release

# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt

name: release
on:
  push:
    tags:
    - v*.*.*
    - "!v*.*.*-**"
env:
  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: kubernetes
  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
  PYPI_USERNAME: __token__
  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: 1.21.x
  NODEVERSION: 20.x
  PYTHONVERSION: "3.11"
  DOTNETVERSION: |
    6.0.x
    3.1.301
  JAVAVERSION: "11"
  AWS_REGION: us-west-2
  PULUMI_TEST_OWNER: moolumi
  GOLANGCI_LINT_VERSION: v1.55.2
  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-k8s-provider.iam.gserviceaccount.com
  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
  GOOGLE_PROJECT_NUMBER: 637339343727
jobs:
  prerequisites:
    runs-on: ubuntu-latest
    name: prerequisites
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - if: github.event_name == 'pull_request'
      name: Install Schema Tools
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/schema-tools
    - name: Build K8sgen
      run: make k8sgen
    - name: Prepare OpenAPI file
      run: make openapi_file
    - name: Prepare Schema
      run: make schema
    - name: Make Kubernetes provider
      run: make k8sprovider
    - if: github.event_name == 'pull_request'
      name: Check Schema is Valid
      run: >-
        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV

        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV

        echo 'EOF' >> $GITHUB_ENV
      env:
        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
    - if: github.event_name == 'pull_request'
      name: Comment on PR with Details of Schema Check
      uses: thollander/actions-comment-pull-request@v2
      with:
        message: |
          ${{ env.SCHEMA_CHANGES }}
        comment_tag: schemaCheck
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
        github.actor == 'pulumi-bot'
      name: Add label if no breaking changes
      uses: actions-ecosystem/action-add-labels@v1.1.0
      with:
        labels: impact/no-changelog-required
        number: ${{ github.event.issue.number }}
        github_token: ${{ secrets.GITHUB_TOKEN }}
    - name: Check worktree clean
      uses: pulumi/git-status-check-action@v1
      with:
        allowed-changes: |-
          sdk/**/pulumi-plugin.json
          sdk/dotnet/Pulumi.*.csproj
          sdk/go/**/pulumiUtilities.go
          sdk/nodejs/package.json
          sdk/python/pyproject.toml
    - run: git status --porcelain
    - name: Tar provider binaries
      run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
        github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
        pulumi-gen-${{ env.PROVIDER}}
    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin/provider.tar.gz
    - name: Test Provider Library
      run: make test_provider
    - name: Upload coverage reports to Codecov
      uses: codecov/codecov-action@v4
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@v3
      with:
        author_name: Failure in building provider prerequisites
        fields: repo,commit,author,action
        status: ${{ job.status }}
  build_sdks:
    needs: prerequisites
    runs-on: pulumi-ubuntu-8core
    strategy:
      fail-fast: true
      matrix:
        language:
        - nodejs
        - python
        - dotnet
        - go
        - java
    name: build_sdks
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODEVERSION }}
        registry-url: https://registry.npmjs.org
    - name: Setup DotNet
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: ${{ env.DOTNETVERSION }}
    - name: Setup Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
      uses: actions/setup-java@v4
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
      uses: gradle/gradle-build-action@v3
      with:
        gradle-version: "7.6"
    - name: Download provider + tfgen binaries
      uses: actions/download-artifact@v4
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
    - name: UnTar provider binaries
      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
        github.workspace}}/bin
    - name: Restore Binary Permissions
      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
        -exec chmod +x {} \;
    - name: Generate SDK
      run: make ${{ matrix.language }}_sdk
    - name: Check worktree clean
      uses: pulumi/git-status-check-action@v1
      with:
        allowed-changes: |-
          sdk/**/pulumi-plugin.json
          sdk/dotnet/Pulumi.*.csproj
          sdk/go/**/pulumiUtilities.go
          sdk/nodejs/package.json
          sdk/python/pyproject.toml
    - run: git status --porcelain
    - name: Tar SDK folder
      run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: ${{ matrix.language  }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@v3
      with:
        author_name: Failure while building SDKs
        fields: repo,commit,author,action
        status: ${{ job.status }}
  test:
    runs-on: pulumi-ubuntu-8core
    needs:
    - build_sdks
    - build-test-cluster
    strategy:
      fail-fast: true
      matrix:
        language:
        - nodejs
        - python
        - dotnet
        - go
        - java
    name: test
    permissions:
      contents: read
      id-token: write
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODEVERSION }}
        registry-url: https://registry.npmjs.org
    - name: Setup DotNet
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: ${{ env.DOTNETVERSION }}
    - name: Setup Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
      uses: actions/setup-java@v4
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
      uses: gradle/gradle-build-action@v3
      with:
        gradle-version: "7.6"
    - name: Download provider + tfgen binaries
      uses: actions/download-artifact@v4
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
    - name: UnTar provider binaries
      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
        github.workspace}}/bin
    - name: Restore Binary Permissions
      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
        -exec chmod +x {} \;
    - name: Download SDK
      uses: actions/download-artifact@v4
      with:
        name: ${{ matrix.language }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: UnTar SDK folder
      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
        github.workspace}}/sdk/${{ matrix.language}}
    - name: Update path
      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
    - name: Install Node dependencies
      run: yarn global add typescript
    - run: dotnet nuget add source ${{ github.workspace }}/nuget
    - name: Install Python deps
      run: |-
        pip3 install virtualenv==20.0.23
        pip3 install pipenv
    - name: Install dependencies
      run: make install_${{ matrix.language}}_sdk
    - name: Make Kube Directory
      run: mkdir -p "~/.kube/"
    - name: Download Kubeconfig
      uses: actions/download-artifact@v4
      with:
        name: config
        path: ~/.kube/
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: ${{ env.AWS_REGION }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        role-duration-seconds: 3600
        role-session-name: ${{ env.PROVIDER }}@githubActions
        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@v0
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
          env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
    - name: Setup gcloud auth
      uses: google-github-actions/setup-gcloud@v2
      with:
        install_components: gke-gcloud-auth-plugin
    - name: Install Kubectl
      run: >
        curl -LO
        https://storage.googleapis.com/kubernetes-release/release/$(curl -s
        https://storage.googleapis.com/kubernetes-release/release/stable-1.28.txt)/bin/linux/amd64/kubectl

