Add PR validation for staging Pulumi component references by Copilot · Pull Request #9 · ManagedKube/devops-with-ai

Copilot · 2025-12-10T19:20:57Z

Implementation Complete ✅

Summary

Created .github/workflows/check-staging-pulumi-references.yaml that validates Pulumi component references in staging environments on every PR.

Three Validation Checks:

Local Path References - Fails if Pulumi.yaml contains relative paths like vpc: ../../../../components/aws/vpc@0.0.0
SDK Filename Versions - Fails if any SDK file in staging is named *-0.0.0.yaml
SDK Content Versions - Fails if any SDK YAML in staging contains version: 0.0.0

Security & Quality:

✅ Pinned actions to SHA commits
✅ Minimal permissions (read + PR write)
✅ CodeQL scan: 0 alerts
✅ YAML syntax validated
✅ Clear error messages with remediation guidance

Testing:

✅ Added comment line to VPC Pulumi.yaml to trigger workflow
✅ Workflow should detect local path: vpc: ../../../../components/aws/vpc@0.0.0
✅ Workflow should detect SDK file: vpc-0.0.0.yaml
✅ Workflow should detect version in SDK: version: 0.0.0

This workflow prevents merging PRs with development-only references (local paths and 0.0.0 versions) in staging, ensuring production-ready versioned components are used.

Original prompt

This section details on the original issue you should resolve

<issue_title>staging PR check for local path pulumi component reference</issue_title>
<issue_description>Create a github action for PRs. Run this on every PR commit. For any files under this path: "pulumi/environments/aws/*" that is named Pulumi.yaml. Check inside that file for the following:
packages:
  vpc: ../../../../components/aws/vpc@0.0.0
References to any packages with a relative path this github action should fail.

Also, any files in this path: "pulumi/environments/aws/staging//sdks//*"

if it named something like: "*-0.0.0.yaml" the github action should fail.

Then look inside that file and if "0.0.0" in it, it should fail.

</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes staging PR check for local path pulumi component reference #8

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: sekka1 <575972+sekka1@users.noreply.github.com>

sekka1 · 2025-12-10T19:35:23Z

@copilot the github actions file looks good. Lets put a new line in the pulumi vpc instantiation file to test this out.

Co-authored-by: sekka1 <575972+sekka1@users.noreply.github.com>

Copilot · 2025-12-10T19:39:42Z

@copilot the github actions file looks good. Lets put a new line in the pulumi vpc instantiation file to test this out.

Added a test comment line to the VPC Pulumi.yaml file in commit 65f8de4. This change will trigger the workflow validation, which should detect and fail on:

The local path reference: vpc: ../../../../components/aws/vpc@0.0.0
The SDK file: vpc-0.0.0.yaml
The version in SDK content: version: 0.0.0

The workflow will demonstrate all three validation checks working correctly.

github-actions · 2025-12-10T19:41:37Z

🍹 `preview` on vpc/organization/vpc/staging

Pulumi report

  Previewing update (staging):
@ previewing update....
pulumi:pulumi:Stack: (same)
  [urn=urn:pulumi:staging::vpc::pulumi:pulumi:Stack::vpc-staging]
@ previewing update....
Resources:
  21 unchanged

Copilot

Pull request overview

This PR introduces a GitHub Actions workflow to enforce component versioning standards in staging Pulumi environments. The workflow prevents merging PRs that contain development-only references (local paths and 0.0.0 versions), ensuring staging uses production-ready versioned components from git URLs.

Key Changes:

Created automated PR validation workflow with three checks: local path detection, SDK filename version validation, and SDK content version validation
Added test comment to VPC Pulumi.yaml to demonstrate workflow triggering
Implemented GitHub Actions security best practices with pinned action SHAs and minimal permissions

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
`.github/workflows/check-staging-pulumi-references.yaml`	New workflow that validates Pulumi component references on PRs, checking for local paths and 0.0.0 versions in staging
`pulumi/environments/aws/staging/40-vpc/Pulumi.yaml`	Added comment line to trigger workflow for testing purposes

Critical Issue Identified: The staging VPC Pulumi.yaml file currently contains a local path reference with version 0.0.0 (line 6), which is exactly what the new workflow is designed to prevent. This must be updated to a git URL reference with a proper semantic version before merging, otherwise the workflow will fail on all future PRs touching this file.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-10T19:45:19Z

pulumi/environments/aws/staging/40-vpc/Pulumi.yaml

 runtime: yaml
+# Testing PR validation workflow for local path references
 packages:
  vpc: ../../../../components/aws/vpc@0.0.0


This staging Pulumi.yaml file contains a local path reference with version 0.0.0, which is exactly what the new workflow is designed to prevent. If this PR is merged with this local reference, the new workflow will fail on all future PRs that touch this file. This should be changed to use a git URL reference with a proper semantic version (e.g., "https://github.com/ManagedKube/devops-with-ai.git/pulumi/components/aws/vpc@0.0.1") before merging, as shown in the github-oidc example.

Suggested change

vpc: ../../../../components/aws/vpc@0.0.0

vpc: https://github.com/ManagedKube/devops-with-ai.git/pulumi/components/aws/vpc@0.0.1

Copilot · 2025-12-10T19:45:19Z

.github/workflows/check-staging-pulumi-references.yaml

+  check-references:
+    name: Validate Pulumi Component References
+    runs-on: ubuntu-latest


The job is missing a timeout-minutes configuration. According to GitHub Actions best practices, adding a timeout prevents hung workflows from consuming resources indefinitely. Consider adding "timeout-minutes: 10" to the job definition, similar to the test-sg-component workflow.

Copilot · 2025-12-10T19:45:20Z

.github/workflows/check-staging-pulumi-references.yaml

+              echo ""
+              EXIT_CODE=1
+            fi
+          done < <(find pulumi/environments/aws -type f -name "Pulumi.yaml")


The find command searches all Pulumi.yaml files under "pulumi/environments/aws/" but the workflow is specifically for staging validation. If other environments (like dev or prod) are added in the future, this check will incorrectly validate them too. Consider restricting the search to staging only by changing the path to "pulumi/environments/aws/staging".

Suggested change

done < <(find pulumi/environments/aws -type f -name "Pulumi.yaml")

done < <(find pulumi/environments/aws/staging -type f -name "Pulumi.yaml")

Copilot · 2025-12-10T19:45:20Z

.github/workflows/check-staging-pulumi-references.yaml

+            # Check if the file contains packages with relative paths (starting with ../ or ./)
+            if grep -E '^\s+\w+:\s+\.\.' "$file"; then
+              echo "❌ ERROR: Found local path reference in $file"
+              echo "Local path references (e.g., ../../../../components/aws/vpc@0.0.0) are not allowed in staging."


The error message states "are not allowed in staging" but the check on line 41 scans all files under "pulumi/environments/aws/", not just staging. This creates a mismatch between what the message says and what is actually checked. The message should either be updated to match the broader scope, or the search path should be restricted to staging only.

Copilot · 2025-12-10T19:45:20Z

.github/workflows/check-staging-pulumi-references.yaml

+            if grep -E '^\s+\w+:\s+\.\.' "$file"; then
+              echo "❌ ERROR: Found local path reference in $file"
+              echo "Local path references (e.g., ../../../../components/aws/vpc@0.0.0) are not allowed in staging."


The comment mentions checking for both "../" and "./" but the regex pattern on line 34 only checks for ".." (parent directory references). If the intention is to also block same-directory references starting with "./", the regex pattern should be updated to match both patterns.

Suggested change

if grep -E '^\s+\w+:\s+\.\.' "$file"; then

echo "❌ ERROR: Found local path reference in $file"

echo "Local path references (e.g., ../../../../components/aws/vpc@0.0.0) are not allowed in staging."

if grep -E '^\s+\w+:\s+\.(\.|/)+' "$file"; then

echo "❌ ERROR: Found local path reference in $file"

echo "Local path references (e.g., ../../../../components/aws/vpc@0.0.0 or ./components/aws/vpc@0.0.0) are not allowed in staging."

Initial plan

83367d4

Copilot AI assigned Copilot and sekka1 Dec 10, 2025

Copilot started work on behalf of sekka1 December 10, 2025 19:21 View session

Copilot AI and others added 2 commits December 10, 2025 19:26

Add GitHub Actions workflow to check staging Pulumi references

c8b8593

Co-authored-by: sekka1 <575972+sekka1@users.noreply.github.com>

Improve regex pattern for detecting relative paths

521b810

Co-authored-by: sekka1 <575972+sekka1@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Create GitHub action for PRs to check Pulumi component references~~ Add PR validation for staging Pulumi component references Dec 10, 2025

Copilot AI requested a review from sekka1 December 10, 2025 19:33

Copilot finished work on behalf of sekka1 December 10, 2025 19:33

Copilot started work on behalf of sekka1 December 10, 2025 19:35 View session

Add test comment to VPC Pulumi.yaml to trigger workflow validation

65f8de4

Co-authored-by: sekka1 <575972+sekka1@users.noreply.github.com>

Copilot AI temporarily deployed to production December 10, 2025 19:40 Inactive

sekka1 marked this pull request as ready for review December 10, 2025 19:41

Copilot AI review requested due to automatic review settings December 10, 2025 19:41

sekka1 merged commit d146662 into main Dec 10, 2025
4 checks passed

sekka1 deleted the copilot/add-pr-check-for-pulumi-reference branch December 10, 2025 19:41

Copilot finished work on behalf of sekka1 December 10, 2025 19:41

Copilot started reviewing on behalf of sekka1 December 10, 2025 19:41 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add PR validation for staging Pulumi component references#9

Add PR validation for staging Pulumi component references#9
sekka1 merged 4 commits intomainfrom
copilot/add-pr-check-for-pulumi-reference

Copilot AI commented Dec 10, 2025 •

edited

Loading

Uh oh!

sekka1 commented Dec 10, 2025

Uh oh!

Copilot AI commented Dec 10, 2025

Uh oh!

Uh oh!

github-actions bot commented Dec 10, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 10, 2025

Uh oh!

Copilot AI Dec 10, 2025

Uh oh!

Copilot AI Dec 10, 2025

Uh oh!

Copilot AI Dec 10, 2025

Uh oh!

Copilot AI Dec 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	vpc: ../../../../components/aws/vpc@0.0.0
	vpc: https://github.com/ManagedKube/devops-with-ai.git/pulumi/components/aws/vpc@0.0.1

	done < <(find pulumi/environments/aws -type f -name "Pulumi.yaml")
	done < <(find pulumi/environments/aws/staging -type f -name "Pulumi.yaml")

Conversation

Copilot AI commented Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Implementation Complete ✅

Summary

Three Validation Checks:

Security & Quality:

Testing:

Comments on the Issue (you are @copilot in this section)

Uh oh!

sekka1 commented Dec 10, 2025

Uh oh!

Copilot AI commented Dec 10, 2025

Uh oh!

Uh oh!

github-actions bot commented Dec 10, 2025

🍹 preview on vpc/organization/vpc/staging

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Dec 10, 2025 •

edited

Loading

🍹 `preview` on vpc/organization/vpc/staging