pulumiverse / infra

IaC for all infrastructure required by Pulumiverse

Please go to the .github repository for more.

infra's Issues

Import pulumi-scaleway in the setup

The Scaleway provider has been transferred manually from @jaxxstorm via me to the Pulumiverse organization:

https://github.com/pulumiverse/pulumi-scaleway

We need to import this repo to the Pulumi managed setup here.

Ability to publish Java SDKs

We should investigate what is needed to publish the Java SDKs of all the providers under the Pulumiverse umbrella.

Import `terraform-provider-pulumi` to the coded setup

A while back, @dmattia contributed this Terraform provider:

https://github.com/pulumiverse/terraform-provider-pulumi

We haven't adopted this Github repository yet in our Pulumi code managed setup. Also, the membership of @dmattia to the organization and his access to this contribution should still be added to our setup here.

Declaratively set forwarding rules on ImprovMX

The email service of Pulumiverse.com is managed by ImprovMX, a free e-mail forwarding service. The email account which manages our service is [email protected] which is an alias (alias is currently to my email, [email protected]).

There are open questions at the moment, at least for me:

• Should we declare the forwarding rules as infrastructure as code? Hint: I've found a Terraform-provider.

Add Github-setup

We probably want to add contributors, set owners and access permissions for the Pulumiverse organization.

Add `permissions` to workflows and repositories

By the way, permissions should probably be added. Newer repositories require that by default; we should consider requiring it for all our repositories/workflows.

Originally posted by @simenandre in #67 (comment)

Specify default versions for shared workflows

In ba26100 there was a change to make the language versions configurable, which is very nice.

But this breaks the pipeline in https://github.com/pulumiverse/pulumi-heroku/actions/runs/3497205846, because the versions are not specified and they are required.

So my questions is:
Should we define default values in cases they are not specified?

@ringods

Add automation to keep the provider build workflows up to date

How a provider needs to be build, packaged and released is mainly defined by Pulumi. They also have a lot of automation for keeping the Github Actions workflows up to date in all of the provider repositories.

We could benefit from having an automated setup serving two purposes:

• initial setup of the workflows for new providers being set up in Pulumiverse
• updating the workflows to support new features coming from Pulumi (e.g recent addition was support for Java)

Pulumi is aware that building & releasing a provider must become must simpler. There is planned work to make the pulumi/ci-mgmt a consumable artefact. This artefact, with the proper configuration, would be able to generate the correct workflows for a provider repository.

Let's follow up on that work, test it, provide feedback (issues & PR), so we can build on top of that effort.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update dependency @types/node to v18.19.41
• fix(deps): update dependency @pulumi/pulumi to v3.125.0
• chore(deps): update dependency typescript to v5
• Click on this checkbox to rebase all open PRs at once

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• fix(deps): update dependency @pulumi/github to v6.2.3
• chore(deps): update pulumi/actions action to v5.3.3
• chore(deps): update node.js to v20 (node, @types/node)

Detected dependencies

github-actions

.github/workflows/auto-issue-assignment.yaml

• pozil/auto-assign-issue v1

.github/workflows/auto-pr-assignment.yaml

• pozil/auto-assign-issue v1

.github/workflows/provider-build-sdk.yaml

• actions/checkout v4
• actions/checkout v4
• actions/setup-go v5
• jaxxstorm/action-install-gh-release v1.12.0
• pulumi/actions v5
• actions/setup-node v4
• actions/setup-dotnet v4
• actions/setup-python v5
• actions/download-artifact v4
• actions/upload-artifact v4

.github/workflows/provider-prerequisites.yaml

• actions/checkout v4
• actions/checkout v4
• actions/setup-go v5
• jaxxstorm/action-install-gh-release v1.12.0
• pulumi/actions v5
• jaxxstorm/action-install-gh-release v1.12.0
• thollander/actions-comment-pull-request v2
• actions/upload-artifact v4

.github/workflows/pull-request.yml

• actions/checkout v4
• actions/checkout v4
• volta-cli/action v4
• pulumi/actions v5.2.4

.github/workflows/push.yml

• actions/checkout v4
• volta-cli/action v4
• pulumi/actions v5.2.4

npm

package.json

• @pulumi/github ^6.0.0
• @pulumi/pulumi ^3.13.2
• runtypes ^6.5.1
• yaml ^2.1.1
• @bjerk/eslint-config ^6.0.0
• @simenandre/prettier ^5.0.0
• @tsconfig/node16 ^16.0.0
• @types/node ^18.0.0
• typescript ^4.7.3
• node >=18
• node 18.20.4

---

• Check this box to trigger a request for Renovate to run again on this repository

Replace credentials with a new set owned by a new admin

Before dropping my admin permissions for pulumiverse, please rotate the Github Actions secrets in this provider with a new set belonging to a new admin.

https://github.com/pulumiverse/infra/settings/secrets/actions

pulumi-fortios doesn't have code repository setup, or my permissions are wrong

When the pulumi-fortios provider repo was created, it seems I either don't have enough permissions, or it was not fully initialized.

> git push pulumiverse
fatal: '[email protected]/pulumiverse/pulumi-fortios.git' does not appear to be a git repository
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Potentially because there wasn't a template setup as well? Fixed via PR #69

Let me know if there's something I'm missing.

Cannot Sign Tags

With pulumiverse/pulumi-doppler, I ran into an issue where the release.yaml workflow was unable to run and it's because I was signing my Git tags.

We should update release.yaml to work with these, or add some documentation that tags can't be signed.

`github/workflows/provider-prerequisites.yaml`'s `Comment on PR with Details of Schema Check` breaks fork based PRs

Looks like the sub-job Comment on PR with Details of Schema Check requires the workflow's github.token to have read and write permissions.

This becomes an issue when a pr is created from a fork, since the token is from the fork and not from the parent repo.

Can we remove this section?

infra/.github/workflows/provider-prerequisites.yaml

Lines 61 to 69 in c467230

	- if: github.event_name == 'pull_request'
	name: Comment on PR with Details of Schema Check
	uses: thollander/actions-comment-pull-request@v2
	with:
	GITHUB_TOKEN: ${{ github.token }}
	message: |
	### Does the PR have any schema changes?
	${{ env.SCHEMA_CHANGES }}

cc: @schmidtw