build-test.yml

name: build-test

on:
  workflow_call:
    inputs:
      ref:
        required: true
        type: string
      version:
        type: string
        description: Version to be used to build the binaries, schema and SDKs
        required: true
      short_test:
        type: boolean
        description: Skip longer running tests
        default: false
      oidc_arm_client_id:
        type: string
        description: The Azure Active Directory application to authenticate the OIDC tests. Empty skips the OIDC tests.
        default: "89380e12-5be6-486a-89ef-eea107af2f47" # AD app 'oidc-test'
      retention_days:
        type: number
        description: The number of days for which we retain assets
        default: 90
      use_azcore:
        type: boolean
        description: Whether to use the newer azcore+azidentity backend for REST and auth, or the older autorest
        default: true
      upload_codecov:
        type: boolean
        description: Whether to upload coverage reports to Codecov
        default: true

env:
  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: azure-native
  PROVIDER_VERSION: ${{ inputs.version }}
  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
  # TRAVIS_OS_NAME required by https://github.com/pulumi/scripts/blob/master/ci/publish-tfgen-package
  TRAVIS_OS_NAME: linux
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
  ARM_CLIENT_ID: 30e520fa-12b4-4e21-b473-9426c5ac2e1e # application id of the "TravisCI" service principal
  ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
  ARM_CLIENT_CERTIFICATE_PASSWORD_FOR_TEST: ${{ secrets.ARM_CLIENT_CERTIFICATE_PASSWORD }}
  ARM_ENVIRONMENT: public
  ARM_LOCATION: westus2
  ARM_SUBSCRIPTION_ID: 0282681f-7a9e-424b-80b2-96babd57a8a1
  ARM_TENANT_ID: 706143bc-e1d4-4593-aee2-c9dc60ab9be7
  PULUMI_API: https://api.pulumi-staging.io
  # Feature toggle that's read in provider.go enableAzcoreBackend()
  PULUMI_ENABLE_AZCORE_BACKEND: ${{ inputs.use_azcore }}
  # This is the content of a ~/.azure/ folder, zipped and base64-encoded, for CLI auth.
  # If/when the contained refresh token expires, someone with access to our subscription needs to
  # `az login` on their own computer and repeat the steps below.
  # Generated by using @mikhail's .azure folder and running:
  #     cp -R ~/.azure ~/azure
  #     cd ~/azure
  #     rm -rf .DS_Store logs/ commands/* cliextensions/ extensionCommandTree.json
  #     zip -v azure.zip *
  #     base64 --input azure.zip | clipcopy
  #     Paste into repo secret
  AZURE_CLI_FOLDER: ${{ secrets.AZURE_CLI_FOLDER }}

jobs:
  prerequisites:
    runs-on: ubuntu-latest
    name: Build binaries and schema
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}
          submodules: true

      - name: Install Languages & Frameworks
        uses: ./.github/actions/install
        with:
          skip_dotnet_and_java: "true"

      - name: Build schema and binaries
        run: make codegen schema provider

      - name: Artifact capture
        uses: ./.github/actions/prerequisites-artifact-capture

      - name: Schema Check
        if: github.event_name == 'pull_request'
        uses: ./.github/actions/schema-check
        with:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          compare_to: ${{  github.base_ref }}

      - name: Check worktree clean
        uses: pulumi/git-status-check-action@v1

      - if: failure() && github.event_name == 'push'
        name: Notify Slack
        uses: 8398a7/action-slack@v3
        with:
          author_name: Failure in building provider prerequisites
          fields: repo,commit,author,action
          status: ${{ job.status }}

  build_sdks:
    needs: prerequisites
    # Use big runner for dotnet and nodejs because we need more memory and more compute, respectively
    runs-on: ${{ (matrix.language == 'dotnet' || matrix.language == 'nodejs' || matrix.language == 'go') && 'pulumi-ubuntu-8core' || 'ubuntu-latest' }}
    strategy:
      fail-fast: false
      matrix:
        language:
          - nodejs
          - python
          - dotnet
          - go
          - java
    name: Build SDKs
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}
          submodules: true

      - name: Install Languages & Frameworks
        uses: ./.github/actions/install

      - run: make ensure

      - name: Prerequisites artifact restore
        uses: ./.github/actions/prerequisites-artifact-restore

      - name: Mark prerequisites as up-to-date
        run: |
          make prebuild
          make --touch codegen schema provider

      - name: Generate SDK
        run: make generate_${{ matrix.language }}

      - name: Build SDK
        run: make build_${{ matrix.language }}

      - name: Check worktree clean
        uses: pulumi/git-status-check-action@v1
        with:
          allowed-changes: |
            sdk/**/pulumi-plugin.json
            sdk/dotnet/Pulumi.*.csproj
            sdk/nodejs/package.json
            sdk/python/pyproject.toml

      - name: Tar SDK folder
        if: ${{ matrix.language != 'go' }}
        run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .

      - name: Upload artifacts
        if: ${{ matrix.language != 'go' }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{ matrix.language  }}-sdk.tar.gz
          path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
          retention-days: ${{ inputs.retention_days }}

      - name: Tar split Go SDK folder
        if: ${{ matrix.language == 'go' }}
        run: tar -zcf sdk/pulumi-azure-native-sdk.tar.gz -C sdk/pulumi-azure-native-sdk .

      - name: Upload split Go artifacts
        uses: actions/upload-artifact@v4
        if: ${{ matrix.language == 'go' }}
        with:
          name: pulumi-azure-native-sdk.tar.gz
          path: ${{ github.workspace}}/sdk/pulumi-azure-native-sdk.tar.gz
          retention-days: ${{ inputs.retention_days }}

      - if: failure() && github.event_name == 'push'
        name: Notify Slack
        uses: 8398a7/action-slack@v3
        with:
          author_name: Failure while building SDKs
          fields: repo,commit,author,action
          status: ${{ job.status }}

  test_sdks:
    needs: build_sdks
    # Use big runner for dotnet and nodejs because we need more memory and more compute, respectively
    runs-on: ${{ (matrix.language == 'dotnet' || matrix.language == 'nodejs' || matrix.language == 'go') && 'pulumi-ubuntu-8core' || 'ubuntu-latest' }}
    environment: env-ci
    strategy:
      fail-fast: false
      matrix:
        language:
          - nodejs
          - python
          - dotnet
          - go
          - java
    name: Test SDKs
    permissions:
      id-token: write # required for OIDC auth
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}
          submodules: true

      - name: Setup
        uses: ./.github/actions/test-setup
        with:
          language: ${{ matrix.language }}

      - name: Write client certificate
        # The provider wants the cert as a path to a cert file but GH secrets can only be strings.
        # We store the base64-encoded cert as a secret, decode it here, and write it out to a file.
        run: |
          echo "${{ secrets.ARM_CLIENT_CERTIFICATE }}" | base64 -d > "${{ runner.temp }}/azure-client-certificate.pfx"

      - name: Write .azure.tmp folder
        # We write to .azure.tmp, not directly to .azure, because we want only one test to use
        # this folder. The test needs to rename it to .azure and then back. This is to avoid other
        # tests using it unintentionally since CLI is the fallback auth method.
        run: |
          set -euxo pipefail
          echo "${{ secrets.AZURE_CLI_FOLDER }}" | base64 -d > "${{ runner.temp }}/azure-cli-folder.zip"
          # Unzip it to a temp folder to avoid other tests using it unintentionally (since CLI auth is the fallback method).
          # We only want one specific test to use it.
          unzip -d "$HOME/.azure.tmp" "${{ runner.temp }}/azure-cli-folder.zip"
          rm "${{ runner.temp }}/azure-cli-folder.zip"

      - name: Run tests
        if: ${{ ! inputs.short_test }}
        env:
          # specifying this id will cause the OIDC test(s) to run against this AD application
          OIDC_ARM_CLIENT_ID: ${{ inputs.oidc_arm_client_id }}
          ARM_CLIENT_CERTIFICATE_PATH_FOR_TEST: "${{ runner.temp }}/azure-client-certificate.pfx"
        run: |
          set -euo pipefail
          cd examples && go test -cover -timeout 2h -tags=${{ matrix.language }} -skip TestPulumiExamples -parallel 16 . 2>&1 | tee /tmp/gotest.log

      - name: Run short tests
        if: inputs.short_test
        run: |
          set -euo pipefail
          cd examples && go test -cover -timeout 15m -short -tags=${{ matrix.language }} -skip TestPulumiExamples -parallel 16 . 2>&1 | tee /tmp/gotest.log

  test_examples:
    needs: build_sdks
    runs-on: ubuntu-latest
    name: Test pulumi/examples
    strategy:
      fail-fast: false
      matrix:
        language:
          - nodejs
          - python
          - dotnet
          - go
          - java
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}
          submodules: true
      - name: Checkout p/examples
        uses: actions/checkout@v4
        with:
          repository: pulumi/examples
          ref: master
          path: p-examples

      - name: Setup
        uses: ./.github/actions/test-setup
        with:
          language: ${{ matrix.language }}

      - name: Free up disk space
        run: |-
          df -h
          rm -rf /opt/hostedtoolcache/CodeQL
          rm -rf /opt/hostedtoolcache/go/1.19.*
          rm -rf /opt/hostedtoolcache/go/1.20.*
          sudo apt clean
          df -h

      - name: Run pulumi/examples tests
        if: ${{ !inputs.short_test }}
        env:
          # specifying this id will cause the OIDC test(s) to run against this AD application
          OIDC_ARM_CLIENT_ID: ${{ inputs.oidc_arm_client_id }}
        run: |
          set -euo pipefail
          cd examples && \
            go mod edit -replace github.com/pulumi/examples/misc/test=../p-examples/misc/test/ && \
            go mod tidy && \
            go test -cover -timeout 2h -tags=${{ matrix.language }} -run TestPulumiExamples -parallel 16 . 2>&1 | tee /tmp/gotest.log

  test_provider:
    runs-on: ubuntu-latest
    name: Test Provider
    needs: prerequisites
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          ref: ${{ inputs.ref }}
          submodules: true

      - name: Install Languages & Frameworks
        uses: ./.github/actions/install
        with:
          skip_dotnet_and_java: "true"

      - run: make ensure

      - name: Prerequisites artifact restore
        uses: ./.github/actions/prerequisites-artifact-restore

      # This is essentially just copying files from bin to the provider folder
      - name: Prebuild provider prerequisites
        run: |
          make prebuild
          make --touch codegen schema
          make provider_prebuild

      - name: Test Provider Library
        run: |
          set -euo pipefail
          cd provider && go test -coverprofile="coverage.txt" -coverpkg=./... -timeout 1h -parallel 16 ./... 2>&1 | tee /tmp/gotest.log

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v4
        if: inputs.upload_codecov
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  dist:
    runs-on: ubuntu-latest
    name: Provider Dist
    needs: prerequisites
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4
        with:
          submodules: true
          ref: ${{ inputs.ref }}

      - name: Install Languages & Frameworks
        uses: ./.github/actions/install
        with:
          skip_dotnet_and_java: "true"

      - run: make ensure

      - name: Prerequisites artifact restore
        uses: ./.github/actions/prerequisites-artifact-restore

      - name: Prerequisites
        run: |
          make prebuild
          # Don't include provider as that's the bit we're going to rebuild
          make --touch codegen schema
          make provider_prebuild

      - name: Build dist packages
        run: make dist
        env:
          AZURE_SIGNING_CLIENT_ID: ${{ secrets.AZURE_SIGNING_CLIENT_ID }}
          AZURE_SIGNING_CLIENT_SECRET: ${{ secrets.AZURE_SIGNING_CLIENT_SECRET }}
          AZURE_SIGNING_TENANT_ID: ${{ secrets.AZURE_SIGNING_TENANT_ID }}
          AZURE_SIGNING_KEY_VAULT_URI: ${{ secrets.AZURE_SIGNING_KEY_VAULT_URI }}

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist
          retention-days: ${{ inputs.retention_days }}