.ci-mgmt.yaml

provider: aws
lint: false
major-version: 6
parallel: 1
timeout: 150
generate-nightly-test-workflow: true
providerVersion: github.com/hashicorp/terraform-provider-aws/version.ProviderVersion
toolVersions:
  dotnet: "6.0.x"
  go: "1.23.x"
  java: "11"
  gradle: "7.6"
  node: "20.x"
  pulumi: "dev"
  python: "3.11.8"
env:
  PULUMI_MISSING_DOCS_ERROR: true
  AWS_REGION: "us-west-2"
  OIDC_ROLE_ARN: ${{ secrets.OIDC_ROLE_ARN }}
makeTemplate: bridged
checkoutSubmodules: true
freeDiskSpaceBeforeBuild: true
freeDiskSpaceBeforeSdkBuild: true
freeDiskSpaceBeforeTest: true
# TODO: remove XrunUpstreamTools flag after work to add docs replacement strategies to resources.go is completed
# Tracked in in https://github.com/pulumi/pulumi-aws/issues/2757
XrunUpstreamTools: true
plugins:
  - name: archive
    version: "0.0.1"
  - name: tls
    version: "4.10.0"
  - name: github
    version: "4.10.0"
  - name: kubernetes
    version: "4.11.0"
  - name: "null"
    version: "0.0.3"
  - name: "local"
    version: "0.1.0"
  - name: random
    version: "4.8.2"
  - name: github
    version: "5.14.0"
  - name: std
    version: "1.6.2"
  - name: terraform
    version: "1.0.17"
    kind: converter
# Use `pulumi convert` for translating examples from TF to Pulumi.
pulumiConvert: 1
goBuildParallelism: 2
actions:
  preTest:
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: ${{ env.AWS_REGION }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        role-duration-seconds: 3600
        role-session-name: aws@githubActions
        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
    - name: Make upstream
      run: make upstream

extraTests:
  go_test_shim:
    name: Run test of provider shim
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
    - name: Free Disk Space (Ubuntu)
      uses: jlumbroso/free-disk-space@main
      with:
        swap-storage: false
        tool-cache: false
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        ref: ${{ env.PR_COMMIT_SHA }}
        submodules: true
    - uses: pulumi/provider-version-action@v1
      with:
        set-env: 'PROVIDER_VERSION'
    - name: Setup tools
      uses: ./.github/actions/setup-tools
      with:
        tools: pulumictl, pulumi, go
    - name: Make upstream
      run: make upstream
    - name: go test
      run: |
        cd upstream
        go get github.com/hashicorp/aws-sdk-go-base@v1.1.0
        cd shim
        go test -v -coverprofile="coverage.txt" .
    - name: Upload coverage reports to Codecov
      uses: codecov/codecov-action@v4
      env:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  upstream_lint:
    name: Run upstream provider-lint
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
    - name: Free Disk Space (Ubuntu)
      uses: jlumbroso/free-disk-space@main
      with:
        swap-storage: false
        tool-cache: false
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        ref: ${{ env.PR_COMMIT_SHA }}
        submodules: true
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: "1.23.x"
        cache: false
    - name: Make upstream
      run: make upstream
    - name: upstream lint
      run: |
        cd upstream
        make provider-lint

  test_oidc:
    name: test_oidc
    needs: build_sdk
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
    - name: Free Disk Space (Ubuntu)
      uses: jlumbroso/free-disk-space@main
      with:
        tool-cache: false
        swap-storage: false
        dotnet: ${{ matrix.language != 'dotnet' }}
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        ref: ${{ env.PR_COMMIT_SHA }}
        submodules: true
    - uses: pulumi/provider-version-action@v1
      with:
        set-env: 'PROVIDER_VERSION'
    - name: Setup tools
      uses: ./.github/actions/setup-tools
      with:
        tools: pulumictl, pulumi, go, node
    - name: Download provider + tfgen binaries
      uses: actions/download-artifact@v4
      with:
        name: aws-provider.tar.gz
        path: ${{ github.workspace }}/bin
    - name: Untar provider binaries
      run: >-
        tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
        github.workspace}}/bin

        find ${{ github.workspace }} -name "pulumi-*-aws" -print -exec chmod +x {} \;
    - name: Download SDK
      uses: actions/download-artifact@v4
      with:
        name: ${{ matrix.language }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: Uncompress SDK folder
      run: tar -zxf ${{ github.workspace }}/sdk/${{ matrix.language }}.tar.gz -C ${{
        github.workspace }}/sdk/${{ matrix.language }}
    - name: Update path
      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
    - name: Install dependencies
      run: make install_${{ matrix.language}}_sdk
    - name: Install gotestfmt
      uses: GoTestTools/gotestfmt-action@v2
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
        version: v2.4.0
    - name: Make upstream
      run: make upstream
    - name: Run selected tests with manual web identity/OIDC auth
      run: cd examples && go test -v -json -count=1 -run TestAccCloudWatchOidcManual -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
    - name: Configure AWS Credentials for OIDC
      uses: aws-actions/configure-aws-credentials@v4
      with:
        unset-current-credentials: true
        aws-region: ${{ env.AWS_REGION }}
        role-duration-seconds: 3600
        role-session-name: aws@githubActions
        role-to-assume: ${{ secrets.OIDC_ROLE_ARN }}
    - name: Run selected tests with configure-aws-credentials web identity/OIDC auth
      run: cd examples && go test -v -json -count=1 -run TestAccCloudWatch -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
    strategy:
      fail-fast: false
      matrix:
        language:
        - nodejs

  provider_test:
    name: provider_test
    needs: build_sdk
    permissions:
      contents: read
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@main
        with:
          swap-storage: false
          tool-cache: false
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          ref: ${{ env.PR_COMMIT_SHA }}
          submodules: true
      - uses: pulumi/provider-version-action@v1
        with:
          set-env: 'PROVIDER_VERSION'
      - name: Setup tools
        uses: ./.github/actions/setup-tools
        with:
          tools: pulumictl, pulumi, go, node, dotnet, python, java
      - name: Make upstream
        run: make upstream
      - name: Download provider + tfgen binaries
        uses: actions/download-artifact@v4
        with:
          name: aws-provider.tar.gz
          path: ${{ github.workspace }}/bin
      - name: Untar provider binaries
        run: >-
          tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
          github.workspace}}/bin

          find ${{ github.workspace }} -name "pulumi-*-aws" -print -exec chmod +x {} \;
      - run: dotnet nuget add source ${{ github.workspace }}/nuget
      - name: Download SDK
        uses: actions/download-artifact@v4
        with:
          name: ${{ matrix.language }}-sdk.tar.gz
          path: ${{ github.workspace}}/sdk/
      - name: Uncompress SDK folder
        run: tar -zxf ${{ github.workspace }}/sdk/${{ matrix.language }}.tar.gz -C ${{
          github.workspace }}/sdk/${{ matrix.language }}
      - name: Update path
        run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
      - name: Install Python deps
        run: |-
          pip3 install virtualenv==20.0.23
          pip3 install pipenv
      - name: Install dependencies
        run: make install_${{ matrix.language}}_sdk
      - name: Install gotestfmt
        uses: GoTestTools/gotestfmt-action@v2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          version: v2.5.0
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-region: ${{ env.AWS_REGION }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          role-duration-seconds: 3600
          role-session-name: aws@githubActions
          role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
      - name: Run provider tests
        run: |
          cd provider && go test -v -json -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 . 2>&1 | tee /tmp/gotest.log | gotestfmt
    strategy:
      fail-fast: false
      matrix:
        language:
          - nodejs
          - python
          - dotnet
          - go
          - java