        chmod +x ./kubectl

        sudo mv kubectl /usr/local/bin
    - name: Install and configure Helm
      run: |
        curl -LO  https://get.helm.sh/helm-v3.8.0-linux-amd64.tar.gz
        tar -xvf helm-v3.8.0-linux-amd64.tar.gz
        sudo mv linux-amd64/helm /usr/local/bin
        helm repo add stable https://charts.helm.sh/stable
        helm repo update
    - name: Install gotestfmt
      uses: GoTestTools/gotestfmt-action@v2
      with:
        version: v2.5.0
        token: ${{ secrets.GITHUB_TOKEN }}
    - name: Run tests
      run: cd tests/sdk/${{ matrix.language }} && go test -v -count=1 -cover -timeout
        2h -parallel 4 ./...
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@v3
      with:
        author_name: Failure in SDK tests
        fields: repo,commit,author,action
        status: ${{ job.status }}
  publish:
    runs-on: ubuntu-latest
    needs: test
    name: publish
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Clear GitHub Actions Ubuntu runner disk space
      uses: jlumbroso/free-disk-space@v1.3.1
      with:
        tool-cache: false
        dotnet: false
        android: true
        haskell: true
        swap-storage: true
        large-packages: false
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: us-east-2
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        role-duration-seconds: 7200
        role-session-name: ${{ env.PROVIDER }}@githubActions
        role-external-id: upload-pulumi-release
        role-to-assume: ${{ secrets.AWS_UPLOAD_ROLE_ARN }}
    - name: Run GoReleaser
      uses: goreleaser/goreleaser-action@v5
      env:
        GORELEASER_CURRENT_TAG: v${{ steps.version.outputs.version }}
      with:
        args: -p 3 release --clean --timeout 60m0s
        version: latest
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@v3
      with:
        author_name: Failure in publishing binaries
        fields: repo,commit,author,action
        status: ${{ job.status }}
  publish_sdk:
    runs-on: ubuntu-latest
    needs: publish
    name: publish_sdks
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Checkout Scripts Repo
      uses: actions/checkout@v4
      with:
        path: ci-scripts
        repository: pulumi/scripts
    - run: echo "ci-scripts" >> .git/info/exclude
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODEVERSION }}
        registry-url: https://registry.npmjs.org
    - name: Setup DotNet
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: ${{ env.DOTNETVERSION }}
    - name: Setup Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Download python SDK
      uses: actions/download-artifact@v4
      with:
        name: python-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: Uncompress python SDK
      run: tar -zxf ${{github.workspace}}/sdk/python.tar.gz -C
        ${{github.workspace}}/sdk/python
    - name: Download dotnet SDK
      uses: actions/download-artifact@v4
      with:
        name: dotnet-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: Uncompress dotnet SDK
      run: tar -zxf ${{github.workspace}}/sdk/dotnet.tar.gz -C
        ${{github.workspace}}/sdk/dotnet
    - name: Download nodejs SDK
      uses: actions/download-artifact@v4
      with:
        name: nodejs-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: Uncompress nodejs SDK
      run: tar -zxf ${{github.workspace}}/sdk/nodejs.tar.gz -C
        ${{github.workspace}}/sdk/nodejs
    - name: Install Twine
      run: python -m pip install pip twine
    - name: Publish SDKs
      run: ./ci-scripts/ci/publish-tfgen-package ${{ github.workspace }}
      env:
        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        PYPI_PUBLISH_ARTIFACTS: all
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@v3
      with:
        author_name: Failure in publishing SDK
        fields: repo,commit,author,action
        status: ${{ job.status }}
  publish_java_sdk:
    runs-on: ubuntu-latest
    continue-on-error: true
    needs: publish
    name: publish_java_sdk
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup Java
      uses: actions/setup-java@v4
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
      uses: gradle/gradle-build-action@v3
      with:
        gradle-version: "7.6"
    - name: Download java SDK
      uses: actions/download-artifact@v4
      with:
        name: java-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: Uncompress java SDK
      run: tar -zxf ${{github.workspace}}/sdk/java.tar.gz -C
        ${{github.workspace}}/sdk/java
    - name: Publish Java SDK
      uses: gradle/gradle-build-action@v3
      env:
        PACKAGE_VERSION: ${{ env.PROVIDER_VERSION }}
      with:
        arguments: publishToSonatype closeAndReleaseSonatypeStagingRepository
        build-root-directory: ./sdk/java
        gradle-version: 7.4.1
  publish_go_sdk:
    runs-on: ubuntu-latest
    name: publish-go-sdk
    needs: publish_sdk
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Download go SDK
      uses: actions/download-artifact@v4
      with:
        name: go-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: Uncompress go SDK
      run: tar -zxf ${{github.workspace}}/sdk/go.tar.gz -C
        ${{github.workspace}}/sdk/go
    - name: Publish Go SDK
      uses: pulumi/publish-go-sdk-action@v1
      with:
        repository: ${{ github.repository }}
        base-ref: ${{ github.sha }}
        source: sdk
        path: sdk
        version: ${{ steps.version.outputs.version }}
        additive: false
        files: |-
          go.*
          go/**
          !*.tar.gz
  dispatch_docs_build:
    runs-on: ubuntu-latest
    needs: publish_go_sdk
    steps:
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Dispatch Event
      run: pulumictl create docs-build pulumi-${{ env.PROVIDER }}
        ${GITHUB_REF#refs/tags/}
      env:
        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
    name: dispatch_docs_build
  build-test-cluster:
    runs-on: ubuntu-latest
    name: build-test-cluster
    outputs:
      stack-name: ${{ steps.stackname.outputs.stack-name }}
    permissions:
      contents: read
      id-token: write
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODEVERSION }}
        registry-url: https://registry.npmjs.org
    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@v0
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
          env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
    - name: Setup gcloud auth
      uses: google-github-actions/setup-gcloud@v2
      with:
        install_components: gke-gcloud-auth-plugin
    - name: Install Kubectl
      run: >
        curl -LO
        https://storage.googleapis.com/kubernetes-release/release/$(curl -s
        https://storage.googleapis.com/kubernetes-release/release/stable-1.28.txt)/bin/linux/amd64/kubectl

        chmod +x ./kubectl

        sudo mv kubectl /usr/local/bin
    - name: Login to Google Cloud Registry
      run: gcloud --quiet auth configure-docker
    - name: Set stack name in output
      id: stackname
      run: echo 'stack-name=${{ env.PULUMI_TEST_OWNER }}/${{ github.sha }}-${{
        github.run_id }}-${{ github.run_attempt }}' >> "$GITHUB_OUTPUT"
    - name: Create test infrastructure
      run: ./scripts/ci-cluster-create.sh ${{ steps.stackname.outputs.stack-name }}
    - name: Upload Kubernetes Artifacts
      uses: actions/upload-artifact@v4
      with:
        name: config
        path: ~/.kube/config
  destroy-test-cluster:
    runs-on: ubuntu-latest
    name: teardown-test-cluster
    needs:
    - build-test-cluster
    - test
    if: ${{ always() }} && github.event.pull_request.head.repo.full_name ==
      github.repository
    permissions:
      contents: read
      id-token: write
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODEVERSION }}
        registry-url: https://registry.npmjs.org
    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@v0
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
          env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
    - name: Setup gcloud auth
      uses: google-github-actions/setup-gcloud@v2
      with:
        install_components: gke-gcloud-auth-plugin
    - name: Install Kubectl
      run: >
        curl -LO
        https://storage.googleapis.com/kubernetes-release/release/$(curl -s
        https://storage.googleapis.com/kubernetes-release/release/stable-1.28.txt)/bin/linux/amd64/kubectl

        chmod +x ./kubectl

        sudo mv kubectl /usr/local/bin
    - name: Login to Google Cloud Registry
      run: gcloud --quiet auth configure-docker
    - name: Destroy test infra
      run: ./scripts/ci-cluster-destroy.sh ${{
        needs.build-test-cluster.outputs.stack-name }}
    - uses: geekyeggo/delete-artifact@v1
      with:
        name: config


run-acceptance-tests

# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt

name: run-acceptance-tests
on:
  repository_dispatch:
    types:
    - run-acceptance-tests-command
  pull_request:
    branches:
    - master
    - main
    - v4
    paths-ignore:
    - CHANGELOG.md
  workflow_dispatch: {}
env:
  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: kubernetes
  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
  PYPI_USERNAME: __token__
  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: 1.21.x
  NODEVERSION: 20.x
  PYTHONVERSION: "3.11"
  DOTNETVERSION: |
    6.0.x
    3.1.301
  JAVAVERSION: "11"
  AWS_REGION: us-west-2
  PULUMI_TEST_OWNER: moolumi
  GOLANGCI_LINT_VERSION: v1.55.2
  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-k8s-provider.iam.gserviceaccount.com
  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
  GOOGLE_PROJECT_NUMBER: 637339343727
  PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
jobs:
  comment-notification:
    runs-on: ubuntu-latest
    name: comment-notification
    steps:
    - name: Create URL to the run output
      id: vars
      run: echo
        run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID
        >> "$GITHUB_OUTPUT"
    - name: Update with Result
      uses: peter-evans/create-or-update-comment@v1
      with:
        token: ${{ secrets.PULUMI_BOT_TOKEN }}
        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
        issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
        body: "Please view the PR build: ${{ steps.vars.outputs.run-url }}"
    if: github.event_name == 'repository_dispatch'
  prerequisites:
    runs-on: ubuntu-latest
    name: prerequisites
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
        ref: ${{ env.PR_COMMIT_SHA }}
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - if: github.event_name == 'pull_request'
      name: Install Schema Tools
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/schema-tools
    - name: Build K8sgen
      run: make k8sgen
    - name: Prepare OpenAPI file
      run: make openapi_file
    - name: Prepare Schema
      run: make schema
    - name: Make Kubernetes provider
      run: make k8sprovider
    - if: github.event_name == 'pull_request'
      name: Check Schema is Valid
      run: >-
        echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV

        schema-tools compare -p ${{ env.PROVIDER }} -o ${{ github.event.repository.default_branch }} -n --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV

        echo 'EOF' >> $GITHUB_ENV
      env:
        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
    - if: github.event_name == 'pull_request'
      name: Comment on PR with Details of Schema Check
      uses: thollander/actions-comment-pull-request@v2
      with:
        message: |
          ${{ env.SCHEMA_CHANGES }}
        comment_tag: schemaCheck
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - if: contains(env.SCHEMA_CHANGES, 'Looking good! No breaking changes found.') &&
        github.actor == 'pulumi-bot'
      name: Add label if no breaking changes
      uses: actions-ecosystem/action-add-labels@v1.1.0
      with:
        labels: impact/no-changelog-required
        number: ${{ github.event.issue.number }}
        github_token: ${{ secrets.GITHUB_TOKEN }}
    - name: Check worktree clean
      uses: pulumi/git-status-check-action@v1
      with:
        allowed-changes: |-
          sdk/**/pulumi-plugin.json
          sdk/dotnet/Pulumi.*.csproj
          sdk/go/**/pulumiUtilities.go
          sdk/nodejs/package.json
          sdk/python/pyproject.toml
    - run: git status --porcelain
    - name: Tar provider binaries
      run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
        github.workspace}}/bin/ pulumi-resource-${{ env.PROVIDER }}
        pulumi-gen-${{ env.PROVIDER}}
    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin/provider.tar.gz
    - name: Test Provider Library
      run: make test_provider
    - name: Upload coverage reports to Codecov
      uses: codecov/codecov-action@v4
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@v3
      with:
        author_name: Failure in building provider prerequisites
        fields: repo,commit,author,action
        status: ${{ job.status }}
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository
  build_sdks:
    needs: prerequisites
    runs-on: pulumi-ubuntu-8core
    strategy:
      fail-fast: true
      matrix:
        language:
        - nodejs
        - python
        - dotnet
        - go
        - java
    name: build_sdks
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
        ref: ${{ env.PR_COMMIT_SHA }}
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODEVERSION }}
        registry-url: https://registry.npmjs.org
    - name: Setup DotNet
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: ${{ env.DOTNETVERSION }}
    - name: Setup Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
      uses: actions/setup-java@v4
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
      uses: gradle/gradle-build-action@v3
      with:
        gradle-version: "7.6"
    - name: Download provider + tfgen binaries
      uses: actions/download-artifact@v4
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
    - name: UnTar provider binaries
      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
        github.workspace}}/bin
    - name: Restore Binary Permissions
      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
        -exec chmod +x {} \;
    - name: Generate SDK
      run: make ${{ matrix.language }}_sdk
    - name: Check worktree clean
      uses: pulumi/git-status-check-action@v1
      with:
        allowed-changes: |-
          sdk/**/pulumi-plugin.json
          sdk/dotnet/Pulumi.*.csproj
          sdk/go/**/pulumiUtilities.go
          sdk/nodejs/package.json
          sdk/python/pyproject.toml
    - run: git status --porcelain
    - name: Tar SDK folder
      run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
    - name: Upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: ${{ matrix.language  }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
        retention-days: 30
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@v3
      with:
        author_name: Failure while building SDKs
        fields: repo,commit,author,action
        status: ${{ job.status }}
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository
  test:
    runs-on: pulumi-ubuntu-8core
    needs:
    - build_sdks
    strategy:
      fail-fast: false
      matrix:
        language:
        - nodejs
        - python
        - dotnet
        - go
        - java
    name: test
    permissions:
      contents: read
      id-token: write
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
        ref: ${{ env.PR_COMMIT_SHA }}
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODEVERSION }}
        registry-url: https://registry.npmjs.org
    - name: Setup DotNet
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: ${{ env.DOTNETVERSION }}
    - name: Setup Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Setup Java
      uses: actions/setup-java@v4
      with:
        java-version: ${{ env.JAVAVERSION }}
        distribution: temurin
        cache: gradle
    - name: Setup Gradle
      uses: gradle/gradle-build-action@v3
      with:
        gradle-version: "7.6"
    - name: Download provider + tfgen binaries
      uses: actions/download-artifact@v4
      with:
        name: pulumi-${{ env.PROVIDER }}-provider.tar.gz
        path: ${{ github.workspace }}/bin
    - name: UnTar provider binaries
      run: tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
        github.workspace}}/bin
    - name: Restore Binary Permissions
      run: find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print
        -exec chmod +x {} \;
    - name: Download SDK
      uses: actions/download-artifact@v4
      with:
        name: ${{ matrix.language }}-sdk.tar.gz
        path: ${{ github.workspace}}/sdk/
    - name: UnTar SDK folder
      run: tar -zxf ${{ github.workspace}}/sdk/${{ matrix.language}}.tar.gz -C ${{
        github.workspace}}/sdk/${{ matrix.language}}
    - name: Update path
      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
    - name: Install Node dependencies
      run: yarn global add typescript
    - run: dotnet nuget add source ${{ github.workspace }}/nuget
    - name: Install Python deps
      run: |-
        pip3 install virtualenv==20.0.23
        pip3 install pipenv
    - name: Install dependencies
      run: make install_${{ matrix.language}}_sdk
    - name: Configure AWS Credentials
      uses: aws-actions/configure-aws-credentials@v4
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-region: ${{ env.AWS_REGION }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        role-duration-seconds: 3600
        role-session-name: ${{ env.PROVIDER }}@githubActions
        role-to-assume: ${{ secrets.AWS_CI_ROLE_ARN }}
    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@v0
      with:
        workload_identity_provider: projects/${{ env.GOOGLE_PROJECT_NUMBER
          }}/locations/global/workloadIdentityPools/${{
          env.GOOGLE_CI_WORKLOAD_IDENTITY_POOL }}/providers/${{
          env.GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER }}
        service_account: ${{ env.GOOGLE_CI_SERVICE_ACCOUNT_EMAIL }}
    - name: Setup gcloud auth
      uses: google-github-actions/setup-gcloud@v2
      with:
        install_components: gke-gcloud-auth-plugin
    - name: Install Kubectl
      run: >
        curl -LO
        https://storage.googleapis.com/kubernetes-release/release/$(curl -s
        https://storage.googleapis.com/kubernetes-release/release/stable-1.28.txt)/bin/linux/amd64/kubectl

        chmod +x ./kubectl

        sudo mv kubectl /usr/local/bin
    - name: Install and configure Helm
      run: |
        curl -LO  https://get.helm.sh/helm-v3.8.0-linux-amd64.tar.gz
        tar -xvf helm-v3.8.0-linux-amd64.tar.gz
        sudo mv linux-amd64/helm /usr/local/bin
        helm repo add stable https://charts.helm.sh/stable
        helm repo update
    - name: Install gotestfmt
      uses: GoTestTools/gotestfmt-action@v2
      with:
        version: v2.5.0
        token: ${{ secrets.GITHUB_TOKEN }}
    - name: Setup KinD cluster
      uses: helm/kind-action@v1
      with:
        cluster_name: kind-integration-tests-${{ matrix.language }}
        node_image: kindest/node:v1.29.2
    - name: Run tests
      run: cd tests/sdk/${{ matrix.language }} && go test -v -count=1 -cover -timeout
        2h -parallel 4 -short ./...
    - if: failure() && github.event_name == 'push'
      name: Notify Slack
      uses: 8398a7/action-slack@v3
      with:
        author_name: Failure in SDK tests
        fields: repo,commit,author,action
        status: ${{ job.status }}
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository
  sentinel:
    runs-on: ubuntu-latest
    name: sentinel
    steps:
    - name: Mark workflow as successful
      uses: guibranco/github-status-action-v2@0849440ec82c5fa69b2377725b9b7852a3977e76
      with:
        authToken: ${{ secrets.GITHUB_TOKEN }}
        context: Sentinel
        state: success
        description: Sentinel checks passed
        sha: ${{ github.event.pull_request.head.sha || github.sha }}
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository
    needs:
    - test
    - lint
  lint:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
        ref: ${{ env.PR_COMMIT_SHA }}
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: golangci-lint provider pkg
      uses: golangci/golangci-lint-action@v4
      with:
        version: ${{ env.GOLANGCI_LINT_VERSION }}
        args: -c ../.golangci.yml
        working-directory: provider
    name: lint
    if: github.event_name == 'repository_dispatch' ||
      github.event.pull_request.head.repo.full_name == github.repository


weekly-pulumi-update

# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt

name: weekly-pulumi-update
on:
  schedule:
  - cron: 35 12 * * 4
  workflow_dispatch: {}
env:
  GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
  PROVIDER: kubernetes
  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
  PYPI_USERNAME: __token__
  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
  TRAVIS_OS_NAME: linux
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  GOVERSION: 1.21.x
  NODEVERSION: 20.x
  PYTHONVERSION: "3.11"
  DOTNETVERSION: |
    6.0.x
    3.1.301
  JAVAVERSION: "11"
  AWS_REGION: us-west-2
  PULUMI_TEST_OWNER: moolumi
  GOLANGCI_LINT_VERSION: v1.55.2
  GOOGLE_CI_SERVICE_ACCOUNT_EMAIL: pulumi-ci@pulumi-k8s-provider.iam.gserviceaccount.com
  GOOGLE_CI_WORKLOAD_IDENTITY_POOL: pulumi-ci
  GOOGLE_CI_WORKLOAD_IDENTITY_PROVIDER: pulumi-ci
  GOOGLE_PROJECT_NUMBER: 637339343727
jobs:
  weekly-pulumi-update:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout Repo
      uses: actions/checkout@v4
      with:
        lfs: true
    - id: version
      name: Set Provider Version
      uses: pulumi/provider-version-action@v1
      with:
        set-env: PROVIDER_VERSION
    - name: Install Go
      uses: actions/setup-go@v5
      with:
        go-version: ${{ env.GOVERSION }}
        cache-dependency-path: "**/*.sum"
    - name: Install pulumictl
      uses: jaxxstorm/action-install-gh-release@v1.11.0
      with:
        repo: pulumi/pulumictl
    - name: Install Pulumi CLI
      uses: pulumi/actions@v5
    - name: Setup DotNet
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: ${{ env.DOTNETVERSION }}
    - name: Setup Node
      uses: actions/setup-node@v4
      with:
        node-version: ${{ env.NODEVERSION }}
        registry-url: https://registry.npmjs.org
    - name: Setup Python
      uses: actions/setup-python@v5
      with:
        python-version: ${{ env.PYTHONVERSION }}
    - name: Update Pulumi/Pulumi
      id: gomod
      run: >-
        git config --local user.email 'bot@pulumi.com'

        git config --local user.name 'pulumi-bot'

        git checkout -b update-pulumi/${{ github.run_id }}-${{ github.run_number }}

        for MODFILE in $(find . -name go.mod); do pushd $(dirname $MODFILE); go get github.com/pulumi/pulumi/pkg/v3 github.com/pulumi/pulumi/sdk/v3; go mod tidy; popd; done

        gh repo view pulumi/pulumi --json latestRelease --jq .latestRelease.tagName | sed 's/^v//' > .pulumi.version

        git update-index -q --refresh

        if ! git diff-files --quiet; then echo changes=1 >> "$GITHUB_OUTPUT"; fi
    - name: Provider with Pulumi Upgrade
      if: steps.gomod.outputs.changes != 0
      run: >-
        make build

        git add sdk/nodejs

        git commit -m "Regenerating Node.js SDK based on updated modules" || echo "ignore commit failure, may be empty"

        git add sdk/python

        git commit -m "Regenerating Python SDK based on updated modules" || echo "ignore commit failure, may be empty"

        git add sdk/dotnet

        git commit -m "Regenerating .NET SDK based on updated modules" || echo "ignore commit failure, may be empty"

        git add sdk/go*

        git commit -m "Regenerating Go SDK based on updated modules" || echo "ignore commit failure, may be empty"

        git add sdk/java*

        git commit -m "Regenerating Java SDK based on updated modules" || echo "ignore commit failure, may be empty"

        git add .

        git commit -m "Updated modules" || echo "ignore commit failure, may be empty"

        git push origin update-pulumi/${{ github.run_id }}-${{ github.run_number }}
    - name: Create PR
      id: create-pr
      if: steps.gomod.outputs.changes != 0
      uses: repo-sync/pull-request@v2.6.2
      with:
        source_branch: update-pulumi/${{ github.run_id }}-${{ github.run_number }}
        destination_branch: master
        pr_title: Automated Pulumi/Pulumi upgrade
        github_token: ${{ secrets.PULUMI_BOT_TOKEN }}
      env:
        GITHUB_TOKEN: ${{ secrets.PULUMI_BOT_TOKEN }}
    name: weekly-pulumi-update


Gradle Assemble

name: Gradle Assemble
on: [pull_request]

jobs:
  assemble:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        java: [ 11, 17, 21 ]
        os: [ubuntu-latest, windows-latest, macos-13]
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ matrix.java }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java }}
          distribution: temurin
      - name: Setup docker (missing on MacOS)
        id: setup_docker
        if: runner.os == 'macos'
        uses: douglascamata/setup-docker-macos-action@main
        continue-on-error: true
        with:
          upgrade-qemu: true
          colima:  v0.6.8
      - name: Run Gradle (assemble)
        if: runner.os == 'macos' && steps.setup_docker.outcome != 'success'
        run: |
          # Report success even if previous step failed (Docker on MacOS runner is very unstable)
          exit 0;
      - name: Run Gradle (assemble)
        if: runner.os != 'macos'
        run: |
          ./gradlew assemble --parallel --no-build-cache -PDISABLE_BUILD_CACHE
      - name: Run Gradle (assemble)
        if: runner.os == 'macos' && steps.setup_docker.outcome == 'success'
        run: |
          ./gradlew assemble --parallel --no-build-cache -PDISABLE_BUILD_CACHE


Releases

name: Releases

on:
  push:
    tags:
      - '*'

jobs:

  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: GitHub App token
        id: github_app_token
        uses: tibdex/github-app-token@v2.1.0
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
          installation_id: 22958780
      - name: Get tag
        id: tag
        uses: dawidd6/action-get-tag@v1
      - uses: actions/checkout@v4
      - uses: ncipollo/release-action@v1
        with:
          github_token: ${{ steps.github_app_token.outputs.token }}
          bodyFile: release-notes/opensearch.release-notes-${{steps.tag.outputs.tag}}.md


Backport

name: Backport
on:
  pull_request_target:
    types:
      - closed
      - labeled

jobs:
  backport:
    name: Backport
    runs-on: ubuntu-latest
    # Only react to merged PRs for security reasons.
    # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target.
    if: >
      github.event.pull_request.merged
      && (
        github.event.action == 'closed'
        || (
          github.event.action == 'labeled'
          && contains(github.event.label.name, 'backport')
        )
      )
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: GitHub App token
        id: github_app_token
        uses: tibdex/github-app-token@v2.1.0
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
          installation_id: 22958780

      - name: Backport
        uses: VachaShah/backport@v2.2.0
        with:
          github_token: ${{ steps.github_app_token.outputs.token }}
          head_template: backport/backport-<%= number %>-to-<%= base %>
          failure_labels: backport-failed


Changelog Verifier

name: "Changelog Verifier"
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]

jobs:
  # Enforces the update of a changelog file on every pull request
  verify-changelog:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          ref: ${{ github.event.pull_request.head.sha }}
      - uses: dangoslen/changelog-enforcer@v3
        id: verify-changelog-3x
        with:
          skipLabels: "autocut, skip-changelog"
          changeLogPath: 'CHANGELOG-3.0.md'
        continue-on-error: true
      - uses: dangoslen/changelog-enforcer@v3
        id: verify-changelog
        with:
          skipLabels: "autocut, skip-changelog"
          changeLogPath: 'CHANGELOG.md'
        continue-on-error: true
      - run: |
          # The check was possibly skipped leading to success for both the jobs
          if [[ ${{ steps.verify-changelog-3x.outcome }} == 'success' && ${{ steps.verify-changelog.outcome }} == 'success' ]]; then
            exit 0
          fi

          if [[ ${{ steps.verify-changelog-3x.outcome }} == 'failure' && ${{ steps.verify-changelog.outcome }} == 'failure' ]]; then
            echo "error: Please ensure a changelog entry exists in CHANGELOG.md or CHANGELOG-3.0.md"
            exit 1
          fi

          # Concatenates the labels and checks if the string contains "backport"
          has_backport_label=${{ contains(join(github.event.pull_request.labels.*.name, ', '), 'backport')}}
          if [[ ${{ steps.verify-changelog.outcome }} == 'success' && $has_backport_label == false ]]; then
            echo "error: Please make sure that the PR has a backport label associated with it when making an entry to the CHANGELOG.md file"
            exit 1
          fi


Copy labels from linked issues

name: Copy labels from linked issues
on:
  pull_request_target:
    types: [opened, edited, review_requested, synchronize, reopened, ready_for_review]

jobs:
  copy-issue-labels:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest
    permissions:
      issues: read
      contents: read
      pull-requests: write
    steps:
      - name: copy-issue-labels
        uses: michalvankodev/copy-issue-labels@v1.3.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          labels-to-exclude: |
            untriaged
            triaged


Create Documentation Issue

name: Create Documentation Issue
on:
  pull_request:
    types:
      - labeled
env:
  PR_NUMBER: ${{ github.event.number }}

jobs:
  create-issue:
    if: ${{ github.event.label.name == 'needs-documentation' }}
    runs-on: ubuntu-latest
    name: Create Documentation Issue
    steps:
      - name: GitHub App token
        id: github_app_token
        uses: tibdex/github-app-token@v2.1.0
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
          installation_id: 22958780

      - name: Checkout code
        uses: actions/checkout@v4

      - name: Edit the issue template
        run: |
          echo "https://github.com/opensearch-project/OpenSearch/pull/${{ env.PR_NUMBER }}." >> ./ci/documentation/issue.md

      - name: Create Issue From File
        id: create-issue
        uses: peter-evans/create-issue-from-file@v5
        with:
          title: Add documentation related to new feature
          content-filepath: ./ci/documentation/issue.md
          labels: documentation
          repository: opensearch-project/documentation-website
          token: ${{ steps.github_app_token.outputs.token }}

      - name: Print Issue
        run: echo Created related documentation issue ${{ steps.create-issue.outputs.issue-number }}


Developer Certificate of Origin Check

name: Developer Certificate of Origin Check

on: [pull_request]

jobs:
  dco-check:
    runs-on: ubuntu-latest

    steps:
    - name: Get PR Commits
      id: 'get-pr-commits'
      uses: tim-actions/get-pr-commits@v1.3.1
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
    - name: DCO Check
      uses: tim-actions/dco@v1.1.0
      with:
        commits: ${{ steps.get-pr-commits.outputs.commits }}


name: Delete merged branch of the backport PRs
on:
  pull_request:
    types:
      - closed

jobs:
  delete-branch:
    runs-on: ubuntu-latest
    if: startsWith(github.event.pull_request.head.ref,'backport/')
    steps:
      - name: Delete merged branch
        uses: SvanBoxel/delete-merged-branch@main
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}


Dependabot PR actions

name: Dependabot PR actions
on: pull_request

jobs:
  dependabot:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: write
    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
    steps:
      - name: GitHub App token
        id: github_app_token
        uses: tibdex/github-app-token@v2.1.0
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
          installation_id: 22958780

      - name: Check out code
        uses: actions/checkout@v4
        with:
          token: ${{ steps.github_app_token.outputs.token }}

      - name: Update Gradle SHAs
        run: |
          ./gradlew updateSHAs

      - name: Commit the changes
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Updating SHAs
          branch: ${{ github.head_ref }}
          commit_user_name: dependabot[bot]
          commit_user_email: support@github.com
          commit_options: '--signoff'

      - name: Run spotless
        run: |
          ./gradlew spotlessApply

      - name: Commit the changes
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: Spotless formatting
          branch: ${{ github.head_ref }}
          commit_user_name: dependabot[bot]
          commit_user_email: support@github.com
          commit_options: '--signoff'

      - name: Update the changelog
        uses: dangoslen/dependabot-changelog-helper@v3
        with:
          version: 'Unreleased 2.x'

      - name: Commit the changes
        uses: stefanzweifel/git-auto-commit-action@v5
        with:
          commit_message: "Update changelog"
          branch: ${{ github.head_ref }}
          commit_user_name: dependabot[bot]
          commit_user_email: support@github.com
          commit_options: '--signoff'


Detect Breaking Changes

name: "Detect Breaking Changes"
on:
  pull_request:
    branches-ignore:
      - main # This branch represents a to-be-released version of OpenSearch where breaking changes are allowed

jobs:
  detect-breaking-change:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-java@v4
      with:
        distribution: temurin # Temurin is a distribution of adoptium
        java-version: 21
    - uses: gradle/gradle-build-action@v3
      with:
        cache-disabled: true
        arguments: japicmp
        gradle-version: 8.7
        build-root-directory: server
    - if: failure()
      run: cat server/build/reports/java-compatibility/report.txt
    - if: failure()
      uses: actions/upload-artifact@v4
      with:
        name: java-compatibility-report.html
        path: ${{ github.workspace }}/server/build/reports/java-compatibility/report.html


Gradle Check (Jenkins)

name: Gradle Check (Jenkins)
on:
  push:
    branches-ignore:
      - 'backport/**'
      - 'create-pull-request/**'
      - 'dependabot/**'
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  contents: read # to fetch code (actions/checkout)

jobs:
  check-files:
    runs-on: ubuntu-latest
    outputs:
      RUN_GRADLE_CHECK: ${{ steps.changed-files-specific.outputs.any_changed }}
    steps:
    - uses: actions/checkout@v4
    - name: Get changed files
      id: changed-files-specific
      uses: tj-actions/changed-files@v44
      with:
        files_ignore: |
          release-notes/*.md
          .github/**
          *.md

  gradle-check:
    needs: check-files
    if: github.repository == 'opensearch-project/OpenSearch' && needs.check-files.outputs.RUN_GRADLE_CHECK == 'true'
    permissions:
      contents: read # to fetch code (actions/checkout)
      pull-requests: write # to create or update comment (peter-evans/create-or-update-comment)
      issues: write # To create an issue if check fails on push.
    runs-on: ubuntu-latest
    timeout-minutes: 130
    steps:
      - name: Checkout OpenSearch repo
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Setup environment variables (PR)
        if: github.event_name == 'pull_request_target'
        run: |
          echo "event_name=pull_request_target" >> $GITHUB_ENV
          echo "branch_name=$(jq --raw-output .pull_request.base.ref $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "pr_from_sha=$(jq --raw-output .pull_request.head.sha $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "pr_from_clone_url=$(jq --raw-output .pull_request.head.repo.clone_url $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "pr_to_clone_url=$(jq --raw-output .pull_request.base.repo.clone_url $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "pr_title=$(jq --raw-output .pull_request.title $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "pr_number=$(jq --raw-output .pull_request.number $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "pr_owner=$(jq --raw-output .pull_request.user.login $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "pr_or_commit_description=$(jq --ascii-output .pull_request.body $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "post_merge_action=false" >> $GITHUB_ENV

      # to get the PR data that can be used for post merge actions
      - uses: actions/github-script@v7
        if: github.event_name == 'push'
        id: get_pr_data
        with:
          github-token: ${{secrets.GITHUB_TOKEN}}
          script: |
            return (
              await github.rest.repos.listPullRequestsAssociatedWithCommit({
                commit_sha: context.sha,
                owner: context.repo.owner,
                repo: context.repo.repo,
              })
            ).data[0];

      - name: Setup environment variables (Push)
        if: github.event_name == 'push'
        run: |
          repo_url="https://github.com/opensearch-project/OpenSearch"
          ref_id=$(git rev-parse HEAD)
          branch_name=$(git rev-parse --abbrev-ref HEAD)
          echo "branch_name=$branch_name" >> $GITHUB_ENV
          echo "event_name=push" >> $GITHUB_ENV
          echo "pr_from_sha=$ref_id" >> $GITHUB_ENV
          echo "pr_from_clone_url=$repo_url" >> $GITHUB_ENV
          echo "pr_to_clone_url=$repo_url" >> $GITHUB_ENV
          echo "pr_title=Push trigger $branch_name $ref_id $repo_url" >> $GITHUB_ENV
          echo "pr_owner=$(jq --raw-output '.commits[0].author.username' $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo 'pr_number=${{ fromJson(steps.get_pr_data.outputs.result).number }}' >> $GITHUB_ENV
          echo "pr_or_commit_description=$(jq --ascii-output .head_commit.message $GITHUB_EVENT_PATH)" >> $GITHUB_ENV
          echo "post_merge_action=true" >> $GITHUB_ENV

      - name: Checkout opensearch-build repo
        uses: actions/checkout@v4
        with:
          repository: opensearch-project/opensearch-build
          ref: main
          path: opensearch-build

      - name: Trigger jenkins workflow to run gradle check
        run: |
          set -e
          set -o pipefail
          bash opensearch-build/scripts/gradle/gradle-check.sh ${{ secrets.JENKINS_GRADLE_CHECK_GENERIC_WEBHOOK_TOKEN }} | tee -a gradle-check.log

      - name: Setup Result Status
        if: always()
        run: |
          WORKFLOW_URL=`cat gradle-check.log | grep 'WORKFLOW_URL' | awk '{print $2}'`
          RESULT=`cat gradle-check.log | grep 'Result:' | awk '{print $2}'`
          echo "workflow_url=$WORKFLOW_URL" >> $GITHUB_ENV
          echo "result=$RESULT" >> $GITHUB_ENV

      - name: Upload Coverage Report
        if: success()
        uses: codecov/codecov-action@v4
        with:
          files: ./codeCoverage.xml

      - name: Create Comment Success
        if: ${{ github.event_name == 'pull_request_target' && success() && env.result == 'SUCCESS' }}
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ env.pr_number }}
          body: |
            :white_check_mark: Gradle check result for ${{ env.pr_from_sha }}: [${{ env.result }}](${{ env.workflow_url }})

      - name: Extract Test Failure
        if: ${{ github.event_name == 'pull_request_target' && env.result != 'SUCCESS' }}
        run: |
          TEST_FAILURES=`curl -s "${{ env.workflow_url }}/testReport/api/json?tree=suites\[cases\[status,className,name\]\]" | jq -r '.. | objects | select(.status=="FAILED",.status=="REGRESSION") | (.className + "." +  .name)' | uniq -c | sort -n -r | head -n 10`
          if [[ "$TEST_FAILURES" != "" ]]
          then
            echo "test_failures<<EOF" >> $GITHUB_ENV
            echo "" >> $GITHUB_ENV
            echo "* **TEST FAILURES:**" >> $GITHUB_ENV
            echo '```' >> $GITHUB_ENV
            echo "$TEST_FAILURES" >> $GITHUB_ENV
            echo '```' >> $GITHUB_ENV
            echo "EOF" >> $GITHUB_ENV
          fi

      - name: Create Comment Flaky
        if: ${{ github.event_name == 'pull_request_target' && success() && env.result != 'SUCCESS' }}
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ env.pr_number }}
          body: |
            :grey_exclamation: Gradle check result for ${{ env.pr_from_sha }}: [${{ env.result }}](${{ env.workflow_url }}) ${{ env.test_failures }}

            Please review all [flaky tests](https://github.com/opensearch-project/OpenSearch/blob/main/DEVELOPER_GUIDE.md#flaky-tests) that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

      - name: Create Comment Failure
        if: ${{ github.event_name == 'pull_request_target' && failure() }}
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ env.pr_number }}
          body: |
            :x: Gradle check result for ${{ env.pr_from_sha }}: [${{ env.result }}](${{ env.workflow_url }})

            Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure [a flaky test](https://github.com/opensearch-project/OpenSearch/blob/main/DEVELOPER_GUIDE.md#flaky-tests) unrelated to your change?

  check-result:
    needs: [check-files, gradle-check]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Fail if gradle-check fails
        if: ${{ needs.check-files.outputs.RUN_GRADLE_CHECK && needs.gradle-check.result == 'failure' }}
        run: exit 1


Link Checker

name: Link Checker
on:
  schedule:
    - cron:  '0 0 * * *'
permissions:
  contents: read # to fetch code (actions/checkout)
jobs:
  linkchecker:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
      - name: lychee Link Checker
        id: lychee
        uses: lycheeverse/lychee-action@v1.10.0
        with:
          args: --accept=200,403,429 --exclude-mail **/*.html **/*.md **/*.txt **/*.json --exclude-file .lychee.excludes
          fail: true
        env:
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}


OpenSearch Lucene snapshots

# This workflow will check out, build, and publish snapshots of lucene.

name: OpenSearch Lucene snapshots

on:
  workflow_dispatch:
    # Inputs the workflow accepts.
    inputs:
      ref:
        description: 'Lucene ref in github.com/apache/lucene'
        type: string
        required: false
        default: 'main'

jobs:
  publish-snapshots:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest
    # These permissions are needed to interact with GitHub's OIDC Token endpoint.
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout Lucene ref:${{ github.event.inputs.ref }}
        uses: actions/checkout@v4
        with:
          repository: 'apache/lucene'
          ref: ${{ github.event.inputs.ref }}

      - name: Get Java Min Version and Lucene Revision from Lucene Repository
        run: |
          java_version=`cat build.gradle | grep minJavaVersion | head -1 | grep -Eo '_[0-9]+$' | tr -d '_'`
          echo "JAVA_VERSION=$java_version" >> $GITHUB_ENV
          echo "REVISION=$(git rev-parse --short HEAD)" >> $GITHUB_ENV

      - name: Setup JDK ${{ env.JAVA_VERSION }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ env.JAVA_VERSION }}
          distribution: 'temurin'

      - name: Initialize gradle settings
        run: ./gradlew localSettings

      - name: Publish Lucene to local maven repo.
        run: ./gradlew publishJarsPublicationToMavenLocal -Pversion.suffix=snapshot-${{ env.REVISION }}

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.LUCENE_SNAPSHOTS_SECRET_ROLE }}
          aws-region: us-east-1

      - name: Get S3 Bucket
        id: get_s3_bucket
        run: |
          lucene_snapshots_bucket=`aws secretsmanager get-secret-value --secret-id jenkins-artifact-bucket-name --query SecretString --output text`
          echo "::add-mask::$lucene_snapshots_bucket"
          echo "LUCENE_SNAPSHOTS_BUCKET=$lucene_snapshots_bucket" >> $GITHUB_OUTPUT

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.LUCENE_SNAPSHOTS_S3_ROLE }}
          aws-region: us-east-1

      - name: Copy files to S3 with the aws CLI (New)
        run: |
          aws s3 cp ~/.m2/repository/org/apache/lucene/ s3://${{ steps.get_s3_bucket.outputs.LUCENE_SNAPSHOTS_BUCKET }}/snapshots/lucene/org/apache/lucene/  --recursive --no-progress

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.LUCENE_SNAPSHOTS_ROLE }}
          aws-region: us-west-2

        # We will remove this step once all the lucene snapshots old links are updated with the new one
      - name: Copy files to S3 with the aws CLI (Old)
        run: |
          aws s3 cp ~/.m2/repository/org/apache/lucene/ s3://${{ secrets.LUCENE_SNAPSHOTS_BUCKET }}/snapshots/lucene/org/apache/lucene/  --recursive --no-progress


Maintainers approval

name: Maintainers approval

on:
  pull_request_review:

jobs:
  maintainer-approved-check:
    name: Minimum approval count
    runs-on: ubuntu-latest
    steps:
      - id: find-maintainers
        uses: actions/github-script@v7.0.1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          result-encoding: string
          script: |
            // Get the collaborators - filtered to maintainer permissions
            const maintainersResponse = await github.request('GET /repos/{owner}/{repo}/collaborators', {
                owner: context.repo.owner,
                repo: context.repo.repo,
                permission: 'maintain',
                affiliation: 'all',
                per_page: 100
            });

            return maintainersResponse.data.map(item => item.login).join(', ');

      - uses: peternied/required-approval@v1.3
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          min-required: 1
          required-approvers-list: ${{ steps.find-maintainers.outputs.result }}


Add comment

name: Add comment
on:
  issues:
    types:
      - labeled
jobs:
  add-comment:
    if: github.event.label.name == 'poc'
    runs-on: ubuntu-latest
    permissions:
      issues: write
    steps:
      - name: Add comment
        uses: peter-evans/create-or-update-comment@v4
        with:
          issue-number: ${{ github.event.issue.number }}
          body: |
            ### POC Checklist:

            Please go through the following checklist to ensure these items are taken into account while designing the POC.

            - [ ] Supports safe upgrade paths from all supported BWC versions to the current version
            - [ ] Supports compatibility with all plugins
                - [ ] opensearch-alerting
                - [ ] opensearch-anomaly-detection
                - [ ] opensearch-asynchronous-search
                - [ ] opensearch-cross-cluster-replication
                - [ ] opensearch-geospatial
                - [ ] opensearch-index-management
                - [ ] opensearch-job-scheduler
                - [ ] opensearch-knn
                - [ ] opensearch-ml
                - [ ] opensearch-notifications
                - [ ] opensearch-notifications-core
                - [ ] opensearch-observability
                - [ ] opensearch-performance-analyzer
                - [ ] opensearch-reports-scheduler
                - [ ] opensearch-security
                - [ ] opensearch-sql
            - [ ] Supports lucene upgrades across minor lucene versions
            - [ ] Supports lucene upgrades across major lucene versions
            - [ ] Supports lucene upgrades across underlying lucene codec bumps (Eg: Lucene95Codec -> Lucene96Codec)
            - [ ] Supports wire compatibility of OpenSearch
            - [ ] Plan to measure performance degradation/improvement (if any)
            - [ ] Plan to document any user facing changes introduced by this feature
            - [ ] Ensure working and passing CI

            Thank you for your contribution!


