chore(ci): initial setup of CI & Makefile using pulumi/ci-mgmt #313

ctreatma · 2025-10-29T16:56:20Z

This PR aims to fix our broken CI workflows and make it easier to catch up with future changes to how bridged Pulumi providers are developed.

I added an initial .ci-mgmt.yaml file and then ran the provider-ci tool as described in the pulumi/ci-mgmt docs to generate the standard Pulumi workflows.

ctreatma · 2025-10-29T16:58:10Z

.github/workflows/check-upstream-upgrade.yml

@@ -1,42 +0,0 @@
-# WARNING: This file was build based on https://github.com/pulumi/ci-mgmt


It looks like the upgrade-provider workflow has been updated to run on a schedule instead of running when an issue is opened, so there's no longer a need for a separate check workflow that discovers new provider versions and creates an issue.

ctreatma · 2025-10-29T17:01:48Z

.github/workflows/upgrade-bridge.yml

+  id-token: write # For ESC secrets.
+
 env:
-  GH_TOKEN: ${{ secrets.EQUINIX_BOT_TOKEN }}


Looks like the updated workflows look for PULUMI_PROVIDER_AUTOMATION_TOKEN, so we can put our token there instead. That's likely more straightforward than modifying the generated workflows to keep our old bot token secret name.

ctreatma · 2025-10-29T17:08:41Z

.github/workflows/run-acceptance-tests.yml

-  PULUMI_SKIP_MISSING_MAPPING_ERROR: true
-  PULUMI_SKIP_EXTRA_MAPPING_ERROR: true


We manually added these PULUMI_SKIP_ environment variables to a couple of workflows to smooth out the upgrade process. Having these in all workflows would be bad--we don't want to release broken providers--but it doesn't look like pulumi/ci-mgmt gives the kind of granular control we would need to only have these environment variables in some workflows but not in others. It's probably better to lose these if it means we can follow a standard development process.

.github/workflows/release_command.yml

ctreatma · 2025-10-29T18:51:52Z

.github/workflows/release.yml

    name: publish
-    runs-on: ubuntu-latest
-    outputs:
-      new_release_version: ${{ steps.semantic_release.outputs.new_release_version }}


We'll need to move this semantic release logic to a separate workflow file so that it is not overwritten by ci-mgmt. If it isn't already, the semantic release workflow will need to be created with our own bot token so that the tag it creates will trigger this ci-mgmt-managed release workflow.

github-actions · 2025-10-29T19:29:54Z

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

Maintainer note: consult the runbook for dealing with any breaking changes.

ctreatma · 2025-10-29T19:50:22Z

.golangci.yml

@@ -1,24 +1,37 @@
+# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+


The updated linter is failing, so we should revert to the old files for now. We can regenerate the new linter stuff later.

ctreatma · 2025-10-29T19:53:47Z

Makefile

-	$(WORKING_DIR)/bin/${TFGEN} schema --out provider/cmd/${PROVIDER}
-	(cd provider && VERSION=$(VERSION) go generate cmd/${PROVIDER}/main.go)
-
-bin/pulumi-java-gen: .pulumi-java-gen.version $(PULUMICTL_BIN)


Should bring back the old java gen logic for now and then upgrade to the bridge-native java generator in a follow-up PR.

Given that we need to manually navigate the transition from pulumi-java-gen to pulumi-language-java regardless of what CI is in place, we might as well get #311 figured out first and then revisit this one after we've dropped pulumi-java-gen.

apiiro · 2025-11-06T15:37:02Z

⚠️ Apiiro found 4 new risks - 4 high ⚠️

🔴 High: Exposed Secrets with Unknown Validity in Public, Applicative Code - High in secret of type User password

Secret type: User password
Validity: No validator
Exposure: Exposed
File type: Source Code
Appearances: Appears 1 time in the file
Preview: * .password("•••••") line 45
Insights: Public repository

🔴 High: Exposed Secrets with Unknown Validity in Public, Applicative Code - High in secret of type User password

Secret type: User password
Validity: No validator
Exposure: Exposed
File type: Source Code
Appearances: Appears 1 time in the file
Preview: * final var bgpPassword = "•••••"; line 54
Insights: Public repository

Repository: pulumi-equinix
Applications: ORG - EQUINIX

View in Apiiro

- Checked out github.com/pulumi/ci-mgmt - Built the `provider-ci` tool - Ran `./bin/provider-ci generate --name equinix/pulumi-equinix --config ~/Documents/code/pulumi-equinix/.ci-mgmt.yaml --out ~/Documents/code/pulumi-equinix/`

ctreatma commented Oct 29, 2025

View reviewed changes

.github/workflows/release_command.yml Outdated Show resolved Hide resolved

ctreatma commented Oct 29, 2025

View reviewed changes

ctreatma force-pushed the set-up-ci-mgmt branch from 59f60e4 to 4688aab Compare October 29, 2025 19:14

equinix deleted a comment from apiiro bot Oct 29, 2025

ctreatma force-pushed the set-up-ci-mgmt branch from 4688aab to 850028d Compare October 29, 2025 19:25

ctreatma commented Oct 29, 2025

View reviewed changes

ctreatma force-pushed the set-up-ci-mgmt branch 2 times, most recently from f329d57 to 6bd72bb Compare November 6, 2025 15:36

ctreatma changed the base branch from main to fix-upgrade-provider-action November 6, 2025 15:51

ctreatma force-pushed the set-up-ci-mgmt branch from 6bd72bb to c75979b Compare November 6, 2025 16:34

ctreatma changed the base branch from fix-upgrade-provider-action to drop-pf-shim November 6, 2025 16:34

ctreatma force-pushed the drop-pf-shim branch from 7ca55ef to 520c65d Compare November 6, 2025 17:39

ctreatma force-pushed the set-up-ci-mgmt branch from c75979b to cc35f4e Compare November 6, 2025 17:40

ctreatma force-pushed the drop-pf-shim branch from 520c65d to 9a60cbe Compare November 6, 2025 18:34

ctreatma force-pushed the set-up-ci-mgmt branch from cc35f4e to cfbb153 Compare November 6, 2025 18:34

ctreatma force-pushed the drop-pf-shim branch from 9a60cbe to b6ab8e7 Compare November 6, 2025 19:34

ctreatma added 3 commits November 6, 2025 13:35

create config file for pulumi/ci-mgmt

dd2dd99

run provider-ci to generate updated workflows

41a73c1

- Checked out github.com/pulumi/ci-mgmt - Built the `provider-ci` tool - Ran `./bin/provider-ci generate --name equinix/pulumi-equinix --config ~/Documents/code/pulumi-equinix/.ci-mgmt.yaml --out ~/Documents/code/pulumi-equinix/`

auto-generated whitespace changes for C# examples

2df8b19

ctreatma force-pushed the set-up-ci-mgmt branch from cfbb153 to 2df8b19 Compare November 6, 2025 19:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(ci): initial setup of CI & Makefile using pulumi/ci-mgmt #313

chore(ci): initial setup of CI & Makefile using pulumi/ci-mgmt #313

Uh oh!

ctreatma commented Oct 29, 2025

Uh oh!

ctreatma Oct 29, 2025

Uh oh!

ctreatma Oct 29, 2025

Uh oh!

ctreatma Oct 29, 2025 •

edited

Loading

Uh oh!

Uh oh!

ctreatma Oct 29, 2025

Uh oh!

github-actions bot commented Oct 29, 2025

Uh oh!

ctreatma Oct 29, 2025

Uh oh!

ctreatma Oct 29, 2025

Uh oh!

ctreatma Oct 29, 2025

Uh oh!

apiiro bot commented Nov 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -1,42 +0,0 @@
		# WARNING: This file was build based on https://github.com/pulumi/ci-mgmt

		PULUMI_SKIP_MISSING_MAPPING_ERROR: true
		PULUMI_SKIP_EXTRA_MAPPING_ERROR: true

		@@ -1,24 +1,37 @@
		# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt

chore(ci): initial setup of CI & Makefile using pulumi/ci-mgmt #313

Are you sure you want to change the base?

chore(ci): initial setup of CI & Makefile using pulumi/ci-mgmt #313

Uh oh!

Conversation

ctreatma commented Oct 29, 2025

Uh oh!

ctreatma Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

ctreatma Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

ctreatma Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ctreatma Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 29, 2025

Does the PR have any schema changes?

Uh oh!

ctreatma Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

ctreatma Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

ctreatma Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

apiiro bot commented Nov 6, 2025

⚠️ Apiiro found 4 new risks - 4 high ⚠️

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ctreatma Oct 29, 2025 •

edited

Loading