Add blog post: Introducing Read-Only Mode for Pulumi Neo #7908
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| permissions: write-all # Equivalent to default permissions + id-token: write | |
| name: "Run Example Code Tests" | |
| on: | |
| schedule: | |
| - cron: "0 8 * * *" | |
| pull_request: | |
| branches: | |
| - master | |
| workflow_dispatch: {} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| AWS_REGION: "us-west-2" | |
| GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-ci-gcp-provider.iam.gserviceaccount.com | |
| GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci | |
| GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci | |
| GOOGLE_PROJECT: pulumi-ci-gcp-provider | |
| GOOGLE_PROJECT_NUMBER: 895284651812 | |
| ESC_ACTION_OIDC_AUTH: true | |
| ESC_ACTION_OIDC_ORGANIZATION: pulumi | |
| ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization | |
| ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-docs | |
| ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: ARM_CLIENT_ID=ARM_CLIENT_ID,ARM_CLIENT_SECRET=ARM_CLIENT_SECRET,ARM_TENANT_ID=ARM_TENANT_ID,ARM_SUBSCRIPTION_ID=ARM_SUBSCRIPTION_ID,PULUMI_ACCESS_TOKEN=PULUMI_ACCESS_TOKEN | |
| jobs: | |
| test: | |
| # Skip tests for Dependabot PRs since they don't have access to ESC secrets | |
| if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]' | |
| runs-on: ${{ matrix.platform }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| strategy: | |
| matrix: | |
| platform: | |
| - pulumi-service-ubuntu-24.04-4core | |
| go-version: | |
| - 1.26.x | |
| node-version: | |
| - 24.x | |
| python-version: | |
| - 3.9 | |
| dotnet-version: | |
| - 8.0.x | |
| java-version: | |
| - 11 | |
| steps: | |
| - name: Fetch secrets from ESC | |
| id: esc-secrets | |
| uses: pulumi/esc-action@v1 | |
| - name: Check out the code | |
| uses: actions/checkout@v6 | |
| - name: Fetch master branch | |
| if: github.ref != 'refs/heads/master' | |
| run: git fetch origin master:master | |
| - name: Install Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'yarn' | |
| cache-dependency-path: | | |
| yarn.lock | |
| infrastructure/yarn.lock | |
| theme/yarn.lock | |
| theme/stencil/yarn.lock | |
| - name: Install Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ matrix.go-version }} | |
| - name: Install Java | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: ${{ matrix.java-version }} | |
| - name: Install DotNet | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: ${{ matrix.dotnet-version }} | |
| - name: Install Hugo | |
| uses: peaceiris/actions-hugo@v3 | |
| with: | |
| hugo-version: "0.157.0" | |
| extended: true | |
| - name: Install Pulumi | |
| uses: pulumi/actions@v6 | |
| with: | |
| pulumi-version: latest | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-region: ${{ env.AWS_REGION }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| role-duration-seconds: 14400 # 4 hours | |
| role-session-name: pulumi-docs-examples@githubActions | |
| role-to-assume: ${{ steps.esc-secrets.outputs.AWS_CI_ROLE_ARN }} | |
| - name: Authenticate to Google Cloud | |
| uses: google-github-actions/auth@v3 | |
| with: | |
| workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER }}/locations/global/workloadIdentityPools/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{ env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }} | |
| - name: Kubernetes KinD Cluster | |
| id: kind | |
| uses: helm/kind-action@v1 | |
| - name: Run the tests | |
| run: make test | |
| env: | |
| TEST_MODE: ${{ github.event_name }} | |
| notify: | |
| # Only send slack notifications for failures during scheduled cron runs. | |
| if: (failure() && github.event_name == 'schedule') | |
| name: Send slack notification | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| steps: | |
| - name: Fetch secrets from ESC | |
| id: esc-secrets | |
| uses: pulumi/esc-action@v1 | |
| - name: Slack Notification | |
| uses: docker://sholung/action-slack-notify:v2.3.0 | |
| env: | |
| SLACK_CHANNEL: docs-ops | |
| SLACK_COLOR: "#F54242" | |
| SLACK_MESSAGE: "Failing code example tests in `pulumi/docs` :meow_sad:" | |
| SLACK_USERNAME: docsbot | |
| SLACK_WEBHOOK: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }} | |
| SLACK_ICON: https://www.pulumi.com/logos/brand/avatar-on-white.png |