sync terraform provider v1.83.24

.github/workflows/auto-pull-request-by-release.yml

@@ -3,6 +3,20 @@ name: Auto Pull Request By Release
 on:
   repository_dispatch:
     types: [ webhook ]
+  workflow_dispatch: # allow manual trigger for testing
+
+# Required for pushing the sync branch and creating the PR with the
+# built-in GITHUB_TOKEN (default token permissions are read-only).
+# Note: pushes/PRs made with GITHUB_TOKEN do not re-trigger other
+# workflows (GitHub anti-recursion). Swap in a PAT secret if the PR
+# must trigger the pull-request checks automatically.
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: auto-pr-by-release
+  cancel-in-progress: false
 
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -14,7 +28,8 @@ jobs:
     steps:
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.24.11'
+          # bridge v3.137+ requires go >= 1.25.11 (provider/go.mod declares it)
+          go-version: '1.25.11'
 
       - name: Install pulumictl
         uses: jaxxstorm/action-install-gh-release@v1.5.0
@@ -25,48 +40,69 @@ jobs:
       - name: Install Pulumi CLI
         uses: pulumi/action-install-pulumi-cli@v2.0.0
         with:
-          pulumi-version: 3.210.0
+          # gen-sdk subprocess invoked by tfgen needs a recent CLI;
+          # older CLIs trip "duplicate file: config/index.ts" assertions
+          pulumi-version: 3.259.0
 
       - name: Setup Node
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
-          node-version: 22.3.0
+          # @npmcli/arborist@9.x requires node >= 22.9
+          node-version: 22.23.2
 
       - name: Setup DotNet
-        uses: actions/setup-dotnet@v1
+        uses: actions/setup-dotnet@v4
         with:
           dotnet-version: 6.0.418
 
       - name: Setup Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.13
+          python-version: '3.13'
 
       - name: generate-code
         id: generate-code
         run: |
-          version=`curl https://api.github.com/repos/tencentcloudstack/terraform-provider-tencentcloud/releases/latest --header 'Accept: application/vnd.github+json' --header 'Authorization: Bearer ${{secrets.GITHUB_TOKEN}}' | jq .name | tr -d '"' | tr -d 'v'`
+          version=`curl -s https://api.github.com/repos/tencentcloudstack/terraform-provider-tencentcloud/releases/latest --header 'Accept: application/vnd.github+json' --header 'Authorization: Bearer ${{secrets.GITHUB_TOKEN}}' | jq -r .name | tr -d '"' | tr -d 'v'`
+          if [ -z "$version" ]; then
+            echo "failed to resolve upstream version" >&2
+            exit 1
+          fi
           echo "version=$version" >> "$GITHUB_OUTPUT"
-          
-          git clone https://hellertang:${{secrets.GITHUB_TOKEN}}@github.com/tencentcloudstack/pulumi-tencentcloud.git
+
+          git clone https://x-access-token:${GITHUB_TOKEN}@github.com/tencentcloudstack/pulumi-tencentcloud.git
           cd pulumi-tencentcloud
-          git config --global user.email "hellertang@tencent.com"
-          git config --global user.name "hellertang"
-          git checkout -b "feat/sync_provider_v${version}"
+          git config user.email "hellertang@tencent.com"
+          git config user.name "hellertang"
 
-          cd provider && go get -v github.com/tencentcloudstack/terraform-provider-tencentcloud@v${version} && go mod tidy && cd -
+          # keep main up to date; -B resets the branch if it already exists
+          git checkout main
+          git pull origin main
+          git checkout -B "feat/sync_provider_v${version}"
+
+          cd provider && go get -v github.com/tencentcloudstack/terraform-provider-tencentcloud@v${version} && go mod tidy && cd ..
           make tfgen
-          make provider
           make build_sdks
-          cd sdk && go mod tidy && cd -
-
-          git add .
-          git commit -sm "sync provider"
-          git push origin feat/sync_provider_v${version}
+          cd sdk && go mod tidy && cd ..
+
+          if git diff --quiet && git diff --staged --quiet; then
+            echo "nothing to sync for v${version}, skipping commit"
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            git add .
+            git commit -sm "sync terraform provider v${version}"
+            git push --force-with-lease origin feat/sync_provider_v${version}
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: create pull request
+        if: ${{ steps.generate-code.outputs.changed == 'true' }}
         run: |
           cd pulumi-tencentcloud
-          gh pr create -B main -H feat/sync_provider_v${{ steps.generate-code.outputs.version }} --title "sync terraform provider v${{ steps.generate-code.outputs.version }}" --body "sync terraform provider version to v${{ steps.update-code.outputs.version }}"
+          # tolerate an already-open PR for this branch (idempotent re-runs)
+          gh pr create -B main -H "feat/sync_provider_v${{ steps.generate-code.outputs.version }}" \
+            --title "sync terraform provider v${{ steps.generate-code.outputs.version }}" \
+            --body "sync terraform provider version to v${{ steps.generate-code.outputs.version }}" \
+            || echo "PR may already exist for this branch"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pull-request.yml

@@ -12,12 +12,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+        with:
+          # By default actions/checkout@v4 checks out the ephemeral
+          # `refs/pull/<PR>/merge` commit (a merge of the PR head into the
+          # base branch), NOT the actual PR branch head. That merge commit
+          # is recomputed whenever the base branch moves, and git's textual
+          # 3-way merge of *generated* files (schema.json, sdk/**) produces
+          # content that was never actually regenerated - causing the
+          # "workspace checking" step to intermittently report unrelated,
+          # non-reproducible diffs. Pin to the real PR head SHA instead so
+          # generation is deterministic and matches what was pushed.
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - name: Unshallow clone for tags
         run: git fetch --prune --unshallow --tags
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
+          # bridge v3.137+ requires go >= 1.25.11 (provider/go.mod declares it)
           go-version: ${{ matrix.goversion }}
       - name: Install pulumictl
         uses: jaxxstorm/action-install-gh-release@v1.5.0
@@ -27,17 +39,18 @@ jobs:
       - name: Install Pulumi CLI
         uses: pulumi/action-install-pulumi-cli@v2.0.0
         with:
-          pulumi-version: 3.210.0
+          # recent CLI required by tfgen's gen-sdk subprocess
+          pulumi-version: 3.259.0
       - name: Setup Node
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{matrix.nodeversion}}
       - name: Setup DotNet
-        uses: actions/setup-dotnet@v1
+        uses: actions/setup-dotnet@v4
         with:
           dotnet-version: ${{matrix.dotnetversion}}
       - name: Setup Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
         with:
           python-version: ${{matrix.pythonversion}}
       - name: Build SDK
@@ -57,13 +70,13 @@ jobs:
         dotnetversion:
           - 6.0.418
         goversion:
-          - 1.24.11
+          - 1.25.11
         language:
           - nodejs
           - python
           - dotnet
           - go
         nodeversion:
-          - 22.3.0
+          - 22.23.2
         pythonversion:
-          - "3.13"
+          - "3.13"

.github/workflows/release.yml

@@ -23,12 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Unshallow clone for tags
       run: git fetch --prune --unshallow --tags
     - name: Install Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v5
       with:
+        # bridge v3.137+ requires go >= 1.25.11 (provider/go.mod declares it)
         go-version: ${{matrix.goversion}}
     - name: Install pulumictl
       uses: jaxxstorm/action-install-gh-release@v1.5.0
@@ -48,18 +49,18 @@ jobs:
       fail-fast: true
       matrix:
         goversion:
-        - 1.24.11
+        - 1.25.11
   publish_sdk:
     name: Publish SDKs
     runs-on: ubuntu-latest
     needs: publish_binary
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Unshallow clone for tags
         run: git fetch --prune --unshallow --tags
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
           go-version: ${{ matrix.goversion }}
       - name: Install pulumictl
@@ -70,18 +71,21 @@ jobs:
       - name: Install Pulumi CLI
         uses: pulumi/action-install-pulumi-cli@v2.0.0
         with:
-          pulumi-version: 3.210.0
+          # recent CLI required by tfgen's gen-sdk subprocess
+          pulumi-version: 3.259.0
       - name: Setup Node
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: ${{matrix.nodeversion}}
           registry-url: ${{env.NPM_REGISTRY_URL}}
       - name: Setup DotNet
-        uses: actions/setup-dotnet@v1
+        uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: ${{matrix.dotnetverson}}
+          # fixed typo: was matrix.dotnetverson (missing 'i'), which
+          # resolved to an empty version
+          dotnet-version: ${{matrix.dotnetversion}}
       - name: Setup Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
         with:
           python-version: ${{matrix.pythonversion}}
       - name: Build SDK
@@ -119,13 +123,13 @@ jobs:
         dotnetversion:
           - 6.0.418
         goversion:
-          - 1.24.11
+          - 1.25.11
         language:
           - nodejs
           - python
           - dotnet
           - go
         nodeversion:
-          - 22.3.0
+          - 22.23.2
         pythonversion:
           - "3.13"

Makefile

@@ -82,6 +82,7 @@ build_python:: PYPI_VERSION := $(shell pulumictl get version --language python)
 build_python:: export PULUMI_SKIP_MISSING_MAPPING_ERROR := ${PULUMI_SKIP_ERROR}
 build_python:: install_plugins tfgen # build the python sdk
 	$(WORKING_DIR)/bin/$(TFGEN) python --overlays provider/overlays/python --out sdk/python/
+	python3 scripts/fix_python_sdk_lint.py sdk/python/tencentcloud_iac_pulumi
 	cd sdk/python/ && \
 	cp ../../README.md . && \
 	python3 -m venv .venv && \
@@ -125,6 +126,27 @@ clean::
 install_plugins::
 	[ -x $(shell which pulumi) ] || curl -fsSL https://get.pulumi.com | sh
 	pulumi plugin install resource random 4.3.1
+	# Pin the std plugin version used by tfgen/codegen to translate doc examples
+	# (e.g. "@pulumi/std" -> Go import path). Without pinning, a fresh CI runner
+	# would auto-install whatever is "latest" at build time, which can differ
+	# from what a developer has cached locally and produce non-deterministic
+	# generated SDK code (e.g. github.com/pulumi/pulumi-std/sdk/go/std vs
+	# github.com/pulumi/pulumi-std/sdk/v2/go/std), breaking the "worktree clean"
+	# check in CI.
+	pulumi plugin install resource std 2.3.2
+	# Pin the terraform *converter* plugin (invoked internally by
+	# `pulumi convert --from terraform --language pcl`, which tfgen shells
+	# out to for translating upstream Terraform doc examples - including
+	# HCL `lifecycle { ignore_changes = [...] }` blocks - into per-language
+	# SDK example snippets, e.g. Go's `pulumi.IgnoreChanges(...)`). This
+	# plugin is resolved independently of the Pulumi CLI core version and,
+	# left unpinned, a fresh CI runner (no local plugin cache) will fetch
+	# whatever is "latest" at build time. Different converter versions can
+	# translate the same `lifecycle` block differently (e.g. dropping vs.
+	# emitting the ignore_changes/IgnoreChanges option), producing
+	# non-reproducible schema.json/SDK diffs and breaking the "worktree
+	# clean" check in CI even though the source docs never changed.
+	pulumi plugin install converter terraform 1.2.4
 
 install_dotnet_sdk::
 	mkdir -p $(WORKING_DIR)/nuget

provider/cmd/pulumi-resource-tencentcloud/Pulumi.yaml

@@ -0,0 +1,3 @@
+name: tencentcloud
+description: A Pulumi resource provider for tencentcloud.
+language: schema