pulumi-sdk-python-docs.yml

permissions: write-all # Equivalent to default permissions + id-token: write
env:
  ESC_ACTION_OIDC_AUTH: true
  ESC_ACTION_OIDC_ORGANIZATION: pulumi
  ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
  ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-docs
  ESC_ACTION_EXPORT_ENVIRONMENT_VARIABLES: GITHUB_TOKEN=PULUMI_BOT_TOKEN

name: Pulumi SDK docs - Python
on:
  workflow_dispatch:
    inputs:
      version:
        description: "Pulumi version (e.g. 3.238.0, without leading 'v')"
        required: true
      skip_auto_merge:
        description: "Skip enabling auto-merge on the generated PR (for testing)"
        type: boolean
        default: false

jobs:
  pull-request:
    runs-on: ubuntu-latest
    needs: build-pulumi-sdk-python-docs
    if: needs.build-pulumi-sdk-python-docs.outputs.has_changes == 'true'
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v1
      - name: checkout docs repo
        uses: actions/checkout@v6
      - name: set the pulumi version
        run: |
          echo "PULUMI_VERSION=${{ github.event.inputs.version || github.event.client_payload.ref }}" >> $GITHUB_ENV
      - name: pull-request
        id: create-pr
        uses: repo-sync/pull-request@v2
        with:
          source_branch: "pulumi-sdk-python-docs/${{ github.run_id }}-${{ github.run_number }}"
          destination_branch: "master"
          pr_title: "Generate Pulumi SDK docs - Python @v${{ env.PULUMI_VERSION }}"
          pr_body: |
            Automated PR generated by the [Pulumi SDK docs - Python](https://github.com/${{ github.repository }}/blob/master/.github/workflows/pulumi-sdk-python-docs.yml) workflow (`.github/workflows/pulumi-sdk-python-docs.yml`).

            Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          pr_label: "automation/pulumi-sdk-python-docs,automation/merge"
          github_token: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
      - name: Enable auto-merge
        if: steps.create-pr.outputs.pr_created == 'true' && github.event.inputs.skip_auto_merge != 'true'
        run: gh pr merge ${{ steps.create-pr.outputs.pr_number }} --auto --squash
        env:
          GITHUB_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_BOT_TOKEN }}
  build-pulumi-sdk-python-docs:
    runs-on: ubuntu-latest
    outputs:
      has_changes: ${{ steps.commit.outputs.has_changes }}
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v1
      - name: set the pulumi version
        run: |
          echo "PULUMI_VERSION=${{ github.event.inputs.version || github.event.client_payload.ref }}" >> $GITHUB_ENV
      - name: checkout docs repo
        uses: actions/checkout@v6
      - name: Install Hugo
        uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: '0.157.0'
          extended: true
      - name: Install node
        uses: actions/setup-node@v6
        with:
          node-version: '24.x'
          cache: 'yarn'
          cache-dependency-path: |
            yarn.lock
            infrastructure/yarn.lock
            theme/yarn.lock
            theme/stencil/yarn.lock
      - name: Install python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Install Pipenv
        run: pip3 install pipenv
      - name: Install Vale (required by scripts/ensure.sh)
        run: |
          VALE_VERSION="3.14.1"
          VALE_SHA256="ff2b49ffaa9dcd246fd5008f03ff67746d2790b75bf4d3657e2fb9530fb96db3"
          curl -fsSL -o /tmp/vale.tar.gz "https://github.com/errata-ai/vale/releases/download/v${VALE_VERSION}/vale_${VALE_VERSION}_Linux_64-bit.tar.gz"
          echo "${VALE_SHA256}  /tmp/vale.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin vale -f /tmp/vale.tar.gz
          rm /tmp/vale.tar.gz
      - run: make ensure
      - name: Generate Pulumi Python SDK docs
        env:
          PACKAGE: pulumi
        run: ./scripts/generate_python_docs.sh
      - name: git status
        run: git status && git diff
      - name: commit changes
        id: commit
        run: |
          git config --local user.email "bot@pulumi.com"
          git config --local user.name "pulumi-bot"
          git checkout -b pulumi-sdk-python-docs/${{ github.run_id }}-${{ github.run_number }}
          git add static-prebuilt/
          if git diff --cached --quiet; then
            echo "No changes to commit"
            echo "has_changes=false" >> $GITHUB_OUTPUT
          else
            git commit -m "Regenerating Pulumi SDK Python docs for Pulumi@${{ env.PULUMI_VERSION }}"
            git push origin pulumi-sdk-python-docs/${{ github.run_id }}-${{ github.run_number }}
            echo "has_changes=true" >> $GITHUB_OUTPUT
          fi
  notify:
    if: failure()
    name: Send slack notification
    runs-on: ubuntu-latest
    needs: [pull-request, build-pulumi-sdk-python-docs]
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@v1
      - name: Slack Notification
        uses: docker://sholung/action-slack-notify:v2.3.0
        env:
          SLACK_CHANNEL: docs-ops
          SLACK_COLOR: "#F54242"
          SLACK_MESSAGE: "Pulumi SDK docs - Python build failure in pulumi/docs repo"
          SLACK_USERNAME: docsbot
          SLACK_WEBHOOK: ${{ steps.esc-secrets.outputs.SLACK_WEBHOOK_URL }}
          SLACK_ICON: https://www.pulumi.com/logos/brand/avatar-on-white.png