name: "Verify Release"

on:
  workflow_dispatch:
    inputs:
      providerVersion:
        description: "The version of the provider to verify"
        required: true
        type: string
      enableMacRunner:
        description: "Enable the MacOS runner in addition to Linux and Windows. Defaults to 'false'."
        required: false
        type: boolean
      skipGoSdk:
        description: "Skip the Go SDK verification. Defaults to 'false'. Enable this when verifying a pre-release for which we don't publish the Go SDK (for PRs and the default branch)."
        required: false
        type: boolean
        default: false
      pythonVersion:
        description: "Optional python SDK version to verify. Defaults to inputs.providerVersion."
        type: string
        required: false
  workflow_call:
    inputs:
      providerVersion:
        description: "The version of the provider to verify"
        required: true
        type: string
      skipGoSdk:
        description: "Skip the Go SDK verification. Defaults to 'false'. This is used when we're not publishing a Go SDK on the default branch build."
        required: false
        type: boolean
        default: false
      pythonVersion:
        description: "Optional python SDK version to verify. Defaults to inputs.providerVersion."
        type: string
        required: false

env:
  JAVA_SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
  JAVA_SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
  JAVA_SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
  OSSRH_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
  OSSRH_USERNAME: ${{ secrets.OSSRH_USERNAME }}
  PULUMI_API: https://api.pulumi-staging.io
  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
  PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
  TF_APPEND_USER_AGENT: pulumi

jobs:
  verify-release:
    name: verify-release
    # We don't have any release verification configurations, so we never run this workflow.
    # Configure your .ci-mgmt.yaml files to include the release verification configurations e.g.
    # releaseVerification:
    #   nodejs: path/to/nodejs/project
    #   python: path/to/python/project
    #   dotnet: path/to/dotnet/project
    #   go: path/to/go/project
    if: false
    strategy:
      matrix:
        # We don't have any release verification configurations, so we only run on Linux to print warnings to help users configure the release verification.
        runner: ["ubuntu-latest"]
    runs-on: ${{ matrix.runner }}
    steps:
      - name: Configure Git to checkout files with long names
        run: git config --global core.longpaths true
      - name: Checkout Repo
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false      
      - id: esc-secrets
        name: Map environment to ESC outputs
        uses: ./.github/actions/esc-action
      - name: Setup Node
        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6
        with:
          node-version: 20.x
          registry-url: https://registry.npmjs.org
      - name: Install Go
        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6
        with:
          go-version: "1.21.x"
          cache-dependency-path: |
            provider/*.sum
            upstream/*.sum
            sdk/go/*.sum
            sdk/*.sum
            *.sum
          cache: true
      - name: Set Go Toolchain to auto explicitly
        run: |
          echo "GOTOOLCHAIN=auto" >> "$GITHUB_ENV"
      - name: Install Pulumi CLI
        uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 # v6
        with:
          pulumi-version: "dev"