pulumi/actions

Run Pulumi CLI commands (preview, up, destroy) against a stack from a workflow.

Official actionCategory: Infrastructure & KubernetesLatest v7View on GitHub

What it does

pulumi/actions runs a Pulumi command (preview, up, destroy, refresh) against a named stack, using your regular Pulumi program in the repo.

A common pattern is preview with comment-on-pr: true on pull requests and up on merges to the default branch.

Usage

workflow (.yml)

steps:
  - uses: actions/checkout@v4
  - uses: actions/setup-node@v4
    with:
      node-version: 22
  - run: npm ci
  - uses: pulumi/actions@v7
    with:
      command: up
      stack-name: my-org/dev
    env:
      PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}

Inputs

Input	Description	Default	Required
`command`	Pulumi command to run, eg. up.	-	No
`stack-name`	Which stack you want to apply to, eg. dev.	-	No
`work-dir`	Location of your Pulumi files.	`./`	No
`pulumi-version`	Install a specific version of the Pulumi CLI.	-	No
`comment-on-pr`	If true, a comment will be created with results.	`false`	No
`github-token`	GitHub token (used for PR comments).	`${{ github.token }}`	No
`refresh`	Execute the operation with the --refresh option.	`false`	No
`upsert`	Create the stack if it currently does not exist.	`false`	No

Outputs

Output	Description
`output`	Output from running command.

Notes

If command is omitted the action just installs the Pulumi CLI for later run: steps.

Your program's dependencies must be installed first (npm ci, pip install, etc.), the action runs the program, it does not build it.

Cloud provider credentials are separate from the Pulumi token: pair with configure-aws-credentials, google-github-actions/auth, or azure/login as appropriate.

Common errors

PULUMI_ACCESS_TOKEN must be set for login during non-interactive CLI sessions means the token env var is missing (or you have not pointed cloud-url at a self-managed backend).
A "stack not found" style failure on first deploy of a new stack is fixed by upsert: true, which creates the stack instead of requiring it to exist.
PR comments not appearing usually means comment-on-pr: true is set but the job lacks pull-requests: write permission for the token.

Security and pinning

Store PULUMI_ACCESS_TOKEN as a secret and prefer OIDC-based cloud credentials for the underlying provider instead of static keys.
Pin the action to a commit SHA and pin pulumi-version; an infra-mutating step is the last place you want a floating toolchain.

Alternatives and related

hashicorp/setup-terraformInstall the Terraform CLI and (optionally) wrap it to expose plan output in later steps. aws-actions/configure-aws-credentialsAuthenticate to AWS in a workflow, ideally by assuming a role with OIDC (no stored keys). google-github-actions/authAuthenticate to Google Cloud, ideally via keyless Workload Identity Federation. azure/loginLog in to Azure in a workflow, using OIDC federated credentials or a service principal.

Frequently asked questions

How do I show a Pulumi preview on pull requests?

Run the action with command: preview and comment-on-pr: true on pull_request events, and give the job pull-requests: write. edit-pr-comment (default true) keeps updating one comment instead of stacking new ones.