pulumi-esc

Retrieve Pulumi ESC secrets and stack outputs via GitHub OIDC in GitHub Actions.

Updated Aug 23, 2026

Search Tags:#security #config #secrets #pulumi #oidc #esc

Ready to run

npx skills add https://github.com/aitchwhy/dotfiles --skill pulumi-esc

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pulumi-esc
Source: https://github.com/aitchwhy/dotfiles/tree/main/config/agents/skills/pulumi-esc
Command: npx skills add https://github.com/aitchwhy/dotfiles --skill pulumi-esc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides hybrid OIDC architecture for secure config management using Pulumi ESC; separates identity, config, and secrets.

Core Features & Use Cases

Structured environment layout (base/dev/staging/prod)
Clear separation of concerns; no stored credentials
Supports direnv integration for local dev

Quick Start

Open and configure an environment with ESC, e.g., open org/project/staging, then reference stacks and secrets as needed.

Frequently Asked Questions about pulumi-esc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I securely manage Pulumi infrastructure secrets in CI/CD without storing credentials?▼

Pulumi ESC with GitHub OIDC enables ephemeral credential retrieval directly in GitHub Actions workflows