deploy-infra.yml

permissions: write-all
name: Deploy infrastructure stacks
on:
  merge_group: {}
  pull_request: {}
  workflow_dispatch: {}

env:
  ESC_ACTION_OIDC_AUTH: true
  ESC_ACTION_OIDC_ORGANIZATION: pulumi
  ESC_ACTION_OIDC_REQUESTED_TOKEN_TYPE: urn:pulumi:token-type:access_token:organization
  ESC_ACTION_ENVIRONMENT: github-secrets/pulumi-ci-mgmt

jobs:
  deploy-provider-repos:
    name: Deploy provider repository settings
    runs-on: ubuntu-latest
    concurrency:
      group: pulumi-provider-repos
      cancel-in-progress: false # Don't cancel in-progress deployments
    steps:
      - name: Fetch secrets from ESC
        id: esc-secrets
        uses: pulumi/esc-action@32dda43ffe7a2ab21e6bce11c781b44a3e5623cf # v3

      - name: Checkout Repo
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Install mise
        uses: jdx/mise-action@8d3b0ba20a9cea7b883d922ea958553c941ab082
        with:
          version: 2026.3.7

      - name: Install dependencies
        working-directory: infra/providers
        run: npm ci

      - name: Pulumi login
        run: pulumi login https://api.pulumi.com
        env:
          PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}

      - name: Select stack
        working-directory: infra/providers
        run: pulumi stack select pulumi/pulumi-provider-repos/production

      - name: Pulumi up
        if: github.event_name == 'merge_group'
        working-directory: infra/providers
        run: pulumi up --yes --skip-preview
        env:
          PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}

      - name: Pulumi preview
        if: github.event_name == 'pull_request'
        working-directory: infra/providers
        run: pulumi preview
        env:
          PULUMI_ACCESS_TOKEN: ${{ steps.esc-secrets.outputs.PULUMI_ACCESS_TOKEN }}