the matched OpenAPI operation declares
them and the caller hasn't supplied them
[#&#8203;22726](https://redirect.github.com/pulumi/pulumi/pull/22726)

- \[cli/package] Add `pulumi package new` to bootstrap a Pulumi package
from a template
[#&#8203;22837](https://redirect.github.com/pulumi/pulumi/pull/22837)

##### Bug Fixes

- \[cli] Add blank-line gaps between `pulumi neo` TUI conversation
blocks
[#&#8203;22846](https://redirect.github.com/pulumi/pulumi/pull/22846)

- \[cli/import] Preserve `__`-prefixed keys when generating PCL for
imported resource state, so provider-defined payloads round-trip
correctly
[#&#8203;22856](https://redirect.github.com/pulumi/pulumi/pull/22856)

- \[cli/neo] Render `ux__ask_user` clarifying questions as questions
instead of approval prompts
[#&#8203;22862](https://redirect.github.com/pulumi/pulumi/pull/22862)

-   \[cli/neo] Fix a panic when cancelling a `pulumi neo` session
[#&#8203;22898](https://redirect.github.com/pulumi/pulumi/pull/22898)

- \[cli/neo] Render every assistant message in the TUI scrollback so
multi-turn commentary no longer disappears between tool calls

- \[cli/neo] Return the bare stack name and canonical project name from
`pulumi_preview` and `pulumi_up` tool results instead of echoing the raw
input
[#&#8203;22891](https://redirect.github.com/pulumi/pulumi/pull/22891)

- \[codegen/pcl] Stop reporting spurious circular references when an
`ignoreChanges`, `hideDiffs`, `replaceOnChanges`, or
`additionalSecretOutputs` entry shares a name with a top-level node
[#&#8203;22916](https://redirect.github.com/pulumi/pulumi/pull/22916)

- \[programgen/pcl] Fix PCL binder panic when a conditional mixes a
Promise-typed branch with a try() branch
[#&#8203;22907](https://redirect.github.com/pulumi/pulumi/pull/22907)

- \[sdk/python] Support `NotRequired`, `Required` and `total=False` in
TypedDicts for component resource arg types
[#&#8203;22858](https://redirect.github.com/pulumi/pulumi/pull/22858)

##### Miscellaneous

- \[cli/cloud] Auto-fit `pulumi cloud api list` table to terminal width
and replace the
    `tabular` table renderer with `go-pretty`

[#&#8203;22874](https://redirect.github.com/pulumi/pulumi/pull/22874)

-   \[sdk/nodejs] Test on Node.js 26 and drop 20
[#&#8203;22872](https://redirect.github.com/pulumi/pulumi/pull/22872)

</details>

<details>
<summary>pulumi/pulumi-dotnet
(github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3)</summary>

###
[`v3.106.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31061---2026-05-08)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.106.0...v3.106.1)

##### Bug Fixes

- \[sdk] Revert
[#&#8203;983](https://redirect.github.com/pulumi/pulumi-dotnet/issues/983),
restoring the framework version to v6
[#&#8203;997](https://redirect.github.com/pulumi/pulumi-dotnet/pull/997)

###
[`v3.106.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31060---2026-05-07)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.105.0...v3.106.0)

##### Bug Fixes

- \[sdk] Bump minimum .NET version to 8.0, to help fix a security
vulnerability
[#&#8203;983](https://redirect.github.com/pulumi/pulumi-dotnet/pull/983)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-05-09 00:40:47 +00:00
pulumi-renovate[bot]
b73395a7fa Update module github.com/pulumi/pulumi-java to v1.26.1 (#845)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi-java](https://redirect.github.com/pulumi/pulumi-java)
| require | patch | `v1.26.0` -> `v1.26.1` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi-java (github.com/pulumi/pulumi-java)</summary>

###
[`v1.26.1`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1261---2026-05-07)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.26.0...v1.26.1)

##### Bug Fixes

- \[sdk] Fix inherited input properties missing from component schema
when args class inherits from a base class
[#&#8203;2129](https://redirect.github.com/pulumi/pulumi-java/pull/2129)

- \[runtime] Wait for debugger attach only when it is requested
[#&#8203;2161](https://redirect.github.com/pulumi/pulumi-java/pull/2161)

- \[codegen] Generate `unsecret(...)` as `.asPlaintext()` and emit
`config.requireSecret` for secret config variables in PCL programs
[#&#8203;2155](https://redirect.github.com/pulumi/pulumi-java/pull/2155)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-05-08 08:01:45 +00:00
pulumi-renovate[bot]
05962fcc01 Update first-party Pulumi dependencies to v3.236.0 (#842)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.235.0` ->
`3.236.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.235.0/3.236.0)
|
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.234.0` -> `v3.236.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.236.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32360-2026-05-06)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.235.0...v3.236.0)

</details>

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.236.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.236.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.235.0...v3.236.0)

#### 3.236.0 (2026-05-06)

###
[`v3.235.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.235.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.234.0...v3.235.0)

#### 3.235.0 (2026-05-05)

##### Features

-   \[cli] Add `pulumi logs decrypt` command for viewing logs
[#&#8203;22523](https://redirect.github.com/pulumi/pulumi/pull/22523)

-   \[cli] Bundle the `hcl` language host (from pulumi-labs/pulumi-hcl)
[#&#8203;22807](https://redirect.github.com/pulumi/pulumi/pull/22807)

- \[cli] Automatically install the `hcl` converter from
pulumi-labs/pulumi-hcl when running `pulumi convert --from hcl`
[#&#8203;22816](https://redirect.github.com/pulumi/pulumi/pull/22816)

- \[pcl] Add `read` blocks to PCL to read resources via ID and query
instead of registering them
[#&#8203;22641](https://redirect.github.com/pulumi/pulumi/pull/22641)

- \[cli/cloud] Add `pulumi cloud api <op-or-path>` for calling any
Pulumi Cloud API
endpoint, with `--field`/`--header`/`--input`/`--body` flag handling,
path
template binding, content negotiation via `--format`, and `--dry-run`

[#&#8203;22771](https://redirect.github.com/pulumi/pulumi/pull/22771)

- \[cli/cloud] Add `--paginate` to `pulumi cloud api`: follow
continuation cursors,
    accumulate items into a single JSON envelope, and surface progress
    events to stderr with `--emit-events` (page, complete, truncated,
    partial_failure, cancelled).

[#&#8203;22772](https://redirect.github.com/pulumi/pulumi/pull/22772)

##### Bug Fixes

- \[cli] Fix the `pulumi neo` shell tool to honor the agent-supplied
`timeout` and to terminate the whole process tree (and unblock cmd.Wait)
when the deadline fires, so commands like `kubectl logs -f` no longer
hang Neo indefinitely.
[#&#8203;22820](https://redirect.github.com/pulumi/pulumi/pull/22820)

- \[cli] Surface the error and exit when `pulumi neo` fails to create
the underlying task, instead of leaving the TUI stuck in `Thinking…`
[#&#8203;22825](https://redirect.github.com/pulumi/pulumi/pull/22825)

- \[codegen/go] Correctly generate `[]pulumi.Asset` & `[]pulumi.Archive`
[#&#8203;22827](https://redirect.github.com/pulumi/pulumi/pull/22827)

- \[cli/neo] Exit cleanly when the user presses Ctrl+C twice in `pulumi
neo` instead of hanging until a third press
[#&#8203;22821](https://redirect.github.com/pulumi/pulumi/pull/22821)

- \[engine] The engine now caches schemas at `PULUMI_HOME/schemas`, and
will cache for parameterised packages as well
[#&#8203;22812](https://redirect.github.com/pulumi/pulumi/pull/22812)

- \[sdk-python] Preserve `__`-prefixed keys (e.g. `__type`
discriminators) across RPC deserialization, matching the behavior of the
other language SDKs
[#&#8203;22834](https://redirect.github.com/pulumi/pulumi/pull/22834)

- \[programgen/{nodejs,python}] Fix programgen to emit the right
`length` check for string length
[#&#8203;22802](https://redirect.github.com/pulumi/pulumi/pull/22802)

##### Miscellaneous

- \[cli] Replace the Pulumipus mascot in the `pulumi neo` welcome banner
with new Neo-branded ASCII art.
[#&#8203;22817](https://redirect.github.com/pulumi/pulumi/pull/22817)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-05-07 21:40:04 +00:00
pulumi-provider-automation[bot]
766009ab42 Update GitHub Actions workflows. (#841)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[59779d0eefa4d7d6810a40f8190ef01a101acfe1](59779d0eef).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-05-07 06:32:50 +00:00
pulumi-renovate[bot]
0110626c42 Update first-party Pulumi dependencies (#819)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.231.0` ->
`3.235.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.231.0/3.235.0)
|
|
[github.com/pulumi/providertest](https://redirect.github.com/pulumi/providertest)
| require | minor | `v0.6.0` -> `v0.7.0` |
|
[github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3](https://redirect.github.com/pulumi/pulumi-dotnet)
| require | minor | `v3.103.0` -> `v3.105.0` |
|
[github.com/pulumi/pulumi-go-provider](https://redirect.github.com/pulumi/pulumi-go-provider)
| require | patch | `v1.3.1` -> `v1.3.2` |
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.230.0` -> `v3.234.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.235.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.235.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.234.0...v3.235.0)

##### 3.235.0 (2026-05-05)

##### Features

-   \[cli] Add `pulumi logs decrypt` command for viewing logs
[#&#8203;22523](https://redirect.github.com/pulumi/pulumi/pull/22523)

-   \[cli] Bundle the `hcl` language host (from pulumi-labs/pulumi-hcl)
[#&#8203;22807](https://redirect.github.com/pulumi/pulumi/pull/22807)

- \[cli] Automatically install the `hcl` converter from
pulumi-labs/pulumi-hcl when running `pulumi convert --from hcl`
[#&#8203;22816](https://redirect.github.com/pulumi/pulumi/pull/22816)

- \[pcl] Add `read` blocks to PCL to read resources via ID and query
instead of registering them
[#&#8203;22641](https://redirect.github.com/pulumi/pulumi/pull/22641)

- \[cli/cloud] Add `pulumi cloud api <op-or-path>` for calling any
Pulumi Cloud API
endpoint, with `--field`/`--header`/`--input`/`--body` flag handling,
path
template binding, content negotiation via `--format`, and `--dry-run`

[#&#8203;22771](https://redirect.github.com/pulumi/pulumi/pull/22771)

- \[cli/cloud] Add `--paginate` to `pulumi cloud api`: follow
continuation cursors,
    accumulate items into a single JSON envelope, and surface progress
    events to stderr with `--emit-events` (page, complete, truncated,
    partial_failure, cancelled).

[#&#8203;22772](https://redirect.github.com/pulumi/pulumi/pull/22772)

##### Bug Fixes

- \[cli] Fix the `pulumi neo` shell tool to honor the agent-supplied
`timeout` and to terminate the whole process tree (and unblock cmd.Wait)
when the deadline fires, so commands like `kubectl logs -f` no longer
hang Neo indefinitely.
[#&#8203;22820](https://redirect.github.com/pulumi/pulumi/pull/22820)

- \[cli] Surface the error and exit when `pulumi neo` fails to create
the underlying task, instead of leaving the TUI stuck in `Thinking…`
[#&#8203;22825](https://redirect.github.com/pulumi/pulumi/pull/22825)

- \[codegen/go] Correctly generate `[]pulumi.Asset` & `[]pulumi.Archive`
[#&#8203;22827](https://redirect.github.com/pulumi/pulumi/pull/22827)

- \[cli/neo] Exit cleanly when the user presses Ctrl+C twice in `pulumi
neo` instead of hanging until a third press
[#&#8203;22821](https://redirect.github.com/pulumi/pulumi/pull/22821)

- \[engine] The engine now caches schemas at `PULUMI_HOME/schemas`, and
will cache for parameterised packages as well
[#&#8203;22812](https://redirect.github.com/pulumi/pulumi/pull/22812)

- \[sdk-python] Preserve `__`-prefixed keys (e.g. `__type`
discriminators) across RPC deserialization, matching the behavior of the
other language SDKs
[#&#8203;22834](https://redirect.github.com/pulumi/pulumi/pull/22834)

- \[programgen/{nodejs,python}] Fix programgen to emit the right
`length` check for string length
[#&#8203;22802](https://redirect.github.com/pulumi/pulumi/pull/22802)

##### Miscellaneous

- \[cli] Replace the Pulumipus mascot in the `pulumi neo` welcome banner
with new Neo-branded ASCII art.
[#&#8203;22817](https://redirect.github.com/pulumi/pulumi/pull/22817)

###
[`v3.234.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32340-2026-05-01)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.233.0...v3.234.0)

##### Features

- \[cli/cloud] Add `pulumi cloud api describe` for inspecting the
parameters, request
    body, and response schema of any Pulumi Cloud API operation, with
    text, markdown, and JSON output

[#&#8203;22770](https://redirect.github.com/pulumi/pulumi/pull/22770)

- \[cli/cloud] Add `pulumi cloud api list` for browsing every endpoint
exposed by the Pulumi
    Cloud OpenAPI spec, with table and JSON output

[#&#8203;22769](https://redirect.github.com/pulumi/pulumi/pull/22769)

##### Bug Fixes

- \[engine] Revert changes to property path parsing that resulted in
errors for currently valid paths

###
[`v3.233.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32330-2026-04-30)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.232.0...v3.233.0)

##### Features

- \[auto/python] Expose the auto-generated Pulumi CLI interface as
`workspace.cli_api`
[#&#8203;22638](https://redirect.github.com/pulumi/pulumi/pull/22638)

- \[cli] Add encrypted logging to ~/.pulumi/logs; use the
PULUMI_ENABLE_AUTOMATIC_LOGGING feature flag to turn it on
[#&#8203;22494](https://redirect.github.com/pulumi/pulumi/pull/22494)

- \[cli] Implement the `filesystem__grep` and
`filesystem__content_replace` local tools
for `pulumi neo`. `grep` runs a regex search across files in the project
root
with an optional `include` glob filter and returns results in
`path:lineno: line`
form. `content_replace` performs a literal multi-file search-and-replace
with a
`file_pattern` glob and `dry_run` preview mode. Both tools skip binary
files,
hidden directories, and `node_modules`, and reject paths outside the
project
    root. Their input schemas match the cloud-side tool definitions.

[#&#8203;22655](https://redirect.github.com/pulumi/pulumi/pull/22655)

- \[cli] Add `pulumi_preview` and `pulumi_up` as local tools for the
experimental `pulumi neo`
agent. The Neo TUI renders a persistent bordered block for each
operation that
streams changed resources and diagnostics as the engine runs and
finalizes with a
    summary of the op counts. Hidden behind PULUMI_EXPERIMENTAL.

[#&#8203;22697](https://redirect.github.com/pulumi/pulumi/pull/22697)

-   \[engine] Add `List` to the provider protocol and schema
[#&#8203;22693](https://redirect.github.com/pulumi/pulumi/pull/22693)

##### Bug Fixes

- \[engine] Return a clear error when two installed plugins claim the
same default provider package name (for example, a native `scaleway`
provider alongside a `terraform-provider` bridge parameterized as
`scaleway`) instead of panicking with "Should not have seen an older
plugin if sorting is correct!"
[#&#8203;22679](https://redirect.github.com/pulumi/pulumi/pull/22679)

- \[programgen] Do not wrap a `call(...)` on a method whose return type
is marked plain in an Output. Previously
PCL bound every method call's return type as `Output<T>`, which caused
downstream program-gen
to emit broken `.apply(...)`/`.ApplyT(...)` traversals against plain
struct returns (e.g.
methods with `liftSingleValueMethodReturns=true` or
`ReturnTypePlain=true`).

[#&#8203;22696](https://redirect.github.com/pulumi/pulumi/pull/22696)

- \[backend/diy] When using a backend url containing creds (e.g.
PostgreSQL conn string), mask user:pass as in lock-related error
messages
[#&#8203;22701](https://redirect.github.com/pulumi/pulumi/pull/22701)

- \[codegen/go] Generate unqualified `Provider` references for the
package's own provider resource. Previously
the Go codegen always emitted `<pkg>.Provider` even when the reference
appeared inside `<pkg>`
itself, producing identifiers that would not compile. Affects generated
code for method return
types (and other schema positions) that reference
`pulumi:providers:<pkg>`.

[#&#8203;22696](https://redirect.github.com/pulumi/pulumi/pull/22696)

- \[codegen/nodejs] Generate unqualified `Provider` references for the
package's own provider resource when emitting
TypeScript code inside that package. Previously the generator always
qualified the name as
`<pkg>.Provider`, which does not resolve when no `<pkg>` namespace
import is in scope.

[#&#8203;22696](https://redirect.github.com/pulumi/pulumi/pull/22696)

- \[codegen/nodejs] Import the correct class name for a provider
resource. Imports for `pulumi:providers:<pkg>` used
the title-cased package name instead of `Provider`, producing a phantom
identifier that clashed
    with the containing package's component/resource classes.

[#&#8203;22696](https://redirect.github.com/pulumi/pulumi/pull/22696)

- \[programgen/nodejs] Emit `await` for `call(...)` invocations of
methods whose return type is marked plain, and
force the generated program into an async `export = async () => ...`
wrapper whenever such a
call is present. The Node SDK returns `Promise<T>` for plain methods;
previously program-gen
    used the result directly, which did not match its runtime type.

[#&#8203;22696](https://redirect.github.com/pulumi/pulumi/pull/22696)

- \[codegen/python] Avoid a self-import (`import pulumi_<pkg>` inside
`pulumi_<pkg>/<module>.py`) when referencing
the package's own provider resource. Python referenced the Provider as
`pulumi_<pkg>.Provider`
    even inside that package, which caused a circular import at runtime.

[#&#8203;22696](https://redirect.github.com/pulumi/pulumi/pull/22696)

- \[sdk/python] Reduce internal `Output[T]` data to a single
`asyncio.Future`
[#&#8203;22661](https://redirect.github.com/pulumi/pulumi/pull/22661)

- \[sdkgen/{nodejs,python}] Generate optional input types that accept
undefined/None values
[#&#8203;22552](https://redirect.github.com/pulumi/pulumi/pull/22552)

##### Miscellaneous

- \[auto/go] Drop the "With" prefix from generated option helpers so
they match the naming of the existing optXxx packages
[#&#8203;22682](https://redirect.github.com/pulumi/pulumi/pull/22682)

###
[`v3.232.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32320-2026-04-22)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.231.0...v3.232.0)

##### Features

- \[cli] Add an experimental `pulumi neo` command that creates a Pulumi
Neo agent task in CLI
tool-execution mode and runs the local tool loop. Filesystem and shell
tool calls
issued by the agent run on the user's machine in their working
directory; the
interactive chat continues to happen in the Pulumi Console at the URL
the command
    prints. Hidden behind PULUMI_EXPERIMENTAL.

[#&#8203;22473](https://redirect.github.com/pulumi/pulumi/pull/22473)

- \[cli] Add support for handling user approval requests in the `pulumi
neo` terminal UI.
When the agent requests confirmation for a sensitive action, the TUI
prompts the
user and forwards their response back to the Pulumi Console. Hidden
behind
    PULUMI_EXPERIMENTAL.

[#&#8203;22589](https://redirect.github.com/pulumi/pulumi/pull/22589)

- \[cli] Add an interactive terminal UI for `pulumi neo` built with
bubbletea, rendering
agent messages, tool calls, and streaming output in the terminal
alongside the
    Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.

[#&#8203;22570](https://redirect.github.com/pulumi/pulumi/pull/22570)

-   \[cli] Switch logging library from glog to slog.

BREAKING: any `if logging.V(x) {` need to be changed to `if
logging.V(x).Enabled()`

[#&#8203;22548](https://redirect.github.com/pulumi/pulumi/pull/22548)

- \[cli] Add a plan-mode toggle to the `pulumi neo` TUI, bound to
Shift+Tab. When
plan mode is on, Neo explores and asks questions without writing files,
running `pulumi up`, or opening PRs, and surfaces an approved plan via a
dedicated approval gate. The toggle must be set before the first message
(plan mode is task-level on the wire); approving the proposed plan exits
    plan mode automatically.

[#&#8203;22634](https://redirect.github.com/pulumi/pulumi/pull/22634)

- \[cli] The `pulumi neo` TUI now drives its "thinking" spinner off a
single declarative
rule (the spinner stays on until a final event — final assistant
message, approval
request, cancellation, or error — lands), so the indicator no longer
flickers off
when the agent hands off tool calls to the CLI or when streaming text
arrives
between tools. Press `Esc` during a turn to ask the agent to cancel; the
label
    switches to "Cancelling..." until the backend acknowledges.

[#&#8203;22637](https://redirect.github.com/pulumi/pulumi/pull/22637)

- \[cli] `pulumi neo` now executes the `edit` filesystem tool locally,
matching the schema
and response wording of the upstream mcp-claude-code tool so the agent
sees
identical output whether the call ran on Cloud or CLI. `edit` performs
exact-string
replacement with occurrence-count validation, and creates a new file
when the
    target is missing and `old_string` is empty.

[#&#8203;22654](https://redirect.github.com/pulumi/pulumi/pull/22654)

##### Bug Fixes

- \[cli] Render user messages in the `pulumi neo` TUI as soon as they're
submitted
instead of waiting for the Pulumi Cloud event stream to echo them back.
    The initial prompt passed on the command line also appears in the
transcript at startup. Self-echoes from the server are de-duplicated;
user input that originated from another client (e.g. the web UI on the
    same task) still renders.

[#&#8203;22629](https://redirect.github.com/pulumi/pulumi/pull/22629)

- \[cli] Wrap warnings, errors, and user-message bubbles to the terminal
width in the
`pulumi neo` TUI. Previously these blocks rendered as single long lines
that
were clipped at the right edge of the viewport. On resize, all
width-dependent
transcript blocks (user messages, warnings, errors, assistant messages)
now
    reflow to the new terminal width.

[#&#8203;22635](https://redirect.github.com/pulumi/pulumi/pull/22635)

- \[cli/policy] Fix `policy ls` to use the default org name, not
username
[#&#8203;22656](https://redirect.github.com/pulumi/pulumi/pull/22656)

- \[engine] Fix provider registry race condition in parallel
delete-before-replace
[#&#8203;21487](https://redirect.github.com/pulumi/pulumi/pull/21487)

- \[engine] Signal providers to cancel before closing them during
replacement

-   \[sdkgen] Error on 'id' in state inputs
[#&#8203;22636](https://redirect.github.com/pulumi/pulumi/pull/22636)

- \[programgen/python] Add necessary casts between types in generated
programs
[#&#8203;22567](https://redirect.github.com/pulumi/pulumi/pull/22567)

- \[sdkgen/go] Fix caching of package references to be per-deployment
not per-process
[#&#8203;22170](https://redirect.github.com/pulumi/pulumi/pull/22170)

##### Miscellaneous

-   \[java] Upgrade java to v1.25.0
[#&#8203;22673](https://redirect.github.com/pulumi/pulumi/pull/22673)

- \[auto/go] Generate command methods for the Go Automation API codegen
[#&#8203;22612](https://redirect.github.com/pulumi/pulumi/pull/22612)

- \[sdk] Clarify docs on the `remote` parameter of `ComponentResource` /
`Resource` in the Node and Python SDKs
[#&#8203;22603](https://redirect.github.com/pulumi/pulumi/pull/22603)

-   \[sdk/dotnet] Upgrade dotnet to v3.103.1
[#&#8203;22676](https://redirect.github.com/pulumi/pulumi/pull/22676)

-   \[yaml] Upgrade yaml to v1.32.0
[#&#8203;22674](https://redirect.github.com/pulumi/pulumi/pull/22674)

</details>

<details>
<summary>pulumi/providertest (github.com/pulumi/providertest)</summary>

###
[`v0.7.0`](https://redirect.github.com/pulumi/providertest/releases/tag/v0.7.0)

[Compare
Source](https://redirect.github.com/pulumi/providertest/compare/v0.6.0...v0.7.0)

##### What's Changed

- Bump golang.org/x/crypto from 0.36.0 to 0.45.0 in the go_modules group
across 1 directory by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot]
in[https://github.com/pulumi/providertest/pull/159](https://redirect.github.com/pulumi/providertest/pull/159)9
- Fix python_gcp test by adding setuptools dependency by
[@&#8203;pose](https://redirect.github.com/pose) in
[https://github.com/pulumi/providertest/pull/167](https://redirect.github.com/pulumi/providertest/pull/167)
- Rename project to python_gcp and update description by
[@&#8203;pose](https://redirect.github.com/pose) in
[https://github.com/pulumi/providertest/pull/166](https://redirect.github.com/pulumi/providertest/pull/166)
- fix(pulumitest): start fresh providers per engine operation by
[@&#8203;rshade](https://redirect.github.com/rshade) in
[https://github.com/pulumi/providertest/pull/170](https://redirect.github.com/pulumi/providertest/pull/170)
- feat(pulumitest): log pulumi version and plugins on stack creation by
[@&#8203;rshade](https://redirect.github.com/rshade) in
[https://github.com/pulumi/providertest/pull/171](https://redirect.github.com/pulumi/providertest/pull/171)

**Full Changelog**:
https://github.com/pulumi/providertest/compare/v0.6.0...v0.7.0

</details>

<details>
<summary>pulumi/pulumi-dotnet
(github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3)</summary>

###
[`v3.105.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31050---2026-05-04)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.104.0...v3.105.0)

###
[`v3.104.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31040---2026-04-29)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.103.1...v3.104.0)

##### Improvements

- \[runtime] Support the `getOutput` pcl intrinsic in codegen
[#&#8203;977](https://redirect.github.com/pulumi/pulumi-dotnet/pull/977)

###
[`v3.103.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31031---2026-04-21)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.103.0...v3.103.1)

##### Bug Fixes

- \[runtime] Ensure that 'main' is always respected for selecting
projects to run
[#&#8203;55](https://redirect.github.com/pulumi/pulumi-dotnet/pull/55)

- \[runtime] Generate compilable C# for resources whose range is an
Output-typed expression such as `length(someInvoke.result)`. The loop is
now wrapped in `.Apply(rangeBody => { ... })` so the loop bound sees a
plain `int`, and `length` on an `Output<ImmutableArray<T>>` is emitted
as the extension method `.Length()` (with parentheses) rather than as a
property.
[#&#8203;969](https://redirect.github.com/pulumi/pulumi-dotnet/pull/969)

- \[runtime] Fix codegen for nested `InputMap` literals so the produced
C# compiles
([#&#8203;833](https://redirect.github.com/pulumi/pulumi-dotnet/issues/833))
[#&#8203;970](https://redirect.github.com/pulumi/pulumi-dotnet/pull/970)

</details>

<details>
<summary>pulumi/pulumi-go-provider
(github.com/pulumi/pulumi-go-provider)</summary>

###
[`v1.3.2`](https://redirect.github.com/pulumi/pulumi-go-provider/releases/tag/v1.3.2)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-go-provider/compare/v1.3.1...v1.3.2)

#### What's Changed

- Update module github.com/pulumi/pulumi/pkg/v3 to v3.230.0 by
[@&#8203;pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot]
in[https://github.com/pulumi/pulumi-go-provider/pull/509](https://redirect.github.com/pulumi/pulumi-go-provider/pull/509)9
- Correctly encode & decode `types.AssetOrArchive` by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/512](https://redirect.github.com/pulumi/pulumi-go-provider/pull/512)
- Resolve framework version via runtime/debug.ReadBuildInfo by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/514](https://redirect.github.com/pulumi/pulumi-go-provider/pull/514)

**Full Changelog**:
https://github.com/pulumi/pulumi-go-provider/compare/v1.3.1...v1.3.2

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: Ian Wahbe <me@iwahbe.com>
2026-05-06 16:57:43 +00:00
pulumi-provider-automation[bot]
27b5636c61 Update GitHub Actions workflows. (#840)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[27c21ceadaafd5a7de6e5158a02338d7c19730a1](27c21ceada).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-05-06 06:33:07 +00:00
pulumi-provider-automation[bot]
ed5396c425 Update GitHub Actions workflows. (#839)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[4a9e45cebb804597b1a77dd1d1ba390731ba0d82](4a9e45cebb).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-05-05 06:23:28 +00:00
pulumi-provider-automation[bot]
4ba5f703d4 Update GitHub Actions workflows. (#838)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[f19d25e099c54e3ca45528e9e2348cf6873c5534](f19d25e099).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-05-04 06:32:46 +00:00
pulumi-provider-automation[bot]
72c3e93b42 Update GitHub Actions workflows. (#837)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[46ca3056938b5f6ddaec3f8eb550dcc34a2e3782](46ca305693).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-05-02 06:21:15 +00:00
pulumi-provider-automation[bot]
f864eda3e0 Update GitHub Actions workflows. (#834)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[3b016890d44c5e5e2e184c4b10b07484d9708cc3](3b016890d4).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-30 06:32:36 +00:00
pulumi-provider-automation[bot]
4e01c39bf9 Update GitHub Actions workflows. (#833)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[f99b830821cb45c5b332123be59c6a755cd4fadc](f99b830821).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-29 06:35:12 +00:00
pulumi-provider-automation[bot]
bab57d912d Update GitHub Actions workflows. (#832)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[dbc8a4c59b47e1406420ea87372068fb3780dce8](dbc8a4c59b).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-28 06:32:00 +00:00
pulumi-provider-automation[bot]
96b9de72a5 Update GitHub Actions workflows. (#831)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[fbb025ea2dd9c071a4b0a626d092c4104fc57644](fbb025ea2d).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-27 06:29:59 +00:00
pulumi-provider-automation[bot]
bae0f1379a Update GitHub Actions workflows. (#829)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[4a821ea4d38895a0aa6b855593ea108774165ff6](4a821ea4d3).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-25 06:06:14 +00:00
pulumi-provider-automation[bot]
30e1a98140 Update GitHub Actions workflows. (#828)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[88db566266daeb5f581215c84cd3e8c5f389a18d](88db566266).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-24 06:17:53 +00:00
pulumi-provider-automation[bot]
0b291cf120 Update GitHub Actions workflows. (#826)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[a4ba5d1c3db54f4aa8e7674e03c3032eabd24aaa](a4ba5d1c3d).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-23 06:14:45 +00:00
pulumi-provider-automation[bot]
2e27061ccc Update GitHub Actions workflows. (#825)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[e46e1ac50228764e2a7fa7a76403fca94224df68](e46e1ac502).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-22 06:12:50 +00:00
pulumi-provider-automation[bot]
740410488f Update GitHub Actions workflows. (#824)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[4065ed8e56aa6623046a204c35d57c0376c7cf6c](4065ed8e56).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-21 06:12:31 +00:00
pulumi-provider-automation[bot]
f24d1e662a Update GitHub Actions workflows. (#823)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[7f0c56e9f79bc22f3b4cc6379312d705a56411c6](7f0c56e9f7).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-20 06:21:00 +00:00
pulumi-provider-automation[bot]
703dd21dc8 Update GitHub Actions workflows. (#822)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[144a8c45ec5f8a164b55365078d914dd6955b209](144a8c45ec).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-19 06:12:17 +00:00
pulumi-provider-automation[bot]
8328de32ef Update GitHub Actions workflows. (#821)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[2bc9cb47c63304319f6a34a84c861bedc53274ae](2bc9cb47c6).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-18 06:01:53 +00:00
pulumi-provider-automation[bot]
c9ec41986b Update GitHub Actions workflows. (#820)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[5aad94d008deea2e7db42fa2579fe93fb88256b8](5aad94d008).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-17 06:14:06 +00:00
pulumi-renovate[bot]
ef554c455f Update dependency @pulumi/pulumi to v3.231.0 (#818)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.230.0` ->
`3.231.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.230.0/3.231.0)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.231.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.231.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.230.0...v3.231.0)

##### 3.231.0 (2026-04-16)

##### Features

- \[cli] Auto-detect Mercurial repository metadata for `pulumi up` /
`pulumi preview` updates, mirroring existing Git support
[#&#8203;22618](https://redirect.github.com/pulumi/pulumi/pull/22618)

- \[engine] Send Cancel RPC to plugins on host close for graceful
shutdown
[#&#8203;22569](https://redirect.github.com/pulumi/pulumi/pull/22569)

-   \[engine] Pass resource options to hooks through the engine
[#&#8203;22582](https://redirect.github.com/pulumi/pulumi/pull/22582)

-   \[engine] Add GetDeploymentInfo to the resource monitor service

-   \[auto/go] Add `New` command to Automation API
[#&#8203;22439](https://redirect.github.com/pulumi/pulumi/pull/22439)

-   \[auto/{go,nodejs,python}] Add --diff to automation api for destroy
[#&#8203;22563](https://redirect.github.com/pulumi/pulumi/pull/22563)

-   \[auto/python] Add `new` command to Automation API
[#&#8203;22439](https://redirect.github.com/pulumi/pulumi/pull/22439)

-   \[pcl] Support for resource hooks in PCL
[#&#8203;22365](https://redirect.github.com/pulumi/pulumi/pull/22365)

- \[sdk-nodejs] Warn when a non-ComponentResource class is passed in the
explicit `components` list to `componentProviderHost`
[#&#8203;22619](https://redirect.github.com/pulumi/pulumi/pull/22619)

- \[sdk-python] Warn when a non-ComponentResource class is passed in the
explicit `components` list to `component_provider_host`
[#&#8203;22619](https://redirect.github.com/pulumi/pulumi/pull/22619)

- \[cli/import] Add support for providers to be defined in the same
import file as their users
[#&#8203;21671](https://redirect.github.com/pulumi/pulumi/pull/21671)

-   \[cli/policy] ESC environment support for local policy packs
[#&#8203;22495](https://redirect.github.com/pulumi/pulumi/pull/22495)

-   \[sdk/nodejs] Support package.yaml when using pnpm
[#&#8203;22491](https://redirect.github.com/pulumi/pulumi/pull/22491)

- \[sdk/python] Add function decorator variants for resource and error
hooks
[#&#8203;22519](https://redirect.github.com/pulumi/pulumi/pull/22519)

##### Bug Fixes

- \[auto/{nodejs,python}] Support --run-program for inline programs with
preview_refresh/destroy

- \[backend/diy] Remove state lock for destroy and import with preview
only for diy backend
[#&#8203;22561](https://redirect.github.com/pulumi/pulumi/pull/22561)

- \[engine] Fix snapshot integrity error with component/provider
resources in refresh --run-program
[#&#8203;21817](https://redirect.github.com/pulumi/pulumi/pull/21817)

-   \[pcl] Type list and tuple indices as integers not numbers
[#&#8203;22592](https://redirect.github.com/pulumi/pulumi/pull/22592)

- \[pcl] Builtin functions element and range take int parameters not
numbers
[#&#8203;22597](https://redirect.github.com/pulumi/pulumi/pull/22597)

- \[programgen/{go,nodejs,python}] Fix some cases of name conflicts in
program gen not being handled correctly
[#&#8203;22556](https://redirect.github.com/pulumi/pulumi/pull/22556)

- \[programgen/nodejs] Add necessary casts between types in generated
programs
[#&#8203;22557](https://redirect.github.com/pulumi/pulumi/pull/22557)

-   \[programgen/{nodejs,python}] Fix imports of camelCase modules
[#&#8203;22536](https://redirect.github.com/pulumi/pulumi/pull/22536)

- \[sdk/python] Support Input\[Optional\[T]] in Python runtime type
unwrapping
[#&#8203;22553](https://redirect.github.com/pulumi/pulumi/pull/22553)

- \[sdkgen] Warn about modules nested under the index module which are
not supported
[#&#8203;22531](https://redirect.github.com/pulumi/pulumi/pull/22531)

##### Miscellaneous

-   \[java] Upgrade java to v1.24.0
[#&#8203;22615](https://redirect.github.com/pulumi/pulumi/pull/22615)

-   \[yaml] Upgrade yaml to v1.31.1
[#&#8203;22610](https://redirect.github.com/pulumi/pulumi/pull/22610)

-   \[sdk/dotnet] Upgrade dotnet to v3.103.0
[#&#8203;22614](https://redirect.github.com/pulumi/pulumi/pull/22614)

-   \[sdk/nodejs] Replace `got` by `fetch`
[#&#8203;22533](https://redirect.github.com/pulumi/pulumi/pull/22533)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-04-16 20:16:47 +00:00
pulumi-provider-automation[bot]
0b52de6543 Update GitHub Actions workflows. (#816)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[b05dbe61dbea8fb6ea0c4cde662bde1101961819](b05dbe61db).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-16 06:16:23 +00:00
pulumi-renovate[bot]
a3072f6aa3 Update module github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 to v3.103.0 (#815)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3](https://redirect.github.com/pulumi/pulumi-dotnet)
| require | minor | `v3.102.1` -> `v3.103.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi-dotnet
(github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3)</summary>

###
[`v3.103.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31030---2026-04-15)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.102.1...v3.103.0)

##### Improvements

- \[sdk] Clarify docs on the `remote` parameter of `ComponentResource` /
`Resource`
[#&#8203;963](https://redirect.github.com/pulumi/pulumi-dotnet/pull/963)

##### Bug Fixes

- \[sdk] Fix `ResourceTransforms` being silently dropped when
`CustomResourceOptions.Merge` is called (affects all generated SDK
resources using the `MakeResourceOptions` pattern)
[#&#8203;958](https://redirect.github.com/pulumi/pulumi-dotnet/pull/958)

- \[sdk] Add missing `[Input]` attribute to `StashArgs.Input`, fixing
serialization of the Stash resource
[#&#8203;960](https://redirect.github.com/pulumi/pulumi-dotnet/pull/960)

- \[sdk/auto] Fix running inline programs with refresh/destroy and
--run-program
[#&#8203;725](https://redirect.github.com/pulumi/pulumi-dotnet/pull/725)

##### Improvements

- \[runtime] Add codegen support for AdditionalSecretOutputs, Version,
and PluginDownloadURL resource options
[#&#8203;953](https://redirect.github.com/pulumi/pulumi-dotnet/pull/953)

##### Bug Fixes

- \[runtime] Fix property paths in resource options (IgnoreChanges,
ReplaceOnChanges, HideDiffs) being incorrectly prefixed with @&#8203;
for C# reserved words
[#&#8203;934](https://redirect.github.com/pulumi/pulumi-dotnet/pull/934)

- \[runtime] Fix NuGet package name and version extraction for packages
with prerelease versions (e.g. `3.0.0-alpha.1.internal`)
[#&#8203;947](https://redirect.github.com/pulumi/pulumi-dotnet/pull/947)

- \[runtime] Support call methods in program generation
[#&#8203;946](https://redirect.github.com/pulumi/pulumi-dotnet/pull/946)

- \[runtime] Add missing `System` namespace import for `sha1` builtin,
fixing `BitConverter` not found error
[#&#8203;961](https://redirect.github.com/pulumi/pulumi-dotnet/pull/961)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-04-15 17:55:53 +00:00
pulumi-provider-automation[bot]
afe301cb52 Update GitHub Actions workflows. (#814)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[bf992a9000f6297ee7e288347f354ed2ca8d6bbf](bf992a9000).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-15 06:13:32 +00:00
Keith Mosher
b0c5918c7c Migrate Windows code signing to Azure Trusted Signing (#811)
## Summary

Migrates Windows binary signing from Azure Key Vault (`jsign --storetype
AZUREKEYVAULT`) to [Azure Trusted
Signing](https://learn.microsoft.com/en-us/azure/trusted-signing/). The
previous AKV code-signing cert expired, breaking the release pipeline.
Trusted Signing issues short-lived Microsoft-managed certs so there's
nothing to rotate.

- `Makefile` / `scripts/crossbuild.mk`: bump `jsign` 6.0 → 7.4, switch
`--storetype` to `TRUSTEDSIGNING`, use the
`https://codesigning.azure.net` token audience, derive the keystore host
from `AZURE_SIGNING_ACCOUNT_ENDPOINT`, pass account/profile via
`--alias`, update the `SKIP_SIGNING` guard and error message.
- `.github/workflows/{build,release,prerelease,build_provider}.yml`:
replace the `AZURE_SIGNING_KEY_VAULT_URI` env passthrough with the three
new `AZURE_SIGNING_ACCOUNT_*` outputs and update the `SKIP_SIGNING`
expression.

Companion to pulumi/ci-mgmt#2126, pulumi/pulumi-command#1200, and
pulumi/pulumi-provider-boilerplate#1236. The ESC environment already
exposes the new variables and the signing SP has the `Artifact Signing
Certificate Profile Signer` role on the
`pulumi-code-signing/pulumi-code-signing` profile. Verified end-to-end
against pulumi-command, pulumi-random, and pulumi-provider-boilerplate.

## Test plan

- [ ] CI release build produces a Windows binary with a valid Trusted
Signing certificate chain
2026-04-09 16:52:15 -07:00
pulumi-provider-automation[bot]
00ec8e3ebe Update GitHub Actions workflows. (#812)
This PR was triggered by @kmosher generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[9753531fe8d3f70139c072186a6ddcaa32d27b63](9753531fe8).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-04-09 23:49:54 +00:00
pulumi-renovate[bot]
2079e52a5f Update first-party Pulumi dependencies to v3.230.0 (#809)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.229.0` ->
`3.230.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.229.0/3.230.0)
|
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.229.0` -> `v3.230.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.230.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32300-2026-04-08)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.229.0...v3.230.0)

##### Features

-   \[cli] Detect AI agents and send in update metadata
[#&#8203;22497](https://redirect.github.com/pulumi/pulumi/pull/22497)

- \[auto/nodejs] Add "org" commands (get-default, set-default, search,
search ai) to the auto-generated interface
[#&#8203;22395](https://redirect.github.com/pulumi/pulumi/pull/22395)

-   \[auto/nodejs] Add "new" command to the auto-generated interface
[#&#8203;22421](https://redirect.github.com/pulumi/pulumi/pull/22421)

- \[sdk/{nodejs,python}] Add Cancel handler to Python & Node.js
providers
[#&#8203;22516](https://redirect.github.com/pulumi/pulumi/pull/22516)

-   \[cli/policy] Add ESC environment resolution for policy packs
[#&#8203;22425](https://redirect.github.com/pulumi/pulumi/pull/22425)

##### Bug Fixes

- \[auto/go] Insert --non-interactive flag before "--" positional
separator to avoid misinterpretation as a positional argument
[#&#8203;22462](https://redirect.github.com/pulumi/pulumi/pull/22462)

- \[ci] Add code coverage collection for Node.js automation tools tests
[#&#8203;22412](https://redirect.github.com/pulumi/pulumi/pull/22412)

-   \[pcl] Allow key indexing into a map of resources created by range
[#&#8203;22498](https://redirect.github.com/pulumi/pulumi/pull/22498)

- \[programgen/go] Fix an issue with formatted index modules not
importing correctly

- \[cli/state] Check for Pulumi.yaml projects and `backend` option in
`state upgrade`
[#&#8203;22483](https://redirect.github.com/pulumi/pulumi/pull/22483)

- \[sdk/go] Fix Go program generation for ternary expressions inside
apply callbacks, add Go predeclared identifiers to reserved words,
handle optional list types in union type codegen, and fix
unmarshalOutput for known outputs with null elements.
[#&#8203;22460](https://redirect.github.com/pulumi/pulumi/pull/22460)

- \[sdk/nodejs] Fix inherited input properties missing from component
schema when args interface extends another interface
[#&#8203;22446](https://redirect.github.com/pulumi/pulumi/pull/22446)

- \[sdk/python] Fix inherited input properties missing from component
schema when args class inherits from a base class
[#&#8203;22484](https://redirect.github.com/pulumi/pulumi/pull/22484)

##### Miscellaneous

-   \[java] Upgrade java to v1.23.0

-   \[sdk/dotnet] Upgrade dotnet to v3.102.1

-   \[yaml] Upgrade to v1.31.0
[#&#8203;22501](https://redirect.github.com/pulumi/pulumi/pull/22501)

- \[programgen/{dotnet,go,java,nodejs,pcl,python,yaml}] Remove
`mimeType` & `readDir` from PCL
[#&#8203;22449](https://redirect.github.com/pulumi/pulumi/pull/22449)

</details>

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.230.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.230.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.229.0...v3.230.0)

#### 3.230.0 (2026-04-08)

##### Features

-   \[cli] Detect AI agents and send in update metadata
[#&#8203;22497](https://redirect.github.com/pulumi/pulumi/pull/22497)

- \[auto/nodejs] Add "org" commands (get-default, set-default, search,
search ai) to the auto-generated interface
[#&#8203;22395](https://redirect.github.com/pulumi/pulumi/pull/22395)

-   \[auto/nodejs] Add "new" command to the auto-generated interface
[#&#8203;22421](https://redirect.github.com/pulumi/pulumi/pull/22421)

- \[sdk/{nodejs,python}] Add Cancel handler to Python & Node.js
providers
[#&#8203;22516](https://redirect.github.com/pulumi/pulumi/pull/22516)

-   \[cli/policy] Add ESC environment resolution for policy packs
[#&#8203;22425](https://redirect.github.com/pulumi/pulumi/pull/22425)

##### Bug Fixes

- \[auto/go] Insert --non-interactive flag before "--" positional
separator to avoid misinterpretation as a positional argument
[#&#8203;22462](https://redirect.github.com/pulumi/pulumi/pull/22462)

- \[ci] Add code coverage collection for Node.js automation tools tests
[#&#8203;22412](https://redirect.github.com/pulumi/pulumi/pull/22412)

-   \[pcl] Allow key indexing into a map of resources created by range
[#&#8203;22498](https://redirect.github.com/pulumi/pulumi/pull/22498)

- \[programgen/go] Fix an issue with formatted index modules not
importing correctly

- \[cli/state] Check for Pulumi.yaml projects and `backend` option in
`state upgrade`
[#&#8203;22483](https://redirect.github.com/pulumi/pulumi/pull/22483)

- \[sdk/go] Fix Go program generation for ternary expressions inside
apply callbacks, add Go predeclared identifiers to reserved words,
handle optional list types in union type codegen, and fix
unmarshalOutput for known outputs with null elements.
[#&#8203;22460](https://redirect.github.com/pulumi/pulumi/pull/22460)

- \[sdk/nodejs] Fix inherited input properties missing from component
schema when args interface extends another interface
[#&#8203;22446](https://redirect.github.com/pulumi/pulumi/pull/22446)

- \[sdk/python] Fix inherited input properties missing from component
schema when args class inherits from a base class
[#&#8203;22484](https://redirect.github.com/pulumi/pulumi/pull/22484)

##### Miscellaneous

-   \[java] Upgrade java to v1.23.0

-   \[sdk/dotnet] Upgrade dotnet to v3.102.1

-   \[yaml] Upgrade to v1.31.0
[#&#8203;22501](https://redirect.github.com/pulumi/pulumi/pull/22501)

- \[programgen/{dotnet,go,java,nodejs,pcl,python,yaml}] Remove
`mimeType` & `readDir` from PCL
[#&#8203;22449](https://redirect.github.com/pulumi/pulumi/pull/22449)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-04-09 01:05:50 +00:00
pulumi-renovate[bot]
fd5b2ee95b Update first-party Pulumi dependencies (#807)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3](https://redirect.github.com/pulumi/pulumi-dotnet)
| require | patch | `v3.102.0` -> `v3.102.1` |
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.228.0` -> `v3.229.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi-dotnet
(github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3)</summary>

###
[`v3.102.1`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31021---2026-04-08)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.102.0...v3.102.1)

##### Bug Fixes

- \[sdk] Fix inherited \[Input] properties missing from component schema
when using base class inheritance on args types
[#&#8203;930](https://redirect.github.com/pulumi/pulumi-dotnet/pull/930)

- \[sdk] Fix GetResourceType() returning empty string for
DependencyProviderResource
[#&#8203;922](https://redirect.github.com/pulumi/pulumi-dotnet/pull/922)

</details>

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.229.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.229.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.228.0...v3.229.0)

#### 3.229.0 (2026-04-02)

##### Features

- \[auto/python] Add org get-default and set-default commands to
Automation API

- \[backend/diy] Avoid unnecessary S3 bucket HEAD calls to improve
performance
[#&#8203;22373](https://redirect.github.com/pulumi/pulumi/pull/22373)

- \[cli] Allow TRACEPARENT to be set for CLI invocations, parenting the
pulumi spans under an existing parent span
[#&#8203;22369](https://redirect.github.com/pulumi/pulumi/pull/22369)

- \[cli/display] Add `--urns` flag to display full resource URNs instead
of short names in preview, up, destroy, refresh, import, and watch
commands
[#&#8203;22007](https://redirect.github.com/pulumi/pulumi/pull/22007)

-   \[pcl] Type integer literals as integers rather than numbers in PCL
[#&#8203;22268](https://redirect.github.com/pulumi/pulumi/pull/22268)

-   \[pcl] Support parameterized providers in PCL
[#&#8203;22251](https://redirect.github.com/pulumi/pulumi/pull/22251)

- \[protobuf] Add RunPlugin2 bidirectional streaming RPC to
LanguageRuntime proto
[#&#8203;22389](https://redirect.github.com/pulumi/pulumi/pull/22389)

-   \[yaml] Update YAML runtime to 1.30.2
[#&#8203;22426](https://redirect.github.com/pulumi/pulumi/pull/22426)

- \[sdk/go] Add org get-default and set-default commands to Automation
API

- \[sdk/nodejs] Modernize generated tsconfig.json to align with
TypeScript defaults
[#&#8203;22370](https://redirect.github.com/pulumi/pulumi/pull/22370)

- \[cli/policy] Add a new `policy analyze` command to run a policy pack
against existing state
[#&#8203;22250](https://redirect.github.com/pulumi/pulumi/pull/22250)

##### Bug Fixes

- \[backend/diy] Remove state lock for refresh --preview-only for diy
backend
[#&#8203;22385](https://redirect.github.com/pulumi/pulumi/pull/22385)

-   \[cli] Fix OTEL flushing on provider shutdown
[#&#8203;22358](https://redirect.github.com/pulumi/pulumi/pull/22358)

- \[cli/display] Fix deadlock in message renderer when cancelling an
operation
[#&#8203;22433](https://redirect.github.com/pulumi/pulumi/pull/22433)

- \[engine] Fix `--include` and `--exclude` not working for
program-based refresh (RefreshV2)
[#&#8203;22404](https://redirect.github.com/pulumi/pulumi/pull/22404)

-   \[engine] Parallelize plugin cancellation in SignalCancellation
[#&#8203;22431](https://redirect.github.com/pulumi/pulumi/pull/22431)

-   \[pcl] Fix looking up variables in parent scopes
[#&#8203;22379](https://redirect.github.com/pulumi/pulumi/pull/22379)

-   \[pcl] Apply default values from resource schemas
[#&#8203;22393](https://redirect.github.com/pulumi/pulumi/pull/22393)

-   \[sdk/{bun,go,nodejs,python}] Wire Cancel RPC to language host Run
[#&#8203;22397](https://redirect.github.com/pulumi/pulumi/pull/22397)

-   \[sdk/nodejs] Allow TypeScript 6 as a peer dependency
[#&#8203;22340](https://redirect.github.com/pulumi/pulumi/pull/22340)

- \[sdk/nodejs] Fix closure serialization for \__importStar-wrapped
modules
[#&#8203;22388](https://redirect.github.com/pulumi/pulumi/pull/22388)

- \[sdk/python] Cache type metadata and class references in Python SDK
to reduce CPU overhead during serialization
[#&#8203;22422](https://redirect.github.com/pulumi/pulumi/pull/22422)

- \[sdk/python] Replace busy-wait polling in wait_for_rpcs with
asyncio.wait
[#&#8203;22411](https://redirect.github.com/pulumi/pulumi/pull/22411)

##### Miscellaneous

-   \[cli] Add update metadata to the otel root span
[#&#8203;22357](https://redirect.github.com/pulumi/pulumi/pull/22357)

-   \[java] Update to v1.22.0
[#&#8203;22437](https://redirect.github.com/pulumi/pulumi/pull/22437)

-   \[sdk/nodejs] Use nodenext for moduleResolution and module
[#&#8203;22363](https://redirect.github.com/pulumi/pulumi/pull/22363)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-04-08 13:51:13 +00:00
pulumi-renovate[bot]
8ef055d5e7 Update first-party Pulumi dependencies (#803)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.227.0` ->
`3.229.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.227.0/3.229.0)
|
|
[github.com/pulumi/pulumi-java/pkg](https://redirect.github.com/pulumi/pulumi-java)
| require | minor | `v1.21.3` -> `v1.22.0` |
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.227.0` -> `v3.228.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.229.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.229.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.228.0...v3.229.0)

#### 3.229.0 (2026-04-02)

##### Features

- \[auto/python] Add org get-default and set-default commands to
Automation API

- \[backend/diy] Avoid unnecessary S3 bucket HEAD calls to improve
performance
[#&#8203;22373](https://redirect.github.com/pulumi/pulumi/pull/22373)

- \[cli] Allow TRACEPARENT to be set for CLI invocations, parenting the
pulumi spans under an existing parent span
[#&#8203;22369](https://redirect.github.com/pulumi/pulumi/pull/22369)

- \[cli/display] Add `--urns` flag to display full resource URNs instead
of short names in preview, up, destroy, refresh, import, and watch
commands
[#&#8203;22007](https://redirect.github.com/pulumi/pulumi/pull/22007)

-   \[pcl] Type integer literals as integers rather than numbers in PCL
[#&#8203;22268](https://redirect.github.com/pulumi/pulumi/pull/22268)

-   \[pcl] Support parameterized providers in PCL
[#&#8203;22251](https://redirect.github.com/pulumi/pulumi/pull/22251)

- \[protobuf] Add RunPlugin2 bidirectional streaming RPC to
LanguageRuntime proto
[#&#8203;22389](https://redirect.github.com/pulumi/pulumi/pull/22389)

-   \[yaml] Update YAML runtime to 1.30.2
[#&#8203;22426](https://redirect.github.com/pulumi/pulumi/pull/22426)

- \[sdk/go] Add org get-default and set-default commands to Automation
API

- \[sdk/nodejs] Modernize generated tsconfig.json to align with
TypeScript defaults
[#&#8203;22370](https://redirect.github.com/pulumi/pulumi/pull/22370)

- \[cli/policy] Add a new `policy analyze` command to run a policy pack
against existing state
[#&#8203;22250](https://redirect.github.com/pulumi/pulumi/pull/22250)

##### Bug Fixes

- \[backend/diy] Remove state lock for refresh --preview-only for diy
backend
[#&#8203;22385](https://redirect.github.com/pulumi/pulumi/pull/22385)

-   \[cli] Fix OTEL flushing on provider shutdown
[#&#8203;22358](https://redirect.github.com/pulumi/pulumi/pull/22358)

- \[cli/display] Fix deadlock in message renderer when cancelling an
operation
[#&#8203;22433](https://redirect.github.com/pulumi/pulumi/pull/22433)

- \[engine] Fix `--include` and `--exclude` not working for
program-based refresh (RefreshV2)
[#&#8203;22404](https://redirect.github.com/pulumi/pulumi/pull/22404)

-   \[engine] Parallelize plugin cancellation in SignalCancellation
[#&#8203;22431](https://redirect.github.com/pulumi/pulumi/pull/22431)

-   \[pcl] Fix looking up variables in parent scopes
[#&#8203;22379](https://redirect.github.com/pulumi/pulumi/pull/22379)

-   \[pcl] Apply default values from resource schemas
[#&#8203;22393](https://redirect.github.com/pulumi/pulumi/pull/22393)

-   \[sdk/{bun,go,nodejs,python}] Wire Cancel RPC to language host Run
[#&#8203;22397](https://redirect.github.com/pulumi/pulumi/pull/22397)

-   \[sdk/nodejs] Allow TypeScript 6 as a peer dependency
[#&#8203;22340](https://redirect.github.com/pulumi/pulumi/pull/22340)

- \[sdk/nodejs] Fix closure serialization for \__importStar-wrapped
modules
[#&#8203;22388](https://redirect.github.com/pulumi/pulumi/pull/22388)

- \[sdk/python] Cache type metadata and class references in Python SDK
to reduce CPU overhead during serialization
[#&#8203;22422](https://redirect.github.com/pulumi/pulumi/pull/22422)

- \[sdk/python] Replace busy-wait polling in wait_for_rpcs with
asyncio.wait
[#&#8203;22411](https://redirect.github.com/pulumi/pulumi/pull/22411)

##### Miscellaneous

-   \[cli] Add update metadata to the otel root span
[#&#8203;22357](https://redirect.github.com/pulumi/pulumi/pull/22357)

-   \[java] Update to v1.22.0
[#&#8203;22437](https://redirect.github.com/pulumi/pulumi/pull/22437)

-   \[sdk/nodejs] Use nodenext for moduleResolution and module
[#&#8203;22363](https://redirect.github.com/pulumi/pulumi/pull/22363)

###
[`v3.228.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32280-2026-03-25)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.227.0...v3.228.0)

##### Features

- \[cli] Don't apply the secrets filter to `true` and `false`
(case-insensitive)
[#&#8203;22269](https://redirect.github.com/pulumi/pulumi/pull/22269)

- \[cli] Add grpcs:// support and header authentication to OTLP exporter
[#&#8203;22320](https://redirect.github.com/pulumi/pulumi/pull/22320)

-   \[cli] Read OTEL_RESOURCE_ATTRIBUTES
[#&#8203;22329](https://redirect.github.com/pulumi/pulumi/pull/22329)

- \[auto/nodejs] Add low-level "cancel" command to the auto-generated
interface
[#&#8203;22156](https://redirect.github.com/pulumi/pulumi/pull/22156)

- \[cli/state] Allow `pulumi state delete` to accept multiple resource
URNs and delete them in a dependency-safe order

##### Bug Fixes

-   \[cli] Allow relative file paths for --otel-traces
[#&#8203;22300](https://redirect.github.com/pulumi/pulumi/pull/22300)

-   \[cli] Bridge opentracing spans from providers into OTel
[#&#8203;22313](https://redirect.github.com/pulumi/pulumi/pull/22313)

-   \[cli] Correctly end spans for GRPC streams
[#&#8203;22304](https://redirect.github.com/pulumi/pulumi/pull/22304)

-   \[cli/about] Do not include the access token in plain text
[#&#8203;22347](https://redirect.github.com/pulumi/pulumi/pull/22347)

- \[display] Fix detailed diff indentation so changed resources are not
visually nested under unrelated visible resources when unchanged parents
are hidden.
[#&#8203;22317](https://redirect.github.com/pulumi/pulumi/pull/22317)

- \[cli/import] Fix import codegen when generating references to
non-standard names
[#&#8203;22319](https://redirect.github.com/pulumi/pulumi/pull/22319)

-   \[engine] Update golang version
[#&#8203;22277](https://redirect.github.com/pulumi/pulumi/pull/22277)

-   \[pcl] Typecheck component inputs in PCL programs
[#&#8203;22292](https://redirect.github.com/pulumi/pulumi/pull/22292)

- \[programgen/{nodejs,python}] Fix literal conversion when calling into
local components
[#&#8203;22306](https://redirect.github.com/pulumi/pulumi/pull/22306)

##### Miscellaneous

-   \[cli] Add CLI metadata to the root span
[#&#8203;22305](https://redirect.github.com/pulumi/pulumi/pull/22305)

-   \[cli] Add more OTel interceptors for GRPC clients
[#&#8203;22309](https://redirect.github.com/pulumi/pulumi/pull/22309)

- \[cli] Add spans for plugin installation and add more attributes for
dependency installation
[#&#8203;22303](https://redirect.github.com/pulumi/pulumi/pull/22303)

-   \[cli] Allow setting a GRPC endpoint for performance tests
[#&#8203;22330](https://redirect.github.com/pulumi/pulumi/pull/22330)

- \[backend/diy] Start deprecation of non-project mode for DIY backends
[#&#8203;19625](https://redirect.github.com/pulumi/pulumi/pull/19625)

</details>

<details>
<summary>pulumi/pulumi-java
(github.com/pulumi/pulumi-java/pkg)</summary>

###
[`v1.22.0`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1220---2026-04-01)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.21.3...v1.22.0)

##### Bug Fixes

- \[runtime] Do not leak java processes on failed resource creates
[#&#8203;2103](https://redirect.github.com/pulumi/pulumi-java/pull/2103)

##### Improvements

- \[codegen] Support `cwd()` builtin in program generation
[#&#8203;2092](https://redirect.github.com/pulumi/pulumi-java/pull/2092)

- \[codegen] Support `additionalSecretOutputs` resource option in
program generation
[#&#8203;2098](https://redirect.github.com/pulumi/pulumi-java/pull/2098)

- \[codegen] Support `deleteBeforeReplace` and `replaceOnChanges`
resource options in program and SDK generation
[#&#8203;2101](https://redirect.github.com/pulumi/pulumi-java/pull/2101)

##### Bug Fixes

- \[codegen] Emit integer numbers as floats so generated code compiles
[#&#8203;2102](https://redirect.github.com/pulumi/pulumi-java/pull/2102)

- \[codegen] Generate `pom.xml` in the program directory when `main` is
set in `Pulumi.yaml`
[#&#8203;2093](https://redirect.github.com/pulumi/pulumi-java/pull/2093)

- \[codegen] Fix generated SDK `settings.gradle` to work with Gradle 9
[#&#8203;2097](https://redirect.github.com/pulumi/pulumi-java/pull/2097)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-04-02 17:58:57 +00:00
pulumi-renovate[bot]
f98315e8ee Update first-party Pulumi dependencies to v3.227.0 (#802)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.226.0` ->
`3.227.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.226.0/3.227.0)
|
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.226.0` -> `v3.227.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.227.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32270-2026-03-19)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.226.0...v3.227.0)

##### Features

- \[engine] The engine will fill in Name and Type for ResourceReference
values on the wire protocol
[#&#8203;22208](https://redirect.github.com/pulumi/pulumi/pull/22208)

-   \[sdk/bun] Add support for running policy packs with bun
[#&#8203;22206](https://redirect.github.com/pulumi/pulumi/pull/22206)

-   \[cli/policy] Auto-install missing policy analyzer plugins
[#&#8203;22196](https://redirect.github.com/pulumi/pulumi/pull/22196)

- \[sdk/python] Add lock file detection for picking the Python toolchain
[#&#8203;22234](https://redirect.github.com/pulumi/pulumi/pull/22234)

##### Bug Fixes

-   \[cli] Use distinct exit codes for different types of error
[#&#8203;22205](https://redirect.github.com/pulumi/pulumi/pull/22205)

-   \[cli] Improve SAML SSO reauthorization error message

- \[engine] Fix snapshot integrity error in refresh v2 with changed
parents
[#&#8203;22190](https://redirect.github.com/pulumi/pulumi/pull/22190)

- \[pcl] Continue running after errors when running with
--continue-on-error
[#&#8203;22171](https://redirect.github.com/pulumi/pulumi/pull/22171)

-   \[pcl] Deprecate labels on package blocks
[#&#8203;22253](https://redirect.github.com/pulumi/pulumi/pull/22253)

- \[programgen] Preserve traversal parts in
rewriteRelativeTraversalExpression
[#&#8203;22249](https://redirect.github.com/pulumi/pulumi/pull/22249)

-   \[sdk/bun] Check for an SDK version compatible with bun
[#&#8203;22262](https://redirect.github.com/pulumi/pulumi/pull/22262)

-   \[programgen/nodejs] Correctly generate `for` expressions
[#&#8203;22219](https://redirect.github.com/pulumi/pulumi/pull/22219)

- \[sdk/go] Add support for Azure DevOps git URLs in pulumi package
publish code paths
[#&#8203;22217](https://redirect.github.com/pulumi/pulumi/pull/22217)

- \[programgen/python] Correctly generate list & dictionary
comprehension in Python code
[#&#8203;22182](https://redirect.github.com/pulumi/pulumi/pull/22182)

##### Miscellaneous

-   \[backend] Move CloudConsoleURL from httpstate to httpstate/client
[#&#8203;22258](https://redirect.github.com/pulumi/pulumi/pull/22258)

-   \[docs] Move remaining content from /developer-docs to /docs
[#&#8203;22225](https://redirect.github.com/pulumi/pulumi/pull/22225)

- \[sdk/bun] Add a test for the function serialization error message
when using bun
[#&#8203;22207](https://redirect.github.com/pulumi/pulumi/pull/22207)

-   \[sdk/bun] Run policy language tests for bun
[#&#8203;22209](https://redirect.github.com/pulumi/pulumi/pull/22209)

-   \[sdk/bun] Mark pulumi-language-bun as a bundled plugin
[#&#8203;22265](https://redirect.github.com/pulumi/pulumi/pull/22265)

- \[sdk/{bun,nodejs}] Use defaultErrorMessage in run-plugin and
run-policy-pack
[#&#8203;22210](https://redirect.github.com/pulumi/pulumi/pull/22210)

</details>

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.227.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.227.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.226.0...v3.227.0)

##### 3.227.0 (2026-03-19)

##### Features

- \[engine] The engine will fill in Name and Type for ResourceReference
values on the wire protocol
[#&#8203;22208](https://redirect.github.com/pulumi/pulumi/pull/22208)

-   \[sdk/bun] Add support for running policy packs with bun
[#&#8203;22206](https://redirect.github.com/pulumi/pulumi/pull/22206)

-   \[cli/policy] Auto-install missing policy analyzer plugins
[#&#8203;22196](https://redirect.github.com/pulumi/pulumi/pull/22196)

- \[sdk/python] Add lock file detection for picking the Python toolchain
[#&#8203;22234](https://redirect.github.com/pulumi/pulumi/pull/22234)

##### Bug Fixes

-   \[cli] Use distinct exit codes for different types of error
[#&#8203;22205](https://redirect.github.com/pulumi/pulumi/pull/22205)

-   \[cli] Improve SAML SSO reauthorization error message

- \[engine] Fix snapshot integrity error in refresh v2 with changed
parents
[#&#8203;22190](https://redirect.github.com/pulumi/pulumi/pull/22190)

- \[pcl] Continue running after errors when running with
--continue-on-error
[#&#8203;22171](https://redirect.github.com/pulumi/pulumi/pull/22171)

-   \[pcl] Deprecate labels on package blocks
[#&#8203;22253](https://redirect.github.com/pulumi/pulumi/pull/22253)

- \[programgen] Preserve traversal parts in
rewriteRelativeTraversalExpression
[#&#8203;22249](https://redirect.github.com/pulumi/pulumi/pull/22249)

-   \[sdk/bun] Check for an SDK version compatible with bun
[#&#8203;22262](https://redirect.github.com/pulumi/pulumi/pull/22262)

-   \[programgen/nodejs] Correctly generate `for` expressions
[#&#8203;22219](https://redirect.github.com/pulumi/pulumi/pull/22219)

- \[sdk/go] Add support for Azure DevOps git URLs in pulumi package
publish code paths
[#&#8203;22217](https://redirect.github.com/pulumi/pulumi/pull/22217)

- \[programgen/python] Correctly generate list & dictionary
comprehension in Python code
[#&#8203;22182](https://redirect.github.com/pulumi/pulumi/pull/22182)

##### Miscellaneous

-   \[backend] Move CloudConsoleURL from httpstate to httpstate/client
[#&#8203;22258](https://redirect.github.com/pulumi/pulumi/pull/22258)

-   \[docs] Move remaining content from /developer-docs to /docs
[#&#8203;22225](https://redirect.github.com/pulumi/pulumi/pull/22225)

- \[sdk/bun] Add a test for the function serialization error message
when using bun
[#&#8203;22207](https://redirect.github.com/pulumi/pulumi/pull/22207)

-   \[sdk/bun] Run policy language tests for bun
[#&#8203;22209](https://redirect.github.com/pulumi/pulumi/pull/22209)

-   \[sdk/bun] Mark pulumi-language-bun as a bundled plugin
[#&#8203;22265](https://redirect.github.com/pulumi/pulumi/pull/22265)

- \[sdk/{bun,nodejs}] Use defaultErrorMessage in run-plugin and
run-policy-pack
[#&#8203;22210](https://redirect.github.com/pulumi/pulumi/pull/22210)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-03-19 22:21:40 +00:00
pulumi-renovate[bot]
a479383c41 Update module google.golang.org/grpc to v1.79.3 [SECURITY] (#800)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
indirect | patch | `v1.79.2` -> `v1.79.3` |
| [google.golang.org/grpc](https://redirect.github.com/grpc/grpc-go) |
indirect | minor | `v1.72.1` -> `v1.79.3` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

### GitHub Vulnerability Alerts

####
[CVE-2026-33186](https://redirect.github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3)

### Impact
_What kind of vulnerability is it? Who is impacted?_

It is an **Authorization Bypass** resulting from **Improper Input
Validation** of the HTTP/2 `:path` pseudo-header.

The gRPC-Go server was too lenient in its routing logic, accepting
requests where the `:path` omitted the mandatory leading slash (e.g.,
`Service/Method` instead of `/Service/Method`). While the server
successfully routed these requests to the correct handler, authorization
interceptors (including the official `grpc/authz` package) evaluated the
raw, non-canonical path string. Consequently, "deny" rules defined using
canonical paths (starting with `/`) failed to match the incoming
request, allowing it to bypass the policy if a fallback "allow" rule was
present.

**Who is impacted?**
This affects gRPC-Go servers that meet both of the following criteria:
1. They use path-based authorization interceptors, such as the official
RBAC implementation in `google.golang.org/grpc/authz` or custom
interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`.
2. Their security policy contains specific "deny" rules for canonical
paths but allows other requests by default (a fallback "allow" rule).

The vulnerability is exploitable by an attacker who can send raw HTTP/2
frames with malformed `:path` headers directly to the gRPC server.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, the issue has been patched. The fix ensures that any request with a
`:path` that does not start with a leading slash is immediately rejected
with a `codes.Unimplemented` error, preventing it from reaching
authorization interceptors or handlers with a non-canonical path string.

Users should upgrade to the following versions (or newer):
* **v1.79.3**
* The latest **master** branch.

It is recommended that all users employing path-based authorization
(especially `grpc/authz`) upgrade as soon as the patch is available in a
tagged release.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without
upgrading?_

While upgrading is the most secure and recommended path, users can
mitigate the vulnerability using one of the following methods:

#### 1. Use a Validating Interceptor (Recommended Mitigation)
Add an "outermost" interceptor to your server that validates the path
before any other authorization logic runs:

```go
func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
    if info.FullMethod == "" || info.FullMethod[0] != '/' {
        return nil, status.Errorf(codes.Unimplemented, "malformed method name")
    }   
    return handler(ctx, req)
}

// Ensure this is the FIRST interceptor in your chain
s := grpc.NewServer(
    grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor),
)
```

#### 2. Infrastructure-Level Normalization
If your gRPC server is behind a reverse proxy or load balancer (such as
Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to
enforce strict HTTP/2 compliance for pseudo-headers and reject or
normalize requests where the `:path` header does not start with a
leading slash.

#### 3. Policy Hardening
Switch to a "default deny" posture in your authorization policies
(explicitly listing all allowed paths and denying everything else) to
reduce the risk of bypasses via malformed inputs.

---

### Release Notes

<details>
<summary>grpc/grpc-go (google.golang.org/grpc)</summary>

###
[`v1.79.3`](https://redirect.github.com/grpc/grpc-go/releases/tag/v1.79.3):
Release 1.79.3

[Compare
Source](https://redirect.github.com/grpc/grpc-go/compare/v1.79.2...v1.79.3)

### Security

- server: fix an authorization bypass where malformed :path headers
(missing the leading slash) could bypass path-based restricted "deny"
rules in interceptors like `grpc/authz`. Any request with a
non-canonical path is now immediately rejected with an `Unimplemented`
error.
([#&#8203;8981](https://redirect.github.com/grpc/grpc-go/issues/8981))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-03-19 05:12:33 +00:00
pulumi-provider-automation[bot]
474e757992 Update GitHub Actions workflows. (#799)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[4eeb9c0311bcea38a166c43eb897cf2a2f88ea4c](4eeb9c0311).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-03-18 06:01:10 +00:00
pulumi-renovate[bot]
23583bfdc8 Update module github.com/pulumi/pulumi-go-provider to v1.3.1 (#798)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi-go-provider](https://redirect.github.com/pulumi/pulumi-go-provider)
| require | patch | `v1.3.0` -> `v1.3.1` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi-go-provider
(github.com/pulumi/pulumi-go-provider)</summary>

###
[`v1.3.1`](https://redirect.github.com/pulumi/pulumi-go-provider/releases/tag/v1.3.1)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-go-provider/compare/v1.3.0...v1.3.1)

#### What's Changed

- Update module github.com/pulumi/pulumi/pkg/v3 to v3.226.0 by
[@&#8203;pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot]
in[https://github.com/pulumi/pulumi-go-provider/pull/487](https://redirect.github.com/pulumi/pulumi-go-provider/pull/487)7
- Serialize Enum Names by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/488](https://redirect.github.com/pulumi/pulumi-go-provider/pull/488)
- Allow annotating enums by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/489](https://redirect.github.com/pulumi/pulumi-go-provider/pull/489)

**Full Changelog**:
https://github.com/pulumi/pulumi-go-provider/compare/v1.3.0...v1.3.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-03-17 15:59:50 +00:00
pulumi-renovate[bot]
c1ec48af0a Update first-party Pulumi dependencies to v3.226.0 (#796)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.225.1` ->
`3.226.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.225.1/3.226.0)
|
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.225.1` -> `v3.226.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.226.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32260-2026-03-11)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.225.1...v3.226.0)

##### Features

- \[backend/service] Automatically repair snapshot integrity issues,
while sending an error event to the backend for further diagnosis
[#&#8203;22179](https://redirect.github.com/pulumi/pulumi/pull/22179)

- \[cli] Add a --otel-traces flag, that allows writing otel traces to a
file, or directly to a grpc interface
[#&#8203;22129](https://redirect.github.com/pulumi/pulumi/pull/22129)

- \[engine] Engine will use provider references from `__self__`
arguments to calls
[#&#8203;22114](https://redirect.github.com/pulumi/pulumi/pull/22114)

-   \[sdk/bun] Support bun as a runtime
[#&#8203;22177](https://redirect.github.com/pulumi/pulumi/pull/22177)
[#&#8203;22049](https://redirect.github.com/pulumi/pulumi/pull/22049)

-   \[sdk/bun] Add debugger support for the bun runtime
[#&#8203;22177](https://redirect.github.com/pulumi/pulumi/pull/22177)

-   \[sdk/bun] Add support for Bun as a plugin runtime
[#&#8203;22189](https://redirect.github.com/pulumi/pulumi/pull/22189)

##### Bug Fixes

-   \[engine] Fix ReplacementTrigger firing due to dependency changes
[#&#8203;22119](https://redirect.github.com/pulumi/pulumi/pull/22119)

- \[engine] Correctly serialize output values to the snapshot rather
than always recording them as computed even when known
[#&#8203;22120](https://redirect.github.com/pulumi/pulumi/pull/22120)

-   \[pcl] Support resource ranges in PCL
[#&#8203;22144](https://redirect.github.com/pulumi/pulumi/pull/22144)

- \[cli/config] Include environments used when refreshing a stack's
config
[#&#8203;22103](https://redirect.github.com/pulumi/pulumi/pull/22103)

- \[cli/display] Fix `pulumi destroy` not showing parent resource
hierarchy
[#&#8203;22148](https://redirect.github.com/pulumi/pulumi/pull/22148)

-   \[cli/package] Correctly parse package URLs with .git in them
[#&#8203;22174](https://redirect.github.com/pulumi/pulumi/pull/22174)

- \[cli/plugin] Fix package get-schema for binary providers at relative
paths
[#&#8203;22107](https://redirect.github.com/pulumi/pulumi/pull/22107)

- \[sdk/python] Handle null detailedDiff in automation StepEventMetadata
JSON parsing
[#&#8203;22140](https://redirect.github.com/pulumi/pulumi/pull/22140)

- \[cli/state] Fix state move integrity errors when copied providers
depend on resources left in source stack
[#&#8203;22141](https://redirect.github.com/pulumi/pulumi/pull/22141)

##### Miscellaneous

-   \[cli/about] Show bun information in `pulumi about`
[#&#8203;22121](https://redirect.github.com/pulumi/pulumi/pull/22121)

- \[programgen/go] Target go 1.25 for generated go.mod files (instead of
go 1.23)
[#&#8203;22070](https://redirect.github.com/pulumi/pulumi/pull/22070)

- \[sdkgen/go] Target go 1.25 for generated go.mod files for SDKs
(instead of go 1.20)
[#&#8203;22131](https://redirect.github.com/pulumi/pulumi/pull/22131)

- \[sdk/python] Read Poetry and uv lockfiles to determine program
dependencies
[#&#8203;22072](https://redirect.github.com/pulumi/pulumi/pull/22072)

- \[sdk/python] Use importlib to find pulumi-plugin.json for installed
packages
[#&#8203;22127](https://redirect.github.com/pulumi/pulumi/pull/22127)

</details>

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.226.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.226.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.225.1...v3.226.0)

#### 3.226.0 (2026-03-11)

##### Features

- \[backend/service] Automatically repair snapshot integrity issues,
while sending an error event to the backend for further diagnosis
[#&#8203;22179](https://redirect.github.com/pulumi/pulumi/pull/22179)

- \[cli] Add a --otel-traces flag, that allows writing otel traces to a
file, or directly to a grpc interface
[#&#8203;22129](https://redirect.github.com/pulumi/pulumi/pull/22129)

- \[engine] Engine will use provider references from `__self__`
arguments to calls
[#&#8203;22114](https://redirect.github.com/pulumi/pulumi/pull/22114)

-   \[sdk/bun] Support bun as a runtime
[#&#8203;22177](https://redirect.github.com/pulumi/pulumi/pull/22177)
[#&#8203;22049](https://redirect.github.com/pulumi/pulumi/pull/22049)

-   \[sdk/bun] Add debugger support for the bun runtime
[#&#8203;22177](https://redirect.github.com/pulumi/pulumi/pull/22177)

-   \[sdk/bun] Add support for Bun as a plugin runtime
[#&#8203;22189](https://redirect.github.com/pulumi/pulumi/pull/22189)

##### Bug Fixes

-   \[engine] Fix ReplacementTrigger firing due to dependency changes
[#&#8203;22119](https://redirect.github.com/pulumi/pulumi/pull/22119)

- \[engine] Correctly serialize output values to the snapshot rather
than always recording them as computed even when known
[#&#8203;22120](https://redirect.github.com/pulumi/pulumi/pull/22120)

-   \[pcl] Support resource ranges in PCL
[#&#8203;22144](https://redirect.github.com/pulumi/pulumi/pull/22144)

- \[cli/config] Include environments used when refreshing a stack's
config
[#&#8203;22103](https://redirect.github.com/pulumi/pulumi/pull/22103)

- \[cli/display] Fix `pulumi destroy` not showing parent resource
hierarchy
[#&#8203;22148](https://redirect.github.com/pulumi/pulumi/pull/22148)

-   \[cli/package] Correctly parse package URLs with .git in them
[#&#8203;22174](https://redirect.github.com/pulumi/pulumi/pull/22174)

- \[cli/plugin] Fix package get-schema for binary providers at relative
paths
[#&#8203;22107](https://redirect.github.com/pulumi/pulumi/pull/22107)

- \[sdk/python] Handle null detailedDiff in automation StepEventMetadata
JSON parsing
[#&#8203;22140](https://redirect.github.com/pulumi/pulumi/pull/22140)

- \[cli/state] Fix state move integrity errors when copied providers
depend on resources left in source stack
[#&#8203;22141](https://redirect.github.com/pulumi/pulumi/pull/22141)

##### Miscellaneous

-   \[cli/about] Show bun information in `pulumi about`
[#&#8203;22121](https://redirect.github.com/pulumi/pulumi/pull/22121)

- \[programgen/go] Target go 1.25 for generated go.mod files (instead of
go 1.23)
[#&#8203;22070](https://redirect.github.com/pulumi/pulumi/pull/22070)

- \[sdkgen/go] Target go 1.25 for generated go.mod files for SDKs
(instead of go 1.20)
[#&#8203;22131](https://redirect.github.com/pulumi/pulumi/pull/22131)

- \[sdk/python] Read Poetry and uv lockfiles to determine program
dependencies
[#&#8203;22072](https://redirect.github.com/pulumi/pulumi/pull/22072)

- \[sdk/python] Use importlib to find pulumi-plugin.json for installed
packages
[#&#8203;22127](https://redirect.github.com/pulumi/pulumi/pull/22127)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-03-13 16:28:43 +00:00
pulumi-renovate[bot]
20b453c00b Update module github.com/pulumi/esc to v0.23.0 (#795)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/pulumi/esc](https://redirect.github.com/pulumi/esc) |
indirect | minor | `v0.22.0` -> `v0.23.0` |

---

> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.

---

### Release Notes

<details>
<summary>pulumi/esc (github.com/pulumi/esc)</summary>

###
[`v0.23.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.23.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.22.0...v0.23.0)

##### Improvements

-   Add warning in CLI when using an ambiguous 2-part environment ref
    [#&#8203;622](https://redirect.github.com/pulumi/esc/pull/622)

- Add support for `fn::final` built-in function that marks values as
final and unable to be overwritten.
    [#&#8203;621](https://redirect.github.com/pulumi/esc/pull/621)

##### Bug Fixes

##### Breaking changes

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-03-12 20:38:53 +00:00
Pulumi Bot
f6b499a9d4 [rollout] Set up GH-AW and install shared PR review workflows (#794)
## Summary

This PR sets up GitHub Agentic Workflows (GH-AW) and installs shared PR
review workflows in `pulumi/pulumi-docker-build`.

### Commands Executed

- `gh-aw version` → `v0.56.2` (used as entrypoint)
- `gh-aw init` → ran (`.github/aw/` was not present)
- `gh-aw add
pulumi-labs/gh-aw-internal/.github/workflows/gh-aw-pr-review.md@main
--name docker-build-pr-review --force`
- `gh-aw add
pulumi-labs/gh-aw-internal/.github/workflows/gh-aw-pr-rereview.md@main
--name docker-build-pr-rereview --force`
- `gh-aw compile`
- `gh-aw validate`

### Configuration

| Property | Value |
|---|---|
| AW entrypoint | `gh-aw` (v0.56.2) |
| Target base branch | `main` |
| `prefix_stem` | `docker-build` |
| `gh-aw init` | Ran (was not previously initialized) |

### Changed Files

- `.gitattributes` — added `merge=ours` strategy for
`.github/workflows/*.lock.yml`
- `.github/agents/agentic-workflows.agent.md` — created by `gh-aw init`
- `.github/workflows/copilot-setup-steps.yml` — generated dependency
workflow
- `.github/workflows/docker-build-pr-review.md` — shared PR review
workflow source
- `.github/workflows/docker-build-pr-review.lock.yml` — compiled lock
file
- `.github/workflows/docker-build-pr-rereview.md` — shared PR re-review
workflow source
- `.github/workflows/docker-build-pr-rereview.lock.yml` — compiled lock
file
- `.github/workflows/shared/review.md` — imported shared workflow
- `.github/workflows/shared/plugins/code-review/code-review.md` —
imported shared plugin

### Validation Output

**compile:**
````
⚠ Compiled 2 workflow(s): 0 error(s), 2 warning(s)
```

**validate:**
```
⚠ Compiled 2 workflow(s): 0 error(s), 2 warning(s)
```

### Validation Warnings

Both workflows produced the same non-blocking warning:
```
warning: This workflow grants id-token: write permission
OIDC tokens can authenticate to cloud providers (AWS, Azure, GCP).
Ensure proper audience validation and trust policies are configured.
````

These warnings are expected for the shared review workflows which use
OIDC for cloud authentication and are non-blocking.

---
Rollout triggered by
[provider-ops#41](https://github.com/pulumi/provider-ops/issues/41).




> Generated by [Generic Rollout
Worker](https://github.com/pulumi/provider-ops/actions/runs/23014445857)
·
[◷](https://github.com/search?q=repo%3Apulumi%2Fpulumi-docker-build+%22gh-aw-workflow-id%3A+gh-aw-workflow-rollout-worker%22&type=pullrequests)

<!-- gh-aw-agentic-workflow: Generic Rollout Worker, engine: claude, id:
23014445857, workflow_id: gh-aw-workflow-rollout-worker, run:
https://github.com/pulumi/provider-ops/actions/runs/23014445857 -->

<!-- gh-aw-workflow-id: gh-aw-workflow-rollout-worker -->

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-12 15:25:04 -04:00
pulumi-renovate[bot]
a8af1bfb5d Update module github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 to v3.102.0 (#792)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3](https://redirect.github.com/pulumi/pulumi-dotnet)
| require | minor | `v3.101.2` -> `v3.102.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi-dotnet
(github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3)</summary>

###
[`v3.102.0`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31020---2026-03-11)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.101.2...v3.102.0)

##### Improvements

- \[runtime] Support 'secret' in pcl config blocks
[#&#8203;897](https://redirect.github.com/pulumi/pulumi-dotnet/pull/897)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-03-12 04:43:00 +00:00
pulumi-renovate[bot]
158160e33c Update module github.com/pulumi/pulumi-java/pkg to v1.21.3 (#791)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi-java/pkg](https://redirect.github.com/pulumi/pulumi-java)
| require | patch | `v1.21.2` -> `v1.21.3` |

---

### Release Notes

<details>
<summary>pulumi/pulumi-java
(github.com/pulumi/pulumi-java/pkg)</summary>

###
[`v1.21.3`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#vv1213---2026-03-11)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.21.2...v1.21.3)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-03-11 22:59:16 +00:00
pulumi-provider-automation[bot]
c7b308d64b Update GitHub Actions workflows. (#789)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[7dff4f888cb6e5bfa153146d3658d3e86ba74c6f](7dff4f888c).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-03-11 05:55:42 +00:00
Cam Soper
ac9653175b Fix syntax for language chooser in documentation (#771)
@pose Fixes a bug in the doc that prevents completion of the build in
`pulumi/registry`.
2026-03-06 09:42:06 -08:00
pulumi-renovate[bot]
76a990fcb2 Update module github.com/pulumi/pulumi/pkg/v3 to v3.225.1 (#788)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | patch | `v3.225.0` -> `v3.225.1` |

---

### Release Notes

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.225.1`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.225.1)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.225.0...v3.225.1)

#### 3.225.1 (2026-03-05)

##### Bug Fixes

- \[engine] Fix inheritence of default providers across resources of
different packages
[#&#8203;22101](https://redirect.github.com/pulumi/pulumi/pull/22101)

- \[programgen/go] Fix panic on digit-prefixed schema properties in Go
code generation
[#&#8203;21917](https://redirect.github.com/pulumi/pulumi/pull/21917)

- \[programgen/go] Fix plain values not always being lifted to
input/output values when needed
[#&#8203;22084](https://redirect.github.com/pulumi/pulumi/pull/22084)

-   \[programgen/python] Fix generation of `entries` and `lookup` calls
[#&#8203;22086](https://redirect.github.com/pulumi/pulumi/pull/22086)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-03-06 08:17:59 +00:00
pulumi-provider-automation[bot]
aeb64dc959 Update GitHub Actions workflows. (#787)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[46f89691d9162d78e8ac301d8b8746b1469b2338](46f89691d9).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-03-06 05:53:08 +00:00
pulumi-renovate[bot]
14fafe1ba2 Update dependency @pulumi/pulumi to v3.225.1 (#786)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | patch | [`3.225.0` ->
`3.225.1`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.225.0/3.225.1)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.225.1`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.225.1)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.225.0...v3.225.1)

#### 3.225.1 (2026-03-05)

##### Bug Fixes

- \[engine] Fix inheritence of default providers across resources of
different packages
[#&#8203;22101](https://redirect.github.com/pulumi/pulumi/pull/22101)

- \[programgen/go] Fix panic on digit-prefixed schema properties in Go
code generation
[#&#8203;21917](https://redirect.github.com/pulumi/pulumi/pull/21917)

- \[programgen/go] Fix plain values not always being lifted to
input/output values when needed
[#&#8203;22084](https://redirect.github.com/pulumi/pulumi/pull/22084)

-   \[programgen/python] Fix generation of `entries` and `lookup` calls
[#&#8203;22086](https://redirect.github.com/pulumi/pulumi/pull/22086)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-03-05 23:39:57 +00:00
pulumi-renovate[bot]
38664fbc57 Update first-party Pulumi dependencies to v3.225.0 (#784)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.224.0` ->
`3.225.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.224.0/3.225.0)
|
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.224.0` -> `v3.225.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.225.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.225.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.224.0...v3.225.0)

##### 3.225.0 (2026-03-04)

##### Features

- \[engine] Automatically make invoke outputs secret when there is a
secret input, and the invoke provider does not support secrets
[#&#8203;21959](https://redirect.github.com/pulumi/pulumi/pull/21959)

- \[engine] The engine now handles the inheritance of the `provider`
option in resource registrations
[#&#8203;21999](https://redirect.github.com/pulumi/pulumi/pull/21999)

- \[engine] Enable journaling by default. It can still be turned off
using the PULUMI_DISABLE_JOURNALING env variable
[#&#8203;22041](https://redirect.github.com/pulumi/pulumi/pull/22041)

- \[programgen] PCL can now express config values should be read as
secrets
[#&#8203;22066](https://redirect.github.com/pulumi/pulumi/pull/22066)

-   \[yaml] Update yaml to v1.30.0

- \[cli/engine] Add a flag for automatically opening a Neo task on
preview/up failure
[#&#8203;21960](https://redirect.github.com/pulumi/pulumi/pull/21960)

- \[cli/package] Support source-based packages in `pulumi schema check`,
not just schema files
[#&#8203;21897](https://redirect.github.com/pulumi/pulumi/pull/21897)

##### Bug Fixes

- \[cli] Fix `stack import` panicking when importing a service stack
into a DIY backend
[#&#8203;22076](https://redirect.github.com/pulumi/pulumi/pull/22076)

- \[engine] Fix panic when a new component resource in the program is
not targeted
[#&#8203;21957](https://redirect.github.com/pulumi/pulumi/pull/21957)

-   \[sdk/nodejs] Implement GetProgramDependencies for bun and pnpm
[#&#8203;22065](https://redirect.github.com/pulumi/pulumi/pull/22065)

##### Miscellaneous

- \[cli] Build language plugins with the grpcnotrace tag to reduce the
binary size
[#&#8203;22012](https://redirect.github.com/pulumi/pulumi/pull/22012)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-03-05 12:51:45 +00:00
pulumi-renovate[bot]
8befdfed62 Update module github.com/pulumi/pulumi/pkg/v3 to v3.224.0 (#780)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.223.0` -> `v3.224.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.224.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.224.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.223.0...v3.224.0)

##### 3.224.0 (2026-02-26)

##### Features

- \[backend/diy] Add zstd compression option for DIY backend state files
[#&#8203;21877](https://redirect.github.com/pulumi/pulumi/pull/21877)

- \[engine] Automatically make invoke outputs secret when there is a
secret input, and the invoke provider does not support secrets

- \[cli/package] Support source-based packages in `pulumi schema check`,
not just schema files
[#&#8203;21897](https://redirect.github.com/pulumi/pulumi/pull/21897)

##### Bug Fixes

-   \[pkg] Correct the schema for "pulumi:pulumi:StackReference"
[#&#8203;21895](https://redirect.github.com/pulumi/pulumi/pull/21895)

- \[programgen/nodejs] Correct the semantics of singleOrNone in
generated files
[#&#8203;21947](https://redirect.github.com/pulumi/pulumi/pull/21947)

- \[sdk/python] Fix `StepEventMetadata.from_json` reading
`detailed_diff` (snake_case) instead of `detailedDiff` (camelCase), and
`PolicyEvent.from_json` reading `resource_urn` instead of `resourceUrn`,
causing both fields to always be `None`
[#&#8203;21714](https://redirect.github.com/pulumi/pulumi/pull/21714)

-   \[sdk/python] Convert integer component inputs to `int`
[#&#8203;21944](https://redirect.github.com/pulumi/pulumi/pull/21944)

-   \[sdk/python] Fix crash in forked processes using automation API
[#&#8203;21937](https://redirect.github.com/pulumi/pulumi/pull/21937)

- \[engine] Fix panic when a new component resource in the program is
not targeted
[#&#8203;21957](https://redirect.github.com/pulumi/pulumi/pull/21957)

##### Miscellaneous

-   \[sdk] Update java, dotnet & yaml
[#&#8203;21961](https://redirect.github.com/pulumi/pulumi/pull/21961)

- \[sdk/python] Improve the performance of `contains_unknowns` for large
objects
[#&#8203;21893](https://redirect.github.com/pulumi/pulumi/pull/21893)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-02-27 12:43:28 +00:00
pulumi-renovate[bot]
1e0f067064 Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (#776)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/cloudflare/circl](https://redirect.github.com/cloudflare/circl)
| indirect | patch | `v1.6.1` -> `v1.6.3` |

### GitHub Vulnerability Alerts

####
[CVE-2026-1229](https://redirect.github.com/cloudflare/circl/security/advisories/GHSA-q9hv-hpm4-hj6x)

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1
curve) produces an incorrect value for specific inputs. The issue is
fixed by using complete addition formulas.
ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in
**[v1.6.3](https://redirect.github.com/cloudflare/circl/releases/tag/v1.6.3)**.

---

### Release Notes

<details>
<summary>cloudflare/circl (github.com/cloudflare/circl)</summary>

###
[`v1.6.3`](https://redirect.github.com/cloudflare/circl/releases/tag/v1.6.3):
CIRCL v1.6.3

[Compare
Source](https://redirect.github.com/cloudflare/circl/compare/v1.6.2...v1.6.3)

##### CIRCL v1.6.3

Fix a bug on ecc/p384 scalar multiplication.

##### What's Changed

- sign/mldsa: Check opts for nil value by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/582](https://redirect.github.com/cloudflare/circl/pull/582)
- ecc/p384: Point addition must handle point doubling case. by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/583](https://redirect.github.com/cloudflare/circl/pull/583)
- Release CIRCL v1.6.3 by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/584](https://redirect.github.com/cloudflare/circl/pull/584)

**Full Changelog**:
https://github.com/cloudflare/circl/compare/v1.6.2...v1.6.3

###
[`v1.6.2`](https://redirect.github.com/cloudflare/circl/releases/tag/v1.6.2):
CIRCL v1.6.2

[Compare
Source](https://redirect.github.com/cloudflare/circl/compare/v1.6.1...v1.6.2)

##### CIRCL v1.6.2

-   New SLH-DSA, improvements in ML-DSA for arm64.
-   Tested compilation on WASM.

##### What's Changed

- Optimize pairing product computation by moving exponentiations to G1.
by [@&#8203;dfaranha](https://redirect.github.com/dfaranha) in
[https://github.com/cloudflare/circl/pull/547](https://redirect.github.com/cloudflare/circl/pull/547)
- sign: Adding SLH-DSA signature by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/512](https://redirect.github.com/cloudflare/circl/pull/512)
- Update code generators to CIRCL v1.6.1. by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/548](https://redirect.github.com/cloudflare/circl/pull/548)
- ML-DSA: Add preliminary Wycheproof test vectors by
[@&#8203;bwesterb](https://redirect.github.com/bwesterb) in
[https://github.com/cloudflare/circl/pull/552](https://redirect.github.com/cloudflare/circl/pull/552)
- go fmt by [@&#8203;bwesterb](https://redirect.github.com/bwesterb) in
[https://github.com/cloudflare/circl/pull/554](https://redirect.github.com/cloudflare/circl/pull/554)
- gz-compressing test vectors, use of HexBytes and ReadGzip functions.
by [@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/555](https://redirect.github.com/cloudflare/circl/pull/555)
- group: Removes use of elliptic Marshal and Unmarshal functions. by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/556](https://redirect.github.com/cloudflare/circl/pull/556)
- Support encoding/decoding ML-DSA private keys (as long as they contain
seeds) by [@&#8203;bwesterb](https://redirect.github.com/bwesterb) in
[https://github.com/cloudflare/circl/pull/559](https://redirect.github.com/cloudflare/circl/pull/559)
- Update to golangci-lint v2 by
[@&#8203;bwesterb](https://redirect.github.com/bwesterb) in
[https://github.com/cloudflare/circl/pull/560](https://redirect.github.com/cloudflare/circl/pull/560)
- Preparation for ARM64 Implementation of poly operations for dilithium
package. by
[@&#8203;elementrics](https://redirect.github.com/elementrics) in
[https://github.com/cloudflare/circl/pull/562](https://redirect.github.com/cloudflare/circl/pull/562)
- prepare power2Round for custom implementations in assembly by
[@&#8203;elementrics](https://redirect.github.com/elementrics) in
[https://github.com/cloudflare/circl/pull/564](https://redirect.github.com/cloudflare/circl/pull/564)
- ARM64 implementation for poly.PackLe16 by
[@&#8203;elementrics](https://redirect.github.com/elementrics) in
[https://github.com/cloudflare/circl/pull/563](https://redirect.github.com/cloudflare/circl/pull/563)
- add arm64 version of polyMulBy2toD by
[@&#8203;elementrics](https://redirect.github.com/elementrics) in
[https://github.com/cloudflare/circl/pull/565](https://redirect.github.com/cloudflare/circl/pull/565)
- add arm64 version of polySub by
[@&#8203;elementrics](https://redirect.github.com/elementrics) in
[https://github.com/cloudflare/circl/pull/566](https://redirect.github.com/cloudflare/circl/pull/566)
- group: add byteLen method for short groups and RandomScalar uses
rand.Int by [@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/568](https://redirect.github.com/cloudflare/circl/pull/568)
- add arm64 version of poly.Add/Sub by
[@&#8203;elementrics](https://redirect.github.com/elementrics) in
[https://github.com/cloudflare/circl/pull/572](https://redirect.github.com/cloudflare/circl/pull/572)
- group: Adding cryptobyte marshaling to scalars by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/569](https://redirect.github.com/cloudflare/circl/pull/569)
- Bumping up to Go1.25 by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/574](https://redirect.github.com/cloudflare/circl/pull/574)
- ci: Including WASM compilation. by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/577](https://redirect.github.com/cloudflare/circl/pull/577)
- Revert to using package-declared HPKE errors for shortkem instead of
standard library errors by
[@&#8203;harshiniwho](https://redirect.github.com/harshiniwho) in
[https://github.com/cloudflare/circl/pull/578](https://redirect.github.com/cloudflare/circl/pull/578)
- Release v1.6.2 by
[@&#8203;armfazh](https://redirect.github.com/armfazh) in
[https://github.com/cloudflare/circl/pull/579](https://redirect.github.com/cloudflare/circl/pull/579)

##### New Contributors

- [@&#8203;dfaranha](https://redirect.github.com/dfaranha) made their
first contribution in
[https://github.com/cloudflare/circl/pull/547](https://redirect.github.com/cloudflare/circl/pull/547)
- [@&#8203;elementrics](https://redirect.github.com/elementrics) made
their first contribution in
[https://github.com/cloudflare/circl/pull/562](https://redirect.github.com/cloudflare/circl/pull/562)
- [@&#8203;harshiniwho](https://redirect.github.com/harshiniwho) made
their first contribution in
[https://github.com/cloudflare/circl/pull/578](https://redirect.github.com/cloudflare/circl/pull/578)

**Full Changelog**:
https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.2

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-02-26 21:42:18 +00:00
pulumi-renovate[bot]
52f09191a7 Update first-party Pulumi dependencies (#769)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.221.0` ->
`3.224.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.221.0/3.224.0)
|
|
[github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild](https://redirect.github.com/pulumi/pulumi-docker-build)
| require | patch | `v0.0.12` -> `v0.0.15` |
|
[github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3](https://redirect.github.com/pulumi/pulumi-dotnet)
| require | patch | `v3.101.0` -> `v3.101.2` |
|
[github.com/pulumi/pulumi-java/pkg](https://redirect.github.com/pulumi/pulumi-java)
| require | minor | `v1.16.0` -> `v1.21.2` |
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.220.0` -> `v3.223.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.224.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.224.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.223.0...v3.224.0)

##### 3.224.0 (2026-02-26)

##### Features

- \[backend/diy] Add zstd compression option for DIY backend state files
[#&#8203;21877](https://redirect.github.com/pulumi/pulumi/pull/21877)

- \[engine] Automatically make invoke outputs secret when there is a
secret input, and the invoke provider does not support secrets

- \[cli/package] Support source-based packages in `pulumi schema check`,
not just schema files
[#&#8203;21897](https://redirect.github.com/pulumi/pulumi/pull/21897)

##### Bug Fixes

-   \[pkg] Correct the schema for "pulumi:pulumi:StackReference"
[#&#8203;21895](https://redirect.github.com/pulumi/pulumi/pull/21895)

- \[programgen/nodejs] Correct the semantics of singleOrNone in
generated files
[#&#8203;21947](https://redirect.github.com/pulumi/pulumi/pull/21947)

- \[sdk/python] Fix `StepEventMetadata.from_json` reading
`detailed_diff` (snake_case) instead of `detailedDiff` (camelCase), and
`PolicyEvent.from_json` reading `resource_urn` instead of `resourceUrn`,
causing both fields to always be `None`
[#&#8203;21714](https://redirect.github.com/pulumi/pulumi/pull/21714)

-   \[sdk/python] Convert integer component inputs to `int`
[#&#8203;21944](https://redirect.github.com/pulumi/pulumi/pull/21944)

-   \[sdk/python] Fix crash in forked processes using automation API
[#&#8203;21937](https://redirect.github.com/pulumi/pulumi/pull/21937)

- \[engine] Fix panic when a new component resource in the program is
not targeted
[#&#8203;21957](https://redirect.github.com/pulumi/pulumi/pull/21957)

##### Miscellaneous

-   \[sdk] Update java, dotnet & yaml
[#&#8203;21961](https://redirect.github.com/pulumi/pulumi/pull/21961)

- \[sdk/python] Improve the performance of `contains_unknowns` for large
objects
[#&#8203;21893](https://redirect.github.com/pulumi/pulumi/pull/21893)

###
[`v3.223.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32230-2026-02-19)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.222.0...v3.223.0)

##### Bug Fixes

-   \[engine] Report policy pack installation errors
[#&#8203;21882](https://redirect.github.com/pulumi/pulumi/pull/21882)

###
[`v3.222.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32220-2026-02-18)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.221.0...v3.222.0)

##### Features

-   \[programgen/go] Generate Call requests
[#&#8203;21836](https://redirect.github.com/pulumi/pulumi/pull/21836)

##### Bug Fixes

- \[sdk/{nodejs,python}] Fix hang when loading policy packs that use
v1.18.1 or older of the policy SDK
[#&#8203;21866](https://redirect.github.com/pulumi/pulumi/pull/21866)

</details>

<details>
<summary>pulumi/pulumi-docker-build
(github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild)</summary>

###
[`v0.0.15`](https://redirect.github.com/pulumi/pulumi-docker-build/compare/v0.0.14...v0.0.15)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-docker-build/compare/v0.0.14...v0.0.15)

###
[`v0.0.14`](https://redirect.github.com/pulumi/pulumi-docker-build/compare/v0.0.13...v0.0.14)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-docker-build/compare/v0.0.13...v0.0.14)

###
[`v0.0.13`](https://redirect.github.com/pulumi/pulumi-docker-build/releases/tag/v0.0.13)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-docker-build/compare/v0.0.12...v0.0.13)

#### What's Changed

- Improve exec error messages by
[@&#8203;blampe](https://redirect.github.com/blampe) in
[https://github.com/pulumi/pulumi-docker-build/pull/553](https://redirect.github.com/pulumi/pulumi-docker-build/pull/553)
- Update p-go-provider to fix version replacement behavior by
[@&#8203;blampe](https://redirect.github.com/blampe) in
[https://github.com/pulumi/pulumi-docker-build/pull/584](https://redirect.github.com/pulumi/pulumi-docker-build/pull/584)

**Full Changelog**:
https://github.com/pulumi/pulumi-docker-build/compare/v0.0.12...v0.0.13

</details>

<details>
<summary>pulumi/pulumi-dotnet
(github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3)</summary>

###
[`v3.101.2`](https://redirect.github.com/pulumi/pulumi-dotnet/blob/HEAD/CHANGELOG.md#v31012---2026-02-25)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-dotnet/compare/v3.101.0...v3.101.2)

</details>

<details>
<summary>pulumi/pulumi-java
(github.com/pulumi/pulumi-java/pkg)</summary>

###
[`v1.21.2`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#vv1212---2026-02-25)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.21.1...v1.21.2)

###
[`v1.21.1`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#vv1211---2026-02-25)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.21.0...v1.21.1)

##### Bug Fixes

- \[runtime] Fix `unknown provider package` error in automation API and
correctly propagate errors from inline programs.
[#&#8203;2029](https://redirect.github.com/pulumi/pulumi-java/pull/2029)

###
[`v1.21.0`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#vv1210---2026-01-28)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.20.0...v1.21.0)

##### Improvements

- \[sdk] Add Deployment.requirePulumiVersion
[#&#8203;1979](https://redirect.github.com/pulumi/pulumi-java/pull/1979)

- \[codegen] Implement alias resource options generation
[#&#8203;1982](https://redirect.github.com/pulumi/pulumi-java/pull/1982)

##### Bug Fixes

- \[codegen] Use config.require in codegen when there is no default
value
[#&#8203;1983](https://redirect.github.com/pulumi/pulumi-java/pull/1983)

###
[`v1.20.0`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#vv1200---2025-12-29)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.19.0...v1.20.0)

##### Improvements

- \[sdk] Add support for the `replacementTrigger` resource option
[#&#8203;1958](https://redirect.github.com/pulumi/pulumi-java/pull/1958)

###
[`v1.19.0`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1190---2025-12-10)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.18.0...v1.19.0)

##### Improvements

- \[codegen] Add .gitattributes file to generated SDKs
[#&#8203;1949](https://redirect.github.com/pulumi/pulumi-java/pull/1949)

##### Bug Fixes

- \[language] Stop parsing runtime options at startup
[#&#8203;1947](https://redirect.github.com/pulumi/pulumi-java/pull/1947)

###
[`v1.18.0`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1180---2025-12-03)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.17.1...v1.18.0)

##### Improvements

-   \[sdk] Add `ReplaceWith` as a resource option

###
[`v1.17.1`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1171---2025-11-26)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.17.0...v1.17.1)

##### Improvements

-   \[sdk] Dependency bumps

###
[`v1.17.0`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1170---2025-11-12)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.16.3...v1.17.0)

##### Improvements

- \[sdk] Get the event log in the automation API over gRPC, instead of
through a text file

###
[`v1.16.3`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1163---2025-11-05)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.16.2...v1.16.3)

##### Improvements

-   \[sdk] Update pulumi pkg & sdk to 3.205.0
-   \[runtime] Implement `Language.Link`

###
[`v1.16.2`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1162---2025-10-10)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.16.1...v1.16.2)

##### Bug Fixes

-   \[sdk] Add `hideDiffs` as a new resource option. See details

###
[`v1.16.1`](https://redirect.github.com/pulumi/pulumi-java/blob/HEAD/CHANGELOG.md#v1161---2025-07-31)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-java/compare/v1.16.0...v1.16.1)

##### Bug Fixes

-   \[codegen] Fix generated 'plan' argument of 'preview' command

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-02-26 21:24:50 +00:00
pulumi-provider-automation[bot]
7a9b31c60f Update GitHub Actions workflows. (#777)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[599b3ade95c3408830d062a38ea7cf9c8607a12f](599b3ade95).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-26 06:00:24 +00:00
Pulumi Bot
e5da099be4 Upgrade to golangci-lint v2 (#775)
Upgrades golangci-lint from v1 to v2. Automated by Linear issue IT-144.

Co-authored-by: CI <ci@pulumi.com>
2026-02-25 12:40:02 -08:00
pulumi-provider-automation[bot]
1b95d18edc Update GitHub Actions workflows. (#773)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[b8b29dc51d452160accc76a310efd6eb38760b50](b8b29dc51d).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-24 06:01:23 +00:00
pulumi-provider-automation[bot]
5eabae0608 Update GitHub Actions workflows. (#772)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[f591fbcab3c096e497ab858d7155b31b12495ed1](f591fbcab3).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-20 05:57:28 +00:00
pulumi-provider-automation[bot]
583183d5e6 Update GitHub Actions workflows. (#768)
This PR was triggered by @t0yv0 generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit
[cf7cafe004bfe263736eb8a33fbeead26cc57b58](cf7cafe004).

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-18 06:02:18 +00:00
pulumi-renovate[bot]
a30d557dc3 Update dependency @pulumi/pulumi to v3.221.0 (#767)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.220.0` ->
`3.221.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.220.0/3.221.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.221.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.221.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.220.0...v3.221.0)

#### 3.221.0 (2026-02-17)

##### Features

-   \[auto] Support Go 1.26
[#&#8203;21835](https://redirect.github.com/pulumi/pulumi/pull/21835)

- \[engine] BREAKING: Rename `pulumiVersionRange` to
`requiredPulumiVersion` in `PulumiPlugin.yaml`
[#&#8203;21807](https://redirect.github.com/pulumi/pulumi/pull/21807)

-   \[cli/plugin] Reduce GitHub API usage when downloading plugins
[#&#8203;21774](https://redirect.github.com/pulumi/pulumi/pull/21774)

-   \[protobuf] Add loader_target to RunPluginRequest
[#&#8203;21763](https://redirect.github.com/pulumi/pulumi/pull/21763)

-   \[sdk/nodejs] Support enums when inferring schemas from components
[#&#8203;21787](https://redirect.github.com/pulumi/pulumi/pull/21787)

- \[sdk/nodejs] Support the Partial<T> utility type in component schema
inference
[#&#8203;21802](https://redirect.github.com/pulumi/pulumi/pull/21802)

- \[sdk/nodejs] Support the Required<T> utility type in component schema
inference
[#&#8203;21803](https://redirect.github.com/pulumi/pulumi/pull/21803)

##### Bug Fixes

-   \[cli] Make stack graph output deterministic
[#&#8203;21786](https://redirect.github.com/pulumi/pulumi/pull/21786)

- \[engine] Fix snapshot integrity error in `refresh --run-program` with
component resources
[#&#8203;21806](https://redirect.github.com/pulumi/pulumi/pull/21806)

-   \[engine] Fix race in refresh --run-program
[#&#8203;21815](https://redirect.github.com/pulumi/pulumi/pull/21815)

-   \[programgen/go] Correctly handle import paths for nested modules
[#&#8203;21812](https://redirect.github.com/pulumi/pulumi/pull/21812)

- \[sdkgen] Support type references to parameterized and third-party
packages
[#&#8203;21804](https://redirect.github.com/pulumi/pulumi/pull/21804)

-   \[sdkgen/go] Do not depend on pulumix against instructions for enums
[#&#8203;21818](https://redirect.github.com/pulumi/pulumi/pull/21818)

- \[cli/{install,package}] Don't panic when a non-absolute path is
passed to `pulumi package get-schema` where the PulumiPlugin.yaml has a
packages section
[#&#8203;21794](https://redirect.github.com/pulumi/pulumi/pull/21794)

-   \[cli/{install,package}] Only link a Pulumi project once
[#&#8203;21788](https://redirect.github.com/pulumi/pulumi/pull/21788)

- \[cli/{install,package}] Run in the correct location when using `uv`
to link python packages
[#&#8203;21796](https://redirect.github.com/pulumi/pulumi/pull/21796)

-   \[cli/package] Allow underscores in the path of plugin URLs
[#&#8203;21778](https://redirect.github.com/pulumi/pulumi/pull/21778)

- \[sdk/{nodejs,python}] Use new policy plugin support to run policy
packs
[#&#8203;21684](https://redirect.github.com/pulumi/pulumi/pull/21684)

-   \[sdk/python] Surface errors from uv, poetry or pip during linking
[#&#8203;21770](https://redirect.github.com/pulumi/pulumi/pull/21770)

- \[sdk/python] Always surface errors from uv, poetry or pip during
dependency installation
[#&#8203;21814](https://redirect.github.com/pulumi/pulumi/pull/21814)

-   \[sdkgen/python] Add missing blank line before :param lists
[#&#8203;21789](https://redirect.github.com/pulumi/pulumi/pull/21789)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-02-18 01:31:26 +00:00
Bryce Lampe
710f5d816b Remove unnecessary envOverride (#766)
Our DockerHub password is in ESC, and a bunch of the other variables
were copy-pasted defaults. We need to keep GCP because that isn't in
ESC yet.

Refs https://github.com/pulumi/ci-mgmt/issues/1583.
2026-02-13 15:57:47 -08:00
pulumi-provider-automation[bot]
6aa0b4dde7 Update GitHub Actions workflows. (#765)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit ee5e1047ced9aa4de854f25974720cb5d4243799.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-13 06:04:28 +00:00
Alberto Pose
13a14388f2 Fix workflow failure by ensuring bin directory exists (#762)
# **Note: This is a temporary fix until we get this to `ci-mgmt`**

## Summary
Fixes the GoReleaser workflow failure that started on Feb 6, 2026.

## Root Cause
Commit 491f7de deleted `bin/pulumi-language-python-exec`, which was the
last file in the `bin/` directory. Since Git doesn't track empty
directories, the `bin/` directory disappeared from the repository.

When GoReleaser runs the post-build hook `make
sign-goreleaser-exe-amd64`, it attempts to download `jsign-6.0.jar` to
`bin/jsign-6.0.jar`, but fails with:
```
bin/jsign-6.0.jar: No such file or directory
make: *** [Makefile:260: bin/jsign-6.0.jar] Error 1
```

## Changes
Added `@mkdir -p bin` to Makefile targets that write to the `bin/`
directory:
- `bin/jsign-6.0.jar` target (line 260) - **Critical fix**
- `bin/pulumi-gen-${PACK}` target (line 185) - Defensive fix

This ensures the directory exists before attempting to create files in
it.

Fixes #756

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-02-11 15:31:19 +00:00
pulumi-renovate[bot]
13acd934b6 Update first-party Pulumi dependencies (#760)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/pulumi/esc](https://redirect.github.com/pulumi/esc) |
indirect | minor | `v0.21.0` -> `v0.22.0` |
|
[github.com/pulumi/pulumi/pkg/v3](https://redirect.github.com/pulumi/pulumi)
| require | minor | `v3.219.0` -> `v3.220.0` |

---

### Release Notes

<details>
<summary>pulumi/esc (github.com/pulumi/esc)</summary>

###
[`v0.22.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.22.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.21.0...v0.22.0)

##### Improvements

##### Bug Fixes

##### Breaking changes

</details>

<details>
<summary>pulumi/pulumi (github.com/pulumi/pulumi/pkg/v3)</summary>

###
[`v3.220.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.220.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0)

##### 3.220.0 (2026-02-10)

##### Features

- \[cli] Show environment variables that were set if a snapshot
integrity error happens
[#&#8203;21709](https://redirect.github.com/pulumi/pulumi/pull/21709)

- \[cli/{install,package}] Use the Pulumi Cloud Registry by default to
resolve package names

-   \[engine] Pass replacement trigger through to Construct
[#&#8203;21408](https://redirect.github.com/pulumi/pulumi/pull/21408)

- \[engine] Add EnvVarMappings resource option for provider resources,
allowing environment variables to be remapped before being passed to the
provider
[#&#8203;21572](https://redirect.github.com/pulumi/pulumi/pull/21572)

- \[pkg] BREAKING: Deprecate
github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of
github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This
package will be removed from pulumi/pulumi soon!
[#&#8203;21720](https://redirect.github.com/pulumi/pulumi/pull/21720)

##### Bug Fixes

- \[cli] Retry `yarn install` when it fails (e.g. during `pulumi
install`)
[#&#8203;21707](https://redirect.github.com/pulumi/pulumi/pull/21707)

-   \[engine] Deal with errors in elided journal entries correctly
[#&#8203;21576](https://redirect.github.com/pulumi/pulumi/pull/21576)

- \[sdk/nodejs] Fix remote components with
PULUMI_NODEJS_SKIP_COMPONENT_INPUTS

- \[sdk/python] Fix `_LazyModule` to not trigger full module load for
introspection attributes
[#&#8203;21620](https://redirect.github.com/pulumi/pulumi/pull/21620)

- \[sdkgen/python] Remove workaround for slow typechecking with MyPy and
PyCharm
[#&#8203;21722](https://redirect.github.com/pulumi/pulumi/pull/21722)

##### Miscellaneous

- \[cli] Write logfile location if verbosity is >= 1 to stderr instead
of stdout
[#&#8203;21663](https://redirect.github.com/pulumi/pulumi/pull/21663)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
Co-authored-by: Ian Wahbe <me@iwahbe.com>
2026-02-11 10:27:46 +00:00
pulumi-provider-automation[bot]
8cb8d21332 Update GitHub Actions workflows. (#761)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f34bb277a6b5001ebd945cebced51ef890cdb7b9.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-11 06:04:08 +00:00
pulumi-renovate[bot]
c11144e1b3 Update dependency @pulumi/pulumi to v3.220.0 (#759)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.219.0` ->
`3.220.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.219.0/3.220.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.220.0`](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.219.0...v3.220.0)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-02-10 17:51:07 +00:00
pulumi-renovate[bot]
ca8a59a077 Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (#758)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/go-git/go-git/v5](https://redirect.github.com/go-git/go-git)
| indirect | patch | `v5.16.0` -> `v5.16.5` |

### GitHub Vulnerability Alerts

####
[CVE-2026-25934](https://redirect.github.com/go-git/go-git/security/advisories/GHSA-37cx-329c-33x3)

### Impact 

A vulnerability was discovered in `go-git` whereby data integrity values
for `.pack` and `.idx` files were not properly verified. This resulted
in `go-git` potentially consuming corrupted files, which would likely
result in unexpected errors such as `object not found`.

For context, clients fetch
[`packfiles`](https://git-scm.com/docs/pack-protocol#_packfile_data)
from upstream Git servers. Those files contain a checksum of their
contents, so that clients can perform integrity checks before consuming
it. The pack indexes (`.idx`) are
[generated](https://git-scm.com/docs/pack-format) locally by `go-git`,
or the `git` cli, when new `.pack` files are received and processed. The
integrity checks for both files were not being verified correctly.

Note that the lack of verification of the packfile checksum has no
impact on the trust relationship between the client and server, which is
enforced based on the protocol being used (e.g. TLS in the case of
`https://` or known hosts for `ssh://`). In other words, the packfile
checksum verification does not provide any security benefits when
connecting to a malicious or compromised Git server.

### Patches

Users should upgrade to `v5.16.5`, or the latest `v6`
[pseudo-version](https://go.dev/ref/mod#pseudo-versions), in order to
mitigate this vulnerability.

### Workarounds

In case updating to a fixed version of `go-git` is not possible, users
can run [git fsck](https://git-scm.com/docs/git-fsck) from the `git` cli
to check for data corruption on a given repository.

### Credit

Thanks @&#8203;N0zoM1z0 for finding and reporting this issue privately
to the `go-git` project.

---

### Release Notes

<details>
<summary>go-git/go-git (github.com/go-git/go-git/v5)</summary>

###
[`v5.16.5`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.5)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.4...v5.16.5)

##### What's Changed

- build: Update module golang.org/x/crypto to v0.45.0 \[SECURITY]
(releases/v5.x) by
[@&#8203;go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in[https://github.com/go-git/go-git/pull/1744](https://redirect.github.com/go-git/go-git/pull/1744)4
- build: Bump Go test versions to 1.23-1.25 (v5) by
[@&#8203;pjbgf](https://redirect.github.com/pjbgf) in
[https://github.com/go-git/go-git/pull/1746](https://redirect.github.com/go-git/go-git/pull/1746)
- \[v5] git: worktree, Don't delete local untracked files when resetting
worktree by [@&#8203;Ch00k](https://redirect.github.com/Ch00k) in
[https://github.com/go-git/go-git/pull/1800](https://redirect.github.com/go-git/go-git/pull/1800)
- Expand packfile checks by
[@&#8203;pjbgf](https://redirect.github.com/pjbgf) in
[https://github.com/go-git/go-git/pull/1836](https://redirect.github.com/go-git/go-git/pull/1836)

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5

###
[`v5.16.4`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.4)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.3...v5.16.4)

##### What's Changed

- backport plumbing: format/idxfile, prevent panic by
[@&#8203;swills](https://redirect.github.com/swills) in
[https://github.com/go-git/go-git/pull/1732](https://redirect.github.com/go-git/go-git/pull/1732)
- \[backport] build: test, Fix build on Windows. by
[@&#8203;pjbgf](https://redirect.github.com/pjbgf) in
[https://github.com/go-git/go-git/pull/1734](https://redirect.github.com/go-git/go-git/pull/1734)
- build: Update module golang.org/x/net to v0.38.0 \[SECURITY]
(releases/v5.x) by
[@&#8203;go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in[https://github.com/go-git/go-git/pull/1742](https://redirect.github.com/go-git/go-git/pull/1742)2
- build: Update module github.com/cloudflare/circl to v1.6.1 \[SECURITY]
(releases/v5.x) by
[@&#8203;go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in[https://github.com/go-git/go-git/pull/1741](https://redirect.github.com/go-git/go-git/pull/1741)1
- build: Update module github.com/go-git/go-git/v5 to v5.13.0
\[SECURITY] (releases/v5.x) by
[@&#8203;go-git-renovate](https://redirect.github.com/go-git-renovate)\[bot]
in[https://github.com/go-git/go-git/pull/1743](https://redirect.github.com/go-git/go-git/pull/1743)3

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4

###
[`v5.16.3`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.3)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.2...v5.16.3)

##### What's Changed

- internal: Expand regex to fix build \[5.x] by
[@&#8203;baloo](https://redirect.github.com/baloo) in
[https://github.com/go-git/go-git/pull/1644](https://redirect.github.com/go-git/go-git/pull/1644)
- build: raise timeouts for windows CI tests and disable CIFuzz \[5.x]
by [@&#8203;baloo](https://redirect.github.com/baloo) in
[https://github.com/go-git/go-git/pull/1646](https://redirect.github.com/go-git/go-git/pull/1646)
- plumbing: support commits extra headers, support jujutsu signed commit
\[5.x] by [@&#8203;baloo](https://redirect.github.com/baloo) in
[https://github.com/go-git/go-git/pull/1633](https://redirect.github.com/go-git/go-git/pull/1633)

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3

###
[`v5.16.2`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.2)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.1...v5.16.2)

##### What's Changed

- utils: fix diff so subpaths work for sparse checkouts, fixes 1455 to
releases/v5.x by [@&#8203;kane8n](https://redirect.github.com/kane8n) in
[https://github.com/go-git/go-git/pull/1567](https://redirect.github.com/go-git/go-git/pull/1567)

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2

###
[`v5.16.1`](https://redirect.github.com/go-git/go-git/releases/tag/v5.16.1)

[Compare
Source](https://redirect.github.com/go-git/go-git/compare/v5.16.0...v5.16.1)

##### What's Changed

- utils: merkletrie, Fix diff on sparse-checkout index. Fixes
[#&#8203;1406](https://redirect.github.com/go-git/go-git/issues/1406) to
releases/v5.x by [@&#8203;kane8n](https://redirect.github.com/kane8n) in
[https://github.com/go-git/go-git/pull/1561](https://redirect.github.com/go-git/go-git/pull/1561)

##### New Contributors

- [@&#8203;kane8n](https://redirect.github.com/kane8n) made their first
contribution in
[https://github.com/go-git/go-git/pull/1561](https://redirect.github.com/go-git/go-git/pull/1561)

**Full Changelog**:
https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2026-02-10 00:50:46 +00:00
Bryce Lampe
5b05d733ea Fix lint issues (#755)
Lint fixes in preparation of
https://github.com/pulumi/ci-mgmt/pull/2024.
2026-02-06 22:08:57 +00:00
pulumi-renovate[bot]
e9f6bbf15d Update first-party Pulumi dependencies (#717)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.212.0` ->
`3.219.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.212.0/3.219.0)
|
| [github.com/pulumi/esc](https://redirect.github.com/pulumi/esc) |
indirect | minor | `v0.20.0` -> `v0.21.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.219.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32190-2026-02-05)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.218.0...v3.219.0)

##### Features

-   \[cli] Allow setting `requiredPulumiVersion` in Pulumi.yaml
[#&#8203;21627](https://redirect.github.com/pulumi/pulumi/pull/21627)

- \[cli/{install,package}] Allow using private packages as local
dependencies in components
[#&#8203;21664](https://redirect.github.com/pulumi/pulumi/pull/21664)

-   \[cli/policy] Add `pulumi policy install` command
[#&#8203;21652](https://redirect.github.com/pulumi/pulumi/pull/21652)

-   \[engine] Run analyzer calls in parallel
[#&#8203;21631](https://redirect.github.com/pulumi/pulumi/pull/21631)

-   \[programgen/dotnet] Codegen RequirePulumiVersion for Dotnet
[#&#8203;21621](https://redirect.github.com/pulumi/pulumi/pull/21621)

-   \[sdk/python] Add support for the `OnError` resource hook
[#&#8203;21644](https://redirect.github.com/pulumi/pulumi/pull/21644)

-   \[sdk/python] Add support for protobuf 6
[#&#8203;21647](https://redirect.github.com/pulumi/pulumi/pull/21647)

##### Bug Fixes

-   \[cli] Allow positional arguments to be passed to `convert` again
[#&#8203;21604](https://redirect.github.com/pulumi/pulumi/pull/21604)
[#&#8203;21614](https://redirect.github.com/pulumi/pulumi/pull/21614)

- \[engine] Download/install required policy packs in parallel with
plugins
[#&#8203;21651](https://redirect.github.com/pulumi/pulumi/pull/21651)

- \[cli/package] Correctly install packages that depend on other
packages for `pulumi package add` and `pulumi package get-schema`.
[#&#8203;21321](https://redirect.github.com/pulumi/pulumi/pull/21321)

- \[programgen/python] Fix panic when ranging over a resource output
that is an array of objects
[#&#8203;21679](https://redirect.github.com/pulumi/pulumi/pull/21679)

- \[sdk/python] Fix issue with generic subclasses of `dynamic.Resource`
[#&#8203;21670](https://redirect.github.com/pulumi/pulumi/pull/21670)

##### Miscellaneous

-   \[sdk/python] Relax pip version constraint
[#&#8203;21639](https://redirect.github.com/pulumi/pulumi/pull/21639)

###
[`v3.218.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32180-2026-01-29)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.217.1...v3.218.0)

##### Features

-   \[sdk/nodejs] Add support for the `OnError` resource hook

##### Bug Fixes

-   \[cli] Allow positional arguments to be passed to `convert` again

- \[cli/install] Correctly include git forge organizations as schema
namespaces when generating SDKs
[#&#8203;21579](https://redirect.github.com/pulumi/pulumi/pull/21579)

- \[cli/{install,package}] Correctly grab package names for Python &
NodeJS
[#&#8203;21577](https://redirect.github.com/pulumi/pulumi/pull/21577)

###
[`v3.217.1`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32171-2026-01-27)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.217.0...v3.217.1)

##### Features

-   \[sdk/go] Add support for the `OnError` resource hook
[#&#8203;21515](https://redirect.github.com/pulumi/pulumi/pull/21515)

##### Bug Fixes

- \[cli/install] Copy files when linking to be robust to copying across
file partitions
[#&#8203;21549](https://redirect.github.com/pulumi/pulumi/pull/21549)

- \[cli/install] Do not double install plugins with explicit
parameterizations
[#&#8203;21548](https://redirect.github.com/pulumi/pulumi/pull/21548)

-   \[cli/install] Copy files when linking instead of renaming
[#&#8203;21549](https://redirect.github.com/pulumi/pulumi/pull/21549)

**Full Changelog**:
https://github.com/pulumi/pulumi/compare/v3.217.0...v3.217.1

###
[`v3.217.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32170-2026-01-23)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.216.0...v3.217.0)

##### Features

- \[cli] Extract organization, team, and user from OIDC JWT claims
during login
[#&#8203;21462](https://redirect.github.com/pulumi/pulumi/pull/21462)

- \[engine] Add the `OnError` resource hook to allow for custom retry
policies
[#&#8203;21291](https://redirect.github.com/pulumi/pulumi/pull/21291)

-   \[cli/engine] Add --plan up flag
[#&#8203;21368](https://redirect.github.com/pulumi/pulumi/pull/21368)

-   \[sdk/nodejs] Add requirePulumiVersion to the Node.js SDK
[#&#8203;21528](https://redirect.github.com/pulumi/pulumi/pull/21528)
[#&#8203;21478](https://redirect.github.com/pulumi/pulumi/pull/21478)

-   \[sdk/python] Add require_pulumi_version to the Python SDK
[#&#8203;21528](https://redirect.github.com/pulumi/pulumi/pull/21528)
[#&#8203;21430](https://redirect.github.com/pulumi/pulumi/pull/21430)

-   \[sdk/go] Add CheckPulumiVersion to the Go SDK
[#&#8203;21528](https://redirect.github.com/pulumi/pulumi/pull/21528)
[#&#8203;21514](https://redirect.github.com/pulumi/pulumi/pull/21514)

##### Bug Fixes

-   \[auto/python] Implement `About` in Python automation API server
[#&#8203;21479](https://redirect.github.com/pulumi/pulumi/pull/21479)

- \[engine] When importing a state file that refers to the service
backed secret manager, make `stack import` reconfigure it for the target
stack if required
[#&#8203;20966](https://redirect.github.com/pulumi/pulumi/pull/20966)

- \[protobuf] Fix alias options being passed to Construct for remote
components
[#&#8203;21050](https://redirect.github.com/pulumi/pulumi/pull/21050)

-   \[sdk/nodejs] Fix issue with serialized async generators
[#&#8203;21484](https://redirect.github.com/pulumi/pulumi/pull/21484)

###
[`v3.216.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32160-2026-01-16)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.215.0...v3.216.0)

##### Features

-   \[build] Don't set PULUMI_ROOT with mise
[#&#8203;21457](https://redirect.github.com/pulumi/pulumi/pull/21457)

-   \[cli] Default to Pulumi Cloud when using an OIDC token for login
[#&#8203;21322](https://redirect.github.com/pulumi/pulumi/pull/21322)

-   \[engine] Add CheckPulumiVersion RPC to the engine
[#&#8203;21429](https://redirect.github.com/pulumi/pulumi/pull/21429)

-   \[protobuf] Remove ProviderHandshakeResponse.pulumi_version_range
[#&#8203;21438](https://redirect.github.com/pulumi/pulumi/pull/21438)

- \[sdk/nodejs] Allow dynamic providers to return inputs from read() for
accurate diffs after refresh
[#&#8203;21315](https://redirect.github.com/pulumi/pulumi/pull/21315)

-   \[sdk/nodejs] Add support for serializing async generators
[#&#8203;21410](https://redirect.github.com/pulumi/pulumi/pull/21410)

- \[sdk/python] Allow dynamic providers to return inputs from read() for
accurate diffs after refresh
[#&#8203;21315](https://redirect.github.com/pulumi/pulumi/pull/21315)

##### Bug Fixes

-   \[engine] Optimize StackReference performance
[#&#8203;21446](https://redirect.github.com/pulumi/pulumi/pull/21446)

-   \[cli/display] Fix message renderer on windows
[#&#8203;21401](https://redirect.github.com/pulumi/pulumi/pull/21401)

- \[sdk/nodejs] Fix RangeError in defaultErrorMessage when error objects
are large
[#&#8203;21409](https://redirect.github.com/pulumi/pulumi/pull/21409)

##### Miscellaneous

-   \[sdk/dotnet] Update dotnet to v3.97.0

###
[`v3.215.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32150-2026-01-07)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.214.1...v3.215.0)

##### Features

- \[cli/plugin] Allow plugins to specify a supported version range for
the CLI
[#&#8203;21335](https://redirect.github.com/pulumi/pulumi/pull/21335)

##### Bug Fixes

-   \[cli] Filter internal properties like \__defaults from diff display
[#&#8203;21359](https://redirect.github.com/pulumi/pulumi/pull/21359)

- \[cli/config] Make `config set --type bool` accept different spellings
of boolean values instead of only lowercase "true"
[#&#8203;21314](https://redirect.github.com/pulumi/pulumi/pull/21314)

- \[sdk/python] Fix import_resources with converter failing due to
--stack argument placement
[#&#8203;21373](https://redirect.github.com/pulumi/pulumi/pull/21373)

##### Miscellaneous

-   \[cli] Update pulumi-dotnet to 3.96.1

-   \[cli/package] Remove superfluous version string
[#&#8203;21351](https://redirect.github.com/pulumi/pulumi/pull/21351)

###
[`v3.214.1`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32141-2026-01-03)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.214.0...v3.214.1)

##### Bug Fixes

- \[cli/package] Preserve existing behavior when `pulumi package add` is
used with a local provider
[#&#8203;21350](https://redirect.github.com/pulumi/pulumi/pull/21350)

- \[pkg] Create namespace aliases to avoid Pulumi namespace collisions
during codegen
[#&#8203;21325](https://redirect.github.com/pulumi/pulumi/pull/21325)

###
[`v3.214.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32140-2025-12-30)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.213.0...v3.214.0)

##### Features

-   \[cli] Add --config and --config-path options to destroy and refresh
[#&#8203;21299](https://redirect.github.com/pulumi/pulumi/pull/21299)

- \[sdkgen] Add `OutputStyleOnly` flag to functions to not emit their
plain variants
[#&#8203;21198](https://redirect.github.com/pulumi/pulumi/pull/21198)

- \[sdk/python] Add support for `replacement_trigger` in the Python SDK
[#&#8203;20940](https://redirect.github.com/pulumi/pulumi/pull/20940)

##### Bug Fixes

- \[engine] Pass ignoreChanges when issuing no-diff updates that resolve
initErrors
[#&#8203;21319](https://redirect.github.com/pulumi/pulumi/pull/21319)

- \[programgen] Fix a bug in programgen binding to invokes from
parameterized packages
[#&#8203;21284](https://redirect.github.com/pulumi/pulumi/pull/21284)

- \[cli/plugin] Fix plugin download URL overrides for fallback mechanism
[#&#8203;21095](https://redirect.github.com/pulumi/pulumi/pull/21095)

##### Miscellaneous

-   \[pkg] Upgrade pulumi-java to 1.20.0

###
[`v3.213.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32130-2025-12-17)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.212.0...v3.213.0)

##### Bug Fixes

- \[sdkgen/go] Generate three-level nested builtin output types for Go
SDK
[#&#8203;21248](https://redirect.github.com/pulumi/pulumi/pull/21248)

##### Miscellaneous

-   \[pkg] Move plugin downloading from pkg into sdk
[#&#8203;21220](https://redirect.github.com/pulumi/pulumi/pull/21220)

</details>

<details>
<summary>pulumi/esc (github.com/pulumi/esc)</summary>

###
[`v0.21.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.21.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.20.0...v0.21.0)

##### Improvements

- Added support for `fn::split` built-in function to split strings into
arrays.
    [#&#8203;281](https://redirect.github.com/pulumi/esc/issues/281)
- Add native support for OIDC token exchange when logging into Pulumi
Cloud. Run `esc login --help` for more
information.
[#&#8203;607](https://redirect.github.com/pulumi/esc/pull/607)

##### Bug Fixes

##### Breaking changes

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-02-06 21:06:05 +00:00
pulumi-renovate[bot]
491f7de7d5 Update module github.com/pulumi/pulumi-go-provider to v1.3.0 (#748)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/pulumi-go-provider](https://redirect.github.com/pulumi/pulumi-go-provider)
| require | minor | `v1.1.2` -> `v1.3.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi-go-provider
(github.com/pulumi/pulumi-go-provider)</summary>

###
[`v1.3.0`](https://redirect.github.com/pulumi/pulumi-go-provider/releases/tag/v1.3.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-go-provider/compare/v1.2.0...v1.3.0)

#### What's Changed

- Don't set a default value for `"displayName"` or `"namespace`" by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/452](https://redirect.github.com/pulumi/pulumi-go-provider/pull/452)
- Update module github.com/pulumi/pulumi/pkg/v3 to v3.217.0 by
[@&#8203;pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot]
in[https://github.com/pulumi/pulumi-go-provider/pull/464](https://redirect.github.com/pulumi/pulumi-go-provider/pull/464)4

#### New Contributors

-
[@&#8203;pulumi-renovate](https://redirect.github.com/pulumi-renovate)\[bot]
made their first contribution
in[https://github.com/pulumi/pulumi-go-provider/pull/427](https://redirect.github.com/pulumi/pulumi-go-provider/pull/427)7
- [@&#8203;Frassle](https://redirect.github.com/Frassle) made their
first contribution in
[https://github.com/pulumi/pulumi-go-provider/pull/455](https://redirect.github.com/pulumi/pulumi-go-provider/pull/455)

**Full Changelog**:
https://github.com/pulumi/pulumi-go-provider/compare/v1.2.0...v1.3.0

###
[`v1.2.0`](https://redirect.github.com/pulumi/pulumi-go-provider/releases/tag/v1.2.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi-go-provider/compare/v1.1.2...v1.2.0)

#### What's Changed

- Add old inputs to the rpc passthrough (and the provider in general) by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/414](https://redirect.github.com/pulumi/pulumi-go-provider/pull/414)
- Debug middleware/rpc by printing what the wrapped provider sees by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/415](https://redirect.github.com/pulumi/pulumi-go-provider/pull/415)
- `rpc.Provider` correctly handles wrapping providers without preview
support by [@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/416](https://redirect.github.com/pulumi/pulumi-go-provider/pull/416)
- Add an example of property comments for component resources by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/411](https://redirect.github.com/pulumi/pulumi-go-provider/pull/411)
- Use old inputs when calculating Diff for default infer by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/419](https://redirect.github.com/pulumi/pulumi-go-provider/pull/419)
- \[infer] Prevent deserialization errors with CustomDiff for Config by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/420](https://redirect.github.com/pulumi/pulumi-go-provider/pull/420)
- Fix `CustomDiff[*Config, *Config]` by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/421](https://redirect.github.com/pulumi/pulumi-go-provider/pull/421)
- Fix `GetSchema` by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/422](https://redirect.github.com/pulumi/pulumi-go-provider/pull/422)
- Correctly keep `DiffResponse`'s non-detailed diffs keys top-level by
[@&#8203;iwahbe](https://redirect.github.com/iwahbe) in
[https://github.com/pulumi/pulumi-go-provider/pull/417](https://redirect.github.com/pulumi/pulumi-go-provider/pull/417)

#### New Contributors

- [@&#8203;andrzejressel](https://redirect.github.com/andrzejressel)
made their first contribution in
[https://github.com/pulumi/pulumi-go-provider/pull/418](https://redirect.github.com/pulumi/pulumi-go-provider/pull/418)

**Full Changelog**:
https://github.com/pulumi/pulumi-go-provider/compare/v1.1.2...v1.2.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: Bryce Lampe <bryce@pulumi.com>
2026-02-06 20:48:41 +00:00
pulumi-provider-automation[bot]
f5d459e624 Update GitHub Actions workflows. (#751)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 62def83b594d72ccf4eab97cdf5b566ebb910e83.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-02-03 05:54:15 +00:00
pulumi-provider-automation[bot]
d5e5c8a482 Update GitHub Actions workflows. (#750)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f51ba6a8731f22e9b3cf35393bf9c792097e4aa1.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-30 19:09:44 +00:00
pulumi-renovate[bot]
d0bb326600 Update module github.com/pulumi/providertest to v0.6.0 (#749)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/pulumi/providertest](https://redirect.github.com/pulumi/providertest)
| require | minor | `v0.5.1-0.20251217173405-3861778549dd` -> `v0.6.0` |

---

### Release Notes

<details>
<summary>pulumi/providertest (github.com/pulumi/providertest)</summary>

###
[`v0.6.0`](https://redirect.github.com/pulumi/providertest/releases/tag/v0.6.0)

[Compare
Source](https://redirect.github.com/pulumi/providertest/compare/v0.5.1...v0.6.0)

##### What's Changed

- feat: Add local python SDK replacement option via pip by
[@&#8203;rshade](https://redirect.github.com/rshade) in
[https://github.com/pulumi/providertest/pull/150](https://redirect.github.com/pulumi/providertest/pull/150)

**Full Changelog**:
https://github.com/pulumi/providertest/compare/v0.5.1...v0.6.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2026-01-29 19:33:01 +00:00
pulumi-provider-automation[bot]
534bc6c172 Update GitHub Actions workflows. (#745)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 1131c4d395e39e42386bf9a4dfb975eb219d604b.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-29 05:54:00 +00:00
pulumi-provider-automation[bot]
570f83ca62 Update GitHub Actions workflows. (#743)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit a3bb44291e85389589513a73050a049a024bd800.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-28 05:43:20 +00:00
pulumi-provider-automation[bot]
b35af1d86d Update GitHub Actions workflows. (#742)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 5c1afa4cb1107d1ea52e86433fcd7d54b28925ab.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-26 16:00:41 +00:00
pulumi-provider-automation[bot]
62db1d7f3b Update GitHub Actions workflows. (#740)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit d825a77c6fb8405f61d1283d494a3a2c1cba3587.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-23 12:49:06 +00:00
pulumi-provider-automation[bot]
9b5a5d4371 Update GitHub Actions workflows. (#737)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 16d6357b115512b7bf916a73a75b78fa24fef858.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-16 05:39:51 +00:00
pulumi-provider-automation[bot]
8809a8c708 Update GitHub Actions workflows. (#735)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit dfe81431707efb057395e33fe5234f01031ecd95.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-15 05:40:12 +00:00
pulumi-provider-automation[bot]
cc1bda22e5 Update GitHub Actions workflows. (#734)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 329ced61750d1b5d3027894c5e0c79ac08f71378.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-13 05:38:49 +00:00
pulumi-provider-automation[bot]
f820f6547c Update GitHub Actions workflows. (#733)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit ea67003b42b286f2a9d25c2a5e878fc1aacf5c94.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2026-01-10 05:38:03 +00:00
pulumi-provider-automation[bot]
214793b929 Update GitHub Actions workflows. (#730)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 4cdb4b8cad405d730db594e8adb73ee1b875b4a6.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-30 05:45:22 +00:00
pulumi-provider-automation[bot]
9e8c685bc8 Update GitHub Actions workflows. (#728)
This PR was automatically generated by the
update-workflows-single-bridged-provider workflow in the pulumi/ci-mgmt
repo, from commit 021a1f6c9360e1b569457868b4c0c3ecbfc62ff4.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-23 19:01:30 +00:00
pulumi-provider-automation[bot]
09f7b32602 Update GitHub Actions workflows. (#727)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 6693889d5ebbe0416302e06ac701da21580fbd2d.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-23 15:40:07 +00:00
pulumi-provider-automation[bot]
1e00e5dc89 Update GitHub Actions workflows. (#724)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 90795a3949f95304f4bd3a9dea2ace1ca3465403.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-23 05:44:49 +00:00
pulumi-provider-automation[bot]
93fae0c1a4 Update GitHub Actions workflows. (#723)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 1901fce160a37d0c537d831ce6f96e72bf7c9427.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-20 05:44:19 +00:00
pulumi-provider-automation[bot]
4c85816954 Update GitHub Actions workflows. (#721)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 217fd547b64df90c7919b206f17362d4baec9aa3.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-19 20:07:45 +00:00
pulumi-provider-automation[bot]
4e3830ca83 Update GitHub Actions workflows. (#720)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 0b04a21b810fd7b4a412c1f42867a70f65c14758.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-19 05:44:14 +00:00
pulumi-provider-automation[bot]
3f329778cf Update GitHub Actions workflows. (#718)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f0ec8c55b928cc870e533b367aaba1f9af2330ad.

Co-authored-by: Pulumi Bot <bot@pulumi.com>
2025-12-18 05:44:56 +00:00
pulumi-provider-automation[bot]
c64d5baba6 Update GitHub Actions workflows. (#716)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 02f02bb0bfe879d167ed8f335b4950208454bafb.

---------

Co-authored-by: Pulumi Bot <bot@pulumi.com>
Co-authored-by: Bryce Lampe <bryce@pulumi.com>
2025-12-17 18:20:54 +00:00
pulumi-renovate[bot]
4c8968185c Update dependency @pulumi/pulumi to v3.212.0 (#710)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.211.0` ->
`3.212.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.211.0/3.212.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.212.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.212.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.211.0...v3.212.0)

##### 3.212.0 (2025-12-12)

##### Bug Fixes

-   \[yaml] Update pulumi-yaml to v1.26.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-12-12 22:13:17 +00:00
pulumi-renovate[bot]
7a75efe8c4 Update dependency @pulumi/pulumi to v3.211.0 (#708)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.210.0` ->
`3.211.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.210.0/3.211.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.211.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.211.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.210.0...v3.211.0)

#### 3.211.0 (2025-12-11)

##### Features

- \[cli/about] Print Node.js package manager information in `pulumi
about`
[#&#8203;21163](https://redirect.github.com/pulumi/pulumi/pull/21163)

- \[backend/diy] Add stack tags support for DIY backends (S3, Postgres,
file-based, etc.).

DIY backends now support stack tags functionality, bringing feature
parity with cloud backends.
This includes:

-   Full CRUD operations for stack tags (create, read, update, delete)
-   Automatic system tag injection (e.g., `pulumi:project`)
-   Tag filtering support in stack listing operations
-   Backward compatibility with existing stacks (no tags file required)
-   Atomic operations with caching for performance
-   Automatic cleanup of tag files when stacks are deleted

Tags are stored as separate `.pulumi-tags` files alongside stack
checkpoints, using a versioned
JSON format. The implementation works across all DIY backend storage
types including S3, Azure Blob,
Google Cloud Storage, PostgreSQL, and local file systems.

Example usage:

```bash
pulumi stack tag set environment production
pulumi stack tag set owner backend-team
pulumi stack ls --tag-filter environment=production
```

[#&#8203;19882](https://redirect.github.com/pulumi/pulumi/pull/19882)

- \[backend/service] Improve startup performance with the service as
backend
[#&#8203;21176](https://redirect.github.com/pulumi/pulumi/pull/21176)

- \[sdk/nodejs] Add support for `replacement_trigger` in the NodeJS SDK
[#&#8203;20939](https://redirect.github.com/pulumi/pulumi/pull/20939)

-   \[sdk/python] Allow setting version for python component providers
[#&#8203;21149](https://redirect.github.com/pulumi/pulumi/pull/21149)

##### Bug Fixes

- \[cli/package] Correctly identify the innermost Project/Plugin when
running `pulumi package add`
[#&#8203;21137](https://redirect.github.com/pulumi/pulumi/pull/21137)

- \[engine] Allow referencing multiple git/github/gitlab components from
the same repo
[#&#8203;21119](https://redirect.github.com/pulumi/pulumi/pull/21119)

- \[programgen/go] Account for name conflicts in resource creation
functions
[#&#8203;21107](https://redirect.github.com/pulumi/pulumi/pull/21107)

- \[sdk/python] Fix cancellation handling in a few places in the python
language host
[#&#8203;21145](https://redirect.github.com/pulumi/pulumi/pull/21145)

- \[sdkgen/go] Fix generation of lifted single-value calls in
parameterized SDKs
[#&#8203;21115](https://redirect.github.com/pulumi/pulumi/pull/21115)

##### Miscellaneous

- \[cli] Don't attempt to re-install plugin dependencies on load failure
for plugins based on git with a nested path
[#&#8203;21148](https://redirect.github.com/pulumi/pulumi/pull/21148)

- \[sdk/{dotnet,java,yaml}] Bump language runtimes for dotnet, java, and
yaml
[#&#8203;21201](https://redirect.github.com/pulumi/pulumi/pull/21201)

-   \[cli/engine] Add language runtime metadata to update metadata
[#&#8203;21186](https://redirect.github.com/pulumi/pulumi/pull/21186)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-12-12 05:11:26 +00:00
pulumi-renovate[bot]
16f3939ae0 Update dependency @pulumi/pulumi to v3.210.0 (#694)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.209.0` ->
`3.210.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.209.0/3.210.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.210.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.210.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.209.0...v3.210.0)

#### 3.210.0 (2025-12-03)

##### Features

-   \[cli/about] Print python toolchain information in `pulumi about`

-   \[sdk/java] Update java to v1.18

- \[components/nodejs] Local components will use the version from
package.json rather than 0.0.0
[#&#8203;21100](https://redirect.github.com/pulumi/pulumi/pull/21100)

- \[cli/package] Add `pulumi package delete` command to delete package
versions from the Pulumi Registry
[#&#8203;21069](https://redirect.github.com/pulumi/pulumi/pull/21069)

- \[cli/package] Always print the schema first in `package get-schema`,
then print any binding errors
[#&#8203;21080](https://redirect.github.com/pulumi/pulumi/pull/21080)

-   \[sdk/python] Require `grpcio>=1.75.1` on Python 3.14
[#&#8203;21113](https://redirect.github.com/pulumi/pulumi/pull/21113)

##### Bug Fixes

- \[sdk/nodejs] Fix ComponentResources transfering input arguments to
output properties automatically
[#&#8203;21094](https://redirect.github.com/pulumi/pulumi/pull/21094)

##### Miscellaneous

- \[sdk/nodejs] Remove
[@&#8203;types/uuid](https://redirect.github.com/types/uuid) type
declarations dev dependency
[#&#8203;21077](https://redirect.github.com/pulumi/pulumi/pull/21077)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-12-03 21:28:06 +00:00
pulumi-renovate[bot]
31065543d9 Update dependency @pulumi/pulumi to v3.209.0 (#682)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.208.0` ->
`3.209.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.208.0/3.209.0)
|

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.209.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.209.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.208.0...v3.209.0)

##### 3.209.0 (2025-11-26)

##### Features

- \[cli] Add native support for OIDC token exchange when logging into
Pulumi Cloud. Run `pulumi login --help` for more information.
[#&#8203;20974](https://redirect.github.com/pulumi/pulumi/pull/20974)

-   \[sdk/python] Allow older grpcio and protobuf dependencies
[#&#8203;21007](https://redirect.github.com/pulumi/pulumi/pull/21007)

- \[sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and
.gitattributes files for generated SDKs
[#&#8203;21034](https://redirect.github.com/pulumi/pulumi/pull/21034)

##### Bug Fixes

- \[cli/install] Correctly install non-standard plugins.
See[https://github.com/pulumi/pulumi/issues/20953](https://redirect.github.com/pulumi/pulumi/issues/20953)3
for more information
[#&#8203;20983](https://redirect.github.com/pulumi/pulumi/pull/20983)

- \[cli/new] Create pyproject.toml for uv and poetry projects when using
--generate-only
[#&#8203;20979](https://redirect.github.com/pulumi/pulumi/pull/20979)

-   \[sdk/nodejs] Fix serialization errors due to SxS copies of the SDK
[#&#8203;21029](https://redirect.github.com/pulumi/pulumi/pull/21029)

-   \[sdk/python] Add `PropertyValue` runtime validation checks
[#&#8203;21058](https://redirect.github.com/pulumi/pulumi/pull/21058)

##### Miscellaneous

- \[engine] Don't send root directory and runtime options to language
plugins as command line arguments
[#&#8203;21054](https://redirect.github.com/pulumi/pulumi/pull/21054)

- \[sdk/{dotnet,java,yaml}] Bump language runtimes for yaml, dotnet and
java

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-11-26 16:17:55 +00:00
pulumi-renovate[bot]
68d5f3a0cb Update first-party Pulumi dependencies (#677)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [pulumi/esc-action](https://redirect.github.com/pulumi/esc-action) |
action | minor | `v1.4.0` -> `v1.5.0` |
|
[pulumi/provider-version-action](https://redirect.github.com/pulumi/provider-version-action)
| action | patch | `v1.6.0` -> `v1.6.1` |

---

### Release Notes

<details>
<summary>pulumi/esc-action (pulumi/esc-action)</summary>

###
[`v1.5.0`](https://redirect.github.com/pulumi/esc-action/releases/tag/v1.5.0)

[Compare
Source](https://redirect.github.com/pulumi/esc-action/compare/v1.4.0...v1.5.0)

- Fix line parsing when "=" is present
[https://github.com/pulumi/esc-action/pull/30](https://redirect.github.com/pulumi/esc-action/pull/30)

</details>

<details>
<summary>pulumi/provider-version-action
(pulumi/provider-version-action)</summary>

###
[`v1.6.1`](https://redirect.github.com/pulumi/provider-version-action/releases/tag/v1.6.1)

[Compare
Source](https://redirect.github.com/pulumi/provider-version-action/compare/v1.6.0...v1.6.1)

#### What's Changed

- Automate floating tag updates and document release process by
[@&#8203;EronWright](https://redirect.github.com/EronWright) in
[https://github.com/pulumi/provider-version-action/pull/17](https://redirect.github.com/pulumi/provider-version-action/pull/17)
- Update dependencies for v1.6.1 by
[@&#8203;EronWright](https://redirect.github.com/EronWright) in
[https://github.com/pulumi/provider-version-action/pull/18](https://redirect.github.com/pulumi/provider-version-action/pull/18)

#### New Contributors

- [@&#8203;EronWright](https://redirect.github.com/EronWright) made
their first contribution in
[https://github.com/pulumi/provider-version-action/pull/17](https://redirect.github.com/pulumi/provider-version-action/pull/17)

**Full Changelog**:
https://github.com/pulumi/provider-version-action/compare/v1...v1.6.1

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-11-26 01:13:49 +00:00
Pulumi Bot
98fc73df74 Update GitHub Actions workflows. (#676)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit ad6b9bc68e26fd3eeb270fe212ab46888a1580e3.
2025-11-22 05:45:33 +00:00
pulumi-renovate[bot]
2bf4175cae Update pulumi/esc-action action to v1.5.0 (#674)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [pulumi/esc-action](https://redirect.github.com/pulumi/esc-action) |
action | minor | `v1.4.0` -> `v1.5.0` |

---

### Release Notes

<details>
<summary>pulumi/esc-action (pulumi/esc-action)</summary>

###
[`v1.5.0`](https://redirect.github.com/pulumi/esc-action/releases/tag/v1.5.0)

[Compare
Source](https://redirect.github.com/pulumi/esc-action/compare/v1.4.0...v1.5.0)

- Fix line parsing when "=" is present
[https://github.com/pulumi/esc-action/pull/30](https://redirect.github.com/pulumi/esc-action/pull/30)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
2025-11-21 06:06:38 +00:00
Pulumi Bot
345f4699a8 Update GitHub Actions workflows. (#673)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 8419353a43302449e0cd6d525c08e2d9f4479dd8.
2025-11-21 05:56:36 +00:00
pulumi-renovate[bot]
d5d676f8ec Update first-party Pulumi dependencies (#558)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [@pulumi/pulumi](https://redirect.github.com/pulumi/pulumi)
([source](https://redirect.github.com/pulumi/pulumi/tree/HEAD/sdk/nodejs))
| dependencies | minor | [`3.184.0` ->
`3.208.0`](https://renovatebot.com/diffs/npm/@pulumi%2fpulumi/3.184.0/3.208.0)
|
| [github.com/pulumi/esc](https://redirect.github.com/pulumi/esc) |
indirect | minor | `v0.17.0` -> `v0.20.0` |
| [pulumi/esc-action](https://redirect.github.com/pulumi/esc-action) |
action | minor | `v1.4.0` -> `v1.5.0` |

---

### Release Notes

<details>
<summary>pulumi/pulumi (@&#8203;pulumi/pulumi)</summary>

###
[`v3.208.0`](https://redirect.github.com/pulumi/pulumi/releases/tag/v3.208.0)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.207.0...v3.208.0)

#### 3.208.0 (2025-11-20)

##### Features

- \[cli] Expose all command flags as env vars (e.g. --refresh can now be
set with PULUMI_OPTION_REFRESH)
[#&#8203;20868](https://redirect.github.com/pulumi/pulumi/pull/20868)

-   \[cli/install] Make `pulumi install` recurse into local packages
[#&#8203;20945](https://redirect.github.com/pulumi/pulumi/pull/20945)

- \[engine] Add a `replacement_trigger` resource option. Any change to
this value between program runs will trigger a replace of the resource
[#&#8203;20936](https://redirect.github.com/pulumi/pulumi/pull/20936)

- \[engine] Add a new builtin `Stash` resource which can be used to save
a value to state
[#&#8203;20819](https://redirect.github.com/pulumi/pulumi/pull/20819)

-   \[protobuf] Add `Language.Template` RPC to protos
[#&#8203;20948](https://redirect.github.com/pulumi/pulumi/pull/20948)

-   \[sdk/go] Add support for `replacement_trigger` in the Go SDK
[#&#8203;20937](https://redirect.github.com/pulumi/pulumi/pull/20937)

##### Bug Fixes

- \[engine] Fix duplicate resource snapshot integrity issue with aliases
[#&#8203;20926](https://redirect.github.com/pulumi/pulumi/pull/20926)

- \[engine] Allow resources marked as `Delete` to be targeted, and take
them into account for dependency calculation
[#&#8203;20962](https://redirect.github.com/pulumi/pulumi/pull/20962)

- \[engine] Fix a panic when previewing and import of a resource that
wants to delete and then replace due to diffs
[#&#8203;20997](https://redirect.github.com/pulumi/pulumi/pull/20997)

-   \[pkg] Include invalid property names in bind errors
[#&#8203;20989](https://redirect.github.com/pulumi/pulumi/pull/20989)

- \[sdk/python] Don’t raise when looking up a stack reference output
that does not exist
[#&#8203;20938](https://redirect.github.com/pulumi/pulumi/pull/20938)

- \[sdkgen/python] Ensure resource args accept typeddicts when no
language info is specified
[#&#8203;20982](https://redirect.github.com/pulumi/pulumi/pull/20982)

##### Miscellaneous

- \[cli] Document the \[template|url] argument in `pulumi up` command
help text
[#&#8203;20996](https://redirect.github.com/pulumi/pulumi/pull/20996)

###
[`v3.207.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32070-2025-11-12)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.206.0...v3.207.0)

##### Features

- \[cli] Log gRPC requests before invoking them in gRPC debug
interceptor
[#&#8203;20817](https://redirect.github.com/pulumi/pulumi/pull/20817)

- \[engine] Add `ReplaceWith` resource option to allow one resource's
replace operations to trigger another's
[#&#8203;20693](https://redirect.github.com/pulumi/pulumi/pull/20693)

-   \[sdkgen/python] Allow all PEP440 version specifiers to be used

##### Bug Fixes

-   \[cli/import] Return errors when an import fails
[#&#8203;20904](https://redirect.github.com/pulumi/pulumi/pull/20904)

- \[engine] Fix parenting of resources in some cases in `refresh
--run-program`
[#&#8203;20894](https://redirect.github.com/pulumi/pulumi/pull/20894)

-   \[engine] Fix StackReference secrets performance
[#&#8203;20908](https://redirect.github.com/pulumi/pulumi/pull/20908)

-   \[programgen] Do not panic when re-writing type-invalid PCL
[#&#8203;20770](https://redirect.github.com/pulumi/pulumi/pull/20770)

- \[sdk/go] Fix import path in instructions when linking a package in Go
[#&#8203;20888](https://redirect.github.com/pulumi/pulumi/pull/20888)

-   \[sdk/nodejs] Fix closure serialization on Node.js v25.2.0
[#&#8203;20913](https://redirect.github.com/pulumi/pulumi/pull/20913)

- \[sdk/{nodejs,python}] Avoid cancellations due to do slow processing
of requests

- \[sdk/python] Avoid cancellations due to do slow processing of
requests in the callbacks server
[#&#8203;20917](https://redirect.github.com/pulumi/pulumi/pull/20917)

##### Miscellaneous

-   \[engine] Stop sending ConfigPropertyMap as part of RunRequest
[#&#8203;20887](https://redirect.github.com/pulumi/pulumi/pull/20887)

###
[`v3.206.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32060-2025-11-05)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.205.0...v3.206.0)

##### Features

- \[protobuf] Pass a `preview` flag to invokes so they can tell if
they're being called during a preview
[#&#8203;20827](https://redirect.github.com/pulumi/pulumi/pull/20827)

- \[cli/about] Include PULUMI_\* environment variables in the `pulumi
about` output
[#&#8203;20855](https://redirect.github.com/pulumi/pulumi/pull/20855)

- \[auto/go] Get event log over gRPC instead of trying to read it from a
text file
[#&#8203;20822](https://redirect.github.com/pulumi/pulumi/pull/20822)

- \[auto/nodejs] Get event log over gRPC instead of trying to read it
from a text file
[#&#8203;20824](https://redirect.github.com/pulumi/pulumi/pull/20824)

- \[auto/python] Get event log over gRPC instead of trying to read it
from a text file
[#&#8203;20833](https://redirect.github.com/pulumi/pulumi/pull/20833)

- \[cli/engine] Add environment variable to add --refresh to
preview,update,destroy
[#&#8203;20797](https://redirect.github.com/pulumi/pulumi/pull/20797)

- \[sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment
variable to skip the new feature of sending component inputs to the
engine for diffing and state storage
[#&#8203;20842](https://redirect.github.com/pulumi/pulumi/pull/20842)

##### Bug Fixes

- \[engine] Fix duplicate resource snapshot integrity issue, when
running `pulumi up --refresh --run-program` and when a resource
`PendingReplacement` exists in the snapshot
[#&#8203;20812](https://redirect.github.com/pulumi/pulumi/pull/20812)

- \[engine] Support floating point NaN and Inf values in resource state
[#&#8203;20843](https://redirect.github.com/pulumi/pulumi/pull/20843)

##### Miscellaneous

-   \[sdk/go] Use Language.Link to link Go packages
[#&#8203;20811](https://redirect.github.com/pulumi/pulumi/pull/20811)

###
[`v3.205.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32050-2025-10-28)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.204.0...v3.205.0)

##### Bug Fixes

- \[cli/display] Improve how the severity is displayed for policy
violations
[#&#8203;20805](https://redirect.github.com/pulumi/pulumi/pull/20805)

- \[engine] Fix an issue where `refresh --run-program` could potentially
run forever
[#&#8203;20781](https://redirect.github.com/pulumi/pulumi/pull/20781)

###
[`v3.204.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32040-2025-10-23)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.203.0...v3.204.0)

##### Features

- \[cli] Print replace diffs when a resource tries to replace but is
blocked by still having an import id set
[#&#8203;20762](https://redirect.github.com/pulumi/pulumi/pull/20762)

-   \[engine] Support overriding policy severity on violations
[#&#8203;20767](https://redirect.github.com/pulumi/pulumi/pull/20767)

- \[backend/service] Send journal entries to the backend if it's
supported
[#&#8203;20343](https://redirect.github.com/pulumi/pulumi/pull/20343)

##### Bug Fixes

- \[engine] Fix a potential snapshot integrity error when a resources
dependency fails to be destroyed using `destroy --run-program`
[#&#8203;20692](https://redirect.github.com/pulumi/pulumi/pull/20692)

- \[engine] Fix import error to contain the import ID of non-existent
resources
[#&#8203;20753](https://redirect.github.com/pulumi/pulumi/pull/20753)

- \[sdk/nodejs] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
[#&#8203;20774](https://redirect.github.com/pulumi/pulumi/pull/20774)

- \[sdk/python] Pass secret values as Output objects to resource hooks
to properly maintain their secretness. Previously hooks received an
internal representation for secret values.
[#&#8203;20769](https://redirect.github.com/pulumi/pulumi/pull/20769)

-   \[sdkgen/go] Fix codegen of scalar return SDK functions
[#&#8203;20754](https://redirect.github.com/pulumi/pulumi/pull/20754)

- \[sdkgen/{nodejs,python}] Fix scalar return protocol to allow
returning secret maps
[#&#8203;20747](https://redirect.github.com/pulumi/pulumi/pull/20747)

##### Miscellaneous

-   \[sdk/nodejs] Use Language.Link to link Node.js packages
[#&#8203;20715](https://redirect.github.com/pulumi/pulumi/pull/20715)

###
[`v3.203.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32030-2025-10-15)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.202.0...v3.203.0)

##### Features

-   \[cli/display] Display policy severity for violations
[#&#8203;20746](https://redirect.github.com/pulumi/pulumi/pull/20746)

-   \[cli/package] Show functions in `package info`
[#&#8203;20733](https://redirect.github.com/pulumi/pulumi/pull/20733)

##### Bug Fixes

- \[engine] Make sure errors from the journaler are not shown to the
user
[#&#8203;20740](https://redirect.github.com/pulumi/pulumi/pull/20740)

-   \[backend/diy] Fix casing of stack/latest when importing stacks
[#&#8203;20727](https://redirect.github.com/pulumi/pulumi/pull/20727)

- \[cli/package] Fix 'required' flag for resource inputs in `package
info`
[#&#8203;20731](https://redirect.github.com/pulumi/pulumi/pull/20731)

- \[programgen] Revert
[#&#8203;20345](https://redirect.github.com/pulumi/pulumi/issues/20345)
[#&#8203;20714](https://redirect.github.com/pulumi/pulumi/pull/20714)

- \[programgen/{dotnet,nodejs}] Propagate local dependencies for
parameterized packages during convert down to GenerateProject
[#&#8203;20706](https://redirect.github.com/pulumi/pulumi/pull/20706)

- \[sdkgen/python] Fix python invokes for functions returning map types
[#&#8203;20719](https://redirect.github.com/pulumi/pulumi/pull/20719)

##### Miscellaneous

-   \[sdk/python] Use Language.Link to link python packages
[#&#8203;20612](https://redirect.github.com/pulumi/pulumi/pull/20612)

###
[`v3.202.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32020-2025-10-10)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.201.0...v3.202.0)

##### Features

-   \[auto] Add SetAllConfigJson method to automation APIs
[#&#8203;20709](https://redirect.github.com/pulumi/pulumi/pull/20709)

-   \[cli/config] Add `--json` input support to `pulumi config set-all`
[#&#8203;19427](https://redirect.github.com/pulumi/pulumi/pull/19427)

-   \[cli/display] Add error summary at the end of Resource changes
[#&#8203;20658](https://redirect.github.com/pulumi/pulumi/pull/20658)

- \[components/{go,nodejs}] Send component inputs to be saved in state.
This brings NodeJS and Go inline with Python behaviour
[#&#8203;20357](https://redirect.github.com/pulumi/pulumi/pull/20357)

-   \[sdk/python] Add support for Python 3.14
[#&#8203;20433](https://redirect.github.com/pulumi/pulumi/pull/20433)

-   \[sdk/python] Add the `hide_diffs` resource option
[#&#8203;20655](https://redirect.github.com/pulumi/pulumi/pull/20655)

##### Bug Fixes

- \[engine] Fix assert when a resource that's not targeted on a destroy
is marked as Delete
[#&#8203;20684](https://redirect.github.com/pulumi/pulumi/pull/20684)

-   \[sdk/nodejs] Allow compiled local SDKs to be parameterized
[#&#8203;20685](https://redirect.github.com/pulumi/pulumi/pull/20685)

- \[sdk/nodejs] Handle RangeErrors from util.inspect stringifying error
objects
[#&#8203;20705](https://redirect.github.com/pulumi/pulumi/pull/20705)

###
[`v3.201.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32010-2025-10-06)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.200.0...v3.201.0)

##### Features

-   \[sdkgen/go] Support non-object return types in functions
[#&#8203;20646](https://redirect.github.com/pulumi/pulumi/pull/20646)

##### Bug Fixes

-   \[backend/service] Fix the --insecure flag in `pulumi login`

###
[`v3.200.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#32000-2025-10-03)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.199.0...v3.200.0)

##### Features

- \[cli] Look for .cmd and .ps1 extensions as well on Windows when
looking for executables
[#&#8203;20637](https://redirect.github.com/pulumi/pulumi/pull/20637)

-   \[sdk/go] Add a new resource option: `HideDiffs`
[#&#8203;20631](https://redirect.github.com/pulumi/pulumi/pull/20631)

-   \[sdk/nodejs] Add a new resource option: `hideDiffs`
[#&#8203;20631](https://redirect.github.com/pulumi/pulumi/pull/20631)

-   \[sdkgen/python] Support non-object return types in functions
[#&#8203;20624](https://redirect.github.com/pulumi/pulumi/pull/20624)

##### Bug Fixes

-   \[build] Use ruff to auto fix lints in python
[#&#8203;20644](https://redirect.github.com/pulumi/pulumi/pull/20644)

-   \[sdk/nodejs] Make new arguments to `initialize` optional
[#&#8203;20650](https://redirect.github.com/pulumi/pulumi/pull/20650)

-   \[sdkgen/nodejs] Generate a .gitignore file inside local SDKs
[#&#8203;20643](https://redirect.github.com/pulumi/pulumi/pull/20643)

- \[cli/state] Treat providers that are marked as parents in a move as
providers still instead of as regular resources
[#&#8203;20639](https://redirect.github.com/pulumi/pulumi/pull/20639)

- \[cli/state] Exclude root stack correctly when moving resources and
when --include-parents is passed

###
[`v3.199.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31990-2025-10-01)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.198.0...v3.199.0)

##### Features

-   \[cli/about] Add `pulumi about env` to help
[#&#8203;20633](https://redirect.github.com/pulumi/pulumi/pull/20633)

- \[cli/{about,new}] Add environment variables to override template
repository settings. The new PULUMI_TEMPLATE_GIT_REPOSITORY,
PULUMI_TEMPLATE_BRANCH, PULUMI_POLICY_TEMPLATE_GIT_REPOSITORY, and
PULUMI_POLICY_TEMPLATE_BRANCH environment variables allow runtime
customization of template sources
[#&#8203;20615](https://redirect.github.com/pulumi/pulumi/pull/20615)

- \[cli/{install,package}] Add support for package references in plugins
[#&#8203;20524](https://redirect.github.com/pulumi/pulumi/pull/20524)

- \[sdk/nodejs] Pass options, name, and type to ComponentResources
initialize methods
[#&#8203;20618](https://redirect.github.com/pulumi/pulumi/pull/20618)

-   \[cli/policy] Send vcs metadata when publishing policy packs
[#&#8203;20528](https://redirect.github.com/pulumi/pulumi/pull/20528)

##### Bug Fixes

-   \[cli/display] Always send diag events to stderr in the diff display
[#&#8203;20632](https://redirect.github.com/pulumi/pulumi/pull/20632)

-   \[components] Stop including auth info in plugin name
[#&#8203;20620](https://redirect.github.com/pulumi/pulumi/pull/20620)

-   \[engine] Support the import option in resource transforms
[#&#8203;20586](https://redirect.github.com/pulumi/pulumi/pull/20586)

- \[programgen] Fix panic in parseProxyApply when encoutering warning
diagnostics
[#&#8203;20583](https://redirect.github.com/pulumi/pulumi/pull/20583)

- \[sdk/nodejs] Don't attempt to serialise function values for resource
inputs/outputs
[#&#8203;20621](https://redirect.github.com/pulumi/pulumi/pull/20621)

###
[`v3.198.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31980-2025-09-26)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.197.0...v3.198.0)

##### Features

-   \[engine] Expand snapshot integrity check for resources
[#&#8203;20519](https://redirect.github.com/pulumi/pulumi/pull/20519)

- \[sdk/go] Refactor Go policy SDK to have access to a pulumi Context
object
[#&#8203;20570](https://redirect.github.com/pulumi/pulumi/pull/20570)

- \[sdk/python] Allow registered resources to be retrieved from the mock
monitor for test assertions
[#&#8203;20540](https://redirect.github.com/pulumi/pulumi/pull/20540)

##### Bug Fixes

- \[engine] Fix snapshot integrity error with `run-program --refresh`,
when a provider has a dependency that isn't being created
[#&#8203;20541](https://redirect.github.com/pulumi/pulumi/pull/20541)

-   \[engine] Remove unneeded data from policy summary events
[#&#8203;20589](https://redirect.github.com/pulumi/pulumi/pull/20589)

-   \[sdk] Fix plugin killing during cancellation
[#&#8203;20543](https://redirect.github.com/pulumi/pulumi/pull/20543)

-   \[sdk/go] Fix \[Unm/M]arshalProperties to return nil when given nil
[#&#8203;20544](https://redirect.github.com/pulumi/pulumi/pull/20544)

##### Miscellaneous

-   \[protobuf] Add loader_target to LanguageRuntime.LinkRequest
[#&#8203;20552](https://redirect.github.com/pulumi/pulumi/pull/20552)

- \[cli/package] Move InstallPackage from cmd/packagecmd to cmd/packages
[#&#8203;20550](https://redirect.github.com/pulumi/pulumi/pull/20550)

-   \[cli/package] Move stdout/stderr IO out of GenSDK and LinkPackage
[#&#8203;20546](https://redirect.github.com/pulumi/pulumi/pull/20546)

-   \[sdk] Move PluginSpec.Install to pkg/workspace.InstallPluginContent
[#&#8203;20537](https://redirect.github.com/pulumi/pulumi/pull/20537)

-   \[sdk/yaml] Bump pulumi-yaml to 1.23.2
[#&#8203;20588](https://redirect.github.com/pulumi/pulumi/pull/20588)

###
[`v3.197.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31970-2025-09-17)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.196.0...v3.197.0)

##### Features

-   \[cli] Send new policy fields when publishing a policy pack

-   \[sdk/dotnet] Update dotnet to v3.88
[#&#8203;20512](https://redirect.github.com/pulumi/pulumi/pull/20512)

##### Bug Fixes

- \[engine] Fix a panic in preview, that could happen in some cases when
default providers get updated
[#&#8203;20511](https://redirect.github.com/pulumi/pulumi/pull/20511)

-   \[components/python] Fix parenting of python components
[#&#8203;20508](https://redirect.github.com/pulumi/pulumi/pull/20508)

- \[sdk/python] Fix hang when shutting down in certain error conditions
[#&#8203;20484](https://redirect.github.com/pulumi/pulumi/pull/20484)

-   \[sdk/python] Fix license-files entry for python package
[#&#8203;20506](https://redirect.github.com/pulumi/pulumi/pull/20506)

###
[`v3.196.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31960-2025-09-12)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.195.0...v3.196.0)

##### Miscellaneous

-   \[sdk] Add policy summary events apitypes
[#&#8203;20443](https://redirect.github.com/pulumi/pulumi/pull/20443)

-   \[sdk] Add new policy fields apitypes
[#&#8203;20491](https://redirect.github.com/pulumi/pulumi/pull/20491)

-   \[protobuf] Add support for indicating "not applicable" policies
[#&#8203;20492](https://redirect.github.com/pulumi/pulumi/pull/20492)

-   \[protobuf] Add new analyzer policy fields
[#&#8203;20494](https://redirect.github.com/pulumi/pulumi/pull/20494)

###
[`v3.195.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31950-2025-09-10)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.194.0...v3.195.0)

##### Features

- \[engine] Add support for capturing program stack traces as part of
resource registration
[#&#8203;20430](https://redirect.github.com/pulumi/pulumi/pull/20430)

- \[sdk/go] Registered resources can now be retrieved from the mock
monitor for test assertions
[#&#8203;20472](https://redirect.github.com/pulumi/pulumi/pull/20472)

- \[sdk/go] The current exports map is now available for unit testing
through `GetCurrentExportMap`
[#&#8203;20471](https://redirect.github.com/pulumi/pulumi/pull/20471)

##### Bug Fixes

- \[pkg/go] Fix an issue where v3.194.0 of the
`github.com/pulumi/pulumi/pkg/v3` module depends on APIs from
`github.com/pulumi/pulumi/sdk/v3` that haven't been released
[#&#8203;20487](https://redirect.github.com/pulumi/pulumi/issues/20487)

###
[`v3.194.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31940-2025-09-08)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.193.0...v3.194.0)

##### Features

-   \[cli] Log diagnostics to stderr instead of stdout
[#&#8203;20461](https://redirect.github.com/pulumi/pulumi/pull/20461)

- \[cli/display] Change the default for --show-full-output from true to
false
[#&#8203;20467](https://redirect.github.com/pulumi/pulumi/pull/20467)

-   \[cli/display] Fix the --show-full-output the flag
[#&#8203;20464](https://redirect.github.com/pulumi/pulumi/pull/20464)

-   \[sdk/go] Show a message that the Go program is being compiled
[#&#8203;20460](https://redirect.github.com/pulumi/pulumi/pull/20460)

##### Bug Fixes

-   \[engine] Make ignoreChanges work better for arrays
[#&#8203;20465](https://redirect.github.com/pulumi/pulumi/pull/20465)

- \[programgen] Fix panic in RewriteApplies when encountering warning
diagnostics
[#&#8203;20453](https://redirect.github.com/pulumi/pulumi/pull/20453)

##### Miscellaneous

- \[cli] No longer require the `PULUMI_EXPERIMENTAL` flag for Private
Registry template operations (`pulumi template publish`, registry-based
template resolution in `pulumi new`), while registry-backed template
resolution in `pulumi new` may still be disabled using
`PULUMI_DISABLE_REGISTRY_RESOLVE=true pulumi new`
[#&#8203;20458](https://redirect.github.com/pulumi/pulumi/pull/20458)

-   \[sdk/yaml] Bump pulumi-yaml to 1.23.1

###
[`v3.193.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31930-2025-09-04)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.192.0...v3.193.0)

##### Bug Fixes

- \[cli] Use "Private Registry", not cloud or Pulumi registry, in CLI
output
[#&#8203;20436](https://redirect.github.com/pulumi/pulumi/pull/20436)

- \[cli/display] Avoid printing a double new line when showing secrets
in the outputs
[#&#8203;20435](https://redirect.github.com/pulumi/pulumi/pull/20435)

-   \[cli/display] Fix coloring of cobra error messages on windows

- \[cli/{install,package}] Fix local package resolution when
PULUMI_EXPERIMENTAL=true by including local packages in registry
fallback logic
[#&#8203;20413](https://redirect.github.com/pulumi/pulumi/pull/20413)

- \[cli/new] Fail when running with --language without --ai in
non-interactive mode
[#&#8203;20415](https://redirect.github.com/pulumi/pulumi/pull/20415)

- \[cli/package] Fix not using already-installed package in 'pulumi
package add' when PULUMI_EXPERIMENTAL=1

##### Miscellaneous

-   \[cli] Start the pprof server when receving SIGUSR1
[#&#8203;20392](https://redirect.github.com/pulumi/pulumi/pull/20392)

-   \[cli/display] Replace ijc/Gotty terminfo package with xo/terminfo
[#&#8203;20446](https://redirect.github.com/pulumi/pulumi/pull/20446)

- \[cli/display] Use the passed through writer in ShowProgressOutput
instead of loading a new terminfo

###
[`v3.192.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31920-2025-08-29)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.191.0...v3.192.0)

##### Features

- \[cli/state] Add pulumi state taint/untaint commands to force
replacement of resources upon next update
[#&#8203;20380](https://redirect.github.com/pulumi/pulumi/pull/20380)

- \[sdk/nodejs] Add `previewDestroy` to allow dry-runs of `destroy`
commands
[#&#8203;20371](https://redirect.github.com/pulumi/pulumi/pull/20371)

##### Bug Fixes

- \[engine] Fix a bug causing hooks to never pass correctly to remote Go
components
[#&#8203;20390](https://redirect.github.com/pulumi/pulumi/pull/20390)

-   \[sdk/go] Fix source position information
[#&#8203;20351](https://redirect.github.com/pulumi/pulumi/pull/20351)

- \[sdk/nodejs] Fix function serialisation that contains minified
classes
[#&#8203;19345](https://redirect.github.com/pulumi/pulumi/pull/19345)

- \[sdkgen/nodejs] Limit
[@&#8203;types](https://redirect.github.com/types) packages used during
local SDK generation
[#&#8203;20387](https://redirect.github.com/pulumi/pulumi/pull/20387)

-   \[sdk/python] Set ThreadPoolExecutor max_workers to parallelism \* 4
[#&#8203;20362](https://redirect.github.com/pulumi/pulumi/pull/20362)

-   \[sdk/python] Handle `-v` flag passed to policy packs
[#&#8203;20373](https://redirect.github.com/pulumi/pulumi/pull/20373)

-   \[sdk/python] Forward errors raised in callbacks to the caller
[#&#8203;20381](https://redirect.github.com/pulumi/pulumi/pull/20381)

##### Miscellaneous

-   \[cli] Log stack trace when interrupted when using verbose logging
[#&#8203;20364](https://redirect.github.com/pulumi/pulumi/pull/20364)

- \[cli] Print the location of the log file when running with the
verbose flag
[#&#8203;20365](https://redirect.github.com/pulumi/pulumi/pull/20365)

-   \[sdk/python] Remove custom typing stubs
[#&#8203;20384](https://redirect.github.com/pulumi/pulumi/pull/20384)

###
[`v3.191.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31910-2025-08-21)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.190.0...v3.191.0)

##### Features

-   \[cli] Document the `PULUMI_ENABLE_STREAMING_JSON_PREVIEW` envvar.
[#&#8203;20328](https://redirect.github.com/pulumi/pulumi/pull/20328)

##### Bug Fixes

- \[engine] Check providers returning 'version' or '\__internal' in
their inputs
[#&#8203;20313](https://redirect.github.com/pulumi/pulumi/pull/20313)

-   \[engine] Fix a panic with `refresh --run-program`
[#&#8203;20337](https://redirect.github.com/pulumi/pulumi/pull/20337)

- \[engine] Fix an infinite loop from passing unordered resources to the
dependency system when using --refresh

- \[programgen] Emit warnings instead of errors in non-strict mode when
binding resource blocks
[#&#8203;20347](https://redirect.github.com/pulumi/pulumi/pull/20347)

- \[programgen] Simplify range value types when it is derived from
object of objects and warn on unknown properties
[#&#8203;20345](https://redirect.github.com/pulumi/pulumi/pull/20345)

- \[programgen] Warn instead of erroring out when traversing a NoneType
in PCL
[#&#8203;20342](https://redirect.github.com/pulumi/pulumi/pull/20342)

-   \[cli/display] Escape non-graphic characters in URNs
[#&#8203;20295](https://redirect.github.com/pulumi/pulumi/pull/20295)

- \[cli/import] Disambiguate duplicate resource names by their types
when importing
[#&#8203;20348](https://redirect.github.com/pulumi/pulumi/pull/20348)

-   \[cli/new] Don't prompt for ai or template when passing --yes
[#&#8203;20256](https://redirect.github.com/pulumi/pulumi/pull/20256)

##### Miscellaneous

-   \[cli] Log version and CLI metadata
[#&#8203;20334](https://redirect.github.com/pulumi/pulumi/pull/20334)

-   \[cli/package] Pass ParameterizeParameters to SchemaFromSchemaSource
[#&#8203;20324](https://redirect.github.com/pulumi/pulumi/pull/20324)

###
[`v3.190.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31900-2025-08-15)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.189.0...v3.190.0)

##### Features

- \[engine] Don't error on `ignoreChanges` paths that are missing old
data, there is nothing to ignore in those cases and we just use the new
data
[#&#8203;20278](https://redirect.github.com/pulumi/pulumi/pull/20278)

##### Bug Fixes

- \[cli] Fix `destroy --exclude-protected --remove` returning an error
for empty stacks that could safely be removed
[#&#8203;20283](https://redirect.github.com/pulumi/pulumi/pull/20283)

- \[cli] Fix `pulumi template publish` failing with relative paths by
normalizing to absolute paths before archive creation
[#&#8203;20301](https://redirect.github.com/pulumi/pulumi/pull/20301)

- \[cli/import] Use mapped name instead of logical name for resource
references during import code generation
[#&#8203;20300](https://redirect.github.com/pulumi/pulumi/pull/20300)

- \[pkg] Make TypeScript code generation use 'declare' keyword instead
of definite assertion operator, to avoid setting all fields to undefined
when targeting environments new enough
[#&#8203;20261](https://redirect.github.com/pulumi/pulumi/pull/20261)

-   \[sdkgen/nodejs] Make TypeScript a full dependency of local SDKs
[#&#8203;20272](https://redirect.github.com/pulumi/pulumi/pull/20272)

##### Miscellaneous

- \[build] Updates protobuf and grpc to v5, bumping dependencies in the
Go, Node.js, and Python SDKs
[#&#8203;19588](https://redirect.github.com/pulumi/pulumi/pull/19588)

-   \[build] Update latest Go version to 1.25
[#&#8203;20284](https://redirect.github.com/pulumi/pulumi/pull/20284)

-   \[sdkgen/nodejs] Target ES2020 for generated SDKs
[#&#8203;20276](https://redirect.github.com/pulumi/pulumi/pull/20276)

###
[`v3.189.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31890-2025-08-12)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.188.0...v3.189.0)

##### Features

-   \[sdk] Remove CacheMS from CLIVersionResponse
[#&#8203;20264](https://redirect.github.com/pulumi/pulumi/pull/20264)

-   \[sdk/go] Calculate PluginInfo.Size on demand
[#&#8203;20241](https://redirect.github.com/pulumi/pulumi/pull/20241)

- \[auto/python] Surface `json` option to `pulumi preview` calls in
Python when using the `pulumi.automation` package.
[#&#8203;20233](https://redirect.github.com/pulumi/pulumi/pull/20233)

##### Bug Fixes

- \[cli/package] Fix incorrect console URLs being displayed after
publishing a policy
[#&#8203;20255](https://redirect.github.com/pulumi/pulumi/pull/20255)

-   \[engine] Fix race when reading plugin stdout
[#&#8203;20242](https://redirect.github.com/pulumi/pulumi/pull/20242)

-   \[sdk/nodejs] Fix component providers when using pnpm
[#&#8203;20253](https://redirect.github.com/pulumi/pulumi/pull/20253)

##### Miscellaneous

- \[pkg] Make TypeScript code generation use nullish coalesce operator
for required property checks, as well as state and args accessing
whenever sensible

- \[sdk/nodejs] Fix swapped stderr/stdout callback comments in
PreviewOptions interface
[#&#8203;20250](https://redirect.github.com/pulumi/pulumi/pull/20250)

-   \[sdkgen] Don’t create empty maps for language specific overrides
[#&#8203;20237](https://redirect.github.com/pulumi/pulumi/pull/20237)

###
[`v3.188.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31880-2025-08-07)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.187.0...v3.188.0)

##### Features

- \[cli] Add `--remove-backups` flag to `pulumi stack rm` for DIY
backends
[#&#8203;20203](https://redirect.github.com/pulumi/pulumi/pull/20203)

##### Bug Fixes

-   \[cli] Fix cancellation when running via some CLI wrapper tools
[#&#8203;20195](https://redirect.github.com/pulumi/pulumi/pull/20195)

-   \[cli] Fix concurrent read/write during plugin downloads
[#&#8203;20223](https://redirect.github.com/pulumi/pulumi/pull/20223)

-   \[cli] Restore terminal mode on panic
[#&#8203;20224](https://redirect.github.com/pulumi/pulumi/pull/20224)

-   \[engine] Fix panic in refreshes due to concurrent map writes
[#&#8203;20206](https://redirect.github.com/pulumi/pulumi/pull/20206)

- \[sdkgen] Warn about refs of the form
"#/resources/pulumi:providers:<pkg>"
[#&#8203;20192](https://redirect.github.com/pulumi/pulumi/pull/20192)

-   \[cli/display] Show changed outputs in preview
[#&#8203;20161](https://redirect.github.com/pulumi/pulumi/pull/20161)

- \[cli/engine] Make `--exclude` correctly handle wildcards in all cases
[#&#8203;20158](https://redirect.github.com/pulumi/pulumi/pull/20158)

- \[sdk/go] Fix running against old CLI versions without
SignalAndWaitForShutdown
[#&#8203;20212](https://redirect.github.com/pulumi/pulumi/pull/20212)

-   \[sdk/python] Fix dependency installation in uv workspaces
[#&#8203;20218](https://redirect.github.com/pulumi/pulumi/pull/20218)

##### Miscellaneous

-   \[cli] Update pulumi-dotnet to 3.87.0
[#&#8203;20222](https://redirect.github.com/pulumi/pulumi/pull/20222)

-   \[cli/env] Bump esc to v0.17.0
[#&#8203;20197](https://redirect.github.com/pulumi/pulumi/pull/20197)

###
[`v3.187.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31870-2025-07-31)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.186.0...v3.187.0)

##### Features

-   \[cli] Support for writing v4 checkpoints/deployments
[#&#8203;20159](https://redirect.github.com/pulumi/pulumi/pull/20159)

- \[cli] Add support for qualified registry template names in `pulumi
new`
[#&#8203;20138](https://redirect.github.com/pulumi/pulumi/pull/20138)

- \[cli/import] Enable `pulumi import` to always `--generate-resources`
when converting `--from` state files
[#&#8203;20178](https://redirect.github.com/pulumi/pulumi/pull/20178)

-   \[yaml] Allow config values to be parsed with type `object`
[#&#8203;20132](https://redirect.github.com/pulumi/pulumi/pull/20132)

- \[auto/python] Allow for `on_error` callbacks in commands to capture
stderr incrementally
[#&#8203;20019](https://redirect.github.com/pulumi/pulumi/pull/20019)

-   \[sdk/nodejs] Add option of Bun as a package manager
[#&#8203;18412](https://redirect.github.com/pulumi/pulumi/pull/18412)

-   \[sdk/nodejs] Copy `getRootDirectory` to the pulumi module
[#&#8203;20173](https://redirect.github.com/pulumi/pulumi/pull/20173)

-   \[sdk/python] Copy `get_root_directory` to the pulumi module
[#&#8203;20172](https://redirect.github.com/pulumi/pulumi/pull/20172)

##### Bug Fixes

- \[cli] Fix un-taring registry-backed templates which come in .tar.gz
format
[#&#8203;20135](https://redirect.github.com/pulumi/pulumi/pull/20135)

- \[cli] Stop passing Accept: application/x-tar to registry template
download URLs to avoid signature mismatch
[#&#8203;20133](https://redirect.github.com/pulumi/pulumi/pull/20133)

- \[engine] Fix a panic with `up --refresh --run-program` and resource
replacements
[#&#8203;20147](https://redirect.github.com/pulumi/pulumi/pull/20147)

- \[engine] Untargeted resources in `destroy` now correctly register as
same steps
[#&#8203;20061](https://redirect.github.com/pulumi/pulumi/pull/20061)

- \[cli/engine] Fix hang when waiting for program that would never
complete
[#&#8203;20153](https://redirect.github.com/pulumi/pulumi/pull/20153)

-   \[sdk/nodejs] Fix delete hooks in inline automation API programs
[#&#8203;20143](https://redirect.github.com/pulumi/pulumi/pull/20143)

-   \[sdk/python] Set features inside construct
[#&#8203;20141](https://redirect.github.com/pulumi/pulumi/pull/20141)

##### Miscellaneous

- \[sdk/nodejs] Bump TypeScript target to ES2020 for plugins and policy
packs
[#&#8203;20148](https://redirect.github.com/pulumi/pulumi/pull/20148)

###
[`v3.186.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31860-2025-07-25)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.185.0...v3.186.0)

##### Features

- \[engine] Send `Cancel` message to language runtime plugins on engine
shutdown
[#&#8203;20007](https://redirect.github.com/pulumi/pulumi/pull/20007)

-   \[engine] Pass stack tags to policy plugins on startup
[#&#8203;20084](https://redirect.github.com/pulumi/pulumi/pull/20084)

- \[yaml] Expose `object` as a possible config type in preparation for
`pulumi-yaml` support
[#&#8203;20129](https://redirect.github.com/pulumi/pulumi/pull/20129)

##### Bug Fixes

- \[cli/engine] --exclude and --exclude-protected flags now work
together correctly for `destroy` commands
[#&#8203;20120](https://redirect.github.com/pulumi/pulumi/pull/20120)

-   \[engine] Fix a datarace in the engine event system
[#&#8203;20105](https://redirect.github.com/pulumi/pulumi/pull/20105)

- \[engine] Fix a panic in the engine when running `up --refresh
--run-program` and finding a deleted resource

- \[sdk/nodejs] Avoid "Cannot convert object to primitive value" error
when running into type errors
[#&#8203;20092](https://redirect.github.com/pulumi/pulumi/pull/20092)

- \[sdk/nodejs] Don’t use automatic ESM mode when `—import` or
`—require` is set
[#&#8203;20091](https://redirect.github.com/pulumi/pulumi/pull/20091)

-   \[sdk/nodejs] Fix callback server hang & delete hooks in Node.js
[#&#8203;20109](https://redirect.github.com/pulumi/pulumi/pull/20109)

-   \[sdk/nodejs] Don’t report leaked promises when we exit abnormally
[#&#8203;20128](https://redirect.github.com/pulumi/pulumi/pull/20128)

- \[cli/package] Force new style Go modules to be written out when using
`package add`
[#&#8203;20011](https://redirect.github.com/pulumi/pulumi/pull/20011)

-   \[sdk/python] Run uv sync on uv command
[#&#8203;20117](https://redirect.github.com/pulumi/pulumi/pull/20117)

##### Miscellaneous

-   \[yaml] Update yaml to 1.21.3
[#&#8203;20118](https://redirect.github.com/pulumi/pulumi/pull/20118)

###
[`v3.185.0`](https://redirect.github.com/pulumi/pulumi/blob/HEAD/CHANGELOG.md#31850-2025-07-21)

[Compare
Source](https://redirect.github.com/pulumi/pulumi/compare/v3.184.0...v3.185.0)

##### Features

- \[cli/{install,package}] Allow using `pulumi package add` with
registry identifiers
[#&#8203;19928](https://redirect.github.com/pulumi/pulumi/pull/19928)

##### Bug Fixes

- \[engine] Fix a snapshot integrity issue with `destroy --run-program`
and resource reads
[#&#8203;20078](https://redirect.github.com/pulumi/pulumi/pull/20078)

-   \[sdkgen/python] Remove unnecessary `import copy`
[#&#8203;20089](https://redirect.github.com/pulumi/pulumi/pull/20089)

-   \[sdkgen/python] Support properties named "builtins"
[#&#8203;20085](https://redirect.github.com/pulumi/pulumi/pull/20085)

</details>

<details>
<summary>pulumi/esc (github.com/pulumi/esc)</summary>

###
[`v0.20.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.20.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.19.0...v0.20.0)

##### Improvements

-   Added deletion protection for environments:
- Use `esc env settings set
[<org-name>/][<project-name>/]<environment-name> deletion-protected
true` to enable deletion protection
- Use `esc env settings get
[<org-name>/][<project-name>/]<environment-name> [deletion-protected]`
to check the current status
- When enabled, environments cannot be deleted until protection is
disabled
    -   Deletion protection is disabled by default for new environments

##### Bug Fixes

- Environment declarations are now returned even in the face of syntax
errors.

##### Breaking changes

###
[`v0.19.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.19.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.18.0...v0.19.0)

##### Improvements

- Added support for Open Approvals
[#&#8203;592](https://redirect.github.com/pulumi/esc/pull/592)

##### Bug Fixes

##### Breaking changes

###
[`v0.18.0`](https://redirect.github.com/pulumi/esc/releases/tag/v0.18.0)

[Compare
Source](https://redirect.github.com/pulumi/esc/compare/v0.17.0...v0.18.0)

##### Improvements

- Added support for `fn::concat` built-in function to concatenate
arrays.
    [#&#8203;582](https://redirect.github.com/pulumi/esc/pull/582)

##### Bug Fixes

##### Breaking changes

</details>

<details>
<summary>pulumi/esc-action (pulumi/esc-action)</summary>

###
[`v1.5.0`](https://redirect.github.com/pulumi/esc-action/releases/tag/v1.5.0)

[Compare
Source](https://redirect.github.com/pulumi/esc-action/compare/v1.4.0...v1.5.0)

- Fix line parsing when "=" is present
[https://github.com/pulumi/esc-action/pull/30](https://redirect.github.com/pulumi/esc-action/pull/30)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - Monday through Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xOS4wIiwidXBkYXRlZEluVmVyIjoiMzkuMjY0LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImltcGFjdC9uby1jaGFuZ2Vsb2ctcmVxdWlyZWQiXX0=-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2025-11-20 21:38:09 +00:00
pulumi-renovate[bot]
f1ff9e765f Update vulnerable dependencies [SECURITY] (#671)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/containerd/containerd/v2](https://redirect.github.com/containerd/containerd)
| indirect | patch | `v2.0.3` -> `v2.0.7` |
|
[github.com/go-viper/mapstructure/v2](https://redirect.github.com/go-viper/mapstructure)
| indirect | minor | `v2.0.0` -> `v2.4.0` |
| [github.com/ulikunitz/xz](https://redirect.github.com/ulikunitz/xz) |
indirect | patch | `v0.5.12` -> `v0.5.15` |
| golang.org/x/crypto | indirect | minor | `v0.39.0` -> `v0.45.0` |

### GitHub Vulnerability Alerts

####
[CVE-2024-40635](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)

### Impact
A bug was found in containerd where containers launched with a User set
as a `UID:GID` larger than the maximum 32-bit signed integer can cause
an overflow condition where the container ultimately runs as root (UID
0). This could cause unexpected behavior for environments that require
containers to run as a non-root user.

### Patches
This bug has been fixed in the following containerd versions: 

* 2.0.4 (Fixed in
1a43cb6a10)
* 1.7.27 (Fixed in
05044ec0a9)
* 1.6.38 (Fixed in
cf158e884c)

Users should update to these versions to resolve the issue.

### Workarounds
Ensure that only trusted images are used and that only trusted users
have permissions to import images.

### Credits
The containerd project would like to thank [Benjamin
Koltermann](https://redirect.github.com/p4ck3t0) and
[emxll](https://redirect.github.com/emxll) for responsibly disclosing
this issue in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

### References
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635

### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

####
[CVE-2025-47291](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff)

# Impact

A bug was found in the containerd's CRI implementation where containerd
doesn't put usernamespaced containers under the Kubernetes' cgroup
hierarchy, therefore some Kubernetes limits are not honored. This may
cause a denial of service of the Kubernetes node.

# Patches

This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should
update to these versions to resolve the issue.

# Workarounds

Disable usernamespaced pods in Kubernetes temporarily.

# Credits

The containerd project would like to thank Rodrigo Campos Catelin and
Piotr Rogowski for responsibly disclosing this issue in accordance with
the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

#  For more information
If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at security@containerd.io

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

####
[CVE-2024-25621](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)

### Impact

An overly broad default permission vulnerability was found in
containerd.

- `/var/lib/containerd` was created with the permission bits 0o711,
while it should be created with 0o700
- Allowed local users on the host to potentially access the metadata
store and the content store
- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755,
while it should be created with 0o700
- Allowed local users on the host to potentially access the contents of
Kubernetes local volumes. The contents of volumes might include setuid
binaries, which could allow a local user on the host to elevate
privileges on the host.
- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created
with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration.
When the `temp` directory path is specified in the daemon configuration,
that directory was also created with 0o711, while it should be created
with 0o700.

### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0
* 2.1.5
* 2.0.7
* 1.7.29

Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing
directories.

> [!NOTE]
>
> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task`
are still created with 0o711.
> This is an expected behavior for supporting userns-remapped
containers.

### Workarounds

The system administrator on the host can manually chmod the directories
to not
have group or world accessible permisisons:

```
chmod 700 /var/lib/containerd
chmod 700 /run/containerd/io.containerd.grpc.v1.cri
chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim
```

An alternative mitigation would be to run containerd in [rootless
mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).

### Credits

The containerd project would like to thank David Leadbeater for
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)

####
[CVE-2025-64329](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)

### Impact

A bug was found in containerd's CRI Attach implementation where a user
can exhaust memory on the host due to goroutine leaks.

Repetitive calls of CRI Attach (e.g., [`kubectl
attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/))
could increase the memory usage of containerd.

### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0
* 2.1.5
* 2.0.7
* 1.7.29

Users should update to these versions to resolve the issue.

### Workarounds

Set up an admission controller to control accesses to `pods/attach`
resources.
e.g., [Validating Admission
Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).

### Credits

The containerd project would like to thank @&#8203;Wheat2018 for
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

### References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329

### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)

---

### containerd has an integer overflow in User ID handling in
github.com/containerd/containerd
[CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) /
[GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg)
/ [GO-2025-3528](https://pkg.go.dev/vuln/GO-2025-3528)

<details>
<summary>More information</summary>

#### Details
containerd has an integer overflow in User ID handling in
github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)
-
[05044ec0a9)
-
[1a43cb6a10)
-
[cf158e884c)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3528) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### containerd has an integer overflow in User ID handling
[CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635) /
[GHSA-265r-hfxg-fhmg](https://redirect.github.com/advisories/GHSA-265r-hfxg-fhmg)
/ [GO-2025-3528](https://pkg.go.dev/vuln/GO-2025-3528)

<details>
<summary>More information</summary>

#### Details
##### Impact
A bug was found in containerd where containers launched with a User set
as a `UID:GID` larger than the maximum 32-bit signed integer can cause
an overflow condition where the container ultimately runs as root (UID
0). This could cause unexpected behavior for environments that require
containers to run as a non-root user.

##### Patches
This bug has been fixed in the following containerd versions: 

* 2.0.4 (Fixed in
1a43cb6a10)
* 1.7.27 (Fixed in
05044ec0a9)
* 1.6.38 (Fixed in
cf158e884c)

Users should update to these versions to resolve the issue.

##### Workarounds
Ensure that only trusted images are used and that only trusted users
have permissions to import images.

##### Credits
The containerd project would like to thank [Benjamin
Koltermann](https://redirect.github.com/p4ck3t0) and
[emxll](https://redirect.github.com/emxll) for responsibly disclosing
this issue in accordance with the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### References
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: 4.6 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg)
-
[https://nvd.nist.gov/vuln/detail/CVE-2024-40635](https://nvd.nist.gov/vuln/detail/CVE-2024-40635)
-
[05044ec0a9)
-
[1a43cb6a10)
-
[cf158e884c)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)
-
[https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html](https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-265r-hfxg-fhmg) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI plugin: Incorrect cgroup hierarchy assignment for
containers running in usernamespaced Kubernetes pods.
[CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291) /
[GHSA-cxfp-7pvr-95ff](https://redirect.github.com/advisories/GHSA-cxfp-7pvr-95ff)
/ [GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701)

<details>
<summary>More information</summary>

#### Details
##### Impact

A bug was found in the containerd's CRI implementation where containerd
doesn't put usernamespaced containers under the Kubernetes' cgroup
hierarchy, therefore some Kubernetes limits are not honored. This may
cause a denial of service of the Kubernetes node.

##### Patches

This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should
update to these versions to resolve the issue.

##### Workarounds

Disable usernamespaced pods in Kubernetes temporarily.

##### Credits

The containerd project would like to thank Rodrigo Campos Catelin and
Piotr Rogowski for responsibly disclosing this issue in accordance with
the [containerd security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

#####  For more information
If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at security@containerd.io

To report a security issue in containerd:
* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)

#### Severity
- CVSS Score: Unknown
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff)
-
[https://nvd.nist.gov/vuln/detail/CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)
-
[https://pkg.go.dev/vuln/GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-cxfp-7pvr-95ff) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Incorrect cgroup assignment for containers running in usernamespaced
Kubernetes pods in github.com/containerd/containerd
[CVE-2025-47291](https://nvd.nist.gov/vuln/detail/CVE-2025-47291) /
[GHSA-cxfp-7pvr-95ff](https://redirect.github.com/advisories/GHSA-cxfp-7pvr-95ff)
/ [GO-2025-3701](https://pkg.go.dev/vuln/GO-2025-3701)

<details>
<summary>More information</summary>

#### Details
Incorrect cgroup assignment for containers running in usernamespaced
Kubernetes pods in github.com/containerd/containerd

#### Severity
Unknown

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-cxfp-7pvr-95ff)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3701) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### containerd affected by a local privilege escalation via wide
permissions on CRI directory
[CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621) /
[GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/advisories/GHSA-pwhc-rpq9-4c8w)

<details>
<summary>More information</summary>

#### Details
##### Impact

An overly broad default permission vulnerability was found in
containerd.

- `/var/lib/containerd` was created with the permission bits 0o711,
while it should be created with 0o700
- Allowed local users on the host to potentially access the metadata
store and the content store
- `/run/containerd/io.containerd.grpc.v1.cri` was created with 0o755,
while it should be created with 0o700
- Allowed local users on the host to potentially access the contents of
Kubernetes local volumes. The contents of volumes might include setuid
binaries, which could allow a local user on the host to elevate
privileges on the host.
- `/run/containerd/io.containerd.sandbox.controller.v1.shim` was created
with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration.
When the `temp` directory path is specified in the daemon configuration,
that directory was also created with 0o711, while it should be created
with 0o700.

##### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0
* 2.1.5
* 2.0.7
* 1.7.29

Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing
directories.

> [!NOTE]
>
> `/run/containerd` and `/run/containerd/io.containerd.runtime.v2.task`
are still created with 0o711.
> This is an expected behavior for supporting userns-remapped
containers.

##### Workarounds

The system administrator on the host can manually chmod the directories
to not
have group or world accessible permisisons:

```
chmod 700 /var/lib/containerd
chmod 700 /run/containerd/io.containerd.grpc.v1.cri
chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim
```

An alternative mitigation would be to run containerd in [rootless
mode](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md).

##### Credits

The containerd project would like to thank David Leadbeater for
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)

#### Severity
- CVSS Score: 7.3 / 10 (High)
- Vector String: `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)
-
[https://nvd.nist.gov/vuln/detail/CVE-2024-25621](https://nvd.nist.gov/vuln/detail/CVE-2024-25621)
-
[7c59e8e9e9)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)
-
[https://github.com/containerd/containerd/blob/main/docs/rootless.md](https://redirect.github.com/containerd/containerd/blob/main/docs/rootless.md)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-pwhc-rpq9-4c8w) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### containerd CRI server: Host memory exhaustion through Attach
goroutine leak
[CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329) /
[GHSA-m6hq-p25p-ffr2](https://redirect.github.com/advisories/GHSA-m6hq-p25p-ffr2)

<details>
<summary>More information</summary>

#### Details
##### Impact

A bug was found in containerd's CRI Attach implementation where a user
can exhaust memory on the host due to goroutine leaks.

Repetitive calls of CRI Attach (e.g., [`kubectl
attach`](https://kubernetes.io/docs/reference/kubectl/generated/kubectl_attach/))
could increase the memory usage of containerd.

##### Patches

This bug has been fixed in the following containerd versions:

* 2.2.0
* 2.1.5
* 2.0.7
* 1.7.29

Users should update to these versions to resolve the issue.

##### Workarounds

Set up an admission controller to control accesses to `pods/attach`
resources.
e.g., [Validating Admission
Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/).

##### Credits

The containerd project would like to thank @&#8203;Wheat2018 for
responsibly disclosing this issue in accordance with the [containerd
security
policy](https://redirect.github.com/containerd/project/blob/main/SECURITY.md).

##### References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329

##### For more information

If you have any questions or comments about this advisory:

* Open an issue in
[containerd](https://redirect.github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:

* [Report a new
vulnerability](https://redirect.github.com/containerd/containerd/security/advisories/new)

#### Severity
- CVSS Score: Unknown
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)
-
[https://nvd.nist.gov/vuln/detail/CVE-2025-64329](https://nvd.nist.gov/vuln/detail/CVE-2025-64329)
-
[083b53cd6f)
-
[https://github.com/containerd/containerd](https://redirect.github.com/containerd/containerd)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-m6hq-p25p-ffr2) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

####
[GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h)

### Summary

Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.

### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:


98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value:


1a66224d5e/mapstructure.go (L679-L686)


1a66224d5e/mapstructure.go (L726-L730)


1a66224d5e/mapstructure.go (L783-L787)

& more.

### PoC

To reproduce with OpenBao:

```
$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}
```

### Impact

This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

####
[GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm)

### Summary

Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.

### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:


98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value via `strconv` helpers:


8c61ec1924/mapstructure.go (L720-L727)


8c61ec1924/mapstructure.go (L791-L798)


8c61ec1924/decode_hooks.go (L180)

& more. These are different code paths than are fixed in the previous
iteration at
https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.

### PoC

To reproduce with OpenBao:

```
$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"

--> server logs:

2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""
```

### Impact

This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

---

### mapstructure May Leak Sensitive Information in Logs When Processing
Malformed Data

[GHSA-fv92-fjc5-jj9h](https://redirect.github.com/advisories/GHSA-fv92-fjc5-jj9h)
/ [GO-2025-3787](https://pkg.go.dev/vuln/GO-2025-3787)

<details>
<summary>More information</summary>

#### Details
##### Summary

Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.

##### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:


98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value:


1a66224d5e/mapstructure.go (L679-L686)


1a66224d5e/mapstructure.go (L726-L730)


1a66224d5e/mapstructure.go (L783-L787)

& more.

##### PoC

To reproduce with OpenBao:

```
$ podman run -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"password":{"asdf":"my-sensitive-value"}}' "http://localhost:8300/v1/auth/userpass/users/adsf"
{"errors":["error converting input for field \"password\": '' expected type 'string', got unconvertible type 'map[string]interface {}', value: 'map[asdf:my-sensitive-value]'"]}
```

##### Impact

This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`

#### References
-
[https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h)
-
[https://github.com/go-viper/mapstructure](https://redirect.github.com/go-viper/mapstructure)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-fv92-fjc5-jj9h) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### May leak sensitive information in logs when processing malformed
data in github.com/go-viper/mapstructure

[GHSA-fv92-fjc5-jj9h](https://redirect.github.com/advisories/GHSA-fv92-fjc5-jj9h)
/ [GO-2025-3787](https://pkg.go.dev/vuln/GO-2025-3787)

<details>
<summary>More information</summary>

#### Details
May leak sensitive information in logs when processing malformed data in
github.com/go-viper/mapstructure

#### Severity
Unknown

#### References
-
[https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3787) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Go-viper's mapstructure May Leak Sensitive Information in Logs in
github.com/go-viper/mapstructure

[GHSA-2464-8j7c-4cjm](https://redirect.github.com/advisories/GHSA-2464-8j7c-4cjm)
/ [GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900)

<details>
<summary>More information</summary>

#### Details
Go-viper's mapstructure May Leak Sensitive Information in Logs in
github.com/go-viper/mapstructure

#### Severity
Unknown

#### References
-
[https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm)
-
[742921c9ba)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3900) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### go-viper's mapstructure May Leak Sensitive Information in Logs When
Processing Malformed Data

[GHSA-2464-8j7c-4cjm](https://redirect.github.com/advisories/GHSA-2464-8j7c-4cjm)
/ [GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900)

<details>
<summary>More information</summary>

#### Details
##### Summary

Use of this library in a security-critical context may result in leaking
sensitive information, if used to process sensitive fields.

##### Details

OpenBao (and presumably HashiCorp Vault) have surfaced error messages
from `mapstructure` as follows:


98c3a59c04/sdk/framework/field_data.go (L43-L50)

```go
			_, _, err := d.getPrimitive(field, schema)
			if err != nil {
				return fmt.Errorf("error converting input for field %q: %w", field, err)
			}
```

where this calls `mapstructure.WeakDecode(...)`:
98c3a59c04/sdk/framework/field_data.go (L181-L193)

```go

func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
	raw, ok := d.Raw[k]
	if !ok {
		return nil, false, nil
	}

	switch t := schema.Type; t {
	case TypeBool:
		var result bool
		if err := mapstructure.WeakDecode(raw, &result); err != nil {
			return nil, false, err
		}
		return result, true, nil
```

Notably, `WeakDecode(...)` eventually calls one of the decode helpers,
which surfaces the original value via `strconv` helpers:


8c61ec1924/mapstructure.go (L720-L727)


8c61ec1924/mapstructure.go (L791-L798)


8c61ec1924/decode_hooks.go (L180)

& more. These are different code paths than are fixed in the previous
iteration at
https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.

##### PoC

To reproduce with OpenBao:

```
$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
```

and in a new tab:

```
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"

--> server logs:

2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""
```

##### Impact

This is an information disclosure bug with little mitigation. See
https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717
for a previous version. That version was fixed, but this is in the
second part of that error message (starting at `'' expected a map, got
'string'` -- when the field type is `string` and a `map` is provided, we
see the above information leak -- the previous example had a `map` type
field with a `string` value provided).

This was rated 4.5 Medium by HashiCorp in the past iteration.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`

#### References
-
[https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm](https://redirect.github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm)
-
[742921c9ba)
-
[https://github.com/go-viper/mapstructure](https://redirect.github.com/go-viper/mapstructure)
-
[https://pkg.go.dev/vuln/GO-2025-3900](https://pkg.go.dev/vuln/GO-2025-3900)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-2464-8j7c-4cjm) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

####
[CVE-2025-58058](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9)

### Summary

It is possible to put data in front of an LZMA-encoded byte stream
without detecting the situation while reading the header. This can lead
to increased memory consumption because the current implementation
allocates the full decoding buffer directly after reading the header.
The LZMA header doesn't include a magic number or has a checksum to
detect such an issue according to the
[specification](https://redirect.github.com/jljusten/LZMA-SDK/blob/master/DOC/lzma-specification.txt).

Note that the code recognizes the issue later while reading the stream,
but at this time the memory allocation has already been done.

### Mitigations

The release v0.5.15 includes following mitigations:

- The ReaderConfig DictCap field is now interpreted as a limit for the
dictionary size.
- The default is 2 Gigabytes - 1 byte (2^31-1 bytes).
- Users can check with the [Reader.Header] method what the actual values
are in their LZMA files and set a smaller limit using ReaderConfig.
- The dictionary size will not exceed the larger of the file size and
the minimum dictionary size. This is another measure to prevent huge
memory allocations for the dictionary.
- The code supports stream sizes only up to a pebibyte (1024^5).

Note that the original v0.5.14 version had a compiler error for 32 bit
platforms, which has been fixed by v0.5.15.

### Methods affected

Only software that uses
[lzma.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#NewReader)
or
[lzma.ReaderConfig.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#ReaderConfig.NewReader)
is affected. There is no issue for software using the xz functionality.

I thank  @&#8203;GregoryBuligin for his report, which is provided below.

### Summary
When unpacking a large number of LZMA archives, even in a single
goroutine, if the first byte of the archive file is 0 (a zero byte added
to the beginning), an error __writeMatch: distance out of range__
occurs. Memory consumption spikes sharply, and the GC clearly cannot
handle this situation.

### Details
Judging by the error __writeMatch: distance out of range__, the problems
occur in the code around this function.

c8314b8f21/lzma/decoderdict.go (L81)

### PoC
Run a function similar to this one in 1 or several goroutines on a
multitude of LZMA archives that have a 0 (a zero byte) added to the
beginning.
```
const ProjectLocalPath = "some/path"
const TmpDir = "tmp"

func UnpackLZMA(lzmaFile string) error {
	file, err := os.Open(lzmaFile)
	if err != nil {
		return err
	}
	defer file.Close()

	reader, err := lzma.NewReader(bufio.NewReader(file))
	if err != nil {
		return err
	}

	tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix)
	if err != nil {
		return err
	}
	defer func() {
		tmpFile.Close()
		_ = os.Remove(tmpFile.Name())
	}()

	sha256Hasher := sha256.New()
	multiWriter := io.MultiWriter(tmpFile, sha256Hasher)

	if _, err = io.Copy(multiWriter, reader); err != nil {
		return err
	}

	unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil))
	unpackDir := filepath.Join(
		ProjectLocalPath, unpackHash[:2],
	)
	_ = os.MkdirAll(unpackDir, DirPerm)

	unpackPath := filepath.Join(unpackDir, unpackHash)

	return os.Rename(tmpFile.Name(), unpackPath)
}
```

### Impact
Servers with a small amount of RAM that download and unpack a large
number of unverified LZMA archives

---

### github.com/ulikunitz/xz leaks memory when decoding a corrupted
multiple LZMA archives
[CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) /
[GHSA-jc7w-c686-c4v9](https://redirect.github.com/advisories/GHSA-jc7w-c686-c4v9)
/ [GO-2025-3922](https://pkg.go.dev/vuln/GO-2025-3922)

<details>
<summary>More information</summary>

#### Details
##### Summary

It is possible to put data in front of an LZMA-encoded byte stream
without detecting the situation while reading the header. This can lead
to increased memory consumption because the current implementation
allocates the full decoding buffer directly after reading the header.
The LZMA header doesn't include a magic number or has a checksum to
detect such an issue according to the
[specification](https://redirect.github.com/jljusten/LZMA-SDK/blob/master/DOC/lzma-specification.txt).

Note that the code recognizes the issue later while reading the stream,
but at this time the memory allocation has already been done.

##### Mitigations

The release v0.5.15 includes following mitigations:

- The ReaderConfig DictCap field is now interpreted as a limit for the
dictionary size.
- The default is 2 Gigabytes - 1 byte (2^31-1 bytes).
- Users can check with the [Reader.Header] method what the actual values
are in their LZMA files and set a smaller limit using ReaderConfig.
- The dictionary size will not exceed the larger of the file size and
the minimum dictionary size. This is another measure to prevent huge
memory allocations for the dictionary.
- The code supports stream sizes only up to a pebibyte (1024^5).

Note that the original v0.5.14 version had a compiler error for 32 bit
platforms, which has been fixed by v0.5.15.

##### Methods affected

Only software that uses
[lzma.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#NewReader)
or
[lzma.ReaderConfig.NewReader](https://pkg.go.dev/github.com/ulikunitz/xz/lzma#ReaderConfig.NewReader)
is affected. There is no issue for software using the xz functionality.

I thank  @&#8203;GregoryBuligin for his report, which is provided below.

##### Summary
When unpacking a large number of LZMA archives, even in a single
goroutine, if the first byte of the archive file is 0 (a zero byte added
to the beginning), an error __writeMatch: distance out of range__
occurs. Memory consumption spikes sharply, and the GC clearly cannot
handle this situation.

##### Details
Judging by the error __writeMatch: distance out of range__, the problems
occur in the code around this function.

c8314b8f21/lzma/decoderdict.go (L81)

##### PoC
Run a function similar to this one in 1 or several goroutines on a
multitude of LZMA archives that have a 0 (a zero byte) added to the
beginning.
```
const ProjectLocalPath = "some/path"
const TmpDir = "tmp"

func UnpackLZMA(lzmaFile string) error {
	file, err := os.Open(lzmaFile)
	if err != nil {
		return err
	}
	defer file.Close()

	reader, err := lzma.NewReader(bufio.NewReader(file))
	if err != nil {
		return err
	}

	tmpFile, err := os.CreateTemp(TmpDir, TmpLZMAPrefix)
	if err != nil {
		return err
	}
	defer func() {
		tmpFile.Close()
		_ = os.Remove(tmpFile.Name())
	}()

	sha256Hasher := sha256.New()
	multiWriter := io.MultiWriter(tmpFile, sha256Hasher)

	if _, err = io.Copy(multiWriter, reader); err != nil {
		return err
	}

	unpackHash := hex.EncodeToString(sha256Hasher.Sum(nil))
	unpackDir := filepath.Join(
		ProjectLocalPath, unpackHash[:2],
	)
	_ = os.MkdirAll(unpackDir, DirPerm)

	unpackPath := filepath.Join(unpackDir, unpackHash)

	return os.Rename(tmpFile.Name(), unpackPath)
}
```

##### Impact
Servers with a small amount of RAM that download and unpack a large
number of unverified LZMA archives

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9)
-
[https://nvd.nist.gov/vuln/detail/CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058)
-
[88ddf1d0d9)
-
[https://github.com/ulikunitz/xz](https://redirect.github.com/ulikunitz/xz)

This data is provided by
[OSV](https://osv.dev/vulnerability/GHSA-jc7w-c686-c4v9) and the [GitHub
Advisory Database](https://redirect.github.com/github/advisory-database)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Memory leaks when decoding a corrupted multiple LZMA archives in
github.com/ulikunitz/xz
[CVE-2025-58058](https://nvd.nist.gov/vuln/detail/CVE-2025-58058) /
[GHSA-jc7w-c686-c4v9](https://redirect.github.com/advisories/GHSA-jc7w-c686-c4v9)
/ [GO-2025-3922](https://pkg.go.dev/vuln/GO-2025-3922)

<details>
<summary>More information</summary>

#### Details
Memory leaks when decoding a corrupted multiple LZMA archives in
github.com/ulikunitz/xz

#### Severity
Unknown

#### References
-
[https://github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9](https://redirect.github.com/ulikunitz/xz/security/advisories/GHSA-jc7w-c686-c4v9)
-
[88ddf1d0d9)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2025-3922) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

#### [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181)

SSH servers parsing GSSAPI authentication requests do not validate the
number of mechanisms specified in the request, allowing an attacker to
cause unbounded memory consumption.

#### [CVE-2025-47914](https://nvd.nist.gov/vuln/detail/CVE-2025-47914)

SSH Agent servers do not validate the size of messages when processing
new identity requests, which may cause the program to panic if the
message is malformed due to an out of bounds read.

---

### Release Notes

<details>
<summary>containerd/containerd
(github.com/containerd/containerd/v2)</summary>

###
[`v2.0.7`](https://redirect.github.com/containerd/containerd/releases/tag/v2.0.7):
containerd 2.0.7

[Compare
Source](https://redirect.github.com/containerd/containerd/compare/v2.0.6...v2.0.7)

Welcome to the v2.0.7 release of containerd!

The seventh patch release for containerd 2.0 includes various bug fixes
and updates.

##### Security Updates

-   **containerd**
-
[**GHSA-pwhc-rpq9-4c8w**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)
-
[**GHSA-m6hq-p25p-ffr2**](https://redirect.github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)

-   **runc**
-
[**GHSA-qw9x-cqr3-wc7r**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r)
-
[**GHSA-cgrx-mc8f-2prm**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm)
-
[**GHSA-9493-h29p-rfm2**](https://redirect.github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2)

##### Highlights

##### Container Runtime Interface (CRI)

- **Disable event subscriber during task cleanup**
([#&#8203;12406](https://redirect.github.com/containerd/containerd/pull/12406))
- **Add SystemdCgroup to default runtime options**
([#&#8203;12254](https://redirect.github.com/containerd/containerd/pull/12254))
- **Fix userns with container image VOLUME mounts that need copy**
([#&#8203;12241](https://redirect.github.com/containerd/containerd/pull/12241))

##### Image Distribution

- **Add dial timeout field to hosts toml configuration**
([#&#8203;12136](https://redirect.github.com/containerd/containerd/pull/12136))

##### Runtime

- **Update runc binary to v1.3.3**
([#&#8203;12479](https://redirect.github.com/containerd/containerd/pull/12479))
- **Fix lost container logs from quickly closing io**
([#&#8203;12376](https://redirect.github.com/containerd/containerd/pull/12376))
- **Create bootstrap.json with 0644 permission**
([#&#8203;12184](https://redirect.github.com/containerd/containerd/pull/12184))
- **Fix pidfd leak in UnshareAfterEnterUserns**
([#&#8203;12178](https://redirect.github.com/containerd/containerd/pull/12178))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

##### Contributors

-   Austin Vazquez
-   Phil Estes
-   Rodrigo Campos
-   Wei Fu
-   Akihiro Suda
-   Derek McGowan
-   Maksym Pavlenko
-   ningmingxiao
-   Kirtana Ashok
-   Akhil Mohan
-   Andrew Halaney
-   Jin Dong
-   Jose Fernandez
-   Mike Baynton
-   Philip Laine
-   Swagat Bora
-   wheat2018

##### Changes

<details><summary>56 commits</summary>
<p>

- Prepare release notes for v2.0.7
([#&#8203;12482](https://redirect.github.com/containerd/containerd/pull/12482))
-
[`4931e24f1`](4931e24f16)
Prepare release notes for v2.0.7
-
[`205bc4f2d`](205bc4f2db)
Update mailmap
-
[`5f708b76a`](5f708b76a4)
Merge commit from fork
-
[`8cd112d82`](8cd112d829)
Fix directory permissions
-
[`05290b5bc`](05290b5bc8)
Merge commit from fork
-
[`4d1edf4ad`](4d1edf4add)
fix goroutine leak of container Attach
- Update runc binary to v1.3.3
([#&#8203;12479](https://redirect.github.com/containerd/containerd/pull/12479))
-
[`b46dc6a67`](b46dc6a67c)
runc: Update runc binary to v1.3.3
- ci: bump Go 1.24.9; 1.25.3
([#&#8203;12361](https://redirect.github.com/containerd/containerd/pull/12361))
-
[`5e9c82178`](5e9c821780)
Update GHA runners to use latest images for basic binaries build
-
[`7f59248dc`](7f59248dcd)
Update GHA runners to use latest image for most jobs
-
[`e1373e8a8`](e1373e8a8a)
ci: bump Go 1.24.9, 1.25.3
-
[`e1a910a6a`](e1a910a6a9)
ci: bump Go 1.24.8; 1.25.2
-
[`fd04b7f17`](fd04b7f176)
move exclude-dirs to issues.exclude-dirs
-
[`b49377975`](b493779751)
update golangci-lint to v1.64.2
-
[`6e45022a1`](6e45022a1e)
build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
-
[`09ce0f2a1`](09ce0f2a1e)
build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
-
[`de63a740b`](de63a740b8)
build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0
- Fix lost container logs from quickly closing io
([#&#8203;12376](https://redirect.github.com/containerd/containerd/pull/12376))
-
[`f953ee8a3`](f953ee8a3c)
bugfix:fix container logs lost because io close too quickly
- CI: update Fedora to 43
([#&#8203;12448](https://redirect.github.com/containerd/containerd/pull/12448))
-
[`f6f15f513`](f6f15f5135)
CI: update Fedora to 43
- Disable event subscriber during task cleanup
([#&#8203;12406](https://redirect.github.com/containerd/containerd/pull/12406))
-
[`2a2329cbd`](2a2329cbd0)
cri/server/podsandbox: disable event subscriber
- CI: skip ubuntu-24.04-arm on private repos
([#&#8203;12428](https://redirect.github.com/containerd/containerd/pull/12428))
-
[`dfb954743`](dfb9547437)
CI: skip ubuntu-24.04-arm on private repos
- Remove additional fuzzers from instrumentation repo
([#&#8203;12420](https://redirect.github.com/containerd/containerd/pull/12420))
-
[`f6b02f6bb`](f6b02f6bb8)
Remove additional fuzzers from CI
- runc:Update runc binary to v1.3.1
([#&#8203;12275](https://redirect.github.com/containerd/containerd/pull/12275))
-
[`75c13ee3f`](75c13ee3fc)
runc:Update runc binary to v1.3.1
- Add SystemdCgroup to default runtime options
([#&#8203;12254](https://redirect.github.com/containerd/containerd/pull/12254))
-
[`427cdd06c`](427cdd06c9)
add SystemdCgroup to default runtime options
- install-runhcs-shim: fetch target commit instead of tags
([#&#8203;12255](https://redirect.github.com/containerd/containerd/pull/12255))
-
[`0b35e19fb`](0b35e19fb1)
install-runhcs-shim: fetch target commit instead of tags
- Fix userns with container image VOLUME mounts that need copy
([#&#8203;12241](https://redirect.github.com/containerd/containerd/pull/12241))
-
[`3212afc2f`](3212afc2f2)
integration: Add test for directives with userns
-
[`b855c6e10`](b855c6e103)
cri: Fix userns with Dockerfile VOLUME mounts that need copy
- Fix overlayfs issues related to user namespace
([#&#8203;12223](https://redirect.github.com/containerd/containerd/pull/12223))
-
[`05c0c99f4`](05c0c99f43)
core/mount: Retry unmounting idmapped directories
-
[`afdede4ce`](afdede4ced)
core/mount: Test cleanup of DoPrepareIDMappedOverlay()
-
[`47205f814`](47205f814d)
core/mount: Properly cleanup on doPrepareIDMappedOverlay errors
-
[`6f4abd970`](6f4abd970a)
core/mount: Don't call nil function on errors
-
[`a2f0d65d7`](a2f0d65d78)
core/mount: Only idmap once per overlayfs, not per layer
-
[`1c32accd7`](1c32accd71)
Make ovl idmap mounts read-only
- ci: bump Go 1.23.12, 1.24.6
([#&#8203;12187](https://redirect.github.com/containerd/containerd/pull/12187))
-
[`9e72e91e6`](9e72e91e63)
ci: bump Go 1.23.12, 1.24.6
- Create bootstrap.json with 0644 permission
([#&#8203;12184](https://redirect.github.com/containerd/containerd/pull/12184))
-
[`009622e04`](009622e042)
fix: create bootstrap.json with 0644 permission
- Fix pidfd leak in UnshareAfterEnterUserns
([#&#8203;12178](https://redirect.github.com/containerd/containerd/pull/12178))
    -   [`5bec0a332`](https://redirec

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2025-11-20 20:33:06 +00:00
Pulumi Bot
c7ab0e0f35 Update GitHub Actions workflows. (#669)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 9575e75e5316d699a77abf48a351abe840e1bed5.
2025-11-20 05:54:04 +00:00
pulumi-renovate[bot]
b1e526630c Update module golang.org/x/crypto to v0.45.0 [SECURITY] (#668)
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| golang.org/x/crypto | require | minor | `v0.39.0` -> `v0.45.0` |

### GitHub Vulnerability Alerts

#### [CVE-2025-58181](https://nvd.nist.gov/vuln/detail/CVE-2025-58181)

SSH servers parsing GSSAPI authentication requests do not validate the
number of mechanisms specified in the request, allowing an attacker to
cause unbounded memory consumption.

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbXBhY3Qvbm8tY2hhbmdlbG9nLXJlcXVpcmVkIl19-->

---------

Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
Co-authored-by: pulumi-bot <bot@pulumi.com>
2025-11-20 02:14:14 +00:00
Pulumi Bot
32ecb82eb6 Update GitHub Actions workflows. (#667)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f76cbff100ad8e6e3192b379edb5bcf1f536eb3e.
2025-11-15 05:55:02 +00:00
Pulumi Bot
77b931b32c Update GitHub Actions workflows. (#666)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit ed916848970fd62ea0f62c7e6ac674d4d5ca05ef.
2025-11-14 05:58:25 +00:00
Pulumi Bot
487acd799c Update GitHub Actions workflows. (#663)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 962009a157587c5c11d686e51206a2d312bc4618.
2025-11-11 05:53:59 +00:00
Pulumi Bot
8e273d9f68 Update GitHub Actions workflows. (#662)
This PR was automatically generated by the
update-workflows-single-bridged-provider workflow in the pulumi/ci-mgmt
repo, from commit 52b77e4c448dd747630cff0918ade69cef3b4f16.
2025-11-10 15:47:40 -08:00
Pulumi Bot
faffc8cc45 Update GitHub Actions workflows. (#633)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 5619381e924fbac90750f41b6a27cadcd11c4c2d.
2025-10-22 05:56:54 +00:00
Alberto Pose
2b1230f252 Introduce ${GOTEST} Makefile variable to override test runner. (#632)
Allow to use other tools like `gotestsum` locally.
2025-10-20 15:20:48 +01:00
Pulumi Bot
eaf5461bbc Update GitHub Actions workflows. (#631)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit f0bcdaf5cb0825e542d0a2eb71f05d538135a9bc.
2025-10-18 05:52:38 +00:00
Alberto Pose
38e65a3f81 Remove URL and Token arguments from CacheFromGitHubActions. (#626)
Fixes #75

Arguments URL and Token have been removed but `$ACTIONS_CACHE_URL` and
`$ACTIONS_RUNTIME_TOKEN` env variables could be injected if desired.

---------

Co-authored-by: Bryce Lampe <bryce@pulumi.com>
2025-10-17 11:00:40 +01:00
Pulumi Bot
1811524e66 Update GitHub Actions workflows. (#629)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 16969054030269fefacac22b8536d1f80ed8e2d9.
2025-10-16 05:52:39 +00:00
Pulumi Bot
361335bba0 Update GitHub Actions workflows. (#628)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 0fccf404186fee66f0a9bb9b53959a52b4812c5e.
2025-10-14 05:54:14 +00:00
Pulumi Bot
49deed7d9c Update GitHub Actions workflows. (#627)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit b4e68d0418afb9fa72c1e31347a01f7fae952eff.
2025-10-10 05:51:39 +00:00
Alberto Pose
ff8995c434 Move _index.md and installation-configuration.md into the repo. (#622)
Related to: https://github.com/pulumi/registry/pull/8814

Make this provider follow the Pulumi official convention of [using the
`_index.md` and
`installation-configuration.md`](https://www.pulumi.com/docs/iac/build-with-pulumi/publishing-packages/#write-documentation).
2025-10-09 09:34:35 +01:00
Pulumi Bot
c159079132 Update GitHub Actions workflows. (#624)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 45de636c4cb364e6fc2ab50006d5358239005657.
2025-10-09 05:52:11 +00:00
Pulumi Bot
24ebad1ee5 Update GitHub Actions workflows. (#623)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 93823adfede429861d981e43f485afda9292376e.
2025-10-08 05:55:33 +00:00
Alberto Pose
40c723d82f Remove installation of pulumi CLI and golangci-lint from Makefile (#621)
Installation of runtime and tools should now be done through `mise`.

In addition, the following binaries are included with `pulumi` CLI:

* pulumi-language-go
* pulumi-language-nodejs
* pulumi-language-python
* pulumi-language-java
* pulumi-language-dotnet
* pulumi-converter-yaml
2025-10-07 16:18:53 +01:00
Pulumi Bot
36362d0317 Update GitHub Actions workflows. (#620)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 23f84aba12118601865d1a686c2c46a4ec3fa729.
2025-10-03 22:26:52 +00:00
Pulumi Bot
0b684b81fb Update GitHub Actions workflows. (#619)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 58bbf9b943afc66c10382b6fa89dc3e226f18f20.
2025-10-03 05:53:37 +00:00
Pulumi Bot
ebf4290bb2 Update GitHub Actions workflows. (#617)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 72d9a2e28cf75e7d1ba2c5e6324d26546c95e4cb.
2025-10-02 05:55:45 +00:00
Pulumi Bot
c7b2867559 Update GitHub Actions workflows. (#616)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit d2d946e761bab19abc5e5a598d44cf709dae77e9.
2025-10-01 05:54:01 +00:00
Bryce Lampe
5e589f61ec Upgrade go-provider to 1.1.2 (#615)
Fixes https://github.com/pulumi/pulumi-docker-build/issues/579.
2025-09-30 16:40:35 -07:00
Pulumi Bot
5f0c2ede72 Update GitHub Actions workflows. (#613)
This PR was automatically generated by the
update-workflows-single-bridged-provider workflow in the pulumi/ci-mgmt
repo, from commit f16439eadce749cfc5fc959f926069e5943f4640.
2025-09-29 22:24:54 +00:00
Pulumi Bot
d27e6d14db Update GitHub Actions workflows. (#612)
This PR was automatically generated by the
update-workflows-single-bridged-provider workflow in the pulumi/ci-mgmt
repo, from commit e43a0e1c1f44e3e431240deb0ac363cf172ae9a9.
2025-09-29 15:36:43 -04:00
Cory Hall
6ae16f10ff chore: update modulePath in ci-mgmt (#607)
This is needed for https://github.com/pulumi/ci-mgmt/pull/1730
2025-09-29 12:01:37 -04:00
Pulumi Bot
f17e43bad7 Update GitHub Actions workflows. (#604)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 2b81d6d332c32c7ebc106fb53b745cbbfec266c7.
2025-09-16 05:49:46 +00:00
Pulumi Bot
bce330f598 Update GitHub Actions workflows. (#603)
This PR was automatically generated by the
update-workflows-ecosystem-providers workflow in the pulumi/ci-mgmt
repo, from commit 0337d8381eace02d1b6fb82d43e3ab543bf5774a.
2025-09-12 23:58:08 +00:00
Pulumi Bot
5107181566 Update GitHub Actions workflows. (#602)
This PR was automatically generated by the
update-workflows-single-bridged-provider workflow in the pulumi/ci-mgmt
repo, from commit c390ce58d72b0eb947d844358c3204353b21839c.
2025-09-11 19:03:02 +00:00
425 changed files with 253 additions and 60907 deletions

View File

@@ -1,28 +0,0 @@
template: native
provider: docker-build
major-version: 0
providerDefaultBranch: main
providerVersion: github.com/pulumi/pulumi-docker-build/provider.Version
aws: true
gcp: true
sdkModuleDir: sdk/go/dockerbuild
parallel: 3
esc:
enabled: true
envOverride:
AWS_REGION: us-west-2
PULUMI_API: "https://api.pulumi-staging.io"
ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
AZURE_LOCATION: westus
DIGITALOCEAN_TOKEN: ${{ secrets.DIGITALOCEAN_TOKEN }}
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
GOOGLE_PROJECT: pulumi-ci-gcp-provider
GOOGLE_PROJECT_NUMBER: 895284651812
GOOGLE_REGION: us-central1
GOOGLE_ZONE: us-central1-a
DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}

Submodule .devcontainer deleted from dce1e31630

View File

@@ -1,68 +0,0 @@
// Reference:
// - https://containers.dev/features
// - https://containers.dev/implementors/features
// - https://code.visualstudio.com/docs/getstarted/settings
{
"name": "pulumi",
"image": "ghcr.io/pulumi/devcontainer",
"customizations": {
"vscode": {
"settings": [
"go.testTags", "all",
"go.buildTags", "all",
"editor.minimap.enabled", false,
"explorer.openEditors.visible", 1,
"editor.quickSuggestionsDelay", 0,
"editor.suggestSelection", "first",
"editor.snippetSuggestions", "top",
"editor.gotoLocation.multipleReferences", "goto",
"editor.gotoLocation.multipleDefinitions", "goto",
"editor.gotoLocation.multipleDeclarations", "goto",
"editor.gotoLocation.multipleImplementations", "goto",
"editor.gotoLocation.multipleTypeDefinitions", "goto",
"editor.terminal.integrated.shell.linux", "/usr/bin/zsh",
"files.trimTrailingWhitespace", true,
"files.trimFinalNewlines", true
],
"extensions": [
"golang.go",
"vscodevim.vim",
"github.copilot",
"ms-python.python",
"jetpack-io.devbox",
"redhat.vscode-yaml",
"esbenp.prettier-vscode",
"ms-vscode.makefile-tools",
"ms-azuretools.vscode-docker",
"github.vscode-pull-request-github",
"ms-vscode-remote.remote-containers",
"visualstudioexptteam.vscodeintellicode",
"bierner.markdown-preview-github-styles"
]
}
},
"features": {
"ghcr.io/devcontainers/features/common-utils:2": {
"installZsh": true,
"configureZshAsDefaultShell": true,
"installOhMyZsh": true,
"installOhMyZshConfig": true,
"upgradePackages": true,
"nonFreePackages": true,
"username": "vscode",
"userUid": "automatic",
"userGid": "automatic"
},
"ghcr.io/devcontainers/features/docker-outside-of-docker:1": {
"moby": false,
"installDockerBuildx": true,
"version": "latest",
"dockerDashComposeVersion": "v2"
}
},
"postCreateCommand": "git submodule update --init --recursive",
"remoteUser": "vscode",
"forwardPorts": [1313],
"runArgs": ["--network=host"]
}

2
.gitattributes vendored
View File

@@ -1,2 +0,0 @@
sdk/**/* linguist-generated=true
provider/internal/mock*.go linguist-generated=true

View File

@@ -1,69 +0,0 @@
name: Bug Report
description: Report something that's not working correctly
labels: ["kind/bug", "needs-triage"]
body:
- type: markdown
attributes:
value: |
Thanks for taking the time to fill out this bug report!
You can also ask questions on our [Community Slack](https://slack.pulumi.com/).
- type: textarea
id: what-happened
attributes:
label: Describe what happened
description: Please summarize what happened, including what Pulumi commands you ran, as well as
an inline snippet of any relevant error or console output.
validations:
required: true
- type: textarea
id: sample-program
attributes:
label: Sample program
description: |
<details><summary>Provide a reproducible sample program</summary>
If this is a bug you encountered while running a Pulumi command, please provide us with a minimal,
self-contained Pulumi program that reproduces this behavior so that we can investigate on our end.
Without a functional reproduction, we will not be able to prioritize this bug.
**Note:** If the program output is more than a few lines, please send us a Gist or a link to a file.
</details>
validations:
required: true
- type: textarea
id: log-output
attributes:
label: Log output
description: |
<details><summary>How to Submit Logs</summary>
If this is something that is dependent on your environment, please also provide us with the output of
`pulumi up --logtostderr --logflow -v=10` from the root of your project.
We may also ask you to supply us with debug output following [these steps](https://www.pulumi.com/docs/using-pulumi/pulumi-packages/debugging-provider-packages/).
**Note:** If the log output is more than a few lines, please send us a Gist or a link to a file.
</details>
- type: textarea
id: resources
attributes:
label: Affected Resource(s)
description: Please list the affected Pulumi Resource(s) or Function(s).
validations:
required: false
- type: textarea
id: versions
attributes:
label: Output of `pulumi about`
description: Provide the output of `pulumi about` from the root of your project.
validations:
required: true
- type: textarea
id: ctx
attributes:
label: Additional context
description: Anything else you would like to add?
validations:
required: false
- type: textarea
id: voting
attributes:
label: Contributing
value: |
Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

View File

@@ -1,35 +0,0 @@
---
name: Epic
about: Tracks a shippable unit of work
title: '[Epic] {your-title-here}'
labels: kind/epic
projects: ['pulumi/32']
assignees: ''
type: Epic
---
## Overview
<!-- Start with a one- to three-sentence summary that should be understandable by any Pulumian or community member, even those without any context on the work. -->
## Key KPIs
<!-- What KPIs should this Epic will move; what could we measure to observe that this project was successful? -->
## Key Stakeholders
- Product and Engineering: <!-- Teams and individuals involved in the design and implementation -->
- Documentation: <!-- Representative from the docs team -->
- Marketing/Partnerships: <!-- Representative from the Marketing team -->
- Customers: <!-- [Tracking Issue](add-link-and-uncomment) -->
## Key Deliverables
<!-- List any discrete chunks of work or milestones that are planned in the epic (eg. subcomponent A, dogfood release, beta, etc.) -->
### References 📔
<!-- Any project that is more than one iteration should have a Project Board using this [template](https://github.com/orgs/pulumi/projects/131). -->
- [ ] Project View <!-- [Link](add-link-and-uncomment) -->
- [ ] PR/FAQ <!-- [Link](add-link-and-uncomment) -->
- [ ] Design Doc <!-- [Link](add-link-and-uncomment) -->
- [ ] UX Designs <!-- [Link](add-link-and-uncomment) -->
- [ ] Decision Log <!-- [Link](add-link-and-uncomment) -->
<!-- Work items should be added to the project board linked above -->

View File

@@ -1,12 +0,0 @@
name: "Load secrets"
description: |
This is a temporary action which assists with our migration to ESC. Instead
of surrounding every step that references secrets with an "if ESC" block, we
instead modify those steps to consume their secrets from this step's outputs.
Then, later, we can replace this action with esc-action to actually load
secrets from ESC.
inputs: {}
outputs: {}
runs:
using: "node20"
main: "index.js"

View File

@@ -1,14 +0,0 @@
const fs = require("fs");
const file = process.env["GITHUB_OUTPUT"];
var stream = fs.createWriteStream(file, { flags: "a" });
for (const [name, value] of Object.entries(process.env)) {
try {
stream.write(`${name}<<EEEOOOFFF\n${value}\nEEEOOOFFF\n`); // << syntax accommodates multiline strings.
} catch (err) {
console.log(`error: failed to set output for ${name}: ${err.message}`);
}
}
stream.end();

View File

@@ -1,748 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
name: main # For consistency with bridged providers.
on:
push:
branches:
- master
- main
- feature-**
paths-ignore:
- CHANGELOG.md
tags-ignore:
- v*
- sdk/*
- "**"
workflow_dispatch: {}
env:
PROVIDER: docker-build
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
TRAVIS_OS_NAME: linux
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
GOVERSION: "1.21.x"
NODEVERSION: "20.x"
PYTHONVERSION: "3.11.8"
DOTNETVERSION: "8.0.x"
JAVAVERSION: "11"
ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
AWS_REGION: us-west-2
AZURE_LOCATION: westus
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
GOOGLE_PROJECT: pulumi-ci-gcp-provider
GOOGLE_PROJECT_NUMBER: "895284651812"
GOOGLE_REGION: us-central1
GOOGLE_ZONE: us-central1-a
PULUMI_API: https://api.pulumi-staging.io
jobs:
prerequisites:
runs-on: ubuntu-latest
name: prerequisites
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- if: github.event_name == 'pull_request'
name: Install Schema Tools
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/schema-tools
- name: Build codegen binaries
run: make codegen
- name: Build Schema
run: make generate_schema
- if: github.event_name == 'pull_request'
name: Check Schema is Valid
run: >-
{
echo 'SCHEMA_CHANGES<<EOF';
schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
echo 'EOF';
} >> "$GITHUB_ENV"
env:
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
- if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
name: Comment on PR with Details of Schema Check
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with:
message: |
${{ env.SCHEMA_CHANGES }}
comment-tag: schemaCheck
github-token: ${{ secrets.GITHUB_TOKEN }}
- if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
github.actor == 'pulumi-bot'
name: Add label if no breaking changes
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
with:
labels: impact/no-changelog-required
number: ${{ github.event.issue.number }}
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Build Provider
run: make provider
- name: Check worktree clean
id: worktreeClean
uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
with:
allowed-changes: |-
sdk/**/pulumi-plugin.json
sdk/dotnet/*.*.csproj
sdk/dotnet/version.txt
sdk/go/**/pulumiUtilities.go
sdk/nodejs/package.json
sdk/python/pyproject.toml
- name: Commit SDK changes for Renovate
if: failure() && steps.worktreeClean.outcome == 'failure' &&
contains(github.actor, 'renovate') && github.event_name ==
'pull_request'
shell: bash
run: >
git diff --quiet -- sdk && echo "no changes to sdk" && exit
git config --global user.email "bot@pulumi.com"
git config --global user.name "pulumi-bot"
# Stash local changes and check out the PR's branch directly.
git stash
git fetch
git checkout "origin/$HEAD_REF"
# Apply and add our changes, but don't commit any files we expect to
# always change due to versioning.
git stash pop
git add sdk
git reset sdk/python/*/pulumi-plugin.json \
sdk/python/pyproject.toml \
sdk/dotnet/pulumi-plugin.json \
sdk/dotnet/*.*.csproj \
sdk/dotnet/version.txt \
sdk/go/*/pulumi-plugin.json \
sdk/go/*/internal/pulumiUtilities.go \
sdk/nodejs/package.json
git commit -m 'Commit SDK for Renovate'
# Push with pulumi-bot credentials to trigger a re-run of the
# workflow. https://github.com/orgs/community/discussions/25702
git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
- run: git status --porcelain
- name: Tar provider binaries
run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
pulumi-gen-${{ env.PROVIDER}}
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin/provider.tar.gz
- name: Test Provider Library
run: make test_provider
env:
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
DOCKER_HUB_PASSWORD: ${{ steps.esc-secrets.outputs.DOCKER_HUB_PASSWORD }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
env:
CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in building provider prerequisites
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
build_sdks:
needs: prerequisites
runs-on: pulumi-ubuntu-8core
strategy:
fail-fast: ${{ ! contains(github.actor, 'renovate') }}
matrix:
language:
- nodejs
- python
- dotnet
- go
- java
name: build_sdks
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download provider
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin
- name: UnTar provider binaries
run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin
- name: Restore Binary Permissions
run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-exec chmod +x {} \;
- name: Generate SDK
run: make generate_${{ matrix.language }}
- name: Build SDK
run: make build_${{ matrix.language }}
- name: Check worktree clean
id: worktreeClean
uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
with:
allowed-changes: |-
sdk/**/pulumi-plugin.json
sdk/dotnet/*.*.csproj
sdk/dotnet/version.txt
sdk/go/**/pulumiUtilities.go
sdk/nodejs/package.json
sdk/python/pyproject.toml
- name: Commit SDK changes for Renovate
if: failure() && steps.worktreeClean.outcome == 'failure' &&
contains(github.actor, 'renovate') && github.event_name ==
'pull_request'
shell: bash
run: >
git diff --quiet -- sdk && echo "no changes to sdk" && exit
git config --global user.email "bot@pulumi.com"
git config --global user.name "pulumi-bot"
# Stash local changes and check out the PR's branch directly.
git stash
git fetch
git checkout "origin/$HEAD_REF"
# Apply and add our changes, but don't commit any files we expect to
# always change due to versioning.
git stash pop
git add sdk
git reset sdk/python/*/pulumi-plugin.json \
sdk/python/pyproject.toml \
sdk/dotnet/pulumi-plugin.json \
sdk/dotnet/*.*.csproj \
sdk/dotnet/version.txt \
sdk/go/*/pulumi-plugin.json \
sdk/go/*/internal/pulumiUtilities.go \
sdk/nodejs/package.json
git commit -m 'Commit SDK for Renovate'
# Push with pulumi-bot credentials to trigger a re-run of the
# workflow. https://github.com/orgs/community/discussions/25702
git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
- run: git status --porcelain
- name: Tar SDK folder
run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ matrix.language }}-sdk.tar.gz
path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
retention-days: 30
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure while building SDKs
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
tag_release_if_labeled_needs_release:
name: Tag release if labeled as needs-release
needs: publish
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- name: check if this commit needs release
if: ${{ env.RELEASE_BOT_ENDPOINT != '' }}
uses: pulumi/action-release-by-pr-label@main
with:
command: "release-if-needed"
repo: ${{ github.repository }}
commit: ${{ github.sha }}
slack_channel: C02MGR8JVST
env:
RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }}
RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
test:
runs-on: pulumi-ubuntu-8core
needs:
- build_sdks
strategy:
fail-fast: true
matrix:
language:
- nodejs
- python
- dotnet
- go
- java
- yaml
name: test
permissions:
contents: read
id-token: write
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download provider
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin
- name: UnTar provider binaries
run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin
- name: Restore Binary Permissions
run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-exec chmod +x {} \;
- name: Download SDK
if: ${{ matrix.language != 'yaml' }}
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: ${{ matrix.language }}-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: UnTar SDK folder
if: ${{ matrix.language != 'yaml' }}
run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
github.workspace}}/sdk/${{ matrix.language}}
- name: Update path
run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
- name: Install Node dependencies
run: yarn global add typescript
- run: dotnet nuget add source ${{ github.workspace }}/nuget
- name: Install Python deps
run: |-
pip3 install virtualenv==20.0.23
pip3 install pipenv
- name: Install dependencies
if: ${{ matrix.language != 'yaml' }}
run: make install_${{ matrix.language}}_sdk
- name: Generate Pulumi Access Token
id: generate_pulumi_token
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
with:
organization: pulumi
requested-token-type: urn:pulumi:token-type:access_token:organization
export-environment-variables: false
- name: Export AWS Credentials
uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
env:
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
with:
environment: logins/pulumi-ci
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
}}/locations/global/workloadIdentityPools/${{
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
- name: Setup gcloud auth
uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
with:
install_components: gke-gcloud-auth-plugin
- name: Install gotestfmt
uses: GoTestTools/gotestfmt-action@v2
with:
version: v2.5.0
token: ${{ secrets.GITHUB_TOKEN }}
- name: Run tests
run: >-
set -euo pipefail
cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in SDK tests
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
publish:
runs-on: ubuntu-latest
needs: test
name: publish
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Clear GitHub Actions Ubuntu runner disk space
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
with:
tool-cache: false
dotnet: false
android: true
haskell: true
swap-storage: true
large-packages: false
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
with:
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
aws-region: us-east-2
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
role-duration-seconds: 7200
role-session-name: ${{ env.PROVIDER }}@githubActions
role-external-id: upload-pulumi-release
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
env:
GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
AZURE_SIGNING_KEY_VAULT_URI: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI }}
SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI == '' }}
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
with:
args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
version: latest
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in publishing binaries
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
publish_sdk:
runs-on: ubuntu-latest
needs: publish
name: publish_sdk
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Checkout Scripts Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
path: ci-scripts
repository: pulumi/scripts
- run: echo "ci-scripts" >> .git/info/exclude
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Download python SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: python-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress python SDK
run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
${{github.workspace}}/sdk/python
- name: Download dotnet SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: dotnet-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress dotnet SDK
run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
${{github.workspace}}/sdk/dotnet
- name: Download nodejs SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: nodejs-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress nodejs SDK
run: tar -zxf ${{github.workspace}}/sdk/nodejs.tar.gz -C
${{github.workspace}}/sdk/nodejs
- name: Install Twine
run: python -m pip install twine==5.0.0
- name: Publish SDKs
run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
env:
NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
PYPI_PUBLISH_ARTIFACTS: all
PYPI_USERNAME: __token__
PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in publishing SDK
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
lint:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
persist-credentials: false
ref: ${{ env.PR_COMMIT_SHA }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Disarm go:embed directives to enable linters that compile source code
run: git grep -l 'go:embed' -- provider | xargs --no-run-if-empty sed -i
's/go:embed/ goembed/g'
- name: golangci-lint provider pkg
uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
with:
version: ${{ env.GOLANGCI_LINT_VERSION }}
args: -c ../.golangci.yml
working-directory: provider
name: lint
if: github.event_name == 'repository_dispatch' ||
github.event.pull_request.head.repo.full_name == github.repository

View File

@@ -1,50 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
env:
ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
AWS_REGION: us-west-2
AZURE_LOCATION: westus
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
GOOGLE_PROJECT: pulumi-ci-gcp-provider
GOOGLE_PROJECT_NUMBER: "895284651812"
GOOGLE_REGION: us-central1
GOOGLE_ZONE: us-central1-a
PULUMI_API: https://api.pulumi-staging.io
jobs:
command-dispatch-for-testing:
name: command-dispatch-for-testing
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- uses: peter-evans/slash-command-dispatch@13bc09769d122a64f75aa5037256f6f2d78be8c4 # v4
with:
commands: |
run-acceptance-tests
release
issue-type: pull-request
permission: write
reaction-token: ${{ secrets.GITHUB_TOKEN }}
repository: pulumi/pulumi-docker-build
token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
name: command-dispatch
on:
issue_comment:
types:
- created
- edited

View File

@@ -1,42 +0,0 @@
name: "Comment on stale issues"
on:
schedule:
- cron: "46 4 * * *" # run once per day
jobs:
cleanup:
runs-on: ubuntu-latest
name: Stale issue job
steps:
- uses: aws-actions/stale-issue-cleanup@5650b49bcd757a078f6ca06c373d7807b773f9bc #v7.1.0
with:
issue-types: issues # only look at issues (ignore pull-requests)
# Setting messages to an empty string causes the automation to skip that category
ancient-issue-message: "Unfortunately, it looks like this issue hasn't seen any updates in a while. If you're still experiencing this issue, could you leave a quick comment to let us know so we can prioritize it?"
ancient-pr-message: ""
stale-issue-message: ""
stale-pr-message: ""
# These labels are required
stale-issue-label: awaiting-feedback # somewhat confusingly, this is also used for when labeling "ancient" issues
exempt-issue-labels: kind/enhancement,kind/task,kind/epic,kind/engineering, awaiting-upstream # only run on kind/bug for now, ignore awaiting-upstream too.
stale-pr-label: no-pr-activity # unused because we aren't processing PRs
exempt-pr-labels: awaiting-approval # unused because we aren't processing PRs
response-requested-label: response-requested # unused because we don't set a "stale-issue-message" above
# Issue timing
days-before-close: 10000 # this action lacks the option not to close, so just set this indefinitly far in the future
days-before-ancient: 180 # 6 months
# If you don't want to mark a issue as being ancient based on a
# threshold of "upvotes", you can set this here. An "upvote" is
# the total number of +1, heart, hooray, and rocket reactions
# on an issue.
minimum-upvotes-to-exempt: 2
repo-token: ${{ secrets.GITHUB_TOKEN }}
loglevel: DEBUG
# Set dry-run to true to not perform label or close actions.
dry-run: true

View File

@@ -1,51 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
jobs:
warn_codegen:
name: warn_codegen
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: schema_changed
name: Check for diff in schema
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
with:
filters: "changed: 'provider/cmd/**/schema.json'"
- id: sdk_changed
if: steps.schema_changed.outputs.changed == 'false'
name: Check for diff in sdk/**
uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
with:
filters: "changed: 'sdk/**'"
- if: steps.sdk_changed.outputs.changed == 'true' &&
github.event.pull_request.head.repo.full_name != github.repository
name: Send codegen warning as comment on PR
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
message: >
Hello and thank you for your pull request! :heart: :sparkles:
It looks like you're directly modifying files in the language SDKs, many of which are autogenerated.
Be sure any files you're editing do not begin with a code generation warning.
For generated files, you will need to make changes in `resources.go` instead, and [generate the code](https://github.com/pulumi/${{ github.event.repository.name }}/blob/master/CONTRIBUTING.md#committing-generated-code).
name: warn-codegen
on:
pull_request_target:
branches:
- main
types:
- opened

View File

@@ -1,25 +0,0 @@
permissions: write-all # Equivalent to default permissions plus id-token: write
name: Export secrets to ESC
on: [workflow_dispatch]
jobs:
export-to-esc:
runs-on: ubuntu-latest
name: export GitHub secrets to ESC
steps:
- name: Generate a GitHub token
id: generate-token
uses: actions/create-github-app-token@v1
with:
app-id: 1256780 # Export Secrets GitHub App
private-key: ${{ secrets.EXPORT_SECRETS_PRIVATE_KEY }}
- name: Export secrets to ESC
uses: pulumi/esc-export-secrets-action@9d6485759b6adff2538ae91f1b77cc96265c9dad # v1
with:
organization: pulumi
org-environment: imports/github-secrets
exclude-secrets: EXPORT_SECRETS_PRIVATE_KEY
github-token: ${{ steps.generate-token.outputs.token }}
oidc-auth: true
oidc-requested-token-type: urn:pulumi:token-type:access_token:organization
env:
GITHUB_SECRETS: ${{ toJSON(secrets) }}

View File

@@ -1,778 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
name: prerelease
on:
push:
tags:
- v*.*.*-**
env:
PROVIDER: docker-build
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
TRAVIS_OS_NAME: linux
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
GOVERSION: "1.21.x"
NODEVERSION: "20.x"
PYTHONVERSION: "3.11.8"
DOTNETVERSION: "8.0.x"
JAVAVERSION: "11"
ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
AWS_REGION: us-west-2
AZURE_LOCATION: westus
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
GOOGLE_PROJECT: pulumi-ci-gcp-provider
GOOGLE_PROJECT_NUMBER: "895284651812"
GOOGLE_REGION: us-central1
GOOGLE_ZONE: us-central1-a
PULUMI_API: https://api.pulumi-staging.io
IS_PRERELEASE: true
jobs:
prerequisites:
runs-on: ubuntu-latest
name: prerequisites
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- if: github.event_name == 'pull_request'
name: Install Schema Tools
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/schema-tools
- name: Build codegen binaries
run: make codegen
- name: Build Schema
run: make generate_schema
- if: github.event_name == 'pull_request'
name: Check Schema is Valid
run: >-
{
echo 'SCHEMA_CHANGES<<EOF';
schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
echo 'EOF';
} >> "$GITHUB_ENV"
env:
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
- if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
name: Comment on PR with Details of Schema Check
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with:
message: |
${{ env.SCHEMA_CHANGES }}
comment-tag: schemaCheck
github-token: ${{ secrets.GITHUB_TOKEN }}
- if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
github.actor == 'pulumi-bot'
name: Add label if no breaking changes
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
with:
labels: impact/no-changelog-required
number: ${{ github.event.issue.number }}
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Build Provider
run: make provider
- name: Check worktree clean
id: worktreeClean
uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
with:
allowed-changes: |-
sdk/**/pulumi-plugin.json
sdk/dotnet/*.*.csproj
sdk/dotnet/version.txt
sdk/go/**/pulumiUtilities.go
sdk/nodejs/package.json
sdk/python/pyproject.toml
- name: Commit SDK changes for Renovate
if: failure() && steps.worktreeClean.outcome == 'failure' &&
contains(github.actor, 'renovate') && github.event_name ==
'pull_request'
shell: bash
run: >
git diff --quiet -- sdk && echo "no changes to sdk" && exit
git config --global user.email "bot@pulumi.com"
git config --global user.name "pulumi-bot"
# Stash local changes and check out the PR's branch directly.
git stash
git fetch
git checkout "origin/$HEAD_REF"
# Apply and add our changes, but don't commit any files we expect to
# always change due to versioning.
git stash pop
git add sdk
git reset sdk/python/*/pulumi-plugin.json \
sdk/python/pyproject.toml \
sdk/dotnet/pulumi-plugin.json \
sdk/dotnet/*.*.csproj \
sdk/dotnet/version.txt \
sdk/go/*/pulumi-plugin.json \
sdk/go/*/internal/pulumiUtilities.go \
sdk/nodejs/package.json
git commit -m 'Commit SDK for Renovate'
# Push with pulumi-bot credentials to trigger a re-run of the
# workflow. https://github.com/orgs/community/discussions/25702
git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
- run: git status --porcelain
- name: Tar provider binaries
run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
pulumi-gen-${{ env.PROVIDER}}
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin/provider.tar.gz
- name: Test Provider Library
run: make test_provider
env:
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
DOCKER_HUB_PASSWORD: ${{ steps.esc-secrets.outputs.DOCKER_HUB_PASSWORD }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
env:
CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in building provider prerequisites
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
build_sdks:
needs: prerequisites
runs-on: pulumi-ubuntu-8core
strategy:
fail-fast: ${{ ! contains(github.actor, 'renovate') }}
matrix:
language:
- nodejs
- python
- dotnet
- go
- java
name: build_sdks
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download provider
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin
- name: UnTar provider binaries
run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin
- name: Restore Binary Permissions
run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-exec chmod +x {} \;
- name: Generate SDK
run: make generate_${{ matrix.language }}
- name: Build SDK
run: make build_${{ matrix.language }}
- name: Check worktree clean
id: worktreeClean
uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
with:
allowed-changes: |-
sdk/**/pulumi-plugin.json
sdk/dotnet/*.*.csproj
sdk/dotnet/version.txt
sdk/go/**/pulumiUtilities.go
sdk/nodejs/package.json
sdk/python/pyproject.toml
- name: Commit ${{ matrix.language }} SDK changes for Renovate
if: failure() && steps.worktreeClean.outcome == 'failure' &&
contains(github.actor, 'renovate') && github.event_name ==
'pull_request'
shell: bash
run: >
git diff --quiet -- sdk && echo "no changes to sdk" && exit
git config --global user.email "bot@pulumi.com"
git config --global user.name "pulumi-bot"
# Stash local changes and check out the PR's branch directly.
git stash
git fetch
git checkout "origin/$HEAD_REF"
# Apply and add our changes, but don't commit any files we expect to
# always change due to versioning.
git stash pop
git add sdk
git reset sdk/python/*/pulumi-plugin.json \
sdk/python/pyproject.toml \
sdk/dotnet/pulumi-plugin.json \
sdk/dotnet/*.*.csproj \
sdk/dotnet/version.txt \
sdk/go/*/pulumi-plugin.json \
sdk/go/*/internal/pulumiUtilities.go \
sdk/nodejs/package.json
git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
# Push with pulumi-bot credentials to trigger a re-run of the
# workflow. https://github.com/orgs/community/discussions/25702
git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
- run: git status --porcelain
- name: Tar SDK folder
run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ matrix.language }}-sdk.tar.gz
path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure while building SDKs
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
test:
runs-on: pulumi-ubuntu-8core
needs:
- build_sdks
strategy:
fail-fast: true
matrix:
language:
- nodejs
- python
- dotnet
- go
- java
- yaml
name: test
permissions:
contents: read
id-token: write
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download provider
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin
- name: UnTar provider binaries
run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin
- name: Restore Binary Permissions
run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-exec chmod +x {} \;
- name: Download SDK
if: ${{ matrix.language != 'yaml' }}
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: ${{ matrix.language }}-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: UnTar SDK folder
if: ${{ matrix.language != 'yaml' }}
run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
github.workspace}}/sdk/${{ matrix.language}}
- name: Update path
run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
- name: Install Node dependencies
run: yarn global add typescript
- run: dotnet nuget add source ${{ github.workspace }}/nuget
- name: Install Python deps
run: |-
pip3 install virtualenv==20.0.23
pip3 install pipenv
- name: Install dependencies
if: ${{ matrix.language != 'yaml' }}
run: make install_${{ matrix.language}}_sdk
- name: Generate Pulumi Access Token
id: generate_pulumi_token
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
with:
organization: pulumi
requested-token-type: urn:pulumi:token-type:access_token:organization
export-environment-variables: false
- name: Export AWS Credentials
uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
env:
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
with:
environment: logins/pulumi-ci
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
}}/locations/global/workloadIdentityPools/${{
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
- name: Setup gcloud auth
uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
with:
install_components: gke-gcloud-auth-plugin
- name: Install gotestfmt
uses: GoTestTools/gotestfmt-action@v2
with:
version: v2.5.0
token: ${{ secrets.GITHUB_TOKEN }}
- name: Run tests
run: >-
set -euo pipefail
cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in SDK tests
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
publish:
runs-on: ubuntu-latest
needs: test
name: publish
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Clear GitHub Actions Ubuntu runner disk space
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
with:
tool-cache: false
dotnet: false
android: true
haskell: true
swap-storage: true
large-packages: false
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
with:
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
aws-region: us-east-2
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
role-duration-seconds: 7200
role-session-name: ${{ env.PROVIDER }}@githubActions
role-external-id: upload-pulumi-release
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
env:
GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
AZURE_SIGNING_KEY_VAULT_URI: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI }}
SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI == '' }}
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
with:
args: -p 3 -f .goreleaser.prerelease.yml --clean --skip=validate --timeout 60m0s
version: latest
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in publishing binaries
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
publish_sdk:
runs-on: ubuntu-latest
needs: publish
name: publish_sdk
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Checkout Scripts Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
path: ci-scripts
repository: pulumi/scripts
- run: echo "ci-scripts" >> .git/info/exclude
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Download python SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: python-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress python SDK
run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
${{github.workspace}}/sdk/python
- name: Download dotnet SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: dotnet-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress dotnet SDK
run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
${{github.workspace}}/sdk/dotnet
- name: Download nodejs SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: nodejs-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress nodejs SDK
run: tar -zxf ${{github.workspace}}/sdk/nodejs.tar.gz -C
${{github.workspace}}/sdk/nodejs
- name: Install Twine
run: python -m pip install twine==5.0.0
- name: Publish SDKs
run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
env:
NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
PYPI_PUBLISH_ARTIFACTS: all
PYPI_USERNAME: __token__
PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in publishing SDK
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
publish_java_sdk:
runs-on: ubuntu-latest
continue-on-error: true
needs: publish
name: publish_java_sdk
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download java SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: java-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress java SDK
run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
${{github.workspace}}/sdk/java
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Publish Java SDK
run: gradle -p ./sdk/java publishToSonatype closeAndReleaseSonatypeStagingRepository
env:
PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
publish_go_sdk:
runs-on: ubuntu-latest
name: publish-go-sdk
needs: publish_sdk
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Download go SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: go-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress go SDK
run: tar -zxf ${{github.workspace}}/sdk/go.tar.gz -C
${{github.workspace}}/sdk/go
- name: Publish Go SDK
uses: pulumi/publish-go-sdk-action@v1
with:
repository: ${{ github.repository }}
base-ref: ${{ github.sha }}
source: sdk/go/dockerbuild
path: sdk/go/dockerbuild
version: ${{ steps.version.outputs.version }}
additive: false
files: "**"

View File

@@ -1,56 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
name: pull-request
on:
pull_request_target: {}
env:
PROVIDER: docker-build
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
TRAVIS_OS_NAME: linux
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
GOVERSION: "1.21.x"
NODEVERSION: "20.x"
PYTHONVERSION: "3.11.8"
DOTNETVERSION: "8.0.x"
JAVAVERSION: "11"
ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
AWS_REGION: us-west-2
AZURE_LOCATION: westus
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
GOOGLE_PROJECT: pulumi-ci-gcp-provider
GOOGLE_PROJECT_NUMBER: "895284651812"
GOOGLE_REGION: us-central1
GOOGLE_ZONE: us-central1-a
PULUMI_API: https://api.pulumi-staging.io
jobs:
comment-on-pr:
runs-on: ubuntu-latest
name: comment-on-pr
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- name: Comment PR
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with:
message: >
PR is now waiting for a maintainer to run the acceptance tests.
**Note for the maintainer:** To run the acceptance tests, please comment */run-acceptance-tests* on the PR
github-token: ${{ secrets.GITHUB_TOKEN }}
if: github.event.pull_request.head.repo.full_name != github.repository

View File

@@ -1,804 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
name: release
on:
push:
tags:
- v*.*.*
- "!v*.*.*-**"
env:
PROVIDER: docker-build
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
TRAVIS_OS_NAME: linux
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
GOVERSION: "1.21.x"
NODEVERSION: "20.x"
PYTHONVERSION: "3.11.8"
DOTNETVERSION: "8.0.x"
JAVAVERSION: "11"
ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
AWS_REGION: us-west-2
AZURE_LOCATION: westus
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
GOOGLE_PROJECT: pulumi-ci-gcp-provider
GOOGLE_PROJECT_NUMBER: "895284651812"
GOOGLE_REGION: us-central1
GOOGLE_ZONE: us-central1-a
PULUMI_API: https://api.pulumi-staging.io
jobs:
prerequisites:
runs-on: ubuntu-latest
name: prerequisites
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- if: github.event_name == 'pull_request'
name: Install Schema Tools
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/schema-tools
- name: Build codegen binaries
run: make codegen
- name: Build Schema
run: make generate_schema
- if: github.event_name == 'pull_request'
name: Check Schema is Valid
run: >-
{
echo 'SCHEMA_CHANGES<<EOF';
schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
echo 'EOF';
} >> "$GITHUB_ENV"
env:
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
- if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
name: Comment on PR with Details of Schema Check
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with:
message: |
${{ env.SCHEMA_CHANGES }}
comment-tag: schemaCheck
github-token: ${{ secrets.GITHUB_TOKEN }}
- if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
github.actor == 'pulumi-bot'
name: Add label if no breaking changes
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
with:
labels: impact/no-changelog-required
number: ${{ github.event.issue.number }}
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Build Provider
run: make provider
- name: Check worktree clean
id: worktreeClean
uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
with:
allowed-changes: |-
sdk/**/pulumi-plugin.json
sdk/dotnet/*.*.csproj
sdk/dotnet/version.txt
sdk/go/**/pulumiUtilities.go
sdk/nodejs/package.json
sdk/python/pyproject.toml
- name: Commit SDK changes for Renovate
if: failure() && steps.worktreeClean.outcome == 'failure' &&
contains(github.actor, 'renovate') && github.event_name ==
'pull_request'
shell: bash
run: >
git diff --quiet -- sdk && echo "no changes to sdk" && exit
git config --global user.email "bot@pulumi.com"
git config --global user.name "pulumi-bot"
# Stash local changes and check out the PR's branch directly.
git stash
git fetch
git checkout "origin/$HEAD_REF"
# Apply and add our changes, but don't commit any files we expect to
# always change due to versioning.
git stash pop
git add sdk
git reset sdk/python/*/pulumi-plugin.json \
sdk/python/pyproject.toml \
sdk/dotnet/pulumi-plugin.json \
sdk/dotnet/*.*.csproj \
sdk/dotnet/version.txt \
sdk/go/*/pulumi-plugin.json \
sdk/go/*/internal/pulumiUtilities.go \
sdk/nodejs/package.json
git commit -m 'Commit SDK for Renovate'
# Push with pulumi-bot credentials to trigger a re-run of the
# workflow. https://github.com/orgs/community/discussions/25702
git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
- run: git status --porcelain
- name: Tar provider binaries
run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
pulumi-gen-${{ env.PROVIDER}}
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin/provider.tar.gz
- name: Test Provider Library
run: make test_provider
env:
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
DOCKER_HUB_PASSWORD: ${{ steps.esc-secrets.outputs.DOCKER_HUB_PASSWORD }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
env:
CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in building provider prerequisites
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
build_sdks:
needs: prerequisites
runs-on: pulumi-ubuntu-8core
strategy:
fail-fast: ${{ ! contains(github.actor, 'renovate') }}
matrix:
language:
- nodejs
- python
- dotnet
- go
- java
name: build_sdks
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download provider
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin
- name: UnTar provider binaries
run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin
- name: Restore Binary Permissions
run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-exec chmod +x {} \;
- name: Generate SDK
run: make generate_${{ matrix.language }}
- name: Build SDK
run: make build_${{ matrix.language }}
- name: Check worktree clean
id: worktreeClean
uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
with:
allowed-changes: |-
sdk/**/pulumi-plugin.json
sdk/dotnet/*.*.csproj
sdk/dotnet/version.txt
sdk/go/**/pulumiUtilities.go
sdk/nodejs/package.json
sdk/python/pyproject.toml
- name: Commit SDK changes for Renovate
if: failure() && steps.worktreeClean.outcome == 'failure' &&
contains(github.actor, 'renovate') && github.event_name ==
'pull_request'
shell: bash
run: >
git diff --quiet -- sdk && echo "no changes to sdk" && exit
git config --global user.email "bot@pulumi.com"
git config --global user.name "pulumi-bot"
# Stash local changes and check out the PR's branch directly.
git stash
git fetch
git checkout "origin/$HEAD_REF"
# Apply and add our changes, but don't commit any files we expect to
# always change due to versioning.
git stash pop
git add sdk
git reset sdk/python/*/pulumi-plugin.json \
sdk/python/pyproject.toml \
sdk/dotnet/pulumi-plugin.json \
sdk/dotnet/*.*.csproj \
sdk/dotnet/version.txt \
sdk/go/*/pulumi-plugin.json \
sdk/go/*/internal/pulumiUtilities.go \
sdk/nodejs/package.json
git commit -m 'Commit SDK for Renovate'
# Push with pulumi-bot credentials to trigger a re-run of the
# workflow. https://github.com/orgs/community/discussions/25702
git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
- run: git status --porcelain
- name: Tar SDK folder
run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ matrix.language }}-sdk.tar.gz
path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure while building SDKs
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
test:
runs-on: pulumi-ubuntu-8core
needs:
- build_sdks
strategy:
fail-fast: true
matrix:
language:
- nodejs
- python
- dotnet
- go
- java
- yaml
name: test
permissions:
contents: read
id-token: write
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download provider
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin
- name: UnTar provider binaries
run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin
- name: Restore Binary Permissions
run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-exec chmod +x {} \;
- name: Download SDK
if: ${{ matrix.language != 'yaml' }}
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: ${{ matrix.language }}-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: UnTar SDK folder
if: ${{ matrix.language != 'yaml' }}
run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
github.workspace}}/sdk/${{ matrix.language}}
- name: Update path
run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
- name: Install Node dependencies
run: yarn global add typescript
- run: dotnet nuget add source ${{ github.workspace }}/nuget
- name: Install Python deps
run: |-
pip3 install virtualenv==20.0.23
pip3 install pipenv
- name: Install dependencies
if: ${{ matrix.language != 'yaml' }}
run: make install_${{ matrix.language}}_sdk
- name: Generate Pulumi Access Token
id: generate_pulumi_token
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
with:
organization: pulumi
requested-token-type: urn:pulumi:token-type:access_token:organization
export-environment-variables: false
- name: Export AWS Credentials
uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
env:
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
with:
environment: logins/pulumi-ci
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
}}/locations/global/workloadIdentityPools/${{
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
- name: Setup gcloud auth
uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
with:
install_components: gke-gcloud-auth-plugin
- name: Install gotestfmt
uses: GoTestTools/gotestfmt-action@v2
with:
version: v2.5.0
token: ${{ secrets.GITHUB_TOKEN }}
- name: Run tests
run: >-
set -euo pipefail
cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
env:
GTIHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in SDK tests
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
publish:
runs-on: ubuntu-latest
needs: test
name: publish
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Clear GitHub Actions Ubuntu runner disk space
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
with:
tool-cache: false
dotnet: false
android: true
haskell: true
swap-storage: true
large-packages: false
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
with:
aws-access-key-id: ${{ steps.esc-secrets.outputs.AWS_ACCESS_KEY_ID }}
aws-region: us-east-2
aws-secret-access-key: ${{ steps.esc-secrets.outputs.AWS_SECRET_ACCESS_KEY }}
role-duration-seconds: 7200
role-session-name: ${{ env.PROVIDER }}@githubActions
role-external-id: upload-pulumi-release
role-to-assume: ${{ steps.esc-secrets.outputs.AWS_UPLOAD_ROLE_ARN }}
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@5742e2a039330cbb23ebf35f046f814d4c6ff811 # v5.1.0
env:
GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
AZURE_SIGNING_CLIENT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID }}
AZURE_SIGNING_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET }}
AZURE_SIGNING_TENANT_ID: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID }}
AZURE_SIGNING_KEY_VAULT_URI: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI }}
SKIP_SIGNING: ${{ steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_CLIENT_SECRET == '' && steps.esc-secrets.outputs.AZURE_SIGNING_TENANT_ID == '' && steps.esc-secrets.outputs.AZURE_SIGNING_KEY_VAULT_URI == '' }}
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
with:
args: -p 3 release --clean --timeout 60m0s
version: latest
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in publishing binaries
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
publish_sdk:
runs-on: ubuntu-latest
needs: publish
name: publish_sdks
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Checkout Scripts Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
path: ci-scripts
repository: pulumi/scripts
- run: echo "ci-scripts" >> .git/info/exclude
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Download python SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: python-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress python SDK
run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
${{github.workspace}}/sdk/python
- name: Download dotnet SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: dotnet-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress dotnet SDK
run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
${{github.workspace}}/sdk/dotnet
- name: Download nodejs SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: nodejs-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress nodejs SDK
run: tar -zxf ${{github.workspace}}/sdk/nodejs.tar.gz -C
${{github.workspace}}/sdk/nodejs
- name: Install Twine
run: python -m pip install twine==5.0.0
- name: Publish SDKs
run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
env:
NUGET_PUBLISH_KEY: ${{ steps.esc-secrets.outputs.NUGET_PUBLISH_KEY }}
NODE_AUTH_TOKEN: ${{ steps.esc-secrets.outputs.NPM_TOKEN }}
PYPI_PUBLISH_ARTIFACTS: all
PYPI_USERNAME: __token__
PYPI_PASSWORD: ${{ steps.esc-secrets.outputs.PYPI_API_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in publishing SDK
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
publish_java_sdk:
runs-on: ubuntu-latest
continue-on-error: true
needs: publish
name: publish_java_sdk
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download java SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: java-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress java SDK
run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
${{github.workspace}}/sdk/java
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Publish Java SDK
run: gradle -p ./sdk/java publishToSonatype closeAndReleaseSonatypeStagingRepository
env:
PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
SIGNING_KEY_ID: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY_ID }}
SIGNING_KEY: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_KEY }}
SIGNING_PASSWORD: ${{ steps.esc-secrets.outputs.JAVA_SIGNING_PASSWORD }}
PUBLISH_REPO_PASSWORD: ${{ steps.esc-secrets.outputs.OSSRH_PASSWORD }}
PUBLISH_REPO_USERNAME: ${{ steps.esc-secrets.outputs.OSSRH_USERNAME }}
publish_go_sdk:
runs-on: ubuntu-latest
name: publish-go-sdk
needs: publish_sdk
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Download go SDK
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: go-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: Uncompress go SDK
run: tar -zxf ${{github.workspace}}/sdk/go.tar.gz -C
${{github.workspace}}/sdk/go
- name: Publish Go SDK
uses: pulumi/publish-go-sdk-action@v1
with:
repository: ${{ github.repository }}
base-ref: ${{ github.sha }}
source: sdk/go/dockerbuild
path: sdk/go/dockerbuild
version: ${{ steps.version.outputs.version }}
additive: false
files: "**"
dispatch_docs_build:
runs-on: ubuntu-latest
needs: publish_go_sdk
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Dispatch Event
run: pulumictl create docs-build pulumi-${{ env.PROVIDER }}
"${GITHUB_REF#refs/tags/}"
env:
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
name: dispatch_docs_build

View File

@@ -1,53 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
name: release-command
on:
repository_dispatch:
types:
- release-command
jobs:
should_release:
name: Should release PR
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- name: Should release PR
uses: pulumi/action-release-by-pr-label@main
with:
command: "should-release"
repo: ${{ github.repository }}
pr: ${{ github.event.client_payload.pull_request.number }}
version: ${{ github.event.client_payload.slash_command.args.all }}
slack_channel: ${{ steps.esc-secrets.outputs.RELEASE_OPS_STAGING_SLACK_CHANNEL }}
env:
RELEASE_BOT_ENDPOINT: ${{ steps.esc-secrets.outputs.RELEASE_BOT_ENDPOINT }}
RELEASE_BOT_KEY: ${{ steps.esc-secrets.outputs.RELEASE_BOT_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- if: failure()
name: Notify failure
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
body: |
"release command failed: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
- if: success()
name: Notify success
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
comment-id: ${{ github.event.client_payload.github.payload.comment.id }}
reaction-type: hooray

View File

@@ -1,610 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
name: run-acceptance-tests
on:
repository_dispatch:
types:
- run-acceptance-tests-command
pull_request:
paths-ignore:
- CHANGELOG.md
workflow_dispatch: {}
env:
PROVIDER: docker-build
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
TRAVIS_OS_NAME: linux
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
GOVERSION: "1.21.x"
NODEVERSION: "20.x"
PYTHONVERSION: "3.11.8"
DOTNETVERSION: "8.0.x"
JAVAVERSION: "11"
ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
AWS_REGION: us-west-2
AZURE_LOCATION: westus
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
GOOGLE_PROJECT: pulumi-ci-gcp-provider
GOOGLE_PROJECT_NUMBER: "895284651812"
GOOGLE_REGION: us-central1
GOOGLE_ZONE: us-central1-a
PULUMI_API: https://api.pulumi-staging.io
PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
jobs:
comment-notification:
runs-on: ubuntu-latest
name: comment-notification
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
persist-credentials: false
ref: ${{ env.PR_COMMIT_SHA }}
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- name: Create URL to the run output
id: vars
run: echo
"run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
>> "$GITHUB_OUTPUT"
- name: Update with Result
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
with:
token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
body: "Please view the PR build: ${{ steps.vars.outputs.run-url }}"
if: github.event_name == 'repository_dispatch'
prerequisites:
runs-on: ubuntu-latest
name: prerequisites
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
persist-credentials: false
ref: ${{ env.PR_COMMIT_SHA }}
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- if: github.event_name == 'pull_request'
name: Install Schema Tools
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/schema-tools
- name: Build codegen binaries
run: make codegen
- name: Build Schema
run: make generate_schema
- if: github.event_name == 'pull_request'
name: Check Schema is Valid
run: >-
{
echo 'SCHEMA_CHANGES<<EOF';
schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json;
echo 'EOF';
} >> "$GITHUB_ENV"
env:
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
- if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
name: Comment on PR with Details of Schema Check
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
with:
message: |
${{ env.SCHEMA_CHANGES }}
comment-tag: schemaCheck
github-token: ${{ secrets.GITHUB_TOKEN }}
- if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
github.actor == 'pulumi-bot'
name: Add label if no breaking changes
uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # v1.1.3
with:
labels: impact/no-changelog-required
number: ${{ github.event.issue.number }}
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Build Provider
run: make provider
- name: Check worktree clean
id: worktreeClean
uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
with:
allowed-changes: |-
sdk/**/pulumi-plugin.json
sdk/dotnet/*.*.csproj
sdk/dotnet/version.txt
sdk/go/**/pulumiUtilities.go
sdk/nodejs/package.json
sdk/python/pyproject.toml
- name: Commit SDK changes for Renovate
if: failure() && steps.worktreeClean.outcome == 'failure' &&
contains(github.actor, 'renovate') && github.event_name ==
'pull_request'
shell: bash
run: >
git diff --quiet -- sdk && echo "no changes to sdk" && exit
git config --global user.email "bot@pulumi.com"
git config --global user.name "pulumi-bot"
# Stash local changes and check out the PR's branch directly.
git stash
git fetch
git checkout "origin/$HEAD_REF"
# Apply and add our changes, but don't commit any files we expect to
# always change due to versioning.
git stash pop
git add sdk
git reset sdk/python/*/pulumi-plugin.json \
sdk/python/pyproject.toml \
sdk/dotnet/pulumi-plugin.json \
sdk/dotnet/*.*.csproj \
sdk/dotnet/version.txt \
sdk/go/*/pulumi-plugin.json \
sdk/go/*/internal/pulumiUtilities.go \
sdk/nodejs/package.json
git commit -m 'Commit SDK for Renovate'
# Push with pulumi-bot credentials to trigger a re-run of the
# workflow. https://github.com/orgs/community/discussions/25702
git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
- run: git status --porcelain
- name: Tar provider binaries
run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
pulumi-gen-${{ env.PROVIDER}}
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin/provider.tar.gz
- name: Test Provider Library
run: make test_provider
env:
ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
DIGITALOCEAN_TOKEN: ${{ steps.esc-secrets.outputs.DIGITALOCEAN_TOKEN }}
DOCKER_HUB_PASSWORD: ${{ steps.esc-secrets.outputs.DOCKER_HUB_PASSWORD }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
env:
CODECOV_TOKEN: ${{ steps.esc-secrets.outputs.CODECOV_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in building provider prerequisites
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
if: github.event_name == 'repository_dispatch' ||
github.event.pull_request.head.repo.full_name == github.repository
build_sdks:
needs: prerequisites
runs-on: pulumi-ubuntu-8core
strategy:
fail-fast: ${{ ! contains(github.actor, 'renovate') }}
matrix:
language:
- nodejs
- python
- dotnet
- go
- java
name: build_sdks
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
persist-credentials: false
ref: ${{ env.PR_COMMIT_SHA }}
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download provider
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin
- name: UnTar provider binaries
run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin
- name: Restore Binary Permissions
run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-exec chmod +x {} \;
- name: Generate SDK
run: make generate_${{ matrix.language }}
- name: Build SDK
run: make build_${{ matrix.language }}
- name: Check worktree clean
id: worktreeClean
uses: pulumi/git-status-check-action@54000b91124a8dd9fd6a872cb41f5dd246a46e7c # v1.1.1
with:
allowed-changes: |-
sdk/**/pulumi-plugin.json
sdk/dotnet/*.*.csproj
sdk/dotnet/version.txt
sdk/go/**/pulumiUtilities.go
sdk/nodejs/package.json
sdk/python/pyproject.toml
- name: Commit SDK changes for Renovate
if: failure() && steps.worktreeClean.outcome == 'failure' &&
contains(github.actor, 'renovate') && github.event_name ==
'pull_request'
shell: bash
run: >
git diff --quiet -- sdk && echo "no changes to sdk" && exit
git config --global user.email "bot@pulumi.com"
git config --global user.name "pulumi-bot"
# Stash local changes and check out the PR's branch directly.
git stash
git fetch
git checkout "origin/$HEAD_REF"
# Apply and add our changes, but don't commit any files we expect to
# always change due to versioning.
git stash pop
git add sdk
git reset sdk/python/*/pulumi-plugin.json \
sdk/python/pyproject.toml \
sdk/dotnet/pulumi-plugin.json \
sdk/dotnet/*.*.csproj \
sdk/dotnet/version.txt \
sdk/go/*/pulumi-plugin.json \
sdk/go/*/internal/pulumiUtilities.go \
sdk/nodejs/package.json
git commit -m 'Commit SDK for Renovate'
# Push with pulumi-bot credentials to trigger a re-run of the
# workflow. https://github.com/orgs/community/discussions/25702
git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} "HEAD:$HEAD_REF"
env:
HEAD_REF: ${{ github.head_ref }}
- run: git status --porcelain
- name: Tar SDK folder
run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
- name: Upload artifacts
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: ${{ matrix.language }}-sdk.tar.gz
path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
retention-days: 30
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure while building SDKs
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
if: github.event_name == 'repository_dispatch' ||
github.event.pull_request.head.repo.full_name == github.repository
test:
runs-on: pulumi-ubuntu-8core
needs:
- build_sdks
strategy:
fail-fast: true
matrix:
language:
- nodejs
- python
- dotnet
- go
- java
- yaml
name: test
permissions:
contents: read
id-token: write
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
persist-credentials: false
ref: ${{ env.PR_COMMIT_SHA }}
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- id: version
name: Set Provider Version
uses: pulumi/provider-version-action@f96d032a2758fdda7939e5728eff6c0d980ae894 # v1.6.0
with:
set-env: PROVIDER_VERSION
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Download provider
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
path: ${{ github.workspace }}/bin
- name: UnTar provider binaries
run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
github.workspace}}/bin
- name: Restore Binary Permissions
run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
-exec chmod +x {} \;
- name: Download SDK
if: ${{ matrix.language != 'yaml' }}
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
name: ${{ matrix.language }}-sdk.tar.gz
path: ${{ github.workspace}}/sdk/
- name: UnTar SDK folder
if: ${{ matrix.language != 'yaml' }}
run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
github.workspace}}/sdk/${{ matrix.language}}
- name: Update path
run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
- name: Install Node dependencies
run: yarn global add typescript
- run: dotnet nuget add source ${{ github.workspace }}/nuget
- name: Install Python deps
run: |-
pip3 install virtualenv==20.0.23
pip3 install pipenv
- name: Install dependencies
if: ${{ matrix.language != 'yaml' }}
run: make install_${{ matrix.language}}_sdk
- name: Generate Pulumi Access Token
id: generate_pulumi_token
uses: pulumi/auth-actions@1c89817aab0c66407723cdef72b05266e7376640 # v1.0.1
with:
organization: pulumi
requested-token-type: urn:pulumi:token-type:access_token:organization
export-environment-variables: false
- name: Export AWS Credentials
uses: pulumi/esc-action@efb0bc8946938f0dfbfa00e829196ec95f0d0ea7 # v1.4.0
env:
PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
with:
environment: logins/pulumi-ci
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
with:
workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
}}/locations/global/workloadIdentityPools/${{
env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
- name: Setup gcloud auth
uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
with:
install_components: gke-gcloud-auth-plugin
- name: Install gotestfmt
uses: GoTestTools/gotestfmt-action@v2
with:
version: v2.5.0
token: ${{ secrets.GITHUB_TOKEN }}
- name: Run tests
run: >-
set -euo pipefail
cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- if: failure() && github.event_name == 'push'
name: Notify Slack
uses: 8398a7/action-slack@1750b5085f3ec60384090fb7c52965ef822e869e # v3.18.0
with:
author_name: Failure in SDK tests
fields: repo,commit,author,action
status: ${{ job.status }}
env:
SLACK_WEBHOOK_URL: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
if: github.event_name == 'repository_dispatch' ||
github.event.pull_request.head.repo.full_name == github.repository
sentinel:
runs-on: ubuntu-latest
name: sentinel
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
persist-credentials: false
ref: ${{ env.PR_COMMIT_SHA }}
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- name: Mark workflow as successful
uses: guibranco/github-status-action-v2@0849440ec82c5fa69b2377725b9b7852a3977e76 # v1.1.13
with:
authToken: ${{ secrets.GITHUB_TOKEN }}
context: Sentinel
state: success
description: Sentinel checks passed
sha: ${{ github.event.pull_request.head.sha || github.sha }}
permissions:
statuses: write
if: github.event_name == 'repository_dispatch' ||
github.event.pull_request.head.repo.full_name == github.repository
needs:
- test
- prerequisites
- lint
lint:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
persist-credentials: false
ref: ${{ env.PR_COMMIT_SHA }}
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Disarm go:embed directives to enable linters that compile source code
run: git grep -l 'go:embed' -- provider | xargs --no-run-if-empty sed -i
's/go:embed/ goembed/g'
- name: golangci-lint provider pkg
uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6.5.2
with:
version: ${{ env.GOLANGCI_LINT_VERSION }}
args: -c ../.golangci.yml
working-directory: provider
name: lint
if: github.event_name == 'repository_dispatch' ||
github.event.pull_request.head.repo.full_name == github.repository

View File

@@ -1,142 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
name: weekly-pulumi-update
on:
schedule:
- cron: 35 12 * * 4
workflow_dispatch: {}
env:
GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
PROVIDER: docker-build
PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
TRAVIS_OS_NAME: linux
PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
GOVERSION: "1.21.x"
NODEVERSION: "20.x"
PYTHONVERSION: "3.11.8"
DOTNETVERSION: "8.0.x"
JAVAVERSION: "11"
ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e
ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
AWS_REGION: us-west-2
AZURE_LOCATION: westus
GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com
GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
GOOGLE_PROJECT: pulumi-ci-gcp-provider
GOOGLE_PROJECT_NUMBER: "895284651812"
GOOGLE_REGION: us-central1
GOOGLE_ZONE: us-central1-a
PULUMI_API: https://api.pulumi-staging.io
jobs:
weekly-pulumi-update:
runs-on: ubuntu-latest
steps:
- name: Checkout Repo
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
lfs: true
- env:
ESC_ACTION_ENVIRONMENT: github-secrets/${{ github.repository_owner }}-${{ github.event.repository.name }}
ESC_ACTION_OIDC_AUTH: "true"
ESC_ACTION_OIDC_ORGANIZATION: pulumi
ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
id: esc-secrets
name: Fetch secrets from ESC
uses: pulumi/esc-action@v1
- name: Install Go
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
with:
go-version: ${{ env.GOVERSION }}
cache-dependency-path: "**/*.sum"
- name: Install pulumictl
uses: jaxxstorm/action-install-gh-release@6096f2a2bbfee498ced520b6922ac2c06e990ed2 # v2.1.0
with:
repo: pulumi/pulumictl
- name: Install Pulumi CLI
uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e # v6.5.0
- name: Setup DotNet
uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
with:
dotnet-version: ${{ env.DOTNETVERSION }}
- name: Setup Node
uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
with:
node-version: ${{ env.NODEVERSION }}
registry-url: https://registry.npmjs.org
- name: Setup Python
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
with:
python-version: ${{ env.PYTHONVERSION }}
- name: Setup Java
uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
with:
java-version: ${{ env.JAVAVERSION }}
distribution: temurin
cache: gradle
- name: Setup Gradle
uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
with:
gradle-version: "7.6"
- name: Update Pulumi/Pulumi
id: gomod
run: >-
git config --local user.email 'bot@pulumi.com'
git config --local user.name 'pulumi-bot'
git checkout -b update-pulumi/${{ github.run_id }}-${{ github.run_number }}
find . -name go.mod -execdir sh -c 'go get github.com/pulumi/pulumi/pkg/v3 github.com/pulumi/pulumi/sdk/v3; go mod tidy' \;
gh repo view pulumi/pulumi --json latestRelease --jq .latestRelease.tagName | sed 's/^v//' > .pulumi.version
git update-index -q --refresh
if ! git diff-files --quiet; then echo changes=1 >> "$GITHUB_OUTPUT"; fi
- name: Provider with Pulumi Upgrade
if: steps.gomod.outputs.changes != 0
run: >-
make codegen && make local_generate
git add sdk/nodejs
git commit -m "Regenerating Node.js SDK based on updated modules" || echo "ignore commit failure, may be empty"
git add sdk/python
git commit -m "Regenerating Python SDK based on updated modules" || echo "ignore commit failure, may be empty"
git add sdk/dotnet
git commit -m "Regenerating .NET SDK based on updated modules" || echo "ignore commit failure, may be empty"
git add sdk/go*
git commit -m "Regenerating Go SDK based on updated modules" || echo "ignore commit failure, may be empty"
git add sdk/java*
git commit -m "Regenerating Java SDK based on updated modules" || echo "ignore commit failure, may be empty"
git add .
git commit -m "Updated modules" || echo "ignore commit failure, may be empty"
git push origin update-pulumi/${{ github.run_id }}-${{ github.run_number }}
- name: Create PR
id: create-pr
if: steps.gomod.outputs.changes != 0
run: >
ver=$(cat .pulumi.version)
msg="Automated upgrade: bump pulumi/pulumi to ${ver}"
# See https://github.com/cli/cli/issues/6485#issuecomment-2560935183 for --head workaround
gh pr create -t "$msg" -b "$msg" --head "$(git branch --show-current)"
env:
GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
name: weekly-pulumi-update

21
.gitignore vendored
View File

@@ -1,21 +0,0 @@
/vendor/
**/bin/
**/obj/
**/node_modules/
**/.vs
**/.idea
**/.ionide
**/.vscode
*.swp
Pulumi.*.yaml
yarn.lock
ci-scripts
nuget/
coverage.txt
sdk/dotnet/version.txt
sdk/java/.gradle
sdk/java/build/
sdk/java/build.gradle
sdk/python/venv

3
.gitmodules vendored
View File

@@ -1,3 +0,0 @@
[submodule ".devcontainer"]
path = .devcontainer
url = https://github.com/pulumi/devcontainer

View File

@@ -1,104 +0,0 @@
run:
timeout: 10m
linters:
enable-all: false
enable:
- depguard
- errcheck
- exhaustive
- copyloopvar
- gci
- gocritic
- gofumpt
- goheader
- gosec
- govet
- importas
- ineffassign
- lll
- misspell
- nakedret
- nolintlint
- paralleltest
- perfsprint
- prealloc
- revive
- unconvert
- unused
linters-settings:
depguard:
rules:
protobuf:
deny:
- pkg: "github.com/golang/protobuf"
desc: Use google.golang.org/protobuf instead
gci:
sections:
- standard # Standard section: captures all standard library packages.
- blank # Blank section: contains all blank imports.
- default # Default section: contains all imports that could not be matched to another section type.
- prefix(github.com/pulumi/) # Custom section: groups all imports with the github.com/pulumi/ prefix.
- prefix(github.com/pulumi/pulumi-dockerbuild/) # Custom section: local imports
custom-order: true
gocritic:
enable-all: true
disabled-checks:
- hugeParam
- importShadow
goheader:
template: |-
Copyright 2024, Pulumi Corporation.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
govet:
enable:
- nilness
# Reject comparisons of reflect.Value with DeepEqual or '=='.
- reflectvaluecompare
# Reject sort.Slice calls with a non-slice argument.
- sortslice
# Detect write to struct/arrays by-value that aren't read again.
- unusedwrite
nakedret:
# Make an issue if func has more lines of code than this setting, and it has naked returns.
# Default: 30
max-func-lines: 60
nolintlint:
# Some linter exclusions are added to generated or templated files
# pre-emptively.
# Don't complain about these.
allow-unused: true
issues:
exclude-use-default: false
exclude-rules:
# Don't warn on unused parameters.
# Parameter names are useful; replacing them with '_' is undesirable.
- linters: [revive]
text: 'unused-parameter: parameter \S+ seems to be unused, consider removing or renaming it as _'
# staticcheck already has smarter checks for empty blocks.
# revive's empty-block linter has false positives.
# For example, as of writing this, the following is not allowed.
# for foo() { }
- linters: [revive]
text: "empty-block: this block is empty, you can remove it"
# We *frequently* use the term 'new' in the context of properties
# (new and old properties),
# and we rarely use the 'new' built-in function.
# It's fine to ignore these cases.
- linters: [revive]
text: "redefines-builtin-id: redefinition of the built-in function new"

View File

@@ -1,57 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
project_name: pulumi-docker-build
builds:
- id: build-provider
dir: provider
env:
- CGO_ENABLED=0
- GO111MODULE=on
goos:
- darwin
- linux
goarch:
- amd64
- arm64
ignore: &a1 []
main: ./cmd/pulumi-resource-docker-build/
ldflags: &a2
- -s
- -w
- -X
github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
- -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
binary: pulumi-resource-docker-build
- id: build-provider-sign-windows
dir: provider
env:
- CGO_ENABLED=0
- GO111MODULE=on
goos:
- windows
goarch:
- amd64
- arm64
ignore: *a1
main: ./cmd/pulumi-resource-docker-build/
ldflags: *a2
binary: pulumi-resource-docker-build
hooks:
post:
- make sign-goreleaser-exe-{{ .Arch }}
archives:
- name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
id: archive
snapshot:
name_template: "{{ .Tag }}-SNAPSHOT"
changelog:
skip: true
release:
disable: true
blobs:
- provider: s3
region: us-west-2
bucket: get.pulumi.com
folder: releases/plugins/
ids:
- archive

View File

@@ -1,57 +0,0 @@
# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
project_name: pulumi-docker-build
builds:
- id: build-provider
dir: provider
env:
- CGO_ENABLED=0
- GO111MODULE=on
goos:
- darwin
- linux
goarch:
- amd64
- arm64
ignore: &a1 []
main: ./cmd/pulumi-resource-docker-build/
ldflags: &a2
- -s
- -w
- -X
github.com/pulumi/pulumi-docker-build/provider/pkg/version.Version={{.Tag}}
- -X github.com/pulumi/pulumi-docker-build/provider.Version={{.Tag}}
binary: pulumi-resource-docker-build
- id: build-provider-sign-windows
dir: provider
env:
- CGO_ENABLED=0
- GO111MODULE=on
goos:
- windows
goarch:
- amd64
- arm64
ignore: *a1
main: ./cmd/pulumi-resource-docker-build/
ldflags: *a2
binary: pulumi-resource-docker-build
hooks:
post:
- make sign-goreleaser-exe-{{ .Arch }}
archives:
- name_template: "{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}"
id: archive
snapshot:
name_template: "{{ .Tag }}-SNAPSHOT"
changelog:
skip: true
release:
disable: false
blobs:
- provider: s3
region: us-west-2
bucket: get.pulumi.com
folder: releases/plugins/
ids:
- archive

View File

@@ -1 +0,0 @@
3.192.0

View File

@@ -1,127 +0,0 @@
## Unreleased
## 0.0.13 (2025-08-27)
### Changed
- Docker Build Cloud and `exec` errors are more helpful. (https://github.com/pulumi/pulumi-docker-build/issues/549)
### Fixed
- The provider is no longer replaced on version changes. (https://github.com/pulumi/pulumi-docker-build/issues/581)
## 0.0.12 (2025-05-16)
### Changed
- Upgraded pulumi-go-provider to v1.0.0-rc2.
### Fixed
- Builds now respect cancellation. (https://github.com/pulumi/pulumi-docker-build/issues/533, https://github.com/pulumi/pulumi-docker-build/pull/522)
## 0.0.11 (2025-04-11)
### Changed
- Upgraded buildx from 0.18.0 to 0.20.1 to remain compatible with upcoming
changes to GitHub Actions. (https://github.com/pulumi/pulumi-docker-build/pull/519)
### Fixed
- Upgrading docker-build no longer causes resource replacements. (<https://github.com/pulumi/pulumi-docker-build/issues/404>)
- Fixed a panic that could occur in `exec` mode. (https://github.com/pulumi/pulumi-docker-build/issues/482)
- The default GitHub Actions cache scope is now correctly set as `buildkit`. (https://github.com/pulumi/pulumi-docker-build/issues/496)
## 0.0.10 (2025-01-27)
### Changed
- Windows binaries are now signed. (https://github.com/pulumi/pulumi-docker-build/pull/429)
## 0.0.9 (2025-01-16)
### Changed
- Upgraded pulumi-go-provider to v0.24.1. (https://github.com/pulumi/pulumi-docker-build/pull/413)
### Fixed
- `ACTIONS_RUNTIME_TOKEN` is now correctly marked as a secret. (https://github.com/pulumi/pulumi-docker-build/issues/403)
## 0.0.8 (2024-12-10)
### Added
- Multiple exports are now allowed if the build daemon is detected to have
version 0.13 of Buildkit or newer.
(https://github.com/pulumi/pulumi-docker-build/issues/21)
### Changed
- Upgraded buildx from 0.16.0 to 0.18.0.
### Fixed
- Custom `# syntax=` directives no longer cause validation errors.
(https://github.com/pulumi/pulumi-docker-build/issues/300)
## 0.0.7 (2024-10-16)
### Fixed
- Fixed an issue where registry authentication couldn't be specified on the
provider. (<https://github.com/pulumi/pulumi-docker-build/issues/262>)
## 0.0.6 (2024-08-13)
### Fixed
- Refreshing an `Index` resource will no longer fail if its stored credentials
have expired. (<https://github.com/pulumi/pulumi-docker-build/pull/194>)
### Changed
- Local and tar exporters will now trigger an update if an export doesn't exist
at the expected path. (<https://github.com/pulumi/pulumi-docker-build/pull/195>)
## 0.0.5 (2024-08-08)
### Fixed
- Fixed Go SDK publishing.
### Changed
- Upgraded docker from 27.0.3 to 27.1.0.
## 0.0.4 (2024-07-15)
### Changed
- Upgraded buildkit from 0.13.0 to 0.15.0.
- Upgraded buildx from 0.13.1. to 0.16.0.
- Upgraded docker from 26.0.0-rc1 to 27.0.3.
- Fixed an issue where warnings were not displayed correctly.
## 0.0.3 (2024-05-31)
### Fixed
- Fixed the default value for `ACTIONS_CACHE_URL` when using GitHub action caching. (<https://github.com/pulumi/pulumi-docker-build/pull/80>)
- Fixed Java SDK publishing. (<https://github.com/pulumi/pulumi-docker-build/pull/89>)
- Fixed a panic that could occur when `context` was omitted. (<https://github.com/pulumi/pulumi-docker-build/pull/83>)
### Changed
- The provider will now wait for new builders to fully boot.
## 0.0.2 (2024-04-25)
### Fixed
- Upgraded pulumi-go-provider to fix a panic during cancellation.
## 0.0.1 (2024-04-23)
Initial release.

View File

@@ -1,80 +0,0 @@
# Contributor Covenant Code of Conduct
## Our Pledge
In the interest of fostering an open and welcoming environment, we as
contributors and maintainers pledge to making participation in our project and
our community a harassment-free experience for everyone, regardless of age, body
size, disability, ethnicity, gender identity and expression, level of experience,
education, socio-economic status, nationality, personal appearance, race,
religion, or sexual identity and orientation.
## Our Standards
Examples of behavior that contributes to creating a positive environment
include:
* Using welcoming and inclusive language
* Being respectful of differing viewpoints and experiences
* Gracefully accepting constructive criticism
* Focusing on what is best for the community
* Showing empathy towards other community members
* Contribute in a positive and constructive way
Examples of unacceptable behavior by participants include:
* The use of sexualized language or imagery and unwelcome sexual attention or
advances
* Trolling, insulting/derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or electronic
address, without explicit permission
* Other conduct which could reasonably be considered inappropriate in a
professional setting
## Our Community Guidelines
* Be clear and stay on topic. Communicating with strangers on the Internet can make it hard to convey or read tone, and sarcasm is frequently misunderstood. Try to use clear language, and think about how the other person will receive it.
* Dont cross-post the same thing in multiple GitHub Discussion topics or multiple Slack channels. This can make it difficult for people answering your questions and creates "scrollback spam".
* Public discussion is preferred to private. Avoid using Slack DMs for questions, and instead share them in public Slack channels or GitHub Discussion threads. This allows a larger audience to both share their knowledge as well as learn from your question or issue. If you're having a problem, chances are someone else is having a similar problem. Learning in public is a community contribution.
* Minimize notifications to other community members. Avoid tagging other community members in Slack messages or Discussion threads, unless you are replying to something specific. Community members are here to help each other, but are not "on call" for support, and we expect everyone to try to minimize "notification fatigue". If your issue is time-sensitive or critical, use methods like support@pulumi.com instead.
## Our Responsibilities
Project maintainers are responsible for clarifying the standards of acceptable
behavior and are expected to take appropriate and fair corrective action in
response to any instances of unacceptable behavior.
Project maintainers have the right and responsibility to remove, edit, or
reject comments, commits, code, wiki edits, issues, GitHub Discussions posts,
and other contributions that are not aligned to this Code of Conduct, or to ban
temporarily or permanently any contributor for other behaviors that they deem
inappropriate, threatening, offensive, or harmful.
## Scope
This Code of Conduct applies both within project spaces (including the Community Slack
and GitHub Discussions forums) and in public spaces when an individual is representing the
project or its community. Examples of representing a project or community include
using an official project e-mail address, posting via an official social media account,
or acting as an appointed representative at an online or offline event. Representation
of a project may be further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be
reported by contacting the project team at code-of-conduct@pulumi.com. All
complaints will be reviewed and investigated and will result in a response that
is deemed necessary and appropriate to the circumstances. The project team is
obligated to maintain confidentiality with regard to the reporter of an incident.
Further details of specific enforcement policies may be posted separately.
Project maintainers who do not follow or enforce the Code of Conduct in good
faith may face temporary or permanent repercussions as determined by other
members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
[homepage]: https://www.contributor-covenant.org

316
Makefile
View File

@@ -1,316 +0,0 @@
PROJECT_NAME := Pulumi Docker Build Resource Provider
PACK := docker-build
PACKDIR := sdk
PROJECT := github.com/pulumi/pulumi-docker-build
NODE_MODULE_NAME := @pulumi/docker-build
NUGET_PKG_NAME := Pulumi.DockerBuild
PROVIDER := pulumi-resource-${PACK}
PROVIDER_PATH := provider
VERSION_PATH := ${PROVIDER_PATH}.Version
SCHEMA_PATH := ${PROVIDER_PATH}/cmd/pulumi-resource-${PACK}/schema.json
GOPATH := $(shell go env GOPATH)
WORKING_DIR := $(shell pwd)
EXAMPLES_DIR := ${WORKING_DIR}/examples/yaml
TESTPARALLELISM := 4
PULUMI := bin/pulumi
GOGLANGCILINT := bin/golangci-lint
# Override during CI using `make [TARGET] PROVIDER_VERSION=""` or by setting a PROVIDER_VERSION environment variable
# Local & branch builds will just used this fixed default version unless specified
PROVIDER_VERSION ?= 0.1.0-alpha.0+dev
# Use this normalised version everywhere rather than the raw input to ensure consistency.
VERSION_GENERIC = $(shell pulumictl convert-version --language generic --version "$(PROVIDER_VERSION)")
export PULUMI_IGNORE_AMBIENT_PLUGINS = true
export PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION = true
.PHONY: ensure
ensure:: tidy lint test_provider examples
.PHONY: tidy
tidy:
go mod tidy
.PHONY: provider
provider: bin/${PROVIDER} bin/pulumi-gen-${PACK} # Required by CI
.PHONY: local_generate
local_generate: sdk # Required by CI
provider_debug::
(cd provider && go build -o $(WORKING_DIR)/bin/${PROVIDER} -gcflags="all=-N -l" -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
test_provider:: # Required by CI
go test -short -v -coverprofile="coverage.txt" -coverpkg=./provider/... -timeout 2h -parallel ${TESTPARALLELISM} ./provider/...
test_examples: install_nodejs_sdk install_dotnet_sdk
go test -short -v -cover -tags=all -timeout 2h -parallel ${TESTPARALLELISM} ./examples/...
test_all:: test_provider test_examples
.PHONY:
gen_examples:
examples: $(shell mkdir -p examples)
examples: sdk examples/yaml examples/go examples/nodejs examples/python examples/dotnet examples/java
examples/yaml:
rm -rf ${WORKING_DIR}/examples/yaml/app
cp -r ${WORKING_DIR}/examples/app ${WORKING_DIR}/examples/yaml/app
examples/go: ${PULUMI} bin/${PROVIDER} ${WORKING_DIR}/examples/yaml/Pulumi.yaml
$(call example,go)
@git checkout examples/go/go.mod
examples/nodejs: ${PULUMI} bin/${PROVIDER} ${WORKING_DIR}/examples/yaml/Pulumi.yaml
$(call example,nodejs)
@git checkout examples/nodejs/package.json
examples/python: ${PULUMI} bin/${PROVIDER} ${WORKING_DIR}/examples/yaml/Pulumi.yaml
$(call example,python)
@git checkout examples/python/requirements.txt
examples/dotnet: ${PULUMI} bin/${PROVIDER} ${WORKING_DIR}/examples/yaml/Pulumi.yaml
$(call example,dotnet)
@git checkout examples/dotnet/provider-docker-build.csproj
examples/java: ${PULUMI} bin/${PROVIDER} ${WORKING_DIR}/examples/yaml/Pulumi.yaml
$(call example,java)
@git checkout examples/java/pom.xml
${PULUMI}: go.sum
GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi/pkg/v3/cmd/pulumi
GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi/sdk/go/pulumi-language-go/v3
GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi/sdk/nodejs/cmd/pulumi-language-nodejs/v3
GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi/sdk/python/cmd/pulumi-language-python/v3
GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi-java/pkg/cmd/pulumi-language-java
GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3
GOBIN=${WORKING_DIR}/bin go install github.com/pulumi/pulumi-yaml/cmd/pulumi-converter-yaml
${GOGLANGCILINT}: go.sum
GOBIN=${WORKING_DIR}/bin go install github.com/golangci/golangci-lint/cmd/golangci-lint@8b37f14
define pulumi_login
export PULUMI_CONFIG_PASSPHRASE=asdfqwerty1234; \
pulumi login --local;
endef
define example
rm -rf ${WORKING_DIR}/examples/$(1)
$(PULUMI) convert \
--cwd ${WORKING_DIR}/examples/yaml \
--logtostderr \
--generate-only \
--non-interactive \
--language $(1) \
--out ${WORKING_DIR}/examples/$(1)
cp -r ${WORKING_DIR}/examples/app ${WORKING_DIR}/examples/$(1)/app
cp ${WORKING_DIR}/examples/yaml/.dockerignore ${WORKING_DIR}/examples/$(1)/.dockerignore
endef
up::
$(call pulumi_login) \
cd ${EXAMPLES_DIR} && \
pulumi stack init dev && \
pulumi stack select dev && \
pulumi config set name dev && \
pulumi up -y
down::
$(call pulumi_login) \
cd ${EXAMPLES_DIR} && \
pulumi stack select dev && \
pulumi destroy -y && \
pulumi stack rm dev -y
devcontainer::
git submodule update --init --recursive .devcontainer
git submodule update --remote --merge .devcontainer
cp -f .devcontainer/devcontainer.json .devcontainer.json
.PHONY: build
build:: provider sdk/dotnet sdk/go sdk/nodejs sdk/python sdk/java ${SCHEMA_PATH}
# Required for the codegen action that runs in pulumi/pulumi
only_build:: build
.PHONY: lint
lint: ${GOGLANGCILINT}
${GOGLANGCILINT} run --fix -c .golangci.yml
install:: install_nodejs_sdk install_dotnet_sdk
cp $(WORKING_DIR)/bin/${PROVIDER} ${GOPATH}/bin
install_dotnet_sdk:: # Required by CI
rm -rf $(WORKING_DIR)/nuget/$(NUGET_PKG_NAME).*.nupkg
mkdir -p $(WORKING_DIR)/nuget
find . -name '*.nupkg' -print -exec cp -p {} ${WORKING_DIR}/nuget \;
install_python_sdk:: # Required by CI
install_go_sdk:: # Required by CI
install_nodejs_sdk:: # Required by CI
-yarn unlink --cwd $(WORKING_DIR)/sdk/nodejs/bin
yarn link --cwd $(WORKING_DIR)/sdk/nodejs/bin
.PHONY: codegen
codegen: # Required by CI
.PHONY: generate_schema
generate_schema: ${SCHEMA_PATH} # Required by CI
.PHONY: build_go install_go_sdk
generate_go: sdk/go # Required by CI
build_go: # Required by CI
.PHONY: build_java install_java_sdk
generate_java: sdk/java # Required by CI
build_java: # Required by CI
.PHONY: build_python install_python_sdk
generate_python: sdk/python # Required by CI
build_python: # Required by CI
.PHONY: build_nodejs install_nodejs_sdk
generate_nodejs: sdk/nodejs # Required by CI
build_nodejs: # Required by CI
.PHONY: build_dotnet install_dotnet_sdk
generate_dotnet: sdk/dotnet # Required by CI
build_dotnet: # Required by CI
${SCHEMA_PATH}: bin/${PROVIDER}
pulumi package get-schema ./bin/${PROVIDER} | jq 'del(.version)' > $(SCHEMA_PATH)
bin/${PROVIDER}: $(shell find ./provider -name '*.go') go.mod
(cd provider && go build -o ../bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION_GENERIC}" $(PROJECT)/${PROVIDER_PATH}/cmd/$(PROVIDER))
bin/pulumi-gen-${PACK}: # Required by CI
touch bin/pulumi-gen-${PACK}
go.mod: $(shell find . -name '*.go')
go.sum: go.mod
sdk: $(shell mkdir -p sdk)
sdk: sdk/python sdk/nodejs sdk/java sdk/python sdk/go sdk/dotnet
# Folders can't be used for up-to-date checks as they will be marked as up-to-date even if the step fails - leading to a broken state.
.PHONY: sdk/*
sdk/python: TMPDIR := $(shell mktemp -d)
sdk/python: $(PULUMI) bin/${PROVIDER}
rm -rf sdk/python
$(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language python -o ${TMPDIR}
cp README.md ${TMPDIR}/python/
cd ${TMPDIR}/python/ && \
rm -rf ./bin/ ../python.bin/ && cp -R . ../python.bin && mv ../python.bin ./bin && \
python3 -m venv venv && \
./venv/bin/python -m pip install build && \
cd ./bin && \
../venv/bin/python -m build .
mv -f ${TMPDIR}/python ${WORKING_DIR}/sdk/.
sdk/nodejs: TMPDIR := $(shell mktemp -d)
sdk/nodejs: $(PULUMI) bin/${PROVIDER}
rm -rf sdk/nodejs
$(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language nodejs -o ${TMPDIR}
cp README.md LICENSE ${TMPDIR}/nodejs
cd ${TMPDIR}/nodejs/ && \
yarn install && \
yarn run tsc && \
cp README.md LICENSE package.json yarn.lock bin/
mv -f ${TMPDIR}/nodejs ${WORKING_DIR}/sdk/.
sdk/go: TMPDIR := $(shell mktemp -d)
sdk/go: PATH := "$(WORKING_DIR)/bin:$(PATH)"
sdk/go: $(PULUMI) bin/${PROVIDER}
rm -rf sdk/go
PATH=$(PATH) $(PULUMI) package gen-sdk ./bin/$(PROVIDER) --language go -o ${TMPDIR}
cp go.mod ${TMPDIR}/go/dockerbuild/go.mod
cd ${TMPDIR}/go/dockerbuild && \
go mod edit -module=github.com/pulumi/pulumi-${PACK}/${PACKDIR}/go/dockerbuild && \
go mod tidy
mv -f ${TMPDIR}/go ${WORKING_DIR}/sdk/go
sdk/dotnet: TMPDIR := $(shell mktemp -d)
sdk/dotnet: $(PULUMI) bin/${PROVIDER}
rm -rf sdk/dotnet
$(PULUMI) package gen-sdk ./bin/${PROVIDER} --language dotnet -o ${TMPDIR}
cd ${TMPDIR}/dotnet/ && \
echo "$(VERSION_GENERIC)" > version.txt && \
dotnet build
mv -f ${TMPDIR}/dotnet ${WORKING_DIR}/sdk/.
sdk/java: PACKAGE_VERSION := $(shell pulumictl convert-version --language generic -v "$(VERSION_GENERIC)")
sdk/java: TMPDIR := $(shell mktemp -d)
sdk/java: $(PULUMI) bin/${PROVIDER}
rm -rf sdk/java
$(PULUMI) package gen-sdk --language java ./bin/${PROVIDER} -o ${TMPDIR}
cd ${TMPDIR}/java/ && gradle --console=plain build
mv -f ${TMPDIR}/java ${WORKING_DIR}/sdk/.
docs: $(shell find docs/yaml -type f) $(shell find ./provider/internal/embed -name '*.md') ${SCHEMA_PATH}
go generate docs/generate.go
@touch docs
# Set these variables to enable signing of the windows binary
AZURE_SIGNING_CLIENT_ID ?=
AZURE_SIGNING_CLIENT_SECRET ?=
AZURE_SIGNING_TENANT_ID ?=
AZURE_SIGNING_KEY_VAULT_URI ?=
SKIP_SIGNING ?=
bin/jsign-6.0.jar:
wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar --output-document=bin/jsign-6.0.jar
sign-goreleaser-exe-amd64: GORELEASER_ARCH := amd64_v1
sign-goreleaser-exe-arm64: GORELEASER_ARCH := arm64
# Set the shell to bash to allow for the use of bash syntax.
sign-goreleaser-exe-%: SHELL:=/bin/bash
sign-goreleaser-exe-%: bin/jsign-6.0.jar
@# Only sign windows binary if fully configured.
@# Test variables set by joining with | between and looking for || showing at least one variable is empty.
@# Move the binary to a temporary location and sign it there to avoid the target being up-to-date if signing fails.
@set -e; \
if [[ "${SKIP_SIGNING}" != "true" ]]; then \
if [[ "|${AZURE_SIGNING_CLIENT_ID}|${AZURE_SIGNING_CLIENT_SECRET}|${AZURE_SIGNING_TENANT_ID}|${AZURE_SIGNING_KEY_VAULT_URI}|" == *"||"* ]]; then \
echo "Can't sign windows binaries as required configuration not set: AZURE_SIGNING_CLIENT_ID, AZURE_SIGNING_CLIENT_SECRET, AZURE_SIGNING_TENANT_ID, AZURE_SIGNING_KEY_VAULT_URI"; \
echo "To rebuild with signing delete the unsigned windows exe file and rebuild with the fixed configuration"; \
if [[ "${CI}" == "true" ]]; then exit 1; fi; \
else \
file=dist/build-provider-sign-windows_windows_${GORELEASER_ARCH}/pulumi-resource-docker-build.exe; \
mv $${file} $${file}.unsigned; \
az login --service-principal \
--username "${AZURE_SIGNING_CLIENT_ID}" \
--password "${AZURE_SIGNING_CLIENT_SECRET}" \
--tenant "${AZURE_SIGNING_TENANT_ID}" \
--output none; \
ACCESS_TOKEN=$$(az account get-access-token --resource "https://vault.azure.net" | jq -r .accessToken); \
java -jar bin/jsign-6.0.jar \
--storetype AZUREKEYVAULT \
--keystore "PulumiCodeSigning" \
--url "${AZURE_SIGNING_KEY_VAULT_URI}" \
--storepass "$${ACCESS_TOKEN}" \
$${file}.unsigned; \
mv $${file}.unsigned $${file}; \
az logout; \
fi; \
fi
# To make an immediately observable change to .ci-mgmt.yaml:
#
# - Edit .ci-mgmt.yaml
# - Run make ci-mgmt to apply the change locally.
#
ci-mgmt: .ci-mgmt.yaml
go run github.com/pulumi/ci-mgmt/provider-ci@master generate
.PHONY: ci-mgmt
fi

View File

@@ -1,204 +0,0 @@
#!/usr/bin/env python
# Copyright 2016-2018, Pulumi Corporation. All rights reserved.
import argparse
import asyncio
from typing import Optional
import logging
import os
import sys
import traceback
import runpy
from concurrent.futures import ThreadPoolExecutor
# The user might not have installed Pulumi yet in their environment - provide a high-quality error message in that case.
try:
import pulumi
import pulumi.runtime
except ImportError:
# For whatever reason, sys.stderr.write is not picked up by the engine as a message, but 'print' is. The Python
# langhost automatically flushes stdout and stderr on shutdown, so we don't need to do it here - just trust that
# Python does the sane thing when printing to stderr.
print(traceback.format_exc(), file=sys.stderr)
print("""
It looks like the Pulumi SDK has not been installed. Have you run pip install?
If you are running in a virtualenv, you must run pip install -r requirements.txt from inside the virtualenv.""", file=sys.stderr)
sys.exit(1)
# use exit code 32 to signal to the language host that an error message was displayed to the user
PYTHON_PROCESS_EXITED_AFTER_SHOWING_USER_ACTIONABLE_MESSAGE_CODE = 32
def get_abs_module_path(mod_path):
path, ext = os.path.splitext(mod_path)
if not ext:
path = os.path.join(path, '__main__')
return os.path.abspath(path)
def _get_user_stacktrace(user_program_abspath: str) -> str:
'''grabs the current stacktrace and truncates it to show the only stacks pertaining to a user's program'''
tb = traceback.extract_tb(sys.exc_info()[2])
for frame_index, frame in enumerate(tb):
# loop over stack frames until we reach the main program
# then return the traceback truncated to the user's code
cur_module = frame[0]
if get_abs_module_path(user_program_abspath) == get_abs_module_path(cur_module):
# we have detected the start of a user's stack trace
remaining_frames = len(tb)-frame_index
# include remaining frames from the bottom by negating
return traceback.format_exc(limit=-remaining_frames)
# we did not detect a __main__ program, return normal traceback
return traceback.format_exc()
def _set_default_executor(loop, parallelism: Optional[int]):
'''configure this event loop to respect the settings provided.'''
if parallelism is None:
return
parallelism = max(parallelism, 1)
exec = ThreadPoolExecutor(max_workers=parallelism)
loop.set_default_executor(exec)
if __name__ == "__main__":
# Parse the arguments, program name, and optional arguments.
ap = argparse.ArgumentParser(description='Execute a Pulumi Python program')
ap.add_argument('--project', help='Set the project name')
ap.add_argument('--stack', help='Set the stack name')
ap.add_argument('--parallel', help='Run P resource operations in parallel (default=none)')
ap.add_argument('--dry_run', help='Simulate resource changes, but without making them')
ap.add_argument('--pwd', help='Change the working directory before running the program')
ap.add_argument('--monitor', help='An RPC address for the resource monitor to connect to')
ap.add_argument('--engine', help='An RPC address for the engine to connect to')
ap.add_argument('--tracing', help='A Zipkin-compatible endpoint to send tracing data to')
ap.add_argument('--organization', help='Set the organization name')
ap.add_argument('PROGRAM', help='The Python program to run')
ap.add_argument('ARGS', help='Arguments to pass to the program', nargs='*')
args = ap.parse_args()
# If any config variables are present, parse and set them, so subsequent accesses are fast.
config_env = pulumi.runtime.get_config_env()
if hasattr(pulumi.runtime, "get_config_secret_keys_env") and hasattr(pulumi.runtime, "set_all_config"):
# If the pulumi SDK has `get_config_secret_keys_env` and `set_all_config`, use them
# to set the config and secret keys.
config_secret_keys_env = pulumi.runtime.get_config_secret_keys_env()
pulumi.runtime.set_all_config(config_env, config_secret_keys_env)
else:
# Otherwise, fallback to setting individual config values.
for k, v in config_env.items():
pulumi.runtime.set_config(k, v)
# Configure the runtime so that the user program hooks up to Pulumi as appropriate.
# New versions of pulumi python support setting organization, old versions do not
try:
settings = pulumi.runtime.Settings(
monitor=args.monitor,
engine=args.engine,
project=args.project,
stack=args.stack,
parallel=int(args.parallel),
dry_run=args.dry_run == "true",
organization=args.organization,
)
except TypeError:
settings = pulumi.runtime.Settings(
monitor=args.monitor,
engine=args.engine,
project=args.project,
stack=args.stack,
parallel=int(args.parallel),
dry_run=args.dry_run == "true"
)
pulumi.runtime.configure(settings)
# Finally, swap in the args, chdir if needed, and run the program as if it had been executed directly.
sys.argv = [args.PROGRAM] + args.ARGS
if args.pwd is not None:
os.chdir(args.pwd)
successful = False
try:
# The docs for get_running_loop are somewhat misleading because they state:
# This function can only be called from a coroutine or a callback. However, if the function is
# called from outside a coroutine or callback (the standard case when running `pulumi up`), the function
# raises a RuntimeError as expected and falls through to the exception clause below.
loop = asyncio.get_running_loop()
except RuntimeError:
loop = asyncio.new_event_loop()
asyncio.set_event_loop(loop)
# Configure the event loop to respect the parallelism value provided as input.
_set_default_executor(loop, settings.parallel)
# We are (unfortunately) suppressing the log output of asyncio to avoid showing to users some of the bad things we
# do in our programming model.
#
# Fundamentally, Pulumi is a way for users to build asynchronous dataflow graphs that, as their deployments
# progress, resolve naturally and eventually result in the complete resolution of the graph. If one node in the
# graph fails (i.e. a resource fails to create, there's an exception in an apply, etc.), part of the graph remains
# unevaluated at the time that we exit.
#
# asyncio abhors this. It gets very upset if the process terminates without having observed every future that we
# have resolved. If we are terminating abnormally, it is highly likely that we are not going to observe every single
# future that we have created. Furthermore, it's *harmless* to do this - asyncio logs errors because it thinks it
# needs to tell users that they're doing bad things (which, to their credit, they are), but we are doing this
# deliberately.
#
# In order to paper over this for our users, we simply turn off the logger for asyncio. Users won't see any asyncio
# error messages, but if they stick to the Pulumi programming model, they wouldn't be seeing any anyway.
logging.getLogger("asyncio").setLevel(logging.CRITICAL)
exit_code = 1
try:
# record the location of the user's program to return user tracebacks
user_program_abspath = os.path.abspath(args.PROGRAM)
def run():
try:
runpy.run_path(args.PROGRAM, run_name='__main__')
except ImportError as e:
def fix_module_file(m: str) -> str:
# Work around python 11 reporting "<frozen runpy>" rather
# than runpy.__file__ in the traceback.
return runpy.__file__ if m == "<frozen runpy>" else m
# detect if the main pulumi python program does not exist
stack_modules = [fix_module_file(f.filename) for f in traceback.extract_tb(e.__traceback__)]
unique_modules = set(module for module in stack_modules)
last_module_name = stack_modules[-1]
# we identify a missing program error if
# 1. the only modules in the stack trace are
# - `pulumi-language-python-exec`
# - `runpy`
# 2. the last function in the stack trace is in the `runpy` module
if unique_modules == {
__file__, # the language runtime itself
runpy.__file__,
} and last_module_name == runpy.__file__ :
# this error will only be hit when the user provides a directory
# the engine has a check to determine if the `main` file exists and will fail early
# if a language runtime receives a directory, it's the language's responsibility to determine
# whether the provided directory has a pulumi program
pulumi.log.error(f"unable to find main python program `__main__.py` in `{user_program_abspath}`")
sys.exit(PYTHON_PROCESS_EXITED_AFTER_SHOWING_USER_ACTIONABLE_MESSAGE_CODE)
else:
raise e
coro = pulumi.runtime.run_in_stack(run)
loop.run_until_complete(coro)
exit_code = 0
except pulumi.RunError as e:
pulumi.log.error(str(e))
except Exception:
error_msg = "Program failed with an unhandled exception:\n" + _get_user_stacktrace(user_program_abspath)
pulumi.log.error(error_msg)
exit_code = PYTHON_PROCESS_EXITED_AFTER_SHOWING_USER_ACTIONABLE_MESSAGE_CODE
finally:
loop.close()
sys.stdout.flush()
sys.stderr.flush()
sys.exit(exit_code)

View File

@@ -1,12 +0,0 @@
comment:
layout: "header, files, footer"
hide_project_coverage: false
coverage:
status:
project:
default:
informational: true
patch:
default:
informational: true

View File

@@ -1,216 +0,0 @@
// Copyright 2024, Pulumi Corporation.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//go:generate go run generate.go yaml ../provider/internal/embed
// Package main ingests a multi-document YAML file and converts it into
// Markdown examples.
package main
import (
"fmt"
"io"
"log"
"os"
"os/exec"
"path/filepath"
"strings"
"gopkg.in/yaml.v3"
"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
)
func main() {
if len(os.Args) < 3 {
_, _ = fmt.Fprintf(os.Stdout, "Usage: %s <yaml source dir path> <markdown destination path>\n", os.Args[0])
os.Exit(1)
}
yamlPath := os.Args[1]
mdPath := os.Args[2]
if !filepath.IsAbs(yamlPath) {
cwd, err := os.Getwd()
contract.AssertNoErrorf(err, "getting working directory")
yamlPath = filepath.Join(cwd, yamlPath)
}
if err := os.MkdirAll(mdPath, 0o750); err != nil {
panic(err)
}
fileInfo, err := os.Lstat(mdPath)
if err != nil || !fileInfo.IsDir() {
fmt.Fprintf(os.Stderr, "Expect markdown destination %q to be a directory\n", mdPath)
os.Exit(1)
}
yamlFiles, err := os.ReadDir(yamlPath)
if err != nil {
panic(err)
}
for _, yamlFile := range yamlFiles {
if err := processYaml(filepath.Join(yamlPath, yamlFile.Name()), mdPath); err != nil {
log.Fatal(fmt.Errorf("processing %q: %w", yamlFile.Name(), err))
}
}
}
func markdownExamples(examples []string) string {
s := "{{% examples %}}\n## Example Usage\n"
for _, example := range examples {
s += example
}
s += "{{% /examples %}}"
return s
}
func markdownExample(description string,
typescript string,
python string,
csharp string,
golang string,
yaml string,
java string,
) string {
return fmt.Sprintf("{{%% example %%}}\n### %s\n\n"+
"```typescript\n%s```\n"+
"```python\n%s```\n"+
"```csharp\n%s```\n"+
"```go\n%s```\n"+
"```yaml\n%s```\n"+
"```java\n%s```\n"+
"{{%% /example %%}}\n",
description, typescript, python, csharp, golang, yaml, java)
}
func convert(language, tempDir, programFile string) (string, error) {
exampleDir := filepath.Join(tempDir, "example"+language)
//nolint:gosec // No user-provided input.
cmd := exec.Command(
"pulumi",
"convert",
"--language",
language,
"--out",
filepath.Clean(filepath.Join(tempDir, exampleDir)),
"--generate-only",
)
cmd.Stderr = os.Stderr
cmd.Stdout = os.Stdout
cmd.Dir = tempDir
if err := cmd.Run(); err != nil {
return "", fmt.Errorf("converting: %w", err)
}
content, err := os.ReadFile(filepath.Clean(filepath.Join(tempDir, exampleDir, programFile)))
if err != nil {
return "", fmt.Errorf("reading: %w", err)
}
return string(content), nil
}
func processYaml(path, mdDir string) error {
yamlFile, err := os.Open(filepath.Clean(path))
if err != nil {
return err
}
base := filepath.Base(path)
md := strings.NewReplacer(".yaml", ".md", ".yml", ".md").Replace(base)
defer contract.IgnoreClose(yamlFile)
decoder := yaml.NewDecoder(yamlFile)
exampleStrings := []string{}
for {
keepGoing, err := func() (bool, error) {
example := map[string]interface{}{}
err := decoder.Decode(&example)
if err == io.EOF {
return false, nil
}
description, ok := example["description"].(string)
if !ok {
description = ""
}
dir, err := os.MkdirTemp("", "")
if err != nil {
return false, err
}
defer func() {
contract.IgnoreError(os.RemoveAll(dir))
}()
src, err := os.OpenFile(filepath.Clean(filepath.Join(dir, "Pulumi.yaml")), os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
if err != nil {
return false, err
}
fmt.Println("Converting:", example)
if err := yaml.NewEncoder(src).Encode(example); err != nil {
return false, err
}
contract.AssertNoErrorf(src.Close(), "closing")
typescript, err := convert("typescript", dir, "index.ts")
if err != nil {
return false, err
}
python, err := convert("python", dir, "__main__.py")
if err != nil {
return false, err
}
csharp, err := convert("csharp", dir, "Program.cs")
if err != nil {
return false, err
}
golang, err := convert("go", dir, "main.go")
if err != nil {
return false, err
}
java, err := convert("java", dir, "src/main/java/generated_program/App.java")
if err != nil {
return false, err
}
yamlContent, err := os.ReadFile(filepath.Clean(filepath.Join(dir, "Pulumi.yaml")))
if err != nil {
return false, err
}
yaml := string(yamlContent)
exampleStrings = append(exampleStrings, markdownExample(description, typescript, python, csharp, golang, yaml, java))
return true, nil
}()
if err != nil {
return err
}
if !keepGoing {
break
}
}
_, _ = fmt.Fprintf(os.Stdout, "Writing %s\n", filepath.Join(mdDir, md))
f, err := os.OpenFile(filepath.Clean(filepath.Join(mdDir, md)), os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0o600)
if err != nil {
return err
}
defer contract.IgnoreClose(f)
_, err = f.WriteString(markdownExamples(exampleStrings))
contract.AssertNoErrorf(err, "writing examples")
return nil
}

View File

@@ -1,190 +0,0 @@
name: ecr
description: Push to AWS ECR with caching
outputs:
ref: ${my-image.ref}
resources:
ecr-repository:
type: aws:ecr:Repository
my-image:
type: docker-build:Image
properties:
tags:
- ${ecr-repository.repositoryUrl}:latest
push: true
context:
location: ./app
cacheFrom:
- registry:
ref: ${ecr-repository.repositoryUrl}:cache
cacheTo:
- registry:
ref: ${ecr-repository.repositoryUrl}:cache
imageManifest: true
ociMediaTypes: true
registries:
- username: ${auth-token.userName}
password: ${auth-token.password}
address: ${ecr-repository.repositoryUrl}
runtime: yaml
variables:
auth-token:
fn::aws:ecr:getAuthorizationToken:
registryId: ${ecr-repository.registryId}
---
name: multi-platform
runtime: yaml
description: Multi-platform image
resources:
image:
type: docker-build:Image
properties:
context:
location: "app"
platforms:
- plan9/amd64
- plan9/386
push: false
---
name: registry
runtime: yaml
description: Registry export
resources:
image:
type: docker-build:Image
properties:
tags:
- "docker.io/pulumi/pulumi:3.107.0"
context:
location: "app"
push: true
registries:
- address: docker.io
username: pulumibot
password: ${dockerHubPassword}
outputs:
ref: ${my-image.ref}
---
name: caching
runtime: yaml
description: Caching
resources:
image:
type: docker-build:Image
properties:
context:
location: "app"
cacheTo:
- local:
dest: tmp/cache
mode: max
cacheFrom:
- local:
src: tmp/cache
push: false
---
name: dbc
runtime: yaml
description: Docker Build Cloud
resources:
image:
type: docker-build:Image
properties:
context:
location: "app"
exec: true
builder:
name: cloud-builder-name
push: false
---
name: build-args
runtime: yaml
description: Build arguments
resources:
image:
type: docker-build:Image
properties:
context:
location: "app"
buildArgs:
SET_ME_TO_TRUE: "true"
push: false
---
name: build-target
runtime: yaml
description: Build target
resources:
image:
type: docker-build:Image
properties:
context:
location: "app"
target: "build-me"
push: false
---
name: named-contexts
runtime: yaml
description: Named contexts
resources:
image:
type: docker-build:Image
properties:
context:
location: app
named:
"golang:latest":
location: "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"
push: false
---
name: remote-context
runtime: yaml
description: Remote context
resources:
image:
type: docker-build:Image
properties:
context:
location: "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"
push: false
---
name: inline
runtime: yaml
description: Inline Dockerfile
resources:
image:
type: docker-build:Image
properties:
dockerfile:
inline: |
FROM busybox
COPY hello.c ./
context:
location: "app"
push: false
---
name: remote-context
runtime: yaml
description: Remote context
resources:
image:
type: docker-build:Image
properties:
dockerfile:
location: app/Dockerfile
context:
location: "https://github.com/docker-library/hello-world.git"
push: false
---
name: docker-load
runtime: yaml
description: Local export
resources:
image:
type: docker-build:Image
properties:
context:
location: "app"
exports:
- docker:
tar: true
push: false

View File

@@ -1,48 +0,0 @@
name: registry-caching
description: Multi-platform registry caching
runtime: yaml
resources:
arm64:
type: docker-build:Image
properties:
context:
location: "app"
platforms:
- linux/arm64
tags:
- "docker.io/pulumi/pulumi:3.107.0-arm64"
cacheTo:
- registry:
ref: "docker.io/pulumi/pulumi:cache-arm64"
mode: max
cacheFrom:
- registry:
ref: "docker.io/pulumi/pulumi:cache-arm64"
amd64:
type: docker-build:Image
properties:
context:
location: "app"
platforms:
- linux/amd64
tags:
- "docker.io/pulumi/pulumi:3.107.0-amd64"
cacheTo:
- registry:
ref: "docker.io/pulumi/pulumi:cache-amd64"
mode: max
cacheFrom:
- registry:
ref: "docker.io/pulumi/pulumi:cache-amd64"
index:
type: docker-build:Index
properties:
tag: "docker.io/pulumi/pulumi:3.107.0"
sources:
- ${amd64.ref}
- ${arm64.ref}
outputs:
ref: ${index.ref}

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo 👍

View File

@@ -1,5 +0,0 @@
FROM alpine
ARG SET_ME_TO_TRUE
RUN [ "$SET_ME_TO_TRUE" = "true" ]
RUN echo "That's the correct build arg, thanks! 👍"

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo "This image doesn't use any local files, so it doesn't need a context parameter 👍"

View File

@@ -1,3 +0,0 @@
FROM bash AS base
RUN getent hosts metadata.google.internal

View File

@@ -1,7 +0,0 @@
FROM --platform=$BUILDPLATFORM alpine as build
RUN echo ${BUILDPLATFORM} > buildplatform
RUN echo ${TARGETPLATFORM} > targetplatform
FROM build
RUN cat buildplatform
RUN cat targetplatform

View File

@@ -1,5 +0,0 @@
# syntax=docker/dockerfile:1.4
FROM golang:latest
RUN version="$(go version)" && echo $version && [ "$version" = "go version go1.21.7 linux/amd64" ]
RUN echo "This image uses named contexts to pin golang:latest to a specific SHA 👍"

View File

@@ -1,4 +0,0 @@
FROM alpine
RUN --mount=type=secret,id=password [ "$(cat /run/secrets/password)" = "hunter2" ]

View File

@@ -1,5 +0,0 @@
FROM alpine
RUN apk add openssh-client
RUN --mount=type=ssh ssh-add -l

View File

@@ -1,8 +0,0 @@
FROM alpine as build-me
RUN echo 👍
FROM build-me as also-build-me
RUN echo 🤙
FROM build-me as dont-build-me
RUN [ "true" = "false" ]

View File

@@ -1,2 +0,0 @@
command-output
tmp

View File

@@ -1,353 +0,0 @@
## Ignore Visual Studio temporary files, build results, and
## files generated by popular Visual Studio add-ons.
##
## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
# User-specific files
*.rsuser
*.suo
*.user
*.userosscache
*.sln.docstates
# User-specific files (MonoDevelop/Xamarin Studio)
*.userprefs
# Mono auto generated files
mono_crash.*
# Build results
[Dd]ebug/
[Dd]ebugPublic/
[Rr]elease/
[Rr]eleases/
x64/
x86/
[Aa][Rr][Mm]/
[Aa][Rr][Mm]64/
bld/
[Bb]in/
[Oo]bj/
[Ll]og/
[Ll]ogs/
# Visual Studio 2015/2017 cache/options directory
.vs/
# Uncomment if you have tasks that create the project's static files in wwwroot
#wwwroot/
# Visual Studio 2017 auto generated files
Generated\ Files/
# MSTest test Results
[Tt]est[Rr]esult*/
[Bb]uild[Ll]og.*
# NUnit
*.VisualState.xml
TestResult.xml
nunit-*.xml
# Build Results of an ATL Project
[Dd]ebugPS/
[Rr]eleasePS/
dlldata.c
# Benchmark Results
BenchmarkDotNet.Artifacts/
# .NET Core
project.lock.json
project.fragment.lock.json
artifacts/
# StyleCop
StyleCopReport.xml
# Files built by Visual Studio
*_i.c
*_p.c
*_h.h
*.ilk
*.meta
*.obj
*.iobj
*.pch
*.pdb
*.ipdb
*.pgc
*.pgd
*.rsp
*.sbr
*.tlb
*.tli
*.tlh
*.tmp
*.tmp_proj
*_wpftmp.csproj
*.log
*.vspscc
*.vssscc
.builds
*.pidb
*.svclog
*.scc
# Chutzpah Test files
_Chutzpah*
# Visual C++ cache files
ipch/
*.aps
*.ncb
*.opendb
*.opensdf
*.sdf
*.cachefile
*.VC.db
*.VC.VC.opendb
# Visual Studio profiler
*.psess
*.vsp
*.vspx
*.sap
# Visual Studio Trace Files
*.e2e
# TFS 2012 Local Workspace
$tf/
# Guidance Automation Toolkit
*.gpState
# ReSharper is a .NET coding add-in
_ReSharper*/
*.[Rr]e[Ss]harper
*.DotSettings.user
# JustCode is a .NET coding add-in
.JustCode
# TeamCity is a build add-in
_TeamCity*
# DotCover is a Code Coverage Tool
*.dotCover
# AxoCover is a Code Coverage Tool
.axoCover/*
!.axoCover/settings.json
# Visual Studio code coverage results
*.coverage
*.coveragexml
# NCrunch
_NCrunch_*
.*crunch*.local.xml
nCrunchTemp_*
# MightyMoose
*.mm.*
AutoTest.Net/
# Web workbench (sass)
.sass-cache/
# Installshield output folder
[Ee]xpress/
# DocProject is a documentation generator add-in
DocProject/buildhelp/
DocProject/Help/*.HxT
DocProject/Help/*.HxC
DocProject/Help/*.hhc
DocProject/Help/*.hhk
DocProject/Help/*.hhp
DocProject/Help/Html2
DocProject/Help/html
# Click-Once directory
publish/
# Publish Web Output
*.[Pp]ublish.xml
*.azurePubxml
# Note: Comment the next line if you want to checkin your web deploy settings,
# but database connection strings (with potential passwords) will be unencrypted
*.pubxml
*.publishproj
# Microsoft Azure Web App publish settings. Comment the next line if you want to
# checkin your Azure Web App publish settings, but sensitive information contained
# in these scripts will be unencrypted
PublishScripts/
# NuGet Packages
*.nupkg
# NuGet Symbol Packages
*.snupkg
# The packages folder can be ignored because of Package Restore
**/[Pp]ackages/*
# except build/, which is used as an MSBuild target.
!**/[Pp]ackages/build/
# Uncomment if necessary however generally it will be regenerated when needed
#!**/[Pp]ackages/repositories.config
# NuGet v3's project.json files produces more ignorable files
*.nuget.props
*.nuget.targets
# Microsoft Azure Build Output
csx/
*.build.csdef
# Microsoft Azure Emulator
ecf/
rcf/
# Windows Store app package directories and files
AppPackages/
BundleArtifacts/
Package.StoreAssociation.xml
_pkginfo.txt
*.appx
*.appxbundle
*.appxupload
# Visual Studio cache files
# files ending in .cache can be ignored
*.[Cc]ache
# but keep track of directories ending in .cache
!?*.[Cc]ache/
# Others
ClientBin/
~$*
*~
*.dbmdl
*.dbproj.schemaview
*.jfm
*.pfx
*.publishsettings
orleans.codegen.cs
# Including strong name files can present a security risk
# (https://github.com/github/gitignore/pull/2483#issue-259490424)
#*.snk
# Since there are multiple workflows, uncomment next line to ignore bower_components
# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
#bower_components/
# RIA/Silverlight projects
Generated_Code/
# Backup & report files from converting an old project file
# to a newer Visual Studio version. Backup files are not needed,
# because we have git ;-)
_UpgradeReport_Files/
Backup*/
UpgradeLog*.XML
UpgradeLog*.htm
ServiceFabricBackup/
*.rptproj.bak
# SQL Server files
*.mdf
*.ldf
*.ndf
# Business Intelligence projects
*.rdl.data
*.bim.layout
*.bim_*.settings
*.rptproj.rsuser
*- [Bb]ackup.rdl
*- [Bb]ackup ([0-9]).rdl
*- [Bb]ackup ([0-9][0-9]).rdl
# Microsoft Fakes
FakesAssemblies/
# GhostDoc plugin setting file
*.GhostDoc.xml
# Node.js Tools for Visual Studio
.ntvs_analysis.dat
node_modules/
# Visual Studio 6 build log
*.plg
# Visual Studio 6 workspace options file
*.opt
# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
*.vbw
# Visual Studio LightSwitch build output
**/*.HTMLClient/GeneratedArtifacts
**/*.DesktopClient/GeneratedArtifacts
**/*.DesktopClient/ModelManifest.xml
**/*.Server/GeneratedArtifacts
**/*.Server/ModelManifest.xml
_Pvt_Extensions
# Paket dependency manager
.paket/paket.exe
paket-files/
# FAKE - F# Make
.fake/
# CodeRush personal settings
.cr/personal
# Python Tools for Visual Studio (PTVS)
__pycache__/
*.pyc
# Cake - Uncomment if you are using it
# tools/**
# !tools/packages.config
# Tabs Studio
*.tss
# Telerik's JustMock configuration file
*.jmconfig
# BizTalk build output
*.btp.cs
*.btm.cs
*.odx.cs
*.xsd.cs
# OpenCover UI analysis results
OpenCover/
# Azure Stream Analytics local run output
ASALocalRun/
# MSBuild Binary and Structured Log
*.binlog
# NVidia Nsight GPU debugger configuration file
*.nvuser
# MFractors (Xamarin productivity tool) working folder
.mfractor/
# Local History for Visual Studio
.localhistory/
# BeatPulse healthcheck temp database
healthchecksdb
# Backup folder for Package Reference Convert tool in Visual Studio 2017
MigrationBackup/
# Ionide (cross platform F# VS Code tools) working folder
.ionide/

View File

@@ -1,268 +0,0 @@
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using DockerBuild = Pulumi.DockerBuild;
return await Deployment.RunAsync(() =>
{
var config = new Config();
var dockerHubPassword = config.Require("dockerHubPassword");
var multiPlatform = new DockerBuild.Image("multiPlatform", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Location = "./app/Dockerfile.multiPlatform",
},
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
Platforms = new[]
{
DockerBuild.Platform.Plan9_amd64,
DockerBuild.Platform.Plan9_386,
},
});
var registryPush = new DockerBuild.Image("registryPush", new()
{
Push = false,
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
Tags = new[]
{
"docker.io/pulumibot/buildkit-e2e:example",
},
Exports = new[]
{
new DockerBuild.Inputs.ExportArgs
{
Registry = new DockerBuild.Inputs.ExportRegistryArgs
{
OciMediaTypes = true,
Push = false,
},
},
},
Registries = new[]
{
new DockerBuild.Inputs.RegistryArgs
{
Address = "docker.io",
Username = "pulumibot",
Password = dockerHubPassword,
},
},
});
var cached = new DockerBuild.Image("cached", new()
{
Push = false,
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
CacheTo = new[]
{
new DockerBuild.Inputs.CacheToArgs
{
Local = new DockerBuild.Inputs.CacheToLocalArgs
{
Dest = "tmp/cache",
Mode = DockerBuild.CacheMode.Max,
},
},
},
CacheFrom = new[]
{
new DockerBuild.Inputs.CacheFromArgs
{
Local = new DockerBuild.Inputs.CacheFromLocalArgs
{
Src = "tmp/cache",
},
},
},
});
var buildArgs = new DockerBuild.Image("buildArgs", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Location = "./app/Dockerfile.buildArgs",
},
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
BuildArgs =
{
{ "SET_ME_TO_TRUE", "true" },
},
});
var extraHosts = new DockerBuild.Image("extraHosts", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Location = "./app/Dockerfile.extraHosts",
},
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
AddHosts = new[]
{
"metadata.google.internal:169.254.169.254",
},
});
var sshMount = new DockerBuild.Image("sshMount", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Location = "./app/Dockerfile.sshMount",
},
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
Ssh = new[]
{
new DockerBuild.Inputs.SSHArgs
{
Id = "default",
},
},
});
var secrets = new DockerBuild.Image("secrets", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Location = "./app/Dockerfile.secrets",
},
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
Secrets =
{
{ "password", "hunter2" },
},
});
var labels = new DockerBuild.Image("labels", new()
{
Push = false,
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
Labels =
{
{ "description", "This image will get a descriptive label 👍" },
},
});
var target = new DockerBuild.Image("target", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Location = "./app/Dockerfile.target",
},
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
Target = "build-me",
});
var namedContexts = new DockerBuild.Image("namedContexts", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Location = "./app/Dockerfile.namedContexts",
},
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
Named =
{
{ "golang:latest", new DockerBuild.Inputs.ContextArgs
{
Location = "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
} },
},
},
});
var remoteContext = new DockerBuild.Image("remoteContext", new()
{
Push = false,
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile",
},
});
var remoteContextWithInline = new DockerBuild.Image("remoteContextWithInline", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Inline = @"FROM busybox
COPY hello.c ./
",
},
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "https://github.com/docker-library/hello-world.git",
},
});
var inline = new DockerBuild.Image("inline", new()
{
Push = false,
Dockerfile = new DockerBuild.Inputs.DockerfileArgs
{
Inline = @"FROM alpine
RUN echo ""This uses an inline Dockerfile! 👍""
",
},
});
var dockerLoad = new DockerBuild.Image("dockerLoad", new()
{
Push = false,
Context = new DockerBuild.Inputs.BuildContextArgs
{
Location = "./app",
},
Exports = new[]
{
new DockerBuild.Inputs.ExportArgs
{
Docker = new DockerBuild.Inputs.ExportDockerArgs
{
Tar = true,
},
},
},
});
return new Dictionary<string, object?>
{
["platforms"] = multiPlatform.Platforms,
};
});

View File

@@ -1,10 +0,0 @@
name: provider-docker-build
runtime: dotnet
config:
dockerHubPassword:
type: string
secret: true
plugins:
providers:
- name: docker-build
path: ../../bin

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo 👍

View File

@@ -1,5 +0,0 @@
FROM alpine
ARG SET_ME_TO_TRUE
RUN [ "$SET_ME_TO_TRUE" = "true" ]
RUN echo "That's the correct build arg, thanks! 👍"

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo "This image doesn't use any local files, so it doesn't need a context parameter 👍"

View File

@@ -1,3 +0,0 @@
FROM bash AS base
RUN getent hosts metadata.google.internal

View File

@@ -1,7 +0,0 @@
FROM --platform=$BUILDPLATFORM alpine as build
RUN echo ${BUILDPLATFORM} > buildplatform
RUN echo ${TARGETPLATFORM} > targetplatform
FROM build
RUN cat buildplatform
RUN cat targetplatform

View File

@@ -1,5 +0,0 @@
# syntax=docker/dockerfile:1.4
FROM golang:latest
RUN version="$(go version)" && echo $version && [ "$version" = "go version go1.21.7 linux/amd64" ]
RUN echo "This image uses named contexts to pin golang:latest to a specific SHA 👍"

View File

@@ -1,4 +0,0 @@
FROM alpine
RUN --mount=type=secret,id=password [ "$(cat /run/secrets/password)" = "hunter2" ]

View File

@@ -1,5 +0,0 @@
FROM alpine
RUN apk add openssh-client
RUN --mount=type=ssh ssh-add -l

View File

@@ -1,8 +0,0 @@
FROM alpine as build-me
RUN echo 👍
FROM build-me as also-build-me
RUN echo 🤙
FROM build-me as dont-build-me
RUN [ "true" = "false" ]

View File

@@ -1,14 +0,0 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<OutputType>Exe</OutputType>
<TargetFramework>net8.0</TargetFramework>
<Nullable>enable</Nullable>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Pulumi" Version="3.*" />
<PackageReference Include="Pulumi.DockerBuild" Version="0.0.2-alpha.1712594380+4cd6d49b.dirty" />
</ItemGroup>
</Project>

View File

@@ -1,39 +0,0 @@
//go:build dotnet || all
// +build dotnet all
package examples
import (
"os"
"os/exec"
"path"
"path/filepath"
"testing"
"github.com/pulumi/pulumi/pkg/v3/testing/integration"
"github.com/stretchr/testify/require"
)
func TestDotNetExample(t *testing.T) {
cwd, err := os.Getwd()
require.NoError(t, err)
nuget := filepath.Join(cwd, "../nuget")
t.Setenv("PULUMI_LOCAL_NUGET", nuget)
cmd := exec.Command("dotnet", "nuget", "add", "source", nuget)
_ = cmd.Run()
test := integration.ProgramTestOptions{
Dir: path.Join(cwd, "dotnet"),
Dependencies: []string{
"Pulumi.DockerBuild",
},
Secrets: map[string]string{
"dockerHubPassword": os.Getenv("DOCKER_HUB_PASSWORD"),
},
NoParallel: true,
}
integration.ProgramTest(t, &test)
}

View File

@@ -1,2 +0,0 @@
command-output
tmp

View File

@@ -1,10 +0,0 @@
name: provider-docker-build
runtime: go
config:
dockerHubPassword:
type: string
secret: true
plugins:
providers:
- name: docker-build
path: ../../bin

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo 👍

View File

@@ -1,5 +0,0 @@
FROM alpine
ARG SET_ME_TO_TRUE
RUN [ "$SET_ME_TO_TRUE" = "true" ]
RUN echo "That's the correct build arg, thanks! 👍"

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo "This image doesn't use any local files, so it doesn't need a context parameter 👍"

View File

@@ -1,3 +0,0 @@
FROM bash AS base
RUN getent hosts metadata.google.internal

View File

@@ -1,7 +0,0 @@
FROM --platform=$BUILDPLATFORM alpine as build
RUN echo ${BUILDPLATFORM} > buildplatform
RUN echo ${TARGETPLATFORM} > targetplatform
FROM build
RUN cat buildplatform
RUN cat targetplatform

View File

@@ -1,5 +0,0 @@
# syntax=docker/dockerfile:1.4
FROM golang:latest
RUN version="$(go version)" && echo $version && [ "$version" = "go version go1.21.7 linux/amd64" ]
RUN echo "This image uses named contexts to pin golang:latest to a specific SHA 👍"

View File

@@ -1,4 +0,0 @@
FROM alpine
RUN --mount=type=secret,id=password [ "$(cat /run/secrets/password)" = "hunter2" ]

View File

@@ -1,5 +0,0 @@
FROM alpine
RUN apk add openssh-client
RUN --mount=type=ssh ssh-add -l

View File

@@ -1,8 +0,0 @@
FROM alpine as build-me
RUN echo 👍
FROM build-me as also-build-me
RUN echo 🤙
FROM build-me as dont-build-me
RUN [ "true" = "false" ]

View File

@@ -1,99 +0,0 @@
module provider-docker-build
go 1.24.1
toolchain go1.24.5
require (
github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12
github.com/pulumi/pulumi/sdk/v3 v3.192.0
)
require (
dario.cat/mergo v1.0.1 // indirect
github.com/BurntSushi/toml v1.5.0 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/ProtonMail/go-crypto v1.2.0 // indirect
github.com/agext/levenshtein v1.2.3 // indirect
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
github.com/atotto/clipboard v0.1.4 // indirect
github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/charmbracelet/bubbles v0.21.0 // indirect
github.com/charmbracelet/bubbletea v1.3.4 // indirect
github.com/charmbracelet/colorprofile v0.3.0 // indirect
github.com/charmbracelet/lipgloss v1.1.0 // indirect
github.com/charmbracelet/x/ansi v0.8.0 // indirect
github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
github.com/charmbracelet/x/term v0.2.1 // indirect
github.com/cheggaaa/pb v1.0.29 // indirect
github.com/cloudflare/circl v1.6.1 // indirect
github.com/cyphar/filepath-securejoin v0.4.1 // indirect
github.com/djherbis/times v1.6.0 // indirect
github.com/emirpasic/gods v1.18.1 // indirect
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
github.com/go-git/go-billy/v5 v5.6.2 // indirect
github.com/go-git/go-git/v5 v5.16.0 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/glog v1.2.4 // indirect
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/hcl/v2 v2.23.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
github.com/kevinburke/ssh_config v1.2.0 // indirect
github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/mattn/go-localereader v0.0.1 // indirect
github.com/mattn/go-runewidth v0.0.16 // indirect
github.com/mitchellh/go-ps v1.0.0 // indirect
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
github.com/muesli/cancelreader v0.2.2 // indirect
github.com/muesli/termenv v0.16.0 // indirect
github.com/opentracing/basictracer-go v1.1.0 // indirect
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/pgavlin/fx v0.1.6 // indirect
github.com/pjbgf/sha1cd v0.3.2 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pkg/term v1.1.0 // indirect
github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
github.com/pulumi/esc v0.17.0 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
github.com/skeema/knownhosts v1.3.1 // indirect
github.com/spf13/cast v1.5.0 // indirect
github.com/spf13/cobra v1.9.1 // indirect
github.com/spf13/pflag v1.0.6 // indirect
github.com/texttheater/golang-levenshtein v1.0.1 // indirect
github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
github.com/xanzy/ssh-agent v0.3.3 // indirect
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
github.com/zclconf/go-cty v1.16.2 // indirect
go.opentelemetry.io/otel v1.36.0 // indirect
go.opentelemetry.io/otel/sdk v1.36.0 // indirect
go.uber.org/atomic v1.11.0 // indirect
golang.org/x/crypto v0.39.0 // indirect
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
golang.org/x/mod v0.25.0 // indirect
golang.org/x/net v0.40.0 // indirect
golang.org/x/sync v0.15.0 // indirect
golang.org/x/sys v0.33.0 // indirect
golang.org/x/term v0.32.0 // indirect
golang.org/x/text v0.26.0 // indirect
golang.org/x/tools v0.33.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 // indirect
google.golang.org/grpc v1.72.1 // indirect
google.golang.org/protobuf v1.36.6 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
lukechampine.com/frand v1.5.1 // indirect
)

View File

@@ -1,312 +0,0 @@
dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM=
github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo=
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
github.com/ProtonMail/go-crypto v1.2.0 h1:+PhXXn4SPGd+qk76TlEePBfOfivE0zkWFenhGhFLzWs=
github.com/ProtonMail/go-crypto v1.2.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
github.com/charmbracelet/bubbletea v1.3.4/go.mod h1:dtcUCyCGEX3g9tosuYiut3MXgY/Jsv9nKVdibKKRRXo=
github.com/charmbracelet/colorprofile v0.3.0 h1:KtLh9uuu1RCt+Hml4s6Hz+kB1PfV3wi++1h5ia65yKQ=
github.com/charmbracelet/colorprofile v0.3.0/go.mod h1:oHJ340RS2nmG1zRGPmhJKJ/jf4FPNNk0P39/wBPA1G0=
github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
github.com/charmbracelet/x/cellbuf v0.0.13/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg=
github.com/cheggaaa/pb v1.0.29 h1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo=
github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30=
github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
github.com/go-git/go-git/v5 v5.16.0 h1:k3kuOEpkc0DeY7xlL6NaaNg39xdgQbtH5mwCafHO9AQ=
github.com/go-git/go-git/v5 v5.16.0/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/golang/glog v1.2.4 h1:CNNw5U8lSiiBk7druxtSHHTsRWcxKoac6kZKm2peBBc=
github.com/golang/glog v1.2.4/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU=
github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw=
github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
github.com/hashicorp/hcl/v2 v2.23.0 h1:Fphj1/gCylPxHutVSEOf2fBOh1VE4AuLV7+kbJf3qos=
github.com/hashicorp/hcl/v2 v2.23.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
github.com/opentracing/basictracer-go v1.1.0 h1:Oa1fTSBvAl8pa3U+IJYqrKm0NALwH9OsgwOqDv4xJW0=
github.com/opentracing/basictracer-go v1.1.0/go.mod h1:V2HZueSJEp879yv285Aap1BS69fQMD+MNP1mRs6mBQc=
github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
github.com/pgavlin/fx v0.1.6 h1:r9jEg69DhNoCd3Xh0+5mIbdbS3PqWrVWujkY76MFRTU=
github.com/pgavlin/fx v0.1.6/go.mod h1:KWZJ6fqBBSh8GxHYqwYCf3rYE7Gp2p0N8tJp8xv9u9M=
github.com/pgavlin/fx/v2 v2.0.3 h1:ZBVklTFjxcWvBVPE+ti5qwnmTIQ0Gq6nuj3J5RKDtKk=
github.com/pgavlin/fx/v2 v2.0.3/go.mod h1:Cvnwqq0BopdHUJ7CU50h1XPeKrF4ZwdFj1nJLXbAjCE=
github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk=
github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w=
github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc=
github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12 h1:uzmw+0iic764m0Yvh4I/jRV1x3q49dVh5Ctq9RllsQ8=
github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild v0.0.12/go.mod h1:6zFMe786NvFDO03BVJwdw1R/Yms4F6vAU49iBHo8zbQ=
github.com/pulumi/pulumi/sdk/v3 v3.192.0 h1:sfHuR3P02wSbV3xdSMEQ0+uC/HzlMz0YfKrVAXy1hSQ=
github.com/pulumi/pulumi/sdk/v3 v3.192.0/go.mod h1:aV0+c5xpSYccWKmOjTZS9liYCqh7+peu3cQgSXu7CJw=
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06/go.mod h1:+ePHsJ1keEjQtpvf9HHw0f4ZeJ0TLRsxhunSI2hYJSs=
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/texttheater/golang-levenshtein v1.0.1 h1:+cRNoVrfiwufQPhoMzB6N0Yf/Mqajr6t1lOv8GyGE2U=
github.com/texttheater/golang-levenshtein v1.0.1/go.mod h1:PYAKrbF5sAiq9wd+H82hs7gNaen0CplQ9uvm6+enD/8=
github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaOOb6ThwMmTEbhRwtKR97o=
github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg=
github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
github.com/zclconf/go-cty v1.16.2 h1:LAJSwc3v81IRBZyUVQDUdZ7hs3SYs9jv0eZJDWHD/70=
github.com/zclconf/go-cty v1.16.2/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY=
go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM=
golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8=
golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34=
google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
lukechampine.com/frand v1.5.1 h1:fg0eRtdmGFIxhP5zQJzM1lFDbD6CUfu/f+7WgAZd5/w=
lukechampine.com/frand v1.5.1/go.mod h1:4VstaWc2plN4Mjr10chUD46RAVGWhpkZ5Nja8+Azp0Q=
pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw=
pgregory.net/rapid v1.1.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=

View File

@@ -1,233 +0,0 @@
package main
import (
"github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi/config"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
cfg := config.New(ctx, "")
dockerHubPassword := cfg.Require("dockerHubPassword")
multiPlatform, err := dockerbuild.NewImage(ctx, "multiPlatform", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Location: pulumi.String("./app/Dockerfile.multiPlatform"),
},
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
Platforms: dockerbuild.PlatformArray{
dockerbuild.Platform_Plan9_amd64,
dockerbuild.Platform_Plan9_386,
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "registryPush", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
Tags: pulumi.StringArray{
pulumi.String("docker.io/pulumibot/buildkit-e2e:example"),
},
Exports: dockerbuild.ExportArray{
&dockerbuild.ExportArgs{
Registry: &dockerbuild.ExportRegistryArgs{
OciMediaTypes: pulumi.Bool(true),
Push: pulumi.Bool(false),
},
},
},
Registries: dockerbuild.RegistryArray{
&dockerbuild.RegistryArgs{
Address: pulumi.String("docker.io"),
Username: pulumi.String("pulumibot"),
Password: pulumi.String(dockerHubPassword),
},
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "cached", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
CacheTo: dockerbuild.CacheToArray{
&dockerbuild.CacheToArgs{
Local: &dockerbuild.CacheToLocalArgs{
Dest: pulumi.String("tmp/cache"),
Mode: dockerbuild.CacheModeMax,
},
},
},
CacheFrom: dockerbuild.CacheFromArray{
&dockerbuild.CacheFromArgs{
Local: &dockerbuild.CacheFromLocalArgs{
Src: pulumi.String("tmp/cache"),
},
},
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "buildArgs", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Location: pulumi.String("./app/Dockerfile.buildArgs"),
},
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
BuildArgs: pulumi.StringMap{
"SET_ME_TO_TRUE": pulumi.String("true"),
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "extraHosts", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Location: pulumi.String("./app/Dockerfile.extraHosts"),
},
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
AddHosts: pulumi.StringArray{
pulumi.String("metadata.google.internal:169.254.169.254"),
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "sshMount", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Location: pulumi.String("./app/Dockerfile.sshMount"),
},
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
Ssh: dockerbuild.SSHArray{
&dockerbuild.SSHArgs{
Id: pulumi.String("default"),
},
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "secrets", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Location: pulumi.String("./app/Dockerfile.secrets"),
},
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
Secrets: pulumi.StringMap{
"password": pulumi.String("hunter2"),
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "labels", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
Labels: pulumi.StringMap{
"description": pulumi.String("This image will get a descriptive label 👍"),
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "target", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Location: pulumi.String("./app/Dockerfile.target"),
},
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
Target: pulumi.String("build-me"),
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "namedContexts", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Location: pulumi.String("./app/Dockerfile.namedContexts"),
},
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
Named: dockerbuild.ContextMap{
"golang:latest": &dockerbuild.ContextArgs{
Location: pulumi.String("docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984"),
},
},
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "remoteContext", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile"),
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "remoteContextWithInline", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Inline: pulumi.String("FROM busybox\nCOPY hello.c ./\n"),
},
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("https://github.com/docker-library/hello-world.git"),
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "inline", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Dockerfile: &dockerbuild.DockerfileArgs{
Inline: pulumi.String("FROM alpine\nRUN echo \"This uses an inline Dockerfile! 👍\"\n"),
},
})
if err != nil {
return err
}
_, err = dockerbuild.NewImage(ctx, "dockerLoad", &dockerbuild.ImageArgs{
Push: pulumi.Bool(false),
Context: &dockerbuild.BuildContextArgs{
Location: pulumi.String("./app"),
},
Exports: dockerbuild.ExportArray{
&dockerbuild.ExportArgs{
Docker: &dockerbuild.ExportDockerArgs{
Tar: pulumi.Bool(true),
},
},
},
})
if err != nil {
return err
}
ctx.Export("platforms", multiPlatform.Platforms)
return nil
})
}

View File

@@ -1,30 +0,0 @@
//go:build go || all
// +build go all
package examples
import (
"os"
"path"
"testing"
"github.com/pulumi/pulumi/pkg/v3/testing/integration"
"github.com/stretchr/testify/require"
)
func TestGoExample(t *testing.T) {
cwd, err := os.Getwd()
require.NoError(t, err)
test := integration.ProgramTestOptions{
Dir: path.Join(cwd, "go"),
Dependencies: []string{
"github.com/pulumi/pulumi-docker-build/sdk/go/dockerbuild=../sdk/go/dockerbuild",
},
Secrets: map[string]string{
"dockerHubPassword": os.Getenv("DOCKER_HUB_PASSWORD"),
},
}
integration.ProgramTest(t, &test)
}

View File

@@ -1,2 +0,0 @@
command-output
tmp

View File

@@ -1,10 +0,0 @@
name: provider-docker-build
runtime: java
config:
dockerHubPassword:
type: string
secret: true
plugins:
providers:
- name: docker-build
path: ../../bin

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo 👍

View File

@@ -1,5 +0,0 @@
FROM alpine
ARG SET_ME_TO_TRUE
RUN [ "$SET_ME_TO_TRUE" = "true" ]
RUN echo "That's the correct build arg, thanks! 👍"

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo "This image doesn't use any local files, so it doesn't need a context parameter 👍"

View File

@@ -1,3 +0,0 @@
FROM bash AS base
RUN getent hosts metadata.google.internal

View File

@@ -1,7 +0,0 @@
FROM --platform=$BUILDPLATFORM alpine as build
RUN echo ${BUILDPLATFORM} > buildplatform
RUN echo ${TARGETPLATFORM} > targetplatform
FROM build
RUN cat buildplatform
RUN cat targetplatform

View File

@@ -1,5 +0,0 @@
# syntax=docker/dockerfile:1.4
FROM golang:latest
RUN version="$(go version)" && echo $version && [ "$version" = "go version go1.21.7 linux/amd64" ]
RUN echo "This image uses named contexts to pin golang:latest to a specific SHA 👍"

View File

@@ -1,4 +0,0 @@
FROM alpine
RUN --mount=type=secret,id=password [ "$(cat /run/secrets/password)" = "hunter2" ]

View File

@@ -1,5 +0,0 @@
FROM alpine
RUN apk add openssh-client
RUN --mount=type=ssh ssh-add -l

View File

@@ -1,8 +0,0 @@
FROM alpine as build-me
RUN echo 👍
FROM build-me as also-build-me
RUN echo 🤙
FROM build-me as dont-build-me
RUN [ "true" = "false" ]

View File

@@ -1,92 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.pulumi</groupId>
<artifactId>provider-docker-build</artifactId>
<version>1.0-SNAPSHOT</version>
<properties>
<encoding>UTF-8</encoding>
<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
<maven.compiler.release>11</maven.compiler.release>
<mainClass>generated_program.App</mainClass>
<mainArgs/>
</properties>
<dependencies>
<dependency>
<groupId>com.pulumi</groupId>
<artifactId>pulumi</artifactId>
<version>(,1.0]</version>
</dependency>
<dependency>
<groupId>com.pulumi</groupId>
<artifactId>docker-build</artifactId>
<version>[0.0.0,)</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<version>3.2.2</version>
<configuration>
<archive>
<manifest>
<addClasspath>true</addClasspath>
<mainClass>${mainClass}</mainClass>
</manifest>
</archive>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-assembly-plugin</artifactId>
<version>3.4.2</version>
<configuration>
<archive>
<manifest>
<addClasspath>true</addClasspath>
<mainClass>${mainClass}</mainClass>
</manifest>
</archive>
<descriptorRefs>
<descriptorRef>jar-with-dependencies</descriptorRef>
</descriptorRefs>
</configuration>
<executions>
<execution>
<id>make-my-jar-with-dependencies</id>
<phase>package</phase>
<goals>
<goal>single</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>exec-maven-plugin</artifactId>
<version>3.1.0</version>
<configuration>
<mainClass>${mainClass}</mainClass>
<commandlineArgs>${mainArgs}</commandlineArgs>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-wrapper-plugin</artifactId>
<version>3.1.1</version>
<configuration>
<mavenVersion>3.8.5</mavenVersion>
</configuration>
</plugin>
</plugins>
</build>
</project>

View File

@@ -1,204 +0,0 @@
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.dockerbuild.Image;
import com.pulumi.dockerbuild.ImageArgs;
import com.pulumi.dockerbuild.inputs.DockerfileArgs;
import com.pulumi.dockerbuild.inputs.BuildContextArgs;
import com.pulumi.dockerbuild.inputs.ExportArgs;
import com.pulumi.dockerbuild.inputs.ExportRegistryArgs;
import com.pulumi.dockerbuild.inputs.RegistryArgs;
import com.pulumi.dockerbuild.inputs.CacheToArgs;
import com.pulumi.dockerbuild.inputs.CacheToLocalArgs;
import com.pulumi.dockerbuild.inputs.CacheFromArgs;
import com.pulumi.dockerbuild.inputs.CacheFromLocalArgs;
import com.pulumi.dockerbuild.inputs.SSHArgs;
import com.pulumi.dockerbuild.inputs.ExportDockerArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var config = ctx.config();
final var dockerHubPassword = config.get("dockerHubPassword");
var multiPlatform = new Image("multiPlatform", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.location("./app/Dockerfile.multiPlatform")
.build())
.context(BuildContextArgs.builder()
.location("./app")
.build())
.platforms(
"plan9/amd64",
"plan9/386")
.build());
var registryPush = new Image("registryPush", ImageArgs.builder()
.push(false)
.context(BuildContextArgs.builder()
.location("./app")
.build())
.tags("docker.io/pulumibot/buildkit-e2e:example")
.exports(ExportArgs.builder()
.registry(ExportRegistryArgs.builder()
.ociMediaTypes(true)
.push(false)
.build())
.build())
.registries(RegistryArgs.builder()
.address("docker.io")
.username("pulumibot")
.password(dockerHubPassword)
.build())
.build());
var cached = new Image("cached", ImageArgs.builder()
.push(false)
.context(BuildContextArgs.builder()
.location("./app")
.build())
.cacheTo(CacheToArgs.builder()
.local(CacheToLocalArgs.builder()
.dest("tmp/cache")
.mode("max")
.build())
.build())
.cacheFrom(CacheFromArgs.builder()
.local(CacheFromLocalArgs.builder()
.src("tmp/cache")
.build())
.build())
.build());
var buildArgs = new Image("buildArgs", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.location("./app/Dockerfile.buildArgs")
.build())
.context(BuildContextArgs.builder()
.location("./app")
.build())
.buildArgs(Map.of("SET_ME_TO_TRUE", "true"))
.build());
var extraHosts = new Image("extraHosts", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.location("./app/Dockerfile.extraHosts")
.build())
.context(BuildContextArgs.builder()
.location("./app")
.build())
.addHosts("metadata.google.internal:169.254.169.254")
.build());
var sshMount = new Image("sshMount", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.location("./app/Dockerfile.sshMount")
.build())
.context(BuildContextArgs.builder()
.location("./app")
.build())
.ssh(SSHArgs.builder()
.id("default")
.build())
.build());
var secrets = new Image("secrets", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.location("./app/Dockerfile.secrets")
.build())
.context(BuildContextArgs.builder()
.location("./app")
.build())
.secrets(Map.of("password", "hunter2"))
.build());
var labels = new Image("labels", ImageArgs.builder()
.push(false)
.context(BuildContextArgs.builder()
.location("./app")
.build())
.labels(Map.of("description", "This image will get a descriptive label 👍"))
.build());
var target = new Image("target", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.location("./app/Dockerfile.target")
.build())
.context(BuildContextArgs.builder()
.location("./app")
.build())
.target("build-me")
.build());
var namedContexts = new Image("namedContexts", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.location("./app/Dockerfile.namedContexts")
.build())
.context(BuildContextArgs.builder()
.location("./app")
.named(Map.of("golang:latest", Map.of("location", "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984")))
.build())
.build());
var remoteContext = new Image("remoteContext", ImageArgs.builder()
.push(false)
.context(BuildContextArgs.builder()
.location("https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile")
.build())
.build());
var remoteContextWithInline = new Image("remoteContextWithInline", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.inline("""
FROM busybox
COPY hello.c ./
""")
.build())
.context(BuildContextArgs.builder()
.location("https://github.com/docker-library/hello-world.git")
.build())
.build());
var inline = new Image("inline", ImageArgs.builder()
.push(false)
.dockerfile(DockerfileArgs.builder()
.inline("""
FROM alpine
RUN echo "This uses an inline Dockerfile! 👍"
""")
.build())
.build());
var dockerLoad = new Image("dockerLoad", ImageArgs.builder()
.push(false)
.context(BuildContextArgs.builder()
.location("./app")
.build())
.exports(ExportArgs.builder()
.docker(ExportDockerArgs.builder()
.tar(true)
.build())
.build())
.build());
ctx.export("platforms", multiPlatform.platforms());
}
}

View File

@@ -1,29 +0,0 @@
//go:build java || all
// +build java all
package examples
import (
"os"
"path"
"testing"
"github.com/pulumi/pulumi/pkg/v3/testing/integration"
"github.com/stretchr/testify/require"
)
func TestJavaExample(t *testing.T) {
t.Skip("not working yet")
cwd, err := os.Getwd()
require.NoError(t, err)
test := integration.ProgramTestOptions{
Dir: path.Join(cwd, "java"),
Secrets: map[string]string{
"dockerHubPassword": os.Getenv("DOCKER_HUB_PASSWORD"),
},
}
integration.ProgramTest(t, &test)
}

View File

@@ -1,61 +0,0 @@
package examples
import (
"crypto/rsa"
"errors"
"io"
"math/rand"
"net"
"os"
"path/filepath"
"testing"
"golang.org/x/crypto/ssh/agent"
)
func TestMain(m *testing.M) {
sock := sshagent()
os.Setenv("SSH_AUTH_SOCK", sock)
os.Exit(m.Run())
}
// sshagent crates an in-memory SSH agent with one identity.
func sshagent() string {
dir, err := os.MkdirTemp(os.TempDir(), "docker-test-*")
if err != nil {
panic(err)
}
sock := filepath.Join(dir, "test.sock")
l, err := net.Listen("unix", sock)
if err != nil {
panic(err)
}
a := agent.NewKeyring()
//nolint:gosec
key, err := rsa.GenerateKey(rand.New(rand.NewSource(42)), 2048)
if err != nil {
panic(err)
}
err = a.Add(agent.AddedKey{PrivateKey: key})
if err != nil {
panic(err)
}
go func() {
for {
conn, err := l.Accept()
if err != nil {
panic(err)
}
if err := agent.ServeAgent(a, conn); err != nil && !errors.Is(err, io.EOF) {
panic(err)
}
}
}()
return sock
}

View File

@@ -1,2 +0,0 @@
command-output
tmp

View File

@@ -1,2 +0,0 @@
/bin/
/node_modules/

View File

@@ -1,10 +0,0 @@
name: provider-docker-build
runtime: nodejs
config:
dockerHubPassword:
type: string
secret: true
plugins:
providers:
- name: docker-build
path: ../../bin

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo 👍

View File

@@ -1,5 +0,0 @@
FROM alpine
ARG SET_ME_TO_TRUE
RUN [ "$SET_ME_TO_TRUE" = "true" ]
RUN echo "That's the correct build arg, thanks! 👍"

View File

@@ -1,2 +0,0 @@
FROM alpine
RUN echo "This image doesn't use any local files, so it doesn't need a context parameter 👍"

View File

@@ -1,3 +0,0 @@
FROM bash AS base
RUN getent hosts metadata.google.internal

View File

@@ -1,7 +0,0 @@
FROM --platform=$BUILDPLATFORM alpine as build
RUN echo ${BUILDPLATFORM} > buildplatform
RUN echo ${TARGETPLATFORM} > targetplatform
FROM build
RUN cat buildplatform
RUN cat targetplatform

View File

@@ -1,5 +0,0 @@
# syntax=docker/dockerfile:1.4
FROM golang:latest
RUN version="$(go version)" && echo $version && [ "$version" = "go version go1.21.7 linux/amd64" ]
RUN echo "This image uses named contexts to pin golang:latest to a specific SHA 👍"

View File

@@ -1,4 +0,0 @@
FROM alpine
RUN --mount=type=secret,id=password [ "$(cat /run/secrets/password)" = "hunter2" ]

View File

@@ -1,5 +0,0 @@
FROM alpine
RUN apk add openssh-client
RUN --mount=type=ssh ssh-add -l

View File

@@ -1,8 +0,0 @@
FROM alpine as build-me
RUN echo 👍
FROM build-me as also-build-me
RUN echo 🤙
FROM build-me as dont-build-me
RUN [ "true" = "false" ]

View File

@@ -1,169 +0,0 @@
import * as pulumi from "@pulumi/pulumi";
import * as docker_build from "@pulumi/docker-build";
const config = new pulumi.Config();
const dockerHubPassword = config.require("dockerHubPassword");
const multiPlatform = new docker_build.Image("multiPlatform", {
push: false,
dockerfile: {
location: "./app/Dockerfile.multiPlatform",
},
context: {
location: "./app",
},
platforms: [
docker_build.Platform.Plan9_amd64,
docker_build.Platform.Plan9_386,
],
});
const registryPush = new docker_build.Image("registryPush", {
push: false,
context: {
location: "./app",
},
tags: ["docker.io/pulumibot/buildkit-e2e:example"],
exports: [{
registry: {
ociMediaTypes: true,
push: false,
},
}],
registries: [{
address: "docker.io",
username: "pulumibot",
password: dockerHubPassword,
}],
});
const cached = new docker_build.Image("cached", {
push: false,
context: {
location: "./app",
},
cacheTo: [{
local: {
dest: "tmp/cache",
mode: docker_build.CacheMode.Max,
},
}],
cacheFrom: [{
local: {
src: "tmp/cache",
},
}],
});
const buildArgs = new docker_build.Image("buildArgs", {
push: false,
dockerfile: {
location: "./app/Dockerfile.buildArgs",
},
context: {
location: "./app",
},
buildArgs: {
SET_ME_TO_TRUE: "true",
},
});
const extraHosts = new docker_build.Image("extraHosts", {
push: false,
dockerfile: {
location: "./app/Dockerfile.extraHosts",
},
context: {
location: "./app",
},
addHosts: ["metadata.google.internal:169.254.169.254"],
});
const sshMount = new docker_build.Image("sshMount", {
push: false,
dockerfile: {
location: "./app/Dockerfile.sshMount",
},
context: {
location: "./app",
},
ssh: [{
id: "default",
}],
});
const secrets = new docker_build.Image("secrets", {
push: false,
dockerfile: {
location: "./app/Dockerfile.secrets",
},
context: {
location: "./app",
},
secrets: {
password: "hunter2",
},
});
const labels = new docker_build.Image("labels", {
push: false,
context: {
location: "./app",
},
labels: {
description: "This image will get a descriptive label 👍",
},
});
const target = new docker_build.Image("target", {
push: false,
dockerfile: {
location: "./app/Dockerfile.target",
},
context: {
location: "./app",
},
target: "build-me",
});
const namedContexts = new docker_build.Image("namedContexts", {
push: false,
dockerfile: {
location: "./app/Dockerfile.namedContexts",
},
context: {
location: "./app",
named: {
"golang:latest": {
location: "docker-image://golang@sha256:b8e62cf593cdaff36efd90aa3a37de268e6781a2e68c6610940c48f7cdf36984",
},
},
},
});
const remoteContext = new docker_build.Image("remoteContext", {
push: false,
context: {
location: "https://raw.githubusercontent.com/pulumi/pulumi-docker/api-types/provider/testdata/Dockerfile",
},
});
const remoteContextWithInline = new docker_build.Image("remoteContextWithInline", {
push: false,
dockerfile: {
inline: `FROM busybox
COPY hello.c ./
`,
},
context: {
location: "https://github.com/docker-library/hello-world.git",
},
});
const inline = new docker_build.Image("inline", {
push: false,
dockerfile: {
inline: `FROM alpine
RUN echo "This uses an inline Dockerfile! 👍"
`,
},
});
const dockerLoad = new docker_build.Image("dockerLoad", {
push: false,
context: {
location: "./app",
},
exports: [{
docker: {
tar: true,
},
}],
});
export const platforms = multiPlatform.platforms;

Some files were not shown because too many files have changed in this diff Show More