# This is a combination of 7 commits.

# This is the 1st commit message:

Fix import resources with provider default tags

We have special logic around applying default provider tags to
resources. This logic only applied to the `Check` call which means it
was not applied when you were importing resources. This PR extends that
logic to also run during the `Read` call.

fix #4030, fix 4080

# This is the commit message #2:

skip test

# This is the commit message #3:

fixing test

# This is the commit message #4:

Adding more tests

# This is the commit message #5:

Upgrade pulumi-terraform-bridge to v3.86.0 (#4160)

This PR was generated via `$ upgrade-provider pulumi/pulumi-aws
--kind=bridge --pr-reviewers=guineveresaenger`.

Fixes #4091
Fixes #4137

---

- Upgrading pulumi-terraform-bridge from v3.85.0 to v3.86.0.
- Upgrading pulumi-terraform-bridge/pf from v0.38.0 to v0.39.0.
# This is the commit message #6:

chore: run upstream provider-lint (#4120)

This adds a step for running the upstream `provider-lint` make target.

As part of this I had to fix some of the patches which violated some
lint rules.

**0009-Add-ECR-credentials_data_source.patch**
- `ForceNew` does not apply to data sources

**0032-DisableTagSchemaCheck-for-PF-provider.patch**
- Schema have to have a `Type`
- Also needed to add a ignore for `S013` which forces `Computed`,
  `Optional` or `Required` to be set. Looks like it can't recognize the
  `tagsComputed` var

**0034-Fail-fast-when-PF-resources-are-dropped.patch**
- Added a lint ignore for a rule which doesn't allow panics

**0050-Normalize-retentionDays-in-aws_controltower_landing_.patch**
- This test doesn't actually need a region or partition so replacing
  with a placeholder

closes #4110
# This is the commit message #7:

fix: CVE-2024-24791 (#4175)

Fixes #4163

Upgrades minimally required Go versions to those unaffected by
CVE-2024-24791.

.ci-mgmt.yaml

@@ -86,6 +86,33 @@ extraTests:
       env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
+  upstream_lint:
+    name: Run upstream provider-lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+    - name: Free Disk Space (Ubuntu)
+      uses: jlumbroso/free-disk-space@main
+      with:
+        swap-storage: false
+        tool-cache: false
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ env.PR_COMMIT_SHA }}
+        submodules: true
+    - name: Install Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: "1.22.x"
+        cache: false
+    - name: Make upstream
+      run: make upstream
+    - name: upstream lint
+      run: |
+        cd upstream
+        make provider-lint
+
   test_oidc:
     name: test_oidc
     needs: build_sdk

.github/actions/download-bin/action.yml

@@ -0,0 +1,16 @@
+name: Download binary assets
+description: Downloads the provider and tfgen binaries to `bin/`.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: aws-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: Untar provider binaries
+      shell: bash
+      run: |
+        tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace}}/bin
+        find ${{ github.workspace }} -name "pulumi-*-aws" -print -exec chmod +x {} \;

.github/actions/download-sdk/action.yml

@@ -0,0 +1,19 @@
+name: Download SDK asset
+description: Restores the SDK asset for a language.
+
+inputs:
+  language:
+    required: true
+    description: One of nodejs, python, dotnet, go, java
+
+runs:
+  using: "composite"
+  steps:
+    - name: Download ${{ inputs.language }} SDK
+      uses: actions/download-artifact@v4
+      with:
+        name: ${{ inputs.language }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: Uncompress SDK folder
+      shell: bash
+      run: tar -zxf ${{ github.workspace }}/sdk/${{ inputs.language }}.tar.gz -C ${{ github.workspace }}/sdk/${{ inputs.language }}

.github/actions/setup-tools/action.yml

@@ -26,6 +26,7 @@ runs:
         cache-dependency-path: |
           provider/*.sum
           upstream/*.sum
+          sdk/*.sum
 
     - name: Install pulumictl
       if: inputs.tools == 'all' || contains(inputs.tools, 'pulumictl')

.github/actions/upload-bin/action.yml

@@ -0,0 +1,15 @@
+name: Upload bin assets
+description: Uploads the provider and tfgen binaries to `bin/`.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Tar provider binaries
+      shell: bash
+      run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace }}/bin/ pulumi-resource-aws pulumi-tfgen-aws
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: aws-provider.tar.gz
+        path: ${{ github.workspace }}/bin/provider.tar.gz
+        retention-days: 30

