Consolidate go modules

.github/actions/setup-tools/action.yml

@@ -66,19 +66,19 @@ runs:
 
     - name: Setup DotNet
       if: inputs.tools == 'all' || contains(inputs.tools, 'dotnet')
-      uses: actions/setup-dotnet@87b7050bc53ea08284295505d98d2aa94301e852 # v4.2.0
+      uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4
       with:
         dotnet-version: 6.0.x
 
     - name: Setup Python
       if: inputs.tools == 'all' || contains(inputs.tools, 'python')
-      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
       with:
         python-version: 3.11.8
 
     - name: Setup Java
       if: inputs.tools == 'all' || contains(inputs.tools, 'java')
-      uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
+      uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4
       with:
         cache: gradle
         distribution: temurin

.github/actions/upload-sdk/action.yml

@@ -13,7 +13,7 @@ runs:
       shell: bash
       run: tar -zcf sdk/${{ inputs.language }}.tar.gz -C sdk/${{ inputs.language }} .
     - name: Upload artifacts
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
       with:
         name: ${{ inputs.language  }}-sdk.tar.gz
         path: ${{ github.workspace}}/sdk/${{ inputs.language }}.tar.gz

.github/workflows/build_provider.yml

@@ -66,7 +66,7 @@ jobs:
         run: make provider_dist-${{ matrix.platform.os }}-${{ matrix.platform.arch }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: pulumi-resource-gcp-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz
           path: bin/pulumi-resource-gcp-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz

.github/workflows/build_sdk.yml

@@ -41,9 +41,7 @@ jobs:
     name: build_sdk
     runs-on: ubuntu-latest
     strategy:
-      # We normally fail fast unless this is a PR from Renovate in which case
-      # we'll always build all SDKs in case there are any changes to commit.
-      fail-fast: ${{ ! contains(github.actor, 'renovate') }}
+      fail-fast: true
       matrix:
         language:
         - nodejs
@@ -77,56 +75,14 @@ jobs:
       - name: Build SDK
         run: make build_${{ matrix.language }}
       - name: Check worktree clean
-        id: worktreeClean
         uses: pulumi/git-status-check-action@v1
         with:
-          # Keep these in sync with the Renovate step below to avoid them getting checked in.
           allowed-changes: |
             sdk/**/pulumi-plugin.json
             sdk/dotnet/*.csproj
             sdk/go/**/pulumiUtilities.go
             sdk/nodejs/package.json
             sdk/python/pyproject.toml
-      - name: Commit ${{ matrix.language }} SDK changes for Renovate
-        # If the worktree is dirty and this is a Renovate PR to bump
-        # dependencies, commit the updated SDK and push it back to the PR. The
-        # job will still be marked as a failure.
-        if: failure() && steps.worktreeClean.outcome == 'failure' && contains(github.actor, 'renovate') && github.event_name == 'pull_request'
-        shell: bash
-        run: |
-          git diff --quiet -- sdk && echo "no changes to sdk" && exit
-
-          git config --global user.email "[email protected]"
-          git config --global user.name "pulumi-bot"
-
-          # Stash local changes and check out the PR's branch directly.
-          git stash
-          git fetch
-          git checkout "origin/$HEAD_REF"
-
-          # Apply and add our changes, but don't commit any files we expect to
-          # always change due to versioning.
-          git stash pop
-          git add sdk
-          git reset \
-              sdk/python/*/pulumi-plugin.json \
-              sdk/python/pyproject.toml \
-              sdk/dotnet/pulumi-plugin.json \
-              sdk/dotnet/Pulumi.*.csproj \
-              sdk/go/*/pulumi-plugin.json \
-              sdk/go/*/internal/pulumiUtilities.go \
-              sdk/nodejs/package.json
-          git commit -m 'Commit ${{ matrix.language }} SDK for Renovate'
-
-          # Push with pulumi-bot credentials to trigger a re-run of the
-          # workflow. https://github.com/orgs/community/discussions/25702
-          git push https://pulumi-bot:${{ secrets.PULUMI_BOT_TOKEN }}@github.com/${{ github.repository }} \
-              "HEAD:$HEAD_REF"
-        env:
-          # head_ref is untrusted so it's recommended to pass via env var to
-          # avoid injections.
-          HEAD_REF: ${{ github.head_ref }}
-
       - name: Upload SDK
         uses: ./.github/actions/upload-sdk
         with:

.github/workflows/license.yml

@@ -46,8 +46,7 @@ jobs:
         with:
           tools: go
           cache-go: false
-      - run: make prepare_local_workspace
-        continue-on-error: true
+      - run: make upstream
       - uses: pulumi/license-check-action@main
         with:
           module-path: provider

.github/workflows/lint.yml

@@ -52,9 +52,9 @@ jobs:
       continue-on-error: true # this fails if there are no go:embed directives
       run: |
         git grep -l 'go:embed' -- provider | xargs sed -i 's/go:embed/ goembed/g'
-    - name: prepare workspace
+    - name: prepare upstream
       continue-on-error: true
-      run: make prepare_local_workspace
+      run: make upstream
     - name: golangci-lint
       uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6
       with:

.github/workflows/prerequisites.yml

@@ -79,7 +79,7 @@ jobs:
     - name: Unit-test provider code
       run: make test_provider
     - name: Upload coverage reports to Codecov
-      uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
+      uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e # v5.1.1
       env:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     - if: inputs.is_pr
@@ -104,14 +104,14 @@ jobs:
           Maintainer note: consult the [runbook](https://github.com/pulumi/platform-providers-team/blob/main/playbooks/tf-provider-updating.md) for dealing with any breaking changes.
 
     - name: Upload pulumi-tfgen-gcp
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
       with:
         name: pulumi-tfgen-gcp
         path: ${{ github.workspace }}/bin/pulumi-tfgen-gcp
         retention-days: 30
 
     - name: Upload schema-embed.json
-      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
       with:
         name: schema-embed.json
         path: provider/cmd/pulumi-resource-gcp/schema-embed.json

Makefile

@@ -3,7 +3,7 @@
 PACK := gcp
 ORG := pulumi
 PROJECT := github.com/$(ORG)/pulumi-$(PACK)
-PROVIDER_PATH := provider/v8
+PROVIDER_PATH := v8/provider
 VERSION_PATH := $(PROVIDER_PATH)/pkg/version.Version
 TFGEN := pulumi-tfgen-$(PACK)
 PROVIDER := pulumi-resource-$(PACK)
@@ -255,7 +255,7 @@ tfgen_no_deps: .make/schema
 	(cd provider && VERSION=$(VERSION_GENERIC) go generate cmd/$(PROVIDER)/main.go)
 	@touch $@
 tfgen_build_only: bin/$(TFGEN)
-bin/$(TFGEN): provider/*.go provider/go.* .make/upstream
+bin/$(TFGEN): provider/*.go go.* .make/upstream
 	(cd provider && go build $(PULUMI_PROVIDER_BUILD_PARALLELISM) -o $(WORKING_DIR)/bin/$(TFGEN) -ldflags "$(LDFLAGS_PROJ_VERSION) $(LDFLAGS_EXTRAS)" $(PROJECT)/$(PROVIDER_PATH)/cmd/$(TFGEN))
 .PHONY: tfgen schema tfgen_no_deps tfgen_build_only
 
@@ -282,7 +282,7 @@ ci-mgmt: .ci-mgmt.yaml
 .PHONY: ci-mgmt
 
 # Because some codegen depends on the version of the CLI used, we install a local CLI
-# version pinned to the same version as `provider/go.mod`.
+# version pinned to the same version as `go.mod`.
 #
 # This logic compares the version of .pulumi/bin/pulumi already installed. If it matches
 # the desired version, we just print. Otherwise we (re)install pulumi at the desired
@@ -297,7 +297,7 @@ ci-mgmt: .ci-mgmt.yaml
 	fi
 
 # Compute the version of Pulumi to use by inspecting the Go dependencies of the provider.
-.pulumi/version: provider/go.mod
+.pulumi/version: $(wildcard go.mod provider/go.mod) # go.mod can exist in either of these places.
 	cd provider && go list -f "{{slice .Version 1}}" -m github.com/pulumi/pulumi/pkg/v3 | tee ../$@
 
 # Start debug server for tfgen