pulumi · pulumi-provider-automation · Mar 12, 2026
diff --git a/.config/mise.toml b/.config/mise.toml
@@ -8,18 +8,18 @@ PULUMI_HOME = "{{config_root}}/.pulumi"
 [tools]
 
 # Runtimes
-# TODO: we may not need 'get_env' once https://github.com/jdx/mise/discussions/6339 is fixed
-go = "{{ get_env(name='GO_VERSION_MISE', default='latest') }}"
+go = "{{ env.GO_VERSION_MISE }}"
 node = '20.19.5'
 python = '3.11.8'
 "vfox:version-fox/vfox-dotnet" = "8.0.20" # vfox backend doesn't work on Windows, gives "error converting Lua table to PreInstall (no version returned from vfox plugin)" https://github.com/jdx/mise/discussions/5876 https://github.com/jdx/mise/discussions/5550
 # Corretto version used as Java SE/OpenJDK version no longer offered
 java = 'corretto-11'
 
 # Executable tools
-pulumi = "{{ get_env(name='PULUMI_VERSION_MISE', default='latest') }}"
+"github:pulumi/pulumi" = "{{ env.PULUMI_VERSION_MISE }}"
 "github:pulumi/pulumictl" = '0.0.50'
 "github:pulumi/schema-tools" = "0.6.0"
+"go:github.com/pulumi/upgrade-provider" = "main"
 "aqua:gradle/gradle-distributions" = '7.6.6'
 golangci-lint = "1.64.8" # See note about about overrides if you need to customize this.
 "npm:yarn" = "1.22.22"
@@ -29,6 +29,7 @@ experimental = true # Required for Go binaries (e.g. pulumictl).
 lockfile = false
 http_retries = 3
 pin = true # `mise use` should pin versions instead of defaulting to latest.
+fetch_remote_versions_cache = "24h" # Mise queries versions even if they're pinned to confirm they exist. Reduce GitHub API calls by doing that less often.
 
 [plugins]
 vfox-pulumi = "https://github.com/pulumi/vfox-pulumi"
diff --git a/.github/workflows/build_provider.yml b/.github/workflows/build_provider.yml
@@ -71,13 +71,12 @@ jobs:
         with:
           tag: v2.1.5-procursus2
       - name: Setup mise
-        uses: blampe/mise-action@blampe/plugins
+        uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
         env:
           MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
         with:
-          version: 2026.1.1
+          version: 2026.3.7
           github_token: ${{ steps.app-auth.outputs.token }}
-          plugin_install: https://github.com/pulumi/vfox-pulumi
           # only saving the cache in the prerequisites job
           cache_save: false
       # Based on https://github.com/actions/cache/blob/main/examples.md#go---modules

diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
@@ -43,13 +43,12 @@ jobs:
           private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
       - name: Setup mise
-        uses: blampe/mise-action@blampe/plugins
+        uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
         env:
           MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
         with:
-          version: 2026.1.1
+          version: 2026.3.7
           github_token: ${{ steps.app-auth.outputs.token }}
-          plugin_install: https://github.com/pulumi/vfox-pulumi
           # only saving the cache in the prerequisites job
           cache_save: false
       - run: make prepare_local_workspace

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -50,25 +50,18 @@ jobs:
         private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
         owner: ${{ github.repository_owner }}
     - name: Setup mise
-      uses: blampe/mise-action@blampe/plugins
+      uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
       env:
         MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
       with:
-        version: 2026.1.1
+        version: 2026.3.7
         github_token: ${{ steps.app-auth.outputs.token }}
-        plugin_install: https://github.com/pulumi/vfox-pulumi
         cache_save: false # A different job handles caching our tools.
-    - name: disarm go:embed directives to enable lint
-      continue-on-error: true # this fails if there are no go:embed directives
-      run: |
-        git grep -l 'go:embed' -- provider | xargs sed -i 's/go:embed/ goembed/g'
     - name: prepare workspace
       continue-on-error: true
       run: make prepare_local_workspace
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    - name: golangci-lint
-      uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6
-      with:
-        install-mode: none # Handled by mise.
-        working-directory: .
+
+    - name: lint
+      run: make lint
diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml
@@ -70,13 +70,12 @@ jobs:
         major-version: 0
         set-env: 'PROVIDER_VERSION'
     - name: Setup mise
-      uses: blampe/mise-action@blampe/plugins
+      uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
       env:
         MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
       with:
-        version: 2026.1.1
+        version: 2026.3.7
         github_token: ${{ steps.app-auth.outputs.token }}
-        plugin_install: https://github.com/pulumi/vfox-pulumi
         # only saving the cache in the prerequisites job
         cache_save: true
     - name: Setup Go Cache
@@ -91,7 +90,7 @@ jobs:
     - name: Prepare local workspace before restoring previously built files
       run: make prepare_local_workspace
       env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ steps.app-auth.outputs.token }}
     - name: Build provider binary
       run: make provider
     - name: Unit-test provider code

