pulumi-cli-docs.yml

permissions: write-all # Equivalent to default permissions + id-token: write
env:
  ESC_ACTION_OIDC_AUTH: true
  ESC_ACTION_OIDC_ORGANIZATION: pulumi
  ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
  ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-docs
  ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: GITHUB_TOKEN=PULUMI_BOT_TOKEN

name: Pulumi CLI docs

# Serialize runs so two release regens can't open PRs that conflict on the
# shared generated files (static/latest-version, data/versions.json, CLI pages).
concurrency:
  group: pulumi-cli-docs
  cancel-in-progress: false

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Pulumi CLI version (e.g. 3.150.0, without leading 'v')"
        required: true
      skip_auto_merge:
        description: "Skip enabling auto-merge on the generated PR (for testing)"
        type: boolean
        default: false
      publish_only:
        description: "Generate + publish the versioned snapshot only; skip the latest-docs PR (for backfill)"
        type: boolean
        default: false
      target_env:
        description: "Versioned-docs publish target (when publishing)"
        type: choice
        options:
          - production
          - testing
        default: production

jobs:
  pull-request:
    runs-on: ubuntu-latest
    needs: build-pulumi-cli-docs
    if: needs.build-pulumi-cli-docs.outputs.has_changes == 'true' && github.event.inputs.publish_only != 'true'
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3
      - name: checkout docs repo
        uses: actions/checkout@v7
      - name: set the pulumi version
        run: |
          echo "PULUMI_VERSION=${{ github.event.inputs.version || github.event.client_payload.ref }}" >> $GITHUB_ENV
      - name: pull-request
        id: create-pr
        uses: repo-sync/pull-request@v2
        with:
          source_branch: "pulumi-cli-docs/${{ github.run_id }}-${{ github.run_number }}"
          destination_branch: "master"
          pr_title: "Generate Pulumi CLI docs @v${{ env.PULUMI_VERSION }}"
          pr_body: |
            Automated PR generated by the [Pulumi CLI docs](https://github.com/${{ github.repository }}/blob/master/.github/workflows/pulumi-cli-docs.yml) workflow (`.github/workflows/pulumi-cli-docs.yml`).

            Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          pr_label: "automation/pulumi-cli-docs,automation/merge"
          github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
      - name: Enable auto-merge
        if: steps.create-pr.outputs.pr_created == 'true' && github.event.inputs.skip_auto_merge != 'true'
        run: gh pr merge ${{ steps.create-pr.outputs.pr_number }} --auto --squash
        env:
          GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
      # A still-open older CLI-docs PR is superseded by the PR this run just
      # opened and would go permanently conflicted (both rewrite
      # static/latest-version and data/versions.json) the moment the newer PR
      # merges — so close it. Runs only after the successor PR exists, so a
      # failed run never leaves us with no open CLI-docs PR. Best-effort: a
      # failed list/close only leaves a conflicted PR for the next run to clean
      # up. (publish_only backfills never reach this job, so they can't close a
      # live PR.)
      - name: Close superseded CLI-docs PRs
        if: steps.create-pr.outputs.pr_created == 'true' && github.event.inputs.skip_auto_merge != 'true'
        env:
          GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
          NEW_PR: ${{ steps.create-pr.outputs.pr_number }}
        run: |
          prs=$(gh pr list --repo "$GITHUB_REPOSITORY" \
            --author pulumi-bot --label automation/pulumi-cli-docs --state open \
            --json number,title \
            --jq '.[] | select(.title | startswith("Generate Pulumi CLI docs")) | .number') \
            || { echo "::warning::Failed to list open CLI-docs PRs; skipping supersede step."; exit 0; }
          for pr in $prs; do
            [ "$pr" = "$NEW_PR" ] && continue
            gh pr close "$pr" --repo "$GITHUB_REPOSITORY" --delete-branch \
              --comment "Superseded by the regen for \`v$PULUMI_VERSION\` (#$NEW_PR, $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID); closing so it can't go stale-conflicted." \
              || echo "::warning::Failed to close superseded PR #$pr; the next CLI-docs run will retry."
          done
  build-pulumi-cli-docs:
    runs-on: ubuntu-latest
    outputs:
      has_changes: ${{ steps.commit.outputs.has_changes }}
    steps:
      - name: set the pulumi version
        run: |
          echo "PULUMI_VERSION=${{ github.event.inputs.version || github.event.client_payload.ref }}" >> $GITHUB_ENV
      - name: Fetch secrets from ESC and install the Pulumi CLI
        id: esc-secrets
        uses: pulumi/esc-action@v3
        with:
          version: ${{ env.PULUMI_VERSION }}
      - name: checkout docs repo
        uses: actions/checkout@v7
      - name: Install Hugo
        uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: '0.157.0'
          extended: true
      - name: Install node
        uses: actions/setup-node@v6
        with:
          node-version: '24.x'
          cache: 'yarn'
          cache-dependency-path: |
            yarn.lock
            infrastructure/yarn.lock
            theme/yarn.lock
            theme/stencil/yarn.lock
      - name: Install Vale (required by scripts/ensure.sh)
        run: |
          VALE_VERSION="3.14.1"
          VALE_SHA256="ff2b49ffaa9dcd246fd5008f03ff67746d2790b75bf4d3657e2fb9530fb96db3"
          curl -fsSL -o /tmp/vale.tar.gz "https://github.com/errata-ai/vale/releases/download/v${VALE_VERSION}/vale_${VALE_VERSION}_Linux_64-bit.tar.gz"
          echo "${VALE_SHA256}  /tmp/vale.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin vale -f /tmp/vale.tar.gz
          rm /tmp/vale.tar.gz
      - run: make ensure
      - name: clean stale generated command pages
        run: |
          find ./content/docs/iac/cli/commands -type f \
            ! -name '_index.md' ! -name 'README.txt' -print0 \
          | while IFS= read -r -d '' f; do
              grep -aq '^redirect_to:' "$f" || rm -- "$f"
            done
      - name: generate markdown
        run: |
          PULUMI_EXPERIMENTAL=true pulumi gen-markdown ./content/docs/iac/cli/commands
      - name: Update latest version
        run: |
          echo -n "${{ env.PULUMI_VERSION }}" > ./static/latest-version
      - name: Update versions
        run: node scripts/get-cli-versions.js
        env:
          GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
      - name: git status
        run: git status && git diff
      - name: commit changes
        id: commit
        run: |
          git config --local user.email "bot@pulumi.com"
          git config --local user.name "pulumi-bot"
          git checkout -b pulumi-cli-docs/${{ github.run_id }}-${{ github.run_number }}
          git add content/
          git add data/
          git add static/
          if git diff --cached --quiet; then
            echo "No changes to commit"
            echo "has_changes=false" >> $GITHUB_OUTPUT
          else
            git commit -m "Regenerating CLI docs for Pulumi@${{ env.PULUMI_VERSION}}"
            if [ "${{ github.event.inputs.publish_only }}" != "true" ]; then
              git push origin pulumi-cli-docs/${{ github.run_id }}-${{ github.run_number }}
            fi
            echo "has_changes=true" >> $GITHUB_OUTPUT
          fi
      # --- Versioned docs: archive this CLI release as an immutable snapshot. ---------
      # No enable flag: the publish turns itself on once the versioned-docs storage stack
      # exists - the resolve step reads the bucket/role/distribution from stack outputs and
      # every step below no-ops while they are absent. Runs AFTER the commit/push and is
      # continue-on-error, so a publish hiccup never blocks the normal docs PR.
      - name: Resolve versioned-docs publish target
        id: vdocs
        env:
          PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}
        run: |
          TARGET="${{ github.event.inputs.target_env || 'production' }}"
          if [ "$TARGET" = "testing" ]; then
            STORAGE_STACK="pulumi/pulumi-docs-versioned/testing"
            WWW_STACK="pulumi/www.pulumi.com/www-testing"
            SITE="https://www.pulumi-test.io"
          else
            STORAGE_STACK="pulumi/pulumi-docs-versioned/production"
            WWW_STACK="pulumi/www.pulumi.com/www-production"
            SITE="https://www.pulumi.com"
          fi
          # Resolve EVERYTHING from the IaC that owns it - no hardcoded names, no enable flag.
          # The bucket + publisher role come from the versioned-docs storage stack; the
          # CloudFront distribution (for the post-publish invalidation) from the www stack.
          # An empty bucket means versioned docs are not stood up for this env yet: every step
          # below is gated on bucket != '' and simply no-ops, so the feature turns itself on
          # the moment the storage stack exists. Mirrors how scripts/run-pulumi.sh and the
          # registry repo read these values from stack outputs instead of copying them.
          BUCKET="$(pulumi stack output bucketNameOutput --stack "$STORAGE_STACK" 2>/dev/null || true)"
          ROLE_ARN="$(pulumi stack output publisherRoleArn --stack "$STORAGE_STACK" 2>/dev/null || true)"
          DIST_ID="$(pulumi stack output cloudFrontDistributionId --stack "$WWW_STACK" 2>/dev/null || true)"
          if [ -z "$BUCKET" ]; then
            echo "::notice::versioned-docs: storage stack $STORAGE_STACK has no bucket output - versioned docs are not stood up for '$TARGET'; skipping the archive publish."
          elif [ -z "$DIST_ID" ]; then
            echo "::warning::versioned-docs: could not read cloudFrontDistributionId from $WWW_STACK; publishing without a CloudFront invalidation (staleness bounded by the 300s manifest TTL)."
          fi
          {
            echo "role_arn=$ROLE_ARN"
            echo "bucket=$BUCKET"
            echo "distribution_id=$DIST_ID"
            echo "site=$SITE"
          } >> "$GITHUB_OUTPUT"
      - name: Configure AWS credentials (versioned-docs publisher)
        if: ${{ steps.vdocs.outputs.bucket != '' }}
        continue-on-error: true
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ steps.vdocs.outputs.role_arn }}
          role-session-name: versioned-docs-cli-publish
          aws-region: us-west-2
      - name: Build site and publish versioned CLI snapshot
        if: ${{ steps.vdocs.outputs.bucket != '' }}
        continue-on-error: true
        run: |
          make build
          # Backfill (publish_only) archives an OLD release, so it must NOT be marked "latest"
          # — that flag belongs to the newest version. The manifest sorts by semver, so the
          # publish date doesn't affect ordering. The normal release path leaves mark-latest at
          # its default (true), correct for the version just shipped.
          EXTRA=()
          [ "${{ github.event.inputs.publish_only }}" = "true" ] && EXTRA+=(--no-mark-latest)
          ./scripts/versioned-docs/snapshot-cli-docs.sh \
            --version "v${{ env.PULUMI_VERSION }}" \
            --public ./public \
            --bucket "${{ steps.vdocs.outputs.bucket }}" \
            --distribution-id "${{ steps.vdocs.outputs.distribution_id }}" \
            --site "${{ steps.vdocs.outputs.site }}" \
            "${EXTRA[@]}"
  notify:
    if: failure() && github.event.inputs.publish_only != 'true'
    name: Send slack notification
    runs-on: ubuntu-latest
    needs: [pull-request, build-pulumi-cli-docs]
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v3
      - name: Slack Notification
        uses: docker://sholung/action-slack-notify:v2.3.0
        env:
          SLACK_CHANNEL: docs-ops
          SLACK_COLOR: "#F54242"
          SLACK_MESSAGE: "Pulumi CLI docs build failure in pulumi/docs repo"
          SLACK_USERNAME: docsbot
          SLACK_WEBHOOK: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
          SLACK_ICON: https://www.pulumi.com/logos/brand/avatar-on-white.png