Automated Pulumi/Pulumi upgrade

[pulumi-bot]

No description provided.

[eon-pulumi]

Review Verdict: Approved

Mechanical, forward-only dependency bump (pulumi/pulumi v3.256.0 -> v3.259.0 plus transitive deps) touching only go.mod/go.sum; verified no version downgrades, go build/vet/mod verify succeed, and the change reproduces byte-identical from go mod tidy. The one required CI check is green; a non-required test shard failed on an unrelated infra flake. Automated low-risk assessment, not a human review.

---

View session · Was this review helpful? Yes · No

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.47%. Comparing base (2d1b4ed) to head (0068843).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3587   +/-   ##
=======================================
  Coverage   70.47%   70.47%           
=======================================
  Files         358      358           
  Lines       39474    39474           
=======================================
  Hits        27820    27820           
  Misses       9705     9705           
  Partials     1949     1949           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[eon-pulumi-agent]

Reviewed this automated dependency bump, which touches only go.mod/go.sum in the root module and tools/. It raises github.com/pulumi/pulumi/pkg/v3 and github.com/pulumi/pulumi/sdk/v3 from v3.256.0 to v3.259.0 in lockstep, plus a large set of transitive dependency updates (AWS SDK v2, Google Cloud, OpenTelemetry, golang.org/x/*, etc). No .go source files change.

Verification performed (independently, and corroborated by four specialist passes covering correctness, security, AGENTS.md compliance, and tests):

• Diffed every changed module version across both go.mod files: every bump moves strictly forward, no accidental downgrades.
• go build ./... and go vet ./... succeed against the new dependency graph in both the root module and tools/.
• go mod verify passes for both modules; reproducing go mod tidy locally yields a byte-identical go.mod/go.sum, confirming this matches the repo's make tidy convention (AGENTS.md).
• go.work/go.work.sum are correctly absent (gitignored, per .gitignore), so no workspace-refresh omission.
• New transitive-only dependencies pulled in by the SDK bump (e.g. keyring/TPM-related packages) are not reachable from this bridge's code paths, so they don't introduce new attack surface here.

CI: the one required check from the branch ruleset ("Ensure test assets build cleanly") is green. The full Test and Lint matrix is still finishing; one shard (test (1.26.x, ubuntu-latest, DEFAULT, 0)) shows a failure, but its log shows it failed within 6 seconds on a fetch failed error while authenticating to the pulumi/esc-action secrets step, before any test code ran — an infrastructure flake unrelated to this diff, not a required check, and not evidence of a regression from the dependency bump.

No issues found across any of the four specialist passes (correctness, security, tests, AGENTS.md compliance).