ci: harden generated-artifact checks and pre-commit flow

Author: bruno-espino

.github/workflows/prerequisites.yml

@@ -90,7 +90,21 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: Generate schema
-      run: make schema
+      run: make schema PULUMI_CONVERT=0
+    - name: Check schema worktree clean
+      uses: pulumi/git-status-check-action@v1
+    - name: Regenerate SDKs
+      run: make generate_sdks PULUMI_CONVERT=0
+    - name: Check SDK worktree clean
+      uses: pulumi/git-status-check-action@v1
+      with:
+        # Keep these in sync with build_sdk.yml to avoid false positives on
+        # provider-version derived files.
+        allowed-changes: |
+          sdk/**/pulumi-plugin.json
+          sdk/go/**/pulumiUtilities.go
+          sdk/nodejs/package.json
+          sdk/python/pyproject.toml
     - name: Build provider binary
       run: make provider
     - name: Unit-test provider code

.pre-commit-config.yaml

@@ -0,0 +1,10 @@
+minimum_pre_commit_version: "3.0.0"
+repos:
+  - repo: local
+    hooks:
+      - id: generated-artifacts
+        name: Ensure generated artifacts are in sync
+        entry: ./scripts/precommit-check-generated.sh
+        language: system
+        pass_filenames: false
+        files: ^(provider/|schema/|sdk/|Makefile|\.ci-mgmt\.yaml|README\.md|examples/)

CONTRIBUTING.md

@@ -20,11 +20,16 @@ https://github.com/pulumi/pulumi/blob/master/CONTRIBUTING.md#developing) for det
 
 ## Committing Generated Code
 
-You must generate and check in the SDKs on each pull request containing a code change, e.g. adding a new resource to `resources.go`.
+You must generate and check in the schema and SDKs on each pull request containing provider changes.
 
-1. Run `make build_sdks` from the root of this repository
-1. Open a pull request containing all changes
-1. *Note:* If a large number of seemingly-unrelated diffs are produced by `make build_sdks` (for example, lots of changes to comments unrelated to the change you are making), ensure that the latest dependencies for the provider are installed by running `go mod tidy` in the `provider/` directory of this repository.
+1. Install [pre-commit](https://pre-commit.com/) and run: `pre-commit install`
+1. Regenerate committed artifacts before opening a PR:
+   - `make schema PULUMI_CONVERT=0`
+   - `make generate_sdks PULUMI_CONVERT=0`
+1. Open a pull request containing all generated changes.
+1. If a large number of unrelated diffs are produced, run `go mod tidy` in `provider/` and regenerate.
+
+The local pre-commit hook runs generation checks only when relevant files are staged. Use `SKIP=generated-artifacts git commit ...` to bypass it for one commit.
 
 ## Running Integration Tests
 

scripts/precommit-check-generated.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+echo "[pre-commit] Regenerating schema and SDKs to verify generated files are in sync..."
+make schema PULUMI_CONVERT=0
+make generate_sdks PULUMI_CONVERT=0
+
+if ! git diff --quiet -- provider/cmd/pulumi-resource-logfire/schema.json provider/cmd/pulumi-resource-logfire/schema-embed.json sdk; then
+  echo "[pre-commit] Generated artifacts changed after regeneration."
+  echo "[pre-commit] Run the following and re-commit:"
+  echo "  git add provider/cmd/pulumi-resource-logfire/schema.json provider/cmd/pulumi-resource-logfire/schema-embed.json sdk"
+  exit 1
+fi