[internal] Update GitHub Actions workflow files (#319)

.github/workflows/main.yml

@@ -177,7 +177,7 @@ jobs:
 
         aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     name: lint
     runs-on: ubuntu-latest
     steps:

.github/workflows/master.yml

@@ -177,7 +177,7 @@ jobs:
 
         aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     name: lint
     runs-on: ubuntu-latest
     steps:

.github/workflows/prerelease.yml

@@ -124,7 +124,7 @@ jobs:
         - go
         - java
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     name: lint
     runs-on: ubuntu-latest
     steps:

.github/workflows/release.yml

@@ -137,7 +137,7 @@ jobs:
       run: pulumictl create docs-build pulumi-${{ env.PROVIDER }}
         "${GITHUB_REF#refs/tags/}"
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     name: lint
     runs-on: ubuntu-latest
     steps:

.github/workflows/run-acceptance-tests.yml

@@ -144,7 +144,7 @@ jobs:
         repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
         token: ${{ secrets.PULUMI_BOT_TOKEN }}
   lint:
-    container: golangci/golangci-lint:v1.51
+    container: golangci/golangci-lint:v1.54.1
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository
     name: lint
@@ -261,16 +261,43 @@ jobs:
         fields: repo,commit,author,action
         status: ${{ job.status }}
   sentinel:
-    if: github.event_name == 'repository_dispatch' ||
-      github.event.pull_request.head.repo.full_name == github.repository
     name: sentinel
+    # We would like to be able to specify `sentinel` as the only required job for this
+    # workflow. To do that, we need `sentinel` to succeed only when it is safe to
+    # merge and fail in all other cases.
+    #
+    # We can't use the default `if: success()`, since GitHub interprets a skipped job as a
+    # success, and by default a dependee job failing will skip a dependent job. That means
+    # if a test step fails, then it will skip `sentinel` so GitHub will register
+    # `sentinel` as succeeded.
+    #
+    # GitHub documents `jobs.result` as:
+    #
+    #	The result of a job in the reusable workflow. Possible values are success,
+    #	failure, cancelled, or skipped.
+    #
+    # GitHub documents `cancelled()` as:
+    #
+    #	Returns true if the workflow was canceled.
+    #
+    # Combining these terms gives us an intuitive definition of success:
+    #
+    #	We have succeeded when no dependent workflow has failed and the job was
+    #	not cancelled.
+    #
+    if: (github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository) &&
+      ! cancelled()
     needs:
     - test
     - lint
     runs-on: ubuntu-latest
     steps:
-    - name: Is workflow a success
-      run: echo yes
+    - name: Workflow is not a success
+      if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped')
+      run: exit 1
+    - name: Workflow is a success
+      run: echo "🎉🎈🎉🎈🎉"
   test:
     if: github.event_name == 'repository_dispatch' ||
       github.event.pull_request.head.repo.full_name == github.repository

.github/workflows/upgrade-bridge.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Call upgrade provider action
-      uses: pulumi/[email protected].5
+      uses: pulumi/[email protected].6
       with:
         kind: bridge
     - env:

.github/workflows/upgrade-provider.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Call upgrade provider action
-      uses: pulumi/[email protected].5
+      uses: pulumi/[email protected].6
       with:
         kind: all
     - env: