[internal] Update GitHub Actions workflow files

Author: pulumi-bot

.ci-mgmt.yaml

@@ -6,22 +6,13 @@ shards: 8
 timeout: 150
 generate-nightly-test-workflow: true
 providerVersion: github.com/hashicorp/terraform-provider-aws/version.ProviderVersion
-
 buildProviderPre: "VERSION=${VERSION_GENERIC} ./scripts/minimal_schema.sh"
-
-toolVersions:
-  go: "1.23.x"
-  java: "11"
-  gradle: "7.6"
-  nodejs: "20.x"
-  pulumi: "3.187.0"
-  python: "3.11.8"
 esc:
-  enabled: true
+    enabled: true
 env:
-  PULUMI_MISSING_DOCS_ERROR: true
-  AWS_REGION: "us-west-2"
-  OIDC_ROLE_ARN: ${{ secrets.OIDC_ROLE_ARN }}
+    PULUMI_MISSING_DOCS_ERROR: true
+    AWS_REGION: "us-west-2"
+    OIDC_ROLE_ARN: ${{ secrets.OIDC_ROLE_ARN }}
 makeTemplate: bridged
 checkoutSubmodules: true
 freeDiskSpaceBeforeBuild: true
@@ -31,36 +22,35 @@ freeDiskSpaceBeforeTest: true
 # Tracked in in https://github.com/pulumi/pulumi-aws/issues/2757
 XrunUpstreamTools: true
 plugins:
-  - name: archive
-    version: "0.0.1"
-  - name: tls
-    version: "4.10.0"
-  - name: github
-    version: "4.10.0"
-  - name: kubernetes
-    version: "4.11.0"
-  - name: "null"
-    version: "0.0.3"
-  - name: "local"
-    version: "0.1.0"
-  - name: random
-    version: "4.8.2"
-  - name: github
-    version: "5.14.0"
-  - name: std
-    version: "1.6.2"
-  - name: terraform
-    version: "1.0.17"
-    kind: converter
+    - name: archive
+      version: "0.0.1"
+    - name: tls
+      version: "4.10.0"
+    - name: github
+      version: "4.10.0"
+    - name: kubernetes
+      version: "4.11.0"
+    - name: "null"
+      version: "0.0.3"
+    - name: "local"
+      version: "0.1.0"
+    - name: random
+      version: "4.8.2"
+    - name: github
+      version: "5.14.0"
+    - name: std
+      version: "1.6.2"
+    - name: terraform
+      version: "1.0.17"
+      kind: converter
 # Use `pulumi convert` for translating examples from TF to Pulumi.
 pulumiConvert: 1
 allowMissingDocs: false
 goBuildParallelism: 2
 aws: true
-
 releaseVerification:
-  nodejs: examples/release-verification
-  python: examples/webserver-py
-  dotnet: examples/webserver-cs
-  go: examples/webserver-go
+    nodejs: examples/release-verification
+    python: examples/webserver-py
+    dotnet: examples/webserver-cs
+    go: examples/webserver-go
 autoMergeProviderUpgrades: false

.config/mise.lock

@@ -0,0 +1,39 @@
+[[tools.dotnet]]
+version = "8.0.414"
+backend = "asdf:dotnet"
+
+[[tools."github:pulumi/pulumictl"]]
+version = "0.0.50"
+backend = "github:pulumi/pulumictl"
+
+[tools."github:pulumi/pulumictl".platforms.linux-x64]
+checksum = "blake3:c128dd74993f779c613296fe7cd21c20cbd323f24e59cb76e007620660b60348"
+size = 27744219
+url = "https://github.com/pulumi/pulumictl/releases/download/v0.0.50/pulumictl-v0.0.50-linux-amd64.tar.gz"
+
+[[tools."github:pulumi/schema-tools"]]
+version = "0.6.0"
+backend = "github:pulumi/schema-tools"
+
+[tools."github:pulumi/schema-tools".platforms.linux-x64]
+checksum = "blake3:82dfe616fee18b4258f6e3d2dc3c4e9f14afd43a0a4cc33eff2d2a04088d6ca3"
+size = 14282746
+url = "https://github.com/pulumi/schema-tools/releases/download/v0.6.0/schema-tools-v0.6.0-linux-amd64.tar.gz"
+
+[[tools.go]]
+version = "1.24.6"
+backend = "core:go"
+
+[tools.go.platforms.linux-x64]
+checksum = "sha256:bbca37cc395c974ffa4893ee35819ad23ebb27426df87af92e93a9ec66ef8712"
+size = 78583176
+url = "https://dl.google.com/go/go1.24.6.linux-amd64.tar.gz"
+
+[[tools.golangci-lint]]
+version = "1.64.8"
+backend = "aqua:golangci/golangci-lint"
+
+[tools.golangci-lint.platforms.linux-x64]
+checksum = "sha256:b6270687afb143d019f387c791cd2a6f1cb383be9b3124d241ca11bd3ce2e54e"
+size = 12364828
+url = "https://github.com/golangci/golangci-lint/releases/download/v1.64.8/golangci-lint-1.64.8-linux-amd64.tar.gz"

.config/mise.test.toml

@@ -0,0 +1,7 @@
+# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+
+# Overrides tool versions for test workflows
+
+[tools]
+# always use pulumi latest for tests
+pulumi = "latest"

.config/mise.toml

@@ -0,0 +1,27 @@
+# WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
+# You can create your own root-level mise.toml file to override/augment this. See https://mise.jdx.dev/configuration.html
+
+[env]
+_.source = "{{config_root}}/scripts/get-versions.sh"
+
+[tools]
+
+# Runtimes
+# TODO: we may not need `get_env` once https://github.com/jdx/mise/discussions/6339 is fixed
+go = "{{ get_env(name='GO_VERSION_MISE', default='latest') }}"
+node = '20'
+python = '3.11.8'
+dotnet = '8.0'
+# Corretto version used as Java SE/OpenJDK version no longer offered
+java = 'corretto-11'
+
+# Executable tools
+pulumi = "{{ get_env(name='PULUMI_VERSION_MISE', default='latest') }}"
+"github:pulumi/pulumictl" = 'latest'
+"github:pulumi/schema-tools" = "latest"
+gradle = '7.6'
+golangci-lint = "1.64.8" # See note about about overrides if you need to customize this.
+
+[settings]
+experimental = true # Required for Go binaries (e.g. pulumictl).
+lockfile = true

.github/actions/setup-tools/action.yml

@@ -65,12 +65,13 @@ jobs:
       - uses: MOZGIII/install-ldid-action@v1
         with:
           tag: v2.1.5-procursus2
-      - name: Setup tools
-        uses: ./.github/actions/setup-tools
+      - name: Setup mise
+        uses: jdx/mise-action@v3
         with:
-          tools: pulumictl, go
-          # use per-platform/arch caches instead since we are doing cross-builds
-          cache-go: false
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          cache_key: "mise-{{platform}}-{{file_hash}}"
+          # only saving the cache in the prerequisites job
+          cache_save: false
       # Based on https://github.com/actions/cache/blob/main/examples.md#go---modules
       - name: Get GOCACHE
         id: gocache

.github/workflows/build_provider.yml

@@ -59,15 +59,28 @@ jobs:
         name: Fetch secrets from ESC
         uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
       - name: Cache examples generation
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             .pulumi/examples-cache
           key: ${{ runner.os }}-${{ hashFiles('provider/go.sum') }}
-      - name: Setup tools
-        uses: ./.github/actions/setup-tools
+      - name: Setup mise
+        uses: jdx/mise-action@v3
         with:
-          tools: pulumictl, pulumicli, ${{ matrix.language }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          cache_key: "mise-{{platform}}-{{file_hash}}"
+          # only saving the cache in the prerequisites job
+          cache_save: false
+      - name: Setup Go Cache
+        if: matrix.language == 'go' || contains(matrix.language, 'go')
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
+        with:
+          cache-dependency-path: |
+            provider/*.sum
+            upstream/*.sum
+            sdk/go/*.sum
+            sdk/*.sum
+            *.sum
       - name: Prepare local workspace
         run: make prepare_local_workspace
         env:
@@ -93,46 +106,8 @@ jobs:
             sdk/nodejs/package.json
             sdk/python/pyproject.toml
             sdk/java/build.gradle
-      - name: Commit Java SDK changes for migration to pulumi package gen-sdk
-        if: failure() && steps.worktreeClean.outcome == 'failure' && matrix.language == 'java' && contains(github.actor, 'pulumi-bot') && github.event_name == 'pull_request'
-        shell: bash
-        run: >
-          git diff --quiet -- sdk/java && echo "no changes to sdk/java" && exit
-
-          git config --global user.email "[email protected]"
-
-          git config --global user.name "pulumi-bot"
-
-          # Stash local changes and check out the PR's branch directly.
-
-          git stash
-
-          git fetch
-
-          git checkout "origin/$HEAD_REF"
-
-          # Apply and add our changes, but don't commit any files we expect to
-
-          # always change due to versioning.
-
-          git stash pop
-
-          git add sdk/java
-
-          rm .pulumi-java-gen.version
-
-          git add .pulumi-java-gen.version
-
-          git commit -m "Commit Java changes for pulumi package sdk-gen"
-
-          # Push with pulumi-bot credentials to trigger a re-run of the
-          # workflow. https://github.com/orgs/community/discussions/25702
-
-          git push https://pulumi-bot:${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }}     "HEAD:$HEAD_REF"
-        # head_ref is untrusted so it's recommended to pass via env var to
-        # avoid injections.
-        env:
-          HEAD_REF: ${{ github.head_ref }}
+            **/mise.lock
+            **/mise.*.lock
       - name: Commit ${{ matrix.language }} SDK changes for Renovate
         # If the worktree is dirty and this is a Renovate PR to bump
         # dependencies, commit the updated SDK and push it back to the PR. The

.github/workflows/build_sdk.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Stale issue job
     steps:
-    - uses: aws-actions/stale-issue-cleanup@5650b49bcd757a078f6ca06c373d7807b773f9bc #v7.1.0
+    - uses: aws-actions/stale-issue-cleanup@5650b49bcd757a078f6ca06c373d7807b773f9bc # v7.1.0
       with:
         issue-types: issues # only look at issues (ignore pull-requests)
 

.github/workflows/comment-on-stale-issues.yml

@@ -32,10 +32,13 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Setup tools
-        uses: ./.github/actions/setup-tools
+      - name: Setup mise
+        uses: jdx/mise-action@v3
         with:
-          tools: pulumictl, pulumicli, nodejs, python, dotnet, go, java
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          cache_key: "mise-{{platform}}-{{file_hash}}"
+          # only saving the cache in the prerequisites job
+          cache_save: false
 
       - name: Prepare local workspace
         # this runs install_plugins and upstream