Pulumi Cloud stacks
llms.txtlists every page for an agent
Who it is for
Your stacks live in Pulumi Cloud, and you want previews and updates to run from your own forge's pull requests.
Features
- State and update history stay in Pulumi Cloud next to ESC environments and Insights
- Previews and updates run in your forge's CI, logged in with a Pulumi Cloud token traded from the job's OIDC token
- Stock Pulumi resolves each stack's ESC environments on the Pulumi Cloud backend with that token
- Pulumi Cloud's stack lock keeps updates to a stack in order
- An approval binds the preview digest, on top of Pulumi Cloud's own controls
Every setup gets
- One preview note on every pull request
- Updates of the previews you approved
- No overlapping or stale updates
- Re-preview from a comment
- Scheduled drift checks
- Separate identities to preview and to update
- Policy on every preview, CrossGuard included
- An audit trail in your own repository
- Secrets stay [secret] in notes
- Your backend and your runners, as they are
Differences
- For the stacks plywood runs, your forge's CI starts each update in place of Pulumi Deployments.
- The preview job and the update job log in with separate access tokens.