pulumiverse · ringods · Oct 29, 2025 · Oct 29, 2025
diff --git a/.ci-mgmt.yaml b/.ci-mgmt.yaml
@@ -5,20 +5,6 @@ major-version: 1
 providerDefaultBranch: main
 upstreamProviderOrg: scaleway
 publishRegistry: false
-plugins:
-    - name: terraform
-      version: "1.0.19"
-      kind: converter
-    - name: random
-      version: "4.16.7"
-    - name: aws
-      version: "6.56.1"
-    - name: gitlab
-      version: "8.5.0"
-    - name: local
-      version: "0.1.5"
-    - name: "null"
-      version: "0.0.8"
 languages:
     - dotnet
     - go

diff --git a/.config/mise.lock b/.config/mise.lock
@@ -57,3 +57,27 @@ url = "https://github.com/pulumi/pulumi/releases/download/v3.190.0/pulumi-v3.190
 [[tools.python]]
 version = "3.11.8"
 backend = "core:python"
+
+[[tools."vfox-pulumi:pulumi/pulumi-aws"]]
+version = "7.10.0"
+backend = "vfox-pulumi:pulumi/pulumi-aws"
+
+[[tools."vfox-pulumi:pulumi/pulumi-converter-terraform"]]
+version = "1.2.4"
+backend = "vfox-pulumi:pulumi/pulumi-converter-terraform"
+
+[[tools."vfox-pulumi:pulumi/pulumi-gitlab"]]
+version = "9.4.0"
+backend = "vfox-pulumi:pulumi/pulumi-gitlab"
+
+[[tools."vfox-pulumi:pulumi/pulumi-local"]]
+version = "0.1.6"
+backend = "vfox-pulumi:pulumi/pulumi-local"
+
+[[tools."vfox-pulumi:pulumi/pulumi-null"]]
+version = "0.0.13"
+backend = "vfox-pulumi:pulumi/pulumi-null"
+
+[[tools."vfox-pulumi:pulumi/pulumi-random"]]
+version = "4.18.4"
+backend = "vfox-pulumi:pulumi/pulumi-random"
diff --git a/.config/mise.test.toml b/.config/mise.test.toml
@@ -1,6 +1,10 @@
 # WARNING: This file is autogenerated - changes will be overwritten when regenerated by https://github.com/pulumi/ci-mgmt
 
-# Overrides tool versions for test workflows
+# Overrides for test workflows
+
+[env]
+# Acceptance (specifically providertest) tests require that PULUMI_HOME be the default
+PULUMI_HOME = "{{ env.HOME }}/.pulumi"
 
 [tools]
 # always use pulumi latest for tests

diff --git a/.config/mise.toml b/.config/mise.toml
@@ -3,6 +3,7 @@
 
 [env]
 _.source = "{{config_root}}/scripts/get-versions.sh"
+PULUMI_HOME = "{{config_root}}/.pulumi"
 
 [tools]
 
@@ -22,7 +23,16 @@ pulumi = "{{ get_env(name='PULUMI_VERSION_MISE', default='latest') }}"
 gradle = '7.6'
 golangci-lint = "1.64.8" # See note about about overrides if you need to customize this.
 "npm:yarn" = "1.22.22"
+"vfox-pulumi:pulumi/pulumi-converter-terraform" = "latest"
+"vfox-pulumi:pulumi/pulumi-random" = "latest"
+"vfox-pulumi:pulumi/pulumi-aws" = "latest"
+"vfox-pulumi:pulumi/pulumi-gitlab" = "latest"
+"vfox-pulumi:pulumi/pulumi-local" = "latest"
+"vfox-pulumi:pulumi/pulumi-null" = "latest"
 
 [settings]
 experimental = true # Required for Go binaries (e.g. pulumictl).
 lockfile = true
+
+[plugins]
+vfox-pulumi = "https://github.com/pulumi/vfox-pulumi"
diff --git a/.github/workflows/build_provider.yml b/.github/workflows/build_provider.yml
@@ -53,6 +53,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@v3
         with:
+          # Latest working version. See https://github.com/jdx/mise/discussions/6781
+          version: 2025.10.16
           github_token: ${{ secrets.GITHUB_TOKEN }}
           cache_key: "mise-{{platform}}-{{file_hash}}"
           # only saving the cache in the prerequisites job

diff --git a/.github/workflows/build_sdk.yml b/.github/workflows/build_sdk.yml
@@ -51,6 +51,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@v3
         with:
+          # Latest working version. See https://github.com/jdx/mise/discussions/6781
+          version: 2025.10.16
           github_token: ${{ secrets.GITHUB_TOKEN }}
           cache_key: "mise-{{platform}}-{{file_hash}}"
           # only saving the cache in the prerequisites job

diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
@@ -25,6 +25,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@v3
         with:
+          # Latest working version. See https://github.com/jdx/mise/discussions/6781
+          version: 2025.10.16
           github_token: ${{ secrets.GITHUB_TOKEN }}
           cache_key: "mise-{{platform}}-{{file_hash}}"
           # only saving the cache in the prerequisites job

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -25,6 +25,8 @@ jobs:
     - name: Setup mise
       uses: jdx/mise-action@v3
       with:
+        # Latest working version. See https://github.com/jdx/mise/discussions/6781
+        version: 2025.10.16
         github_token: ${{ secrets.GITHUB_TOKEN }}
         cache_save: false # A different job handles caching our tools.
     - name: disarm go:embed directives to enable lint

diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml
@@ -58,6 +58,8 @@ jobs:
     - name: Setup mise
       uses: jdx/mise-action@v3
       with:
+        # Latest working version. See https://github.com/jdx/mise/discussions/6781
+        version: 2025.10.16
         github_token: ${{ secrets.GITHUB_TOKEN }}
         cache_key: "mise-{{platform}}-{{file_hash}}"
         # only saving the cache in the prerequisites job

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -55,6 +55,8 @@ jobs:
     - name: Setup mise
       uses: jdx/mise-action@v3
       with:
+        # Latest working version. See https://github.com/jdx/mise/discussions/6781
+        version: 2025.10.16
         github_token: ${{ secrets.GITHUB_TOKEN }}
         cache_key: "mise-{{platform}}-${{ hashFiles('mise.lock') }}"
         cache_save: false
@@ -123,12 +125,14 @@ jobs:
     - name: Setup mise
       uses: jdx/mise-action@v3
       with:
+        # Latest working version. See https://github.com/jdx/mise/discussions/6781
+        version: 2025.10.16
         github_token: ${{ secrets.GITHUB_TOKEN }}
         cache_key: "mise-{{platform}}-{{file_hash}}"
         # only saving the cache in the prerequisites job
         cache_save: false
     - name: Setup Node
-      uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+      uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
       with:
         # we don't set node-version because we install with mise.
         # this step is needed to setup npm auth

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -48,6 +48,8 @@ jobs:
       env:
         MISE_ENV: test
       with:
+        # Latest working version. See https://github.com/jdx/mise/discussions/6781
+        version: 2025.10.16
         github_token: ${{ secrets.GITHUB_TOKEN }}
         cache_key: "mise-{{platform}}-{{file_hash}}"
         # also save this cache since we are using a different mise env.

diff --git a/.github/workflows/upgrade-bridge.yml b/.github/workflows/upgrade-bridge.yml
@@ -83,6 +83,8 @@ jobs:
     - name: Setup mise
       uses: jdx/mise-action@v3
       with:
+        # Latest working version. See https://github.com/jdx/mise/discussions/6781
+        version: 2025.10.16
         github_token: ${{ secrets.GITHUB_TOKEN }}
         cache_key: "mise-{{platform}}-{{file_hash}}"
         # only saving the cache in the prerequisites job

diff --git a/.github/workflows/upgrade-provider.yml b/.github/workflows/upgrade-provider.yml
@@ -51,6 +51,8 @@ jobs:
       - name: Setup mise
         uses: jdx/mise-action@v3
         with:
+          # Latest working version. See https://github.com/jdx/mise/discussions/6781
+          version: 2025.10.16
           github_token: ${{ secrets.GITHUB_TOKEN }}
           cache_key: "mise-{{platform}}-{{file_hash}}"
           # only saving the cache in the prerequisites job

diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml
@@ -85,7 +85,7 @@ jobs:
         with:
           dotnet-version: 8.0.x
       - name: Setup Node
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6
         with:
           node-version: 20.x
           registry-url: https://registry.npmjs.org

diff --git a/Makefile b/Makefile
@@ -39,20 +39,36 @@ LDFLAGS=$(LDFLAGS_PROJ_VERSION) $(LDFLAGS_UPSTREAM_VERSION) $(LDFLAGS_EXTRAS) $(
 # Ensure all directories exist before evaluating targets to avoid issues with `touch` creating directories.
 _ := $(shell mkdir -p .make bin .pulumi/bin)
 
+# Installs all necessary tools with mise and records completion in a sentinel
+# file so dependent targets can participate in make's caching behaviour. The
+# environment is refreshed via an order-only prerequisite so it still runs on
+# every invocation without invalidating the sentinel.
+mise_install: .make/mise_install | mise_env
+
+.PHONY: mise_env
+mise_env:
+	@mise env -q  > /dev/null
+
+.make/mise_install:
+	@mise install -q
+	@touch $@
+
 # Build the provider and all SDKs and install ready for testing
-build: install_plugins provider build_sdks install_sdks
+build: .make/mise_install provider build_sdks install_sdks
+build: | mise_env
 # Keep aliases for old targets to ensure backwards compatibility
 development: build
 only_build: build
 # Prepare the workspace for building the provider and SDKs
 # Importantly this is run by CI ahead of restoring the bin directory and resuming SDK builds
-prepare_local_workspace: install_plugins upstream
+prepare_local_workspace: .make/mise_install upstream
+prepare_local_workspace: | mise_env
 # Creates all generated files which need to be committed
 generate: generate_sdks schema
 generate_sdks: generate_dotnet generate_go generate_nodejs generate_python
 build_sdks: build_dotnet build_go build_nodejs build_python
 install_sdks: install_dotnet_sdk install_go_sdk install_nodejs_sdk install_python_sdk
-.PHONY: development only_build build generate generate_sdks build_sdks install_sdks
+.PHONY: development only_build build generate generate_sdks build_sdks install_sdks mise_install mise_env
 
 help:
 	@echo "Usage: make [target]"
@@ -79,7 +95,7 @@ help:
 	@echo ""
 	@echo "Internal Targets (automatically run as dependencies of other targets)"
 	@echo "  prepare_local_workspace  Prepare for building"
-	@echo "  install_plugins          Install plugin dependencies"
+	@echo "  mise_install             Install tools with mise"
 	@echo "  upstream                 Initialize the upstream submodule, if present"
 	@echo ""
 	@echo "Language-Specific Targets"
@@ -97,7 +113,8 @@ GEN_ENVS := PULUMI_HOME=$(GEN_PULUMI_HOME) PULUMI_CONVERT_EXAMPLES_CACHE_DIR=$(G
 
 generate_dotnet: .make/generate_dotnet
 build_dotnet: .make/build_dotnet
-.make/generate_dotnet: .make/install_plugins bin/$(CODEGEN)
+.make/generate_dotnet: .make/mise_install bin/$(CODEGEN)
+.make/generate_dotnet: | mise_env
 	$(GEN_ENVS) $(WORKING_DIR)/bin/$(CODEGEN) dotnet --out sdk/dotnet/
 	cd sdk/dotnet/ && \
 		printf "module fake_dotnet_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
@@ -110,7 +127,8 @@ build_dotnet: .make/build_dotnet
 
 generate_go: .make/generate_go
 build_go: .make/build_go
-.make/generate_go: .make/install_plugins bin/$(CODEGEN)
+.make/generate_go: .make/mise_install bin/$(CODEGEN)
+.make/generate_go: | mise_env
 	$(GEN_ENVS) $(WORKING_DIR)/bin/$(CODEGEN) go --out sdk/go/
 	@touch $@
 .make/build_go: .make/generate_go
@@ -121,7 +139,8 @@ build_go: .make/build_go
 generate_java: .make/generate_java
 build_java: .make/build_java
 .make/generate_java: PACKAGE_VERSION := $(PROVIDER_VERSION)
-.make/generate_java: .make/install_plugins bin/$(CODEGEN)
+.make/generate_java: .make/mise_install bin/$(CODEGEN)
+.make/generate_java: | mise_env
 	$(GEN_ENVS) $(WORKING_DIR)/bin/$(CODEGEN) java --out sdk/java/
 	printf "module fake_java_module // Exclude this directory from Go tools\n\ngo 1.17\n" > sdk/java/go.mod
 	@touch $@
@@ -135,7 +154,8 @@ build_java: .make/build_java
 
 generate_nodejs: .make/generate_nodejs
 build_nodejs: .make/build_nodejs
-.make/generate_nodejs: .make/install_plugins bin/$(CODEGEN)
+.make/generate_nodejs: .make/mise_install bin/$(CODEGEN)
+.make/generate_nodejs: | mise_env
 	$(GEN_ENVS) $(WORKING_DIR)/bin/$(CODEGEN) nodejs --out sdk/nodejs/
 	printf "module fake_nodejs_module // Exclude this directory from Go tools\n\ngo 1.17\n" > sdk/nodejs/go.mod
 	@touch $@
@@ -149,7 +169,8 @@ build_nodejs: .make/build_nodejs
 
 generate_python: .make/generate_python
 build_python: .make/build_python
-.make/generate_python: .make/install_plugins bin/$(CODEGEN)
+.make/generate_python: .make/mise_install bin/$(CODEGEN)
+.make/generate_python: | mise_env
 	$(GEN_ENVS) $(WORKING_DIR)/bin/$(CODEGEN) python --out sdk/python/
 	printf "module fake_python_module // Exclude this directory from Go tools\n\ngo 1.17\n" > sdk/python/go.mod
 	cp README.md sdk/python/
@@ -234,7 +255,8 @@ tfgen_no_deps: .make/schema
 .make/schema: export PULUMI_CONVERT_EXAMPLES_CACHE_DIR := $(WORKING_DIR)/.pulumi/examples-cache
 .make/schema: export PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION := $(PULUMI_CONVERT)
 .make/schema: export PULUMI_MISSING_DOCS_ERROR := $(PULUMI_MISSING_DOCS_ERROR)
-.make/schema: bin/$(CODEGEN) .make/install_plugins .make/upstream
+.make/schema: bin/$(CODEGEN) .make/mise_install .make/upstream
+.make/schema: | mise_env
 	$(WORKING_DIR)/bin/$(CODEGEN) schema --out provider/cmd/$(PROVIDER)
 	(cd provider && VERSION=$(PROVIDER_VERSION) go generate cmd/$(PROVIDER)/main.go)
 	@touch $@
@@ -265,7 +287,6 @@ debug_tfgen:
 	dlv  --listen=:2345 --headless=true --api-version=2  exec $(WORKING_DIR)/bin/$(CODEGEN) -- schema --out provider/cmd/$(PROVIDER)
 .PHONY: debug_tfgen
 
-include scripts/plugins.mk
 include scripts/crossbuild.mk
 
 # Permit providers to extend the Makefile with provider-specific Make includes.

diff --git a/scripts/plugins.mk b/scripts/plugins.mk