Repository navigation
Conversation
claude-code-review.yml reads the PR author from `gh pr view --json author`, which spells a GitHub App `app/<slug>`, but the trusted-bot list carried only `eon-pulumi-agent[bot]` (the REST webhook spelling). The check fell through to the collaborator API, got "none", and skipped every gated step while the run reported success: no card, a stuck review:in-progress label, and a Sentinel G1 that never clears. Every /new-review on #22408 ended this way. List both spellings for every trusted bot, as workprentice already was, in all four lane copies (test_workflow_sanity.py keeps them identical). github-copilot gets its app/ twin too; it trusts no new identity. Claude-Session: https://claude.ai/code/session_01KH71jeP91g5Y6Xob2cxi8x Co-authored-by: Claude <noreply@anthropic.com>
Bumps the security group with 1 update in the /theme/stencil directory: [js-yaml](https://github.com/nodeca/js-yaml). Updates `js-yaml` from 3.14.2 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.2...3.15.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the security group with 1 update in the / directory: [markdown-it](https://github.com/markdown-it/markdown-it). Updates `markdown-it` from 14.3.2 to 14.3.3 - [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.3/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.3.2...14.3.3) --- updated-dependencies: - dependency-name: markdown-it dependency-version: 14.3.3 dependency-type: direct:production dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix Terraform module package names in the modules guide * Add region step and Java workaround to the Terraform modules guide
Self-hosted Pulumi Cloud supports OpenSearch 2.x and 3.x only, matching the search component page.
* Keep marketing-web proxied paths in one list Move the paths www.pulumi.com proxies to pulumi/marketing-web into infrastructure/marketingWebPaths.ts. index.ts maps it to cache behaviors and exports it as a stack output, which the cache-flush workflow now reads in place of its two hardcoded lists. The workflow passed $PATHS unquoted, so bash globbed /dev/* against the runner's device files and Dev Center subpages were never flushed; set noglob. Rename it to invalidate-marketing-web-cache.yml, since it covers /community, /pricing, and /up too. The dev-deployed dispatch type is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Quote workflow_dispatch input description The unquoted "default: " inside it made the workflow file invalid YAML. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Trim the marketing-web pages section of AGENTS.md Drop the /up A/B-test and noindex note and the inventory of pricing page parts; keep where each page is built and what stays in this repo. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Bumps the security group with 1 update in the /theme directory: [fast-uri](https://github.com/fastify/fast-uri). Updates `fast-uri` from 3.1.7 to 3.1.9 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.7...v3.1.9) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.9 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#22488) Bumps the security group with 3 updates in the /infrastructure directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [js-yaml](https://github.com/nodeca/js-yaml) and [minimatch](https://github.com/isaacs/minimatch). Updates `brace-expansion` from 1.1.12 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21) Updates `js-yaml` from 3.15.0 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.15.0...3.15.2) Updates `minimatch` from 3.1.2 to 3.1.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: security - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: security - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
… 3 updates (#22489) Bumps the security group with 3 updates in the /infrastructure/versioned-docs directory: [brace-expansion](https://github.com/juliangruber/brace-expansion), [js-yaml](https://github.com/nodeca/js-yaml) and [undici](https://github.com/nodejs/undici). Updates `brace-expansion` from 1.1.15 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.15...v1.1.21) Updates `js-yaml` from 3.15.1 to 3.15.2 - [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.15.1...3.15.2) Updates `undici` from 6.29.0 to 6.29.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.29.0...v6.29.1) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: security - dependency-name: js-yaml dependency-version: 3.15.2 dependency-type: indirect dependency-group: security - dependency-name: undici dependency-version: 6.29.1 dependency-type: indirect dependency-group: security ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: workprentice <257153108+workprentice@users.noreply.github.com>
Co-authored-by: workprentice <257153108+workprentice@users.noreply.github.com>
…s.md (#22508) Automated existing-content review. Co-authored-by: Claude <noreply@anthropic.com>
…ptions/quickstart-docker-compose.md (#22509) Automated existing-content review. Co-authored-by: Claude <noreply@anthropic.com>
Mirror the 'self-hosted Pulumi' retired-names row in RetiredNames.yml. Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Add guide: fetch secrets at runtime with the ESC SDK * Tighten token-scoping guidance in ESC runtime secrets guide - Correct the token prerequisites: org tokens aren't team-scoped, and both team tokens and role-less org tokens inherit the org's default Member permissions, so note the Environment permissions setting. - State edition availability for teams, org/team tokens, and custom roles with pulumi-cloud-editions. - Mention OIDC token exchange as an alternative to a stored token. - Check apiKey in the Go sample like databaseUrl. - Move the guide out of "Run commands" into its own index section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HvUtCjrwekjeTmtaqpaw2K --------- Co-authored-by: workprentice <257153108+workprentice@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>
* Content glow-up: content/docs/iac/guides/migration/_index.md Automated existing-content review. Co-Authored-By: Claude <noreply@anthropic.com> * Soften conversion structure-preservation claim (F1) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
* Add KubeCon NA 2026 attendee guide blog post New community post from the Pulumi-at-KubeCon attendee guide, authored by Traci Myers (new author profile added). Kubernetes feature image and social copy for X, LinkedIn, and Bluesky. * Use designer-supplied KubeCon SLC 2026 feature image * Add Traci Myers author photo * Publish KubeCon guide Nov 6; unpin AICR hero; restore panel title * Bulletize the talks section for scannability * Make talks a bulleted list with paragraph spacing; link X and LinkedIn in sign-off
* Add fall 2026 changelog catch-up entries * Address review feedback on fall 2026 changelog entries Fix CLI claims on the OIDC setup and ESC change-request entries, point the Neo-in-Slack entry at the Slack integration docs, soften policy-group timing, and reword the access-management note. Remove the Pulumi Discovery and Neo Sonnet 5.5 entries.
The label from #22658 was never created, so nothing carries the old name and the rename is free. `review:long-running` sits alongside `review:author-stalled` and `review:waived` as a PR-process label. It is safe in the `review:` namespace: label exclusivity (set-review-label.sh, cleanup-review-leftovers.py) works from explicit state-label lists, not the prefix, so the review pipeline never strips it. Also gives it its own color instead of reusing review:trivial's. Claude-Session: https://claude.ai/code/session_01RR4Mznb8uEaYJjwhjEQ5dg Co-authored-by: Claude <noreply@anthropic.com>
The project that we were adding issues to has long since been closed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
concurrently 9.x pins shell-quote@1.9.0, which is affected by GHSA-pqg4-j6r4-53mv (critical). 10.0.6 depends on shell-quote@1.12.0. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Team tokens now authenticate as the team's service principal (team-account:<team-id>) rather than the organization. Document the identity, where it appears, the grants a team-token-created stack gets, and what happens on team deletion. Fix the ESC user.login description. Fixes #20493 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…22749) * Add REVIEW.md so Eon can approve docs PRs from the reviewer's guide Eon's review reads a root REVIEW.md first and lets it override its defaults. This one turns it into the docs approver: find the pipeline's author card and reviewer's guide (github-actions[bot] only, current at head), require nothing open in REVIEW_STATE and the Sentinel's other gates green, work each⚠️ row against the diff, and spot-check what the guide can't see. It skips fact verification, never approves external, bot-authored, or non-docs/programs PRs, and overrides the default one-way-door rule for launches, since a docs page is a two-way door. The Sentinel still ignores Eon's approval (it's on `bots:`), so this runs in shadow until a follow-up adds a bot_approvers lane. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RR4MzoaHaWXgA1JLEzZyhK * REVIEW.md: approve bot-authored PRs only when their review is clean Bot PRs move from "never approve" to "clean or nothing": the author card current at head, every finding recorded `fixed` (a bot refuting, deferring, or accepting its own finding is a decline), no held dispute, and every⚠️ row holding. Adds "never approve your own PR", and limits the author_association test to human authors, since App identities often show NONE or CONTRIBUTOR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RR4MzoaHaWXgA1JLEzZyhK --------- Co-authored-by: Claude <noreply@anthropic.com>
* Fix walkthrough examples and claims on How Pulumi IaC works * Tighten the replacement order wording
The gh backend only recognized 404 in a failed call's stderr, so every other failure raised GhError with status=None. team_member() and the other membership lookups treat a 403 as "can't tell", but never saw one, and a repo-scoped token's 403 on orgs/<org>/teams/... crashed collect.py instead of falling back. Parse the `(HTTP NNN)` suffix gh prints. Claude-Session: https://claude.ai/code/session_01RR4MzrF8FNf5Qt2WFKm8Lw Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )