esc-cli.yml

permissions: write-all # Equivalent to default permissions + id-token: write
env:
  ESC_ACTION_OIDC_AUTH: true
  ESC_ACTION_OIDC_ORGANIZATION: pulumi
  ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
  ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-docs
  ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: GITHUB_TOKEN=PULUMI_BOT_TOKEN

name: Pulumi ESC CLI docs
on:
  repository_dispatch:
    types:
      - esc-cli
  workflow_dispatch:
    inputs:
      version:
        description: "esc version (e.g. v0.13.1)"
        required: true
      skip_auto_merge:
        description: "Skip enabling auto-merge on the generated PR (for testing)"
        type: boolean
        default: false
jobs:
  pull-request:
    runs-on: ubuntu-latest
    needs: build-esc-cli-docs
    if: needs.build-esc-cli-docs.outputs.has_changes == 'true'
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v2
      - name: checkout docs repo
        uses: actions/checkout@v6
      - name: set the esc version
        run: |
          echo "ESC_VERSION=${{ github.event.inputs.version || github.event.client_payload.ref }}" >> $GITHUB_ENV
      - name: pull-request
        id: create-pr
        uses: repo-sync/pull-request@v2
        with:
          source_branch: "esc/${{ github.run_id }}-${{ github.run_number }}"
          destination_branch: "master"
          pr_title: "Generate Pulumi ESC CLI docs @${{ env.ESC_VERSION }}"
          pr_body: |
            Automated PR generated by the [Pulumi ESC CLI docs](https://github.com/${{ github.repository }}/blob/master/.github/workflows/esc-cli.yml) workflow (`.github/workflows/esc-cli.yml`).

            Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          pr_label: "automation/esc-cli-docs,automation/merge"
          github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
      - name: Enable auto-merge
        if: steps.create-pr.outputs.pr_created == 'true' && github.event.inputs.skip_auto_merge != 'true'
        run: gh pr merge ${{ steps.create-pr.outputs.pr_number }} --auto --squash
        env:
          GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
  build-esc-cli-docs:
    runs-on: ubuntu-latest
    outputs:
      has_changes: ${{ steps.commit.outputs.has_changes }}
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v2
      - name: set the esc version
        run: |
          echo "ESC_VERSION=${{ github.event.inputs.version || github.event.client_payload.ref }}" >> $GITHUB_ENV
      - name: checkout docs repo
        uses: actions/checkout@v6
        with:
          path: docs
      - name: checkout esc repo
        uses: actions/checkout@v6
        with:
          repository: pulumi/esc
          path: esc
          ref: ${{ env.ESC_VERSION }}
      - name: Install pulumictl
        uses: jaxxstorm/action-install-gh-release@v3.0.0
        with:
          repo: pulumi/pulumictl
      - name: Install esc
        uses: jaxxstorm/action-install-gh-release@v3.0.0
        with:
          repo: pulumi/esc
          binaries-location: esc
      - name: Install Hugo
        uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: '0.157.0'
          extended: true
      - name: Install node
        uses: actions/setup-node@v6
        with:
          node-version: '24.x'
          cache: 'yarn'
          cache-dependency-path: |
            docs/yarn.lock
            docs/infrastructure/yarn.lock
            docs/theme/yarn.lock
            docs/theme/stencil/yarn.lock
      - name: Install Vale (required by scripts/ensure.sh)
        run: |
          VALE_VERSION="3.14.1"
          VALE_SHA256="ff2b49ffaa9dcd246fd5008f03ff67746d2790b75bf4d3657e2fb9530fb96db3"
          curl -fsSL -o /tmp/vale.tar.gz "https://github.com/errata-ai/vale/releases/download/v${VALE_VERSION}/vale_${VALE_VERSION}_Linux_64-bit.tar.gz"
          echo "${VALE_SHA256}  /tmp/vale.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin vale -f /tmp/vale.tar.gz
          rm /tmp/vale.tar.gz
      - run: make ensure
        working-directory: docs
      - name: Clean stale generated command pages
        run: |
          find ./content/docs/esc/cli/commands -type f \
            ! -name '_index.md' ! -name 'README.txt' -print0 \
          | while IFS= read -r -d '' f; do
              grep -aq '^redirect_to:' "$f" || rm -- "$f"
            done
        working-directory: docs
      - name: Generate Markdown docs
        run: |
          esc gen-docs ./content/docs/esc/cli/commands
        working-directory: docs
      - name: Update latest version
        run: |
          VERSION_TAG=${{ env.ESC_VERSION }}
          echo -n "${VERSION_TAG#v}" > ./static/esc/latest-version
        working-directory: docs
      - name: git status
        run: git status && git diff
        working-directory: docs
      - name: commit changes
        id: commit
        run: |
          git config --local user.email "bot@pulumi.com"
          git config --local user.name "pulumi-bot"
          git checkout -b esc/${{ github.run_id }}-${{ github.run_number }}
          git add static/
          git add content/
          if git diff --cached --quiet; then
            echo "No changes to commit"
            echo "has_changes=false" >> $GITHUB_OUTPUT
          else
            git commit -m "Regenerating docs for esc@${{ env.ESC_VERSION }}"
            git push origin esc/${{ github.run_id }}-${{ github.run_number }}
            echo "has_changes=true" >> $GITHUB_OUTPUT
          fi
        working-directory: docs
  notify:
    if: failure()
    name: Send slack notification
    runs-on: ubuntu-latest
    needs: [pull-request, build-esc-cli-docs]
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v2
      - name: Slack Notification
        uses: docker://sholung/action-slack-notify:v2.3.0
        env:
          SLACK_CHANNEL: docs-ops
          SLACK_COLOR: "#F54242"
          SLACK_MESSAGE: "esc cli docs build failure in pulumi/docs repo :meow_sad:"
          SLACK_USERNAME: docsbot
          SLACK_WEBHOOK: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
          SLACK_ICON: https://www.pulumi.com/logos/brand/avatar-on-white.png