Reapplied pulumi/ci-mgmt

.github/workflows/build_provider.yml

@@ -31,6 +31,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup tools
         uses: ./.github/actions/setup-tools
         with:

.github/workflows/build_sdk.yml

@@ -41,6 +41,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Cache examples generation
         uses: actions/cache@v4
         with:

.github/workflows/license.yml

@@ -31,6 +31,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Setup tools
         uses: ./.github/actions/setup-tools
         with:

.github/workflows/lint.yml

@@ -31,6 +31,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Install go
       uses: actions/setup-go@v5
       with:

.github/workflows/main.yml

@@ -56,6 +56,8 @@ jobs:
         swap-storage: false
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Configure AWS Credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -136,6 +138,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:

.github/workflows/prerelease.yml

@@ -80,6 +80,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:

.github/workflows/prerequisites.yml

@@ -44,6 +44,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - uses: pulumi/provider-version-action@v1
       id: provider-version
       with:
@@ -76,7 +78,7 @@ jobs:
         EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
         {
           echo "SCHEMA_CHANGES<<$EOF";
-          schema-tools compare -r github://api.github.com/pulumiverse -p cockroach -o ${{ inputs.default_branch }} -n --local-path=provider/cmd/pulumi-resource-cockroach/schema.json;
+          schema-tools compare -r github://api.github.com/pulumiverse -p cockroach -o "${{ inputs.default_branch }}" -n --local-path=provider/cmd/pulumi-resource-cockroach/schema.json;
           echo "$EOF";
         } >> "$GITHUB_ENV"
     - if: inputs.is_pr && inputs.is_automated == false

.github/workflows/publish.yml

@@ -47,6 +47,8 @@ jobs:
       run: echo "Can't skip Go SDK for stable releases. This is likely a bug in the calling workflow." && exit 1
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
@@ -62,7 +64,7 @@ jobs:
         merge-multiple: true
     - name: Calculate checksums
       working-directory: dist
-      run: shasum ./*.tar.gz > pulumi-cockroach_${{ inputs.version }}_checksums.txt
+      run: shasum ./*.tar.gz > "pulumi-cockroach_${{ inputs.version }}_checksums.txt"
     - name: Get Schema Change Summary
       id: schema-summary
       shell: bash
@@ -77,7 +79,7 @@ jobs:
           echo 'EOF'
         } >> "$GITHUB_OUTPUT"
     - name: Create GH Release
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v2
       if: inputs.isPrerelease == false
       with:
         tag_name: v${{ inputs.version }}
@@ -97,6 +99,9 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        # Persist credentials so we can push back to the repo
+        persist-credentials: true
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:
@@ -135,6 +140,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Clean up release labels
       uses: pulumi/action-release-by-pr-label@main
       with:

.github/workflows/pull-request.yml

@@ -25,6 +25,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Comment PR
       uses: thollander/actions-comment-pull-request@v2
       with:

.github/workflows/release.yml

@@ -86,6 +86,8 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Setup tools
       uses: ./.github/actions/setup-tools
       with:

.github/workflows/resync-build.yml

@@ -26,11 +26,15 @@ jobs:
     steps:
     - name: Checkout Repo
       uses: actions/checkout@v4
+      with:
+        # Persist credentials so we can push a new branch.
+        persist-credentials: true
     - name: Checkout repo
       uses: actions/checkout@v4
       with:
         path: ci-mgmt
         repository: pulumi/ci-mgmt
+        persist-credentials: false
     - id: run-url
       name: Create URL to the run output
       run:  echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT"

.github/workflows/run-acceptance-tests.yml

@@ -130,6 +130,7 @@ jobs:
       uses: actions/checkout@v4
       with:
         ref: ${{ env.PR_COMMIT_SHA }}
+        persist-credentials: false
     - name: Checkout p/examples
       if: matrix.testTarget == 'pulumiExamples'
       uses: actions/checkout@v4

.github/workflows/upgrade-bridge.yml

@@ -1,25 +1,100 @@
-name: Upgrade bridge
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
+name: Upgrade bridge
 on:
+  repository_dispatch:
+    types:
+      - upgrade-bridge
+      - upgrade-bridge-test
   workflow_dispatch:
-  schedule:
-    # At 05:00 on Monday
-    - cron: 0 5 * * 1
+    inputs:
+      kind:
+        description: Overrides the kind of upgrade. Must be one of `all`, `bridge`, `provider`, `code`, `pf`, or `pulumi`.
+        required: false
+        type: string
+        default: "bridge"
+      target-bridge-version:
+        description: pulumi-terraform-bridge version or hash reference
+        required: false
+        type: string
+        default: "latest"
+      target-pulumi-version:
+        description: |
+             Set the version of `pulumi/pkg` and `pulumi/sdk` to depend on for bridged providers. Currently,
+             these versions inform the linked runtime and SDK generation in all languages except Java. Valid
+             options are:
+             - "": Use the same version as pulumi-terraform-bridge
+             - A go version such as "v3.90.1"
+             - A commit SHA in pulumi/pulumi such as "ac71ebc1d34e5ccfd1a7fed61e6ff43a3160f3cb"
+        required: false
+        type: string
+        default: ""
+      pr-reviewers:
+        description: Reviewers to assign to the auto-opened pull request
+        required: false
+        type: string
+        default: ""
+      pr-description:
+        description: Extra description to add to the auto-opened pull request
+        required: false
+        type: string
+        default: ""
+      pr-title-prefix:
+        description: Prefix to add to the auto-opened pull request title
+        required: false
+        type: string
+        default: ""
+      automerge:
+        description: Mark created PR for auto-merging?
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
 
+env:
+  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
 jobs:
-  upgrade_bridge:
-    name: upgrade-bridge
+  upgrade_provider:
+    name: upgrade-provider
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      issues: write
     steps:
-      - name: Call upgrade provider action
-        uses: pulumi/pulumi-upgrade-provider-action@v0.0.12
-        with:
-          kind: bridge
-          email: ringo@de-smet.name
-          username: "Ringo De Smet"
-        env:
-          GH_TOKEN: ${{ secrets.UPGRADE_PROVIDER_TOKEN }}
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, dotnet, go, nodejs, python
+    - name: Call upgrade provider action
+      if: github.event_name == 'workflow_dispatch'
+      uses: pulumi/pulumi-upgrade-provider-action@v0.0.12
+      with:
+        kind: ${{ inputs.kind }}
+        email: bot@pulumi.com
+        username: pulumi-bot
+        automerge: ${{ inputs.automerge }}
+        target-bridge-version: ${{ inputs.target-bridge-version }}
+        target-pulumi-version: ${{ inputs.target-pulumi-version }}
+        pr-reviewers: ${{ inputs.pr-reviewers }}
+        pr-description: ${{ inputs.pr-description }}
+        pr-title-prefix: ${{ inputs.pr-title-prefix }}
+    - name: Call upgrade provider action
+      if: github.event_name == 'repository_dispatch'
+      uses: pulumi/pulumi-upgrade-provider-action@v0.0.12
+      with:
+        kind: ${{ github.event.client_payload.kind || 'bridge' }}
+        email: bot@pulumi.com
+        username: pulumi-bot
+        automerge: ${{ github.event.client_payload.automerge }}
+        target-pulumi-version: ${{ github.event.client_payload.target-pulumi-version }}
+        target-bridge-version: ${{ github.event.client_payload.target-bridge-version }}
+        pr-reviewers: ${{ github.event.client_payload.pr-reviewers }}
+        pr-description: ${{ github.event.client_payload.pr-description }}
+        pr-title-prefix: ${{ github.event.client_payload.pr-title-prefix }}