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -61,13 +61,12 @@ jobs:
         private-key: ${{ steps.esc-secrets.outputs.PULUMI_PROVIDER_AUTOMATION_PRIVATE_KEY }}
         owner: ${{ github.repository_owner }}
     - name: Setup mise
-      uses: blampe/mise-action@blampe/plugins
+      uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
       env:
         MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
       with:
-        version: 2026.1.1
+        version: 2026.3.7
         github_token: ${{ steps.app-auth.outputs.token }}
-        plugin_install: https://github.com/pulumi/vfox-pulumi
         cache_save: false
     - name: Configure AWS Credentials
       uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5.1.1

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -63,14 +63,13 @@ jobs:
         repository: pulumi/examples
         path: p-examples
     - name: Setup mise
-      uses: blampe/mise-action@blampe/plugins
+      uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
       env:
         MISE_ENV: test
         MISE_FETCH_REMOTE_VERSIONS_TIMEOUT: 30s
       with:
-        version: 2026.1.1
+        version: 2026.3.7
         github_token: ${{ steps.app-auth.outputs.token }}
-        plugin_install: https://github.com/pulumi/vfox-pulumi
         # also save this cache since we are using a different mise env.
         cache_save: true
     - name: Prepare local workspace
@@ -89,7 +88,7 @@ jobs:
         requested-token-type: urn:pulumi:token-type:access_token:organization
         export-environment-variables: false
     - name: Export AWS Credentials
-      uses: pulumi/esc-action@6cf9520e68354d86f81c455e8d43eabd58f5c9f5 # v1.5.0
+      uses: pulumi/esc-action@9840934db12128a33f6afb60b17d9de8f7ec5519
       env:
         PULUMI_ACCESS_TOKEN: ${{ steps.generate_pulumi_token.outputs.pulumi-access-token }}
       with:

diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml
@@ -76,12 +76,11 @@ jobs:
         name: Fetch secrets from ESC
         uses: pulumi/esc-action@9eb774255b1a4afb7855678ae8d4a77359da0d9b
       - name: Setup mise
-        uses: blampe/mise-action@blampe/plugins
+        uses: jdx/mise-action@c1a019b8d2586943b4dbebc456323b516910e310
         with:
-          version: 2026.1.1
+          version: 2026.3.7
           github_token: ${{ secrets.GITHUB_TOKEN }}
           cache_save: false
-          plugin_install: https://github.com/pulumi/vfox-pulumi
       - name: Setup Go Cache
         uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
         with:

diff --git a/Makefile b/Makefile
@@ -66,7 +66,7 @@ help:
 	@echo "Main Targets"
 	@echo "  build (default)     Build the provider"
 	@echo "  provider            Build the local provider binary"
-	@echo "  lint_provider<.fix> Run the linter on the provider (& optionally fix)"
+	@echo "  lint<.fix>          Run the linter on the provider (& optionally fix)"
 	@echo "  test_provider       Run the provider tests"
 	@echo "  test                Run the example tests (must run 'build' first)"
 	@echo "  clean               Clean up generated files"
@@ -88,15 +88,15 @@ clean:
 	rm -rf .make/*
 .PHONY: clean
 
-lint_provider: provider
+lint: provider
 	golangci-lint run -c .golangci.yml
 
-# `lint_provider.fix` is a utility target meant to be run manually
+# `lint.fix` is a utility target meant to be run manually
 # that will run the linter and fix errors when possible.
-lint_provider.fix:
+lint.fix:
 	golangci-lint run -c .golangci.yml --fix
 
-.PHONY: lint_provider lint_provider.fix
+.PHONY: lint lint.fix
 build_provider_cmd = GOOS=$(1) GOARCH=$(2) CGO_ENABLED=0 go build $(PULUMI_PROVIDER_BUILD_PARALLELISM) -o "$(3)" -ldflags "$(LDFLAGS)" $(GO_MODULE)/cmd/$(PROVIDER)
 
 .PHONY: provider