github-actions/.github/workflows/pulumi-up.yml at abab22d04307c8f698c83add650080dce2021288 · notdodo/github-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Pulumi Up

on:
  workflow_call:
    inputs:
      aws-role:
        type: string
        default: ''
      aws-region:
        type: string
        default: eu-west-1
      aws-secrets-mapping:
        type: string
        default: ''
      disable-sudo:
        type: boolean
        default: true
      environment:
        type: string
        default: ''
      egress-policy-allowlist:
        type: string
        default: ''
      poetry-version:
        type: string
        default: 'latest'
      python-version:
        type: string
        default: '3.13'
      runs-on:
        type: string
        default: 'ubuntu-latest'
      stack-name:
        type: string
        default: ''
      working-directory:
        type: string
        default: '.'

concurrency:
  group: ghas-${{ github.repository }}-pulumi-up-${{ inputs.stack-name }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  pulumi-up:
    permissions:
      contents: read
      id-token: write
    runs-on: ${{ inputs.runs-on }}
    environment: ${{ inputs.environment != '' && inputs.environment || null }}
    env:
      PULUMI_HOME: ${{ github.workspace }}/.pulumi
    defaults:
      run:
        working-directory: ${{ inputs.working-directory }}
    steps:
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          disable-sudo-and-containers: ${{ inputs.disable-sudo }}
          egress-policy: block
          allowed-endpoints: >
            *.amazonaws.com:443
            api.github.com:443
            api.pulumi.com:443
            files.pythonhosted.org:443
            github.com:443
            install.python-poetry.org:443
            objects.githubusercontent.com:443
            pypi.org:443
            raw.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            releases.astral.sh:443
            ${{ inputs.egress-policy-allowlist }}
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: ${{ inputs.python-version }}

      # ----- Poetry -----
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        if: ${{ hashFiles(format('{0}/poetry.lock', inputs.working-directory)) != '' }}
        with:
          path: ~/.local/bin/
          key: poetry-${{ inputs.poetry-version }}
      - uses: snok/install-poetry@a783c322200f0519c7926aa6faa857c4e23e9263 # v1.4.2
        if: ${{ hashFiles(format('{0}/poetry.lock', inputs.working-directory)) != '' }}
        with:
          version: ${{ inputs.poetry-version }}
          virtualenvs-create: true
          virtualenvs-in-project: true
          installer-parallel: true

      # ----- UV -----
      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        if: ${{ hashFiles(format('{0}/uv.lock', inputs.working-directory)) != '' }}
        with:
          enable-cache: true
      - id: cache-deps
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ${{ inputs.working-directory }}/.venv
            ${{ inputs.working-directory }}/.mypy_cache
            ~/.local/.cache/uv
          key: python-${{ inputs.python-version }}-venv-${{ hashFiles(format('{0}/poetry.lock', inputs.working-directory), format('{0}/uv.lock', inputs.working-directory)) }}
      - run: poetry sync --no-root
        if: ${{ steps.cache-deps.outputs.cache-hit != 'true' && hashFiles(format('{0}/poetry.lock', inputs.working-directory)) != '' }}
      - run: uv sync --locked --all-extras --dev
        if: ${{ steps.cache-deps.outputs.cache-hit != 'true' && hashFiles(format('{0}/uv.lock', inputs.working-directory)) != '' }}
      - uses: pulumi/auth-actions@141415910c3beb54e03b48e9057c204c97b956f2 # v2.1.0
        with:
          organization: notdodo
          # kics-scan ignore-line
          requested-token-type: urn:pulumi:token-type:access_token:personal
          scope: user:notdodo
      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ${{ env.PULUMI_HOME }}/plugins
          key: python-${{ inputs.python-version }}-venv-${{ hashFiles(format('{0}/poetry.lock', inputs.working-directory), format('{0}/uv.lock', inputs.working-directory)) }}
      - uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
        if: ${{ inputs.aws-role != '' }}
        with:
          role-to-assume: ${{ inputs.aws-role }}
          aws-region: ${{ inputs.aws-region }}
          retry-max-attempts: 2
      - uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1
        if: ${{ inputs.aws-role != '' }}
        with:
          secret-ids: >
            ${{ inputs.aws-secrets-mapping }}
      - uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d # v7.0.0
        name: Pulumi Up
        with:
          command: up
          stack-name: ${{ inputs.stack-name }}
          diff: true
          work-dir: ${{ inputs.working-directory }}
          comment-on-pr: true
          color: always
          suppress-progress: true
          always-include-summary: true