Gradle Precommit

name: Gradle Precommit
on: [pull_request]

jobs:
  precommit:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        java: [ 11, 17, 21 ]
        os: [ubuntu-latest, windows-latest, macos-13]
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK ${{ matrix.java }}
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java }}
          distribution: temurin
          cache: gradle
      - name: Run Gradle (precommit)
        run: |
          ./gradlew javadoc precommit --parallel


Publish snapshots to maven

name: Publish snapshots to maven

on:
  workflow_dispatch:
  push:
      branches:
        - main
        - '[0-9]+.[0-9]+'
        - '[0-9]+.x'

jobs:
  build-and-publish-snapshots:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest

    permissions:
      id-token: write
      contents: write

    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: adopt
          java-version: 17

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.PUBLISH_SNAPSHOTS_ROLE }}
          aws-region: us-east-1

      - name: Publish snapshots to maven
        run: |
          export SONATYPE_USERNAME=$(aws secretsmanager get-secret-value --secret-id maven-snapshots-username --query SecretString --output text)
          export SONATYPE_PASSWORD=$(aws secretsmanager get-secret-value --secret-id maven-snapshots-password --query SecretString --output text)
          echo "::add-mask::$SONATYPE_USERNAME"
          echo "::add-mask::$SONATYPE_PASSWORD"
          ./gradlew publishNebulaPublicationToSnapshotsRepository


Label Stalled PRs

name: Label Stalled PRs
on:
  schedule:
    - cron: '15 15 * * *' # Run every day at 15:15 UTC / 7:15 PST / 8:15 PDT
permissions:
  pull-requests: write
jobs:
  stale:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest
    steps:
      - name: GitHub App token
        id: github_app_token
        uses: tibdex/github-app-token@v2.1.0
        with:
          app_id: ${{ secrets.APP_ID }}
          private_key: ${{ secrets.APP_PRIVATE_KEY }}
          installation_id: 22958780
      - name: Stale PRs
        uses: actions/stale@v9
        with:
          repo-token: ${{ steps.github_app_token.outputs.token }}
          stale-pr-label: 'stalled'
          stale-pr-message: 'This PR is stalled because it has been open for 30 days with no activity.'
          days-before-pr-stale: 30
          days-before-issue-stale: -1
          days-before-pr-close: -1
          days-before-issue-close: -1


name: Auto triage based on the component label in issue

on:
  issues:
    types: [opened, reopened, transferred]

jobs:
  apply-label:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v7.0.1
        with:
          script: |
            const { issue, repository } = context.payload;
            const { number, body } = issue;
            const { owner, name } = repository;
            const regex = /###\sRelated\scomponent\n\n(\w.*)\n/gm;
            let match;
            while ( ( match = regex.exec( body ) ) ) {
              const [ , component_label ] = match;
              await github.rest.issues.addLabels( {
                owner: owner.login,
                repo: name,
                issue_number: number,
                labels: [ `${ component_label }` ],
              } );
            }
            github.rest.issues.addLabels({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ['untriaged']
            })


Increment Version

name: Increment Version

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'the tag'
        required: true
        type: string
  push:
    tags:
      - '*.*.*'

permissions:
  contents: write
  issues: write
  pull-requests: write

jobs:
  build:
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest
    steps:
      - name: Fetch tag and version information
        run: |
          TAG=$(echo "${GITHUB_REF#refs/*/}")
          if [ -n ${{ github.event.inputs.tag }} ]; then
            TAG=${{ github.event.inputs.tag }}
          fi
          CURRENT_VERSION_ARRAY=($(echo "$TAG" | tr . '\n'))
          BASE=$(IFS=. ; echo "${CURRENT_VERSION_ARRAY[*]:0:2}")
          BASE_X=$(IFS=. ; echo "${CURRENT_VERSION_ARRAY[*]:0:1}.x")
          CURRENT_VERSION=$(IFS=. ; echo "${CURRENT_VERSION_ARRAY[*]:0:3}")
          CURRENT_VERSION_UNDERSCORE=$(IFS=_ ; echo "V_${CURRENT_VERSION_ARRAY[*]:0:3}")
          CURRENT_VERSION_ARRAY[2]=$((CURRENT_VERSION_ARRAY[2]+1))
          NEXT_VERSION=$(IFS=. ; echo "${CURRENT_VERSION_ARRAY[*]:0:3}")
          NEXT_VERSION_UNDERSCORE=$(IFS=_ ; echo "V_${CURRENT_VERSION_ARRAY[*]:0:3}")
          if [[ ${#CURRENT_VERSION_ARRAY[2]} -gt 1 ]]; then
            NEXT_VERSION_ID="${CURRENT_VERSION_ARRAY[0]:0:3}0${CURRENT_VERSION_ARRAY[1]:0:3}${CURRENT_VERSION_ARRAY[2]:0:3}99"
          else
            NEXT_VERSION_ID=$(IFS=0 ; echo "${CURRENT_VERSION_ARRAY[*]:0:3}99")
          fi
          echo "TAG=$TAG" >> $GITHUB_ENV
          echo "BASE=$BASE" >> $GITHUB_ENV
          echo "BASE_X=$BASE_X" >> $GITHUB_ENV
          echo "CURRENT_VERSION=$CURRENT_VERSION" >> $GITHUB_ENV
          echo "CURRENT_VERSION_UNDERSCORE=$CURRENT_VERSION_UNDERSCORE" >> $GITHUB_ENV
          echo "NEXT_VERSION=$NEXT_VERSION" >> $GITHUB_ENV
          echo "NEXT_VERSION_UNDERSCORE=$NEXT_VERSION_UNDERSCORE" >> $GITHUB_ENV
          echo "NEXT_VERSION_ID=$NEXT_VERSION_ID" >> $GITHUB_ENV

      - uses: actions/checkout@v4
        with:
          ref: ${{ env.BASE }}

      - name: Increment Patch Version on Major.Minor branch
        uses: peternied/opensearch-core-version-updater@v1
        with:
          previous-version: ${{ env.CURRENT_VERSION }}
          new-version: ${{ env.NEXT_VERSION }}
          update-current: true

      - name: Create PR for BASE
        id: base_pr
        uses: peter-evans/create-pull-request@v6
        with:
          base: ${{ env.BASE }}
          branch: 'create-pull-request/patch-${{ env.BASE }}'
          commit-message: Increment version to ${{ env.NEXT_VERSION }}
          signoff: true
          delete-branch: true
          labels: |
            autocut
          title: '[AUTO] Increment version to ${{ env.NEXT_VERSION }}.'
          body: |
            I've noticed that a new tag ${{ env.TAG }} was pushed, and incremented the version from ${{ env.CURRENT_VERSION }} to ${{ env.NEXT_VERSION }}.

      - uses: actions/checkout@v4
        with:
          ref: ${{ env.BASE_X }}

      - name: Add Patch Version on Major.X branch
        uses: peternied/opensearch-core-version-updater@v1
        with:
          previous-version: ${{ env.CURRENT_VERSION }}
          new-version: ${{ env.NEXT_VERSION }}
          update-current: false

      - name: Create PR for BASE_X
        id: base_x_pr
        uses: peter-evans/create-pull-request@v6
        with:
          base: ${{ env.BASE_X }}
          branch: 'create-pull-request/patch-${{ env.BASE_X }}'
          commit-message: Add bwc version ${{ env.NEXT_VERSION }}
          signoff: true
          delete-branch: true
          labels: |
            autocut
          title: '[AUTO] [${{ env.BASE_X }}] Add bwc version ${{ env.NEXT_VERSION }}.'
          body: |
            I've noticed that a new tag ${{ env.TAG }} was pushed, and added a bwc version ${{ env.NEXT_VERSION }}.

      - uses: actions/checkout@v4
        with:
          ref: main

      - name: Add Patch Version on main branch
        uses: peternied/opensearch-core-version-updater@v1
        with:
          previous-version: ${{ env.CURRENT_VERSION }}
          new-version: ${{ env.NEXT_VERSION }}
          update-current: false

      - name: Create PR for main
        id: main_pr
        uses: peter-evans/create-pull-request@v6
        with:
          base: main
          branch: 'create-pull-request/patch-main'
          commit-message: Add bwc version ${{ env.NEXT_VERSION }}
          signoff: true
          delete-branch: true
          labels: |
            autocut
          title: '[AUTO] [main] Add bwc version ${{ env.NEXT_VERSION }}.'
          body: |
            I've noticed that a new tag ${{ env.TAG }} was pushed, and added a bwc version ${{ env.NEXT_VERSION }}.

      - name: Create tracking issue
        id: create-issue
        uses: actions/github-script@v7.0.1
        with:
          script: |
            const body = `
             ### Description
             A new version of OpenSearch was released, to prepare for the next release new version numbers need to be updated in all active branches of development.

             ### Exit Criteria
             Review and merged the following pull requests
             - [ ] ${{ steps.base_pr.outputs.pull-request-url }}
             - [ ] ${{ steps.base_x_pr.outputs.pull-request-url }}
             - [ ] ${{ steps.main_pr.outputs.pull-request-url }}

             ### Additional Context
             See project wide guidance on branching and versions [[link]](https://github.com/opensearch-project/.github/blob/main/RELEASING.md).
            `
            const { data: issue }= await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              labels: ["Build"],
              title: "Increment version for ${{ env.NEXT_VERSION }}",
              body: body
            });
            console.error(JSON.stringify(issue));
            return issue.number;
          result-encoding: string


Validate Gradle Wrapper

name: Validate Gradle Wrapper
on: [pull_request]

jobs:
  validate:
    name: Validate
    if: github.repository == 'opensearch-project/OpenSearch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: gradle/wrapper-validation-action@v3


Continuous Android

name: Continuous Android

on:
  schedule:
    - cron: '0 8 * * *'
  pull_request:
    paths:
      - "android/**"

jobs:
  build:
    if: github.repository == 'deepjavalibrary/djl'
    runs-on: ubuntu-latest
    strategy:
      matrix:
        api-level: [ 26 ]
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'corretto'
          java-version: 17
      - name: Gradle cache
        uses: gradle/gradle-build-action@v2
      - name: run tests
        uses: reactivecircus/android-emulator-runner@v2
        with:
          api-level: ${{ matrix.api-level }}
          force-avd-creation: false
          emulator-options: -no-snapshot-save -no-window -gpu swiftshader_indirect -noaudio -no-boot-anim -camera-back none
          disable-animations: true
          script: cd android/core && ./gradlew cAT


Docs

name: Docs

on:
  pull_request:
    paths:
      - "docs/mkdocs.yml"
  # Publish docs weekly
  schedule:
    - cron:  '0 9 * * 1'
  workflow_dispatch:

jobs:
  documentation:
    if: github.repository == 'deepjavalibrary/djl'
    runs-on: ubuntu-latest
    steps:
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'corretto'
          java-version: 17
      - name: Set up Python3
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'
      - name: Install CN fonts
        run: sudo apt-get update && sudo apt-get install fonts-arphic-uming
      - name: install Python Dependencies
        run: pip3 install nbconvert mkdocs==1.4.3 mkdocs-exclude mknotebooks mkdocs-material jupyter Pygments Markdown
      - name: Install IJava kernel
        run: |
          git clone https://github.com/frankfliu/IJava.git
          cd IJava/
          ./gradlew installKernel
      - name: checkout repo
        uses: actions/checkout@v4
      - name: add mybinder link
        run: |
          python3 tools/scripts/add_online_runner.py
      - name: clone demos
        run: |
          cd docs
          git clone https://github.com/deepjavalibrary/djl-demo.git demos
      - name: clone serving
        run: |
          cd docs
          git clone https://github.com/deepjavalibrary/djl-serving.git serving
      - name: run Notebooks
        run: |
          cd docs/demos/jupyter
          bash test_notebook.sh
      - name: build docs
        run: |
          cd docs
          export DJL_DISABLE_PROGRESS_BAR=true
          mkdocs build --site-dir ../../site
      - name: Configure AWS Credentials
        if: github.event_name != 'pull_request'
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-2
      - name: Copy files to S3 with the AWS CLI
        if: github.event_name != 'pull_request'
        run: |
          aws s3 sync ../site s3://djl-ai/documentation/nightly --delete
          aws cloudfront create-invalidation --distribution-id E733IIDCG0G5U --paths "/*"


Continuous

name: Continuous

on:
  pull_request:
    paths-ignore:
      - "**.md"
      - "**.ipynb"
      - "**.json"
      - "**.html"
      - "**.js"
      - "**.css"
      - "android/**"
  push:
    paths-ignore:
      - "**.md"
      - "**.ipynb"
      - "**.json"
      - "**.html"
      - "**.js"
      - "**.css"
      - "android/**"

jobs:
  build:
    if: github.repository == 'deepjavalibrary/djl'
    runs-on: ${{ matrix.operating-system }}
    strategy:
      matrix:
        operating-system: [ ubuntu-latest, macos-latest ]

    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'corretto'
          java-version: 17
      # Enable gradle cache: https://github.com/actions/cache/blob/master/examples.md#java---gradle
      - uses: actions/cache@v4
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('*/build.gradle.kts', 'engines/**/build.gradle.kts', 'extensions/**/build.gradle.kts') }}
          restore-keys: |
            ${{ runner.os }}-gradle-
      - name: check disk space
        run: df -h
      - uses: dorny/paths-filter@v2
        id: sentencepiece_changes
        with:
          filters: |
            src:
              - 'extensions/sentencepiece/**'
      - name: install libomp on macos
        if: ${{ runner.os == 'macOS' }}
        run: brew install libomp
      - name: Compile Sentencepiece JNI
        if: steps.sentencepiece_changes.outputs.src == 'true'
        run: ./gradlew :extensions:sentencepiece:compileJNI
      - uses: dorny/paths-filter@v2
        id: fasttext_changes
        with:
          filters: |
            src:
              - 'extensions/fasttext/**'
      - name: Compile fastText JNI
        if: steps.fasttext_changes.outputs.src == 'true'
        run: ./gradlew :extensions:fasttext:compileJNI
      - uses: dorny/paths-filter@v2
        id: tokenizers_changes
        with:
          filters: |
            src:
              - 'extensions/tokenizers/**'
      - name: Compile tokenizers JNI
        if: steps.tokenizers_changes.outputs.src == 'true'
        run: ./gradlew :extensions:tokenizers:compileJNI
      - uses: dorny/paths-filter@v2
        id: pytorch_changes
        with:
          filters: |
            src:
              - 'engines/pytorch/pytorch-native/**'
      - name: Compile PyTorch JNI
        if: steps.pytorch_changes.outputs.src == 'true'
        run: ./gradlew :engines:pytorch:pytorch-native:compileJNI
      - name: Test ONNX Runtime
        run: |
          ./gradlew -Dai.djl.default_engine=OnnxRuntime :integration:clean :integration:test --stacktrace
      - name: Build with Gradle
        run: ./gradlew clean build :jacoco:testCodeCoverageReport --stacktrace
      - name: Upload test results
        uses: actions/upload-artifact@v3
        if: always()
        with:
          name: reports-${{ matrix.operating-system }}
          path: |
            ${{ github.workspace }}/**/build/reports/**/*
            !${{ github.workspace }}/**/build/reports/jacoco/*
      - name: upload to codecov
        uses: codecov/codecov-action@v3
        with:
          files: ./jacoco/build/reports/jacoco/testCodeCoverageReport/testCodeCoverageReport.xml
          fail_ci_if_error: false
          path_to_write_report: ./codecov_report.txt

  # Windows platform for testing hybrid engines
  build-windows:
    if: github.repository == 'deepjavalibrary/djl'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'corretto'
          java-version: 17
      # Enable gradle cache: https://github.com/actions/cache/blob/master/examples.md#java---gradle
      - uses: actions/cache@v4
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ hashFiles('*/build.gradle.kts', 'engines/**/build.gradle.kts', 'extensions/**/build.gradle.kts') }}
          restore-keys: |
            ${{ runner.os }}-gradle-
      - uses: dorny/paths-filter@v2
        id: sentencepiece_changes
        with:
          filters: |
            src:
              - 'extensions/sentencepiece/**'
      - name: Compile Sentencepiece JNI
        if: steps.sentencepiece_changes.outputs.src == 'true'
        run: ./gradlew :extensions:sentencepiece:compileJNI
      - uses: dorny/paths-filter@v2
        id: pytorch_changes
        with:
          filters: |
            src:
              - 'engines/pytorch/pytorch-native/**'
      - name: Compile PyTorch JNI
        if: steps.pytorch_changes.outputs.src == 'true'
        run: ./gradlew :engines:pytorch:pytorch-native:compileJNI
      - uses: dorny/paths-filter@v2
        id: tokenizers_changes
        with:
          filters: |
            src:
              - 'extensions/tokenizers/**'
      - name: Compile tokenizers JNI
        if: steps.tokenizers_changes.outputs.src == 'true'
        run: ./gradlew :extensions:tokenizers:compileJNI
      - name: Integration tests
        # MXNet integration test on Github Action fail due to memory limitation on Windows
        run: |
          ./gradlew -Pjni "-Dai.djl.default_engine=PyTorch" test -x examples:test
          ./gradlew -Pjni --rerun-tasks "-Dai.djl.default_engine=TensorFlow" test -x examples:test
          ./gradlew --rerun-tasks "-Dai.djl.default_engine=OnnxRuntime" :integration:test


Native Build MXNet OSX

name: Native Build MXNet OSX

on:
  workflow_dispatch:

jobs:
  build:
    runs-on: macos-13

    steps:
      - name: Checkout Apache MXNet repository
        uses: actions/checkout@v4
        with:
          repository: apache/incubator-mxnet
          ref: 1.9.1
          submodules: 'recursive'
      - name: Install Dependencies
        run: |
          brew install nasm automake ninja libtool
      - name: Build
        run: |
          git --version
          clang --version
          CMAKE_STATICBUILD=1 ./tools/staticbuild/build.sh cpu
      - name: Upload libmxnet.dylib
        uses: actions/upload-artifact@v3
        with:
          name: libmxnet.dylib
          path: build/libmxnet.dylib