Update GitHub Actions workflows.

.github/actions/upload-sdk/action.yml

@@ -13,7 +13,7 @@ runs:
       shell: bash
       run: tar -zcf sdk/${{ inputs.language }}.tar.gz -C sdk/${{ inputs.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: ${{ inputs.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ inputs.language }}.tar.gz

.github/workflows/build_provider.yml

@@ -45,6 +45,11 @@ jobs:
         with:
           submodules: true
           persist-credentials: false
+      # Without ldid cross-compiling Node binaries on a Linux worker intended to work on darwin-arm64 fails to sign the
+      # binaries properly and they do not work as expected. See https://github.com/pulumi/pulumi-awsx/issues/1490
+      - uses: MOZGIII/install-ldid-action@v1
+        with:
+          tag: v2.1.5-procursus2
       - name: Setup tools
         uses: ./.github/actions/setup-tools
         with:
@@ -75,7 +80,7 @@ jobs:
         run: make provider_dist-${{ matrix.platform.os }}-${{ matrix.platform.arch }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: pulumi-resource-aws-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz
           path: bin/pulumi-resource-aws-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz

.github/workflows/lint.yml

@@ -52,7 +52,7 @@ jobs:
       continue-on-error: true
       run: make prepare_local_workspace
     - name: golangci-lint
-      uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6
+      uses: golangci/golangci-lint-action@ec5d18412c0aeab7936cb16880d708ba2a64e1ae # v6
       with:
         version: v1.60
         working-directory: provider

.github/workflows/prerequisites.yml

@@ -107,14 +107,14 @@ jobs:
           Maintainer note: consult the [runbook](https://github.com/pulumi/platform-providers-team/blob/main/playbooks/tf-provider-updating.md) for dealing with any breaking changes.
 
     - name: Upload codegen binary for aws
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: pulumi-tfgen-aws
         path: ${{ github.workspace }}/bin/pulumi-tfgen-aws
         retention-days: 30
 
     - name: Upload schema-embed.json
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: schema-embed.json
         path: provider/cmd/pulumi-resource-aws/schema-embed.json

.github/workflows/publish.yml

@@ -215,6 +215,6 @@ jobs:
     with:
       providerVersion: ${{ inputs.version }}
       # Prelease is run often but we only have 5 concurrent macos runners, so we only test after the stable release.
-      enableMacosRunner: ${{ inputs.isPrerelease == false }}
+      enableMacRunner: ${{ inputs.isPrerelease == false }}
       skipGoSdk: ${{ inputs.skipGoSdk }}
       pythonVersion: ${{ needs.publish_sdk.outputs.python_version }}

.github/workflows/verify-release.yml

@@ -26,7 +26,7 @@ on:
         description: "The version of the provider to verify"
         required: true
         type: string
-      enableMacosRunner:
+      enableMacRunner:
         description: "Enable the macos-latest runner in addition to ubuntu-latest and windows-latest. Defaults to 'false'."
         required: false
         type: boolean
@@ -71,7 +71,7 @@ jobs:
         # Expression expands to ["ubuntu-latest","windows-latest"] or ["ubuntu-latest","windows-latest","macos-latest"]
         # GitHub expressions don't have 'if' statements, so we use a ternary operator to conditionally include the MacOS runner suffix.
         # See the docs for a similar example to this: https://docs.github.com/en/actions/learn-github-actions/expressions#fromjson
-        runner: ${{ fromJSON(format('["ubuntu-latest","windows-latest"{0}]', github.event.inputs.enableMacRunner == 'true' && ',"macos-latest"' || '')) }}
+        runner: ${{ fromJSON(format('["ubuntu-latest","windows-latest"{0}]', inputs.enableMacRunner && ',"macos-latest"' || '')) }}
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout Repo

Makefile

@@ -9,6 +9,7 @@ CODEGEN := pulumi-tfgen-$(PACK)
 PROVIDER := pulumi-resource-$(PACK)
 JAVA_GEN := pulumi-java-gen
 TESTPARALLELISM := 10
+GOTESTARGS := ""
 WORKING_DIR := $(shell pwd)
 PULUMI_PROVIDER_BUILD_PARALLELISM ?= -p 2
 PULUMI_CONVERT := 1
@@ -224,29 +225,30 @@ lint_provider: provider
 lint_provider.fix:
 	cd provider && golangci-lint run --path-prefix provider -c ../.golangci.yml --fix
 .PHONY: lint_provider lint_provider.fix
+build_provider_cmd = cd provider && GOOS=$(1) GOARCH=$(2) CGO_ENABLED=0 go build $(PULUMI_PROVIDER_BUILD_PARALLELISM) -o "$(3)" -ldflags "$(LDFLAGS)" $(PROJECT)/$(PROVIDER_PATH)/cmd/$(PROVIDER)
+
+provider: bin/$(PROVIDER)
 
 # `make provider_no_deps` builds the provider binary directly, without ensuring that
 # `cmd/pulumi-resource-aws/schema.json` is valid and up to date.
 # To create a release ready binary, you should use `make provider`.
-build_provider_cmd = cd provider && CGO_ENABLED=0 go build $(PULUMI_PROVIDER_BUILD_PARALLELISM) -o "$(1)" -ldflags "$(LDFLAGS)" $(PROJECT)/$(PROVIDER_PATH)/cmd/$(PROVIDER)
-provider: bin/$(PROVIDER)
 provider_no_deps:
-	$(call build_provider_cmd,$(WORKING_DIR)/bin/$(PROVIDER))
+	$(call build_provider_cmd,$(shell go env GOOS),$(shell go env GOARCH),$(WORKING_DIR)/bin/$(PROVIDER))
 bin/$(PROVIDER): .make/schema
-	$(call build_provider_cmd,$(WORKING_DIR)/bin/$(PROVIDER))
+	$(call build_provider_cmd,$(shell go env GOOS),$(shell go env GOARCH),$(WORKING_DIR)/bin/$(PROVIDER))
 .PHONY: provider provider_no_deps
 
 test: export PATH := $(WORKING_DIR)/bin:$(PATH)
 test:
-	cd examples && go test -v -tags=all -parallel $(TESTPARALLELISM) -timeout 2h
+	cd examples && go test -v -tags=all -parallel $(TESTPARALLELISM) -timeout 2h $(value GOTESTARGS)
 .PHONY: test
-
+test_provider_cmd = cd provider && go test -v -short \
+	-coverprofile="coverage.txt" \
+	-coverpkg="./...,github.com/hashicorp/terraform-provider-..." \
+	-parallel $(TESTPARALLELISM) \
+	./...
 test_provider:
-	cd provider && go test -v -short \
-		-coverprofile="coverage.txt" \
-		-coverpkg="./...,github.com/hashicorp/terraform-provider-..." \
-		-parallel $(TESTPARALLELISM) \
-		./...
+	$(call test_provider_cmd)
 .PHONY: test_provider
 
 tfgen: schema
@@ -329,18 +331,18 @@ SKIP_SIGNING ?=
 
 # These targets assume that the schema-embed.json exists - it's generated by tfgen.
 # We disable CGO to ensure that the binary is statically linked.
-bin/linux-amd64/$(PROVIDER): export GOOS := linux
-bin/linux-amd64/$(PROVIDER): export GOARCH := amd64
-bin/linux-arm64/$(PROVIDER): export GOOS := linux
-bin/linux-arm64/$(PROVIDER): export GOARCH := arm64
-bin/darwin-amd64/$(PROVIDER): export GOOS := darwin
-bin/darwin-amd64/$(PROVIDER): export GOARCH := amd64
-bin/darwin-arm64/$(PROVIDER): export GOOS := darwin
-bin/darwin-arm64/$(PROVIDER): export GOARCH := arm64
-bin/windows-amd64/$(PROVIDER).exe: export GOOS := windows
-bin/windows-amd64/$(PROVIDER).exe: export GOARCH := amd64
+bin/linux-amd64/$(PROVIDER): GOOS := linux
+bin/linux-amd64/$(PROVIDER): GOARCH := amd64
+bin/linux-arm64/$(PROVIDER): GOOS := linux
+bin/linux-arm64/$(PROVIDER): GOARCH := arm64
+bin/darwin-amd64/$(PROVIDER): GOOS := darwin
+bin/darwin-amd64/$(PROVIDER): GOARCH := amd64
+bin/darwin-arm64/$(PROVIDER): GOOS := darwin
+bin/darwin-arm64/$(PROVIDER): GOARCH := arm64
+bin/windows-amd64/$(PROVIDER).exe: GOOS := windows
+bin/windows-amd64/$(PROVIDER).exe: GOARCH := amd64
 bin/%/$(PROVIDER) bin/%/$(PROVIDER).exe: bin/jsign-6.0.jar
-	$(call build_provider_cmd,$(WORKING_DIR)/$@)
+	$(call build_provider_cmd,$(GOOS),$(GOARCH),$(WORKING_DIR)/$@)
 
 	@# Only sign windows binary if fully configured.
 	@# Test variables set by joining with | between and looking for || showing at least one variable is empty.