.github/actions/upload-sdk/action.yml

@@ -0,0 +1,20 @@
+name: Upload SDK asset
+description: Upload the SDK for a specific language as an asset for the workflow.
+
+inputs:
+  language:
+    required: true
+    description: One of nodejs, python, dotnet, go, java
+
+runs:
+  using: "composite"
+  steps:
+    - name: Compress SDK folder
+      shell: bash
+      run: tar -zcf sdk/${{ inputs.language }}.tar.gz -C sdk/${{ inputs.language }} .
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ inputs.language  }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/${{ inputs.language }}.tar.gz
+        retention-days: 30

.github/workflows/build_sdk.yml

@@ -26,7 +26,6 @@ env:
   SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
   SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
   SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   TF_APPEND_USER_AGENT: pulumi
   PROVIDER_VERSION: ${{ inputs.version }}
 
@@ -58,17 +57,8 @@ jobs:
         uses: ./.github/actions/setup-tools
         with:
           tools: pulumictl, pulumicli, go, node, dotnet, python, java
-      - name: Download provider + tfgen binaries
-        uses: actions/download-artifact@v4
-        with:
-          name: aws-provider.tar.gz
-          path: ${{ github.workspace }}/bin
-      - name: Untar provider binaries
-        run: >-
-          tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{
-          github.workspace}}/bin
-
-          find ${{ github.workspace }} -name "pulumi-*-aws" -print -exec chmod +x {} \;
+      - name: Download bin
+        uses: ./.github/actions/download-bin
       - name: Install plugins
         run: make install_plugins
       - name: Update path
@@ -84,11 +74,7 @@ jobs:
             sdk/go/**/pulumiUtilities.go
             sdk/nodejs/package.json
             sdk/python/pyproject.toml
-      - name: Compress SDK folder
-        run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }} .
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+      - name: Upload SDK
+        uses: ./.github/actions/upload-sdk
         with:
-          name: ${{ matrix.language  }}-sdk.tar.gz
-          path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
-          retention-days: 30
+          language: ${{ matrix.language }}

.github/workflows/check-upstream-upgrade.yml

@@ -8,16 +8,14 @@ jobs:
     name: Check for upstream provider upgrades
     runs-on: ubuntu-latest
     steps:
-    - name: Install Go
-      uses: actions/setup-go@v5
-      with:
-        go-version: "1.21.x"
-        cache-dependency-path: |
-          sdk/go.sum
     - name: Checkout Repo
       uses: actions/checkout@v4
       with:
         submodules: true
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: go
     - name: Install upgrade-provider
       run: go install github.com/pulumi/upgrade-provider@main
       shell: bash
@@ -34,17 +32,6 @@ jobs:
       env:
         REPO: ${{ github.repository }}
       shell: bash
-    - name: Send Check Version Failure To Slack
-      if: failure()
-      uses: rtCamp/action-slack-notify@v2
-      env:
-        SLACK_CHANNEL: provider-upgrade-publish-status
-        SLACK_COLOR: "#FF0000"
-        SLACK_ICON_EMOJI: ":owl:"
-        SLACK_MESSAGE: " Failed to check upstream for a new version "
-        SLACK_TITLE: ${{ github.event.repository.name }} upstream version check
-        SLACK_USERNAME: provider-bot
-        SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
 name: Check upstream upgrade
 on:
   workflow_dispatch: {} #so we can run this manually if necessary.

.github/workflows/command-dispatch.yml

@@ -19,7 +19,6 @@ env:
   SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
   SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
   SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   TF_APPEND_USER_AGENT: pulumi
 jobs:
   command-dispatch-for-testing:

.github/workflows/license.yml

@@ -26,7 +26,6 @@ env:
   SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
   SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
   SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   TF_APPEND_USER_AGENT: pulumi
 
 jobs:
@@ -38,12 +37,10 @@ jobs:
       uses: actions/checkout@v4
       with:
         ref: ${{ env.PR_COMMIT_SHA }}
-    - name: Install Go
-      uses: actions/setup-go@v5
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
       with:
-        cache-dependency-path: |
-            sdk/go.sum
-        go-version: "1.21.x"
+        tools: go
     - run: make upstream
     - uses: pulumi/license-check-action@main
       with:

.github/workflows/lint.yml

@@ -25,7 +25,6 @@ env:
   SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
   SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
   SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
-  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
   TF_APPEND_USER_AGENT: pulumi
 
 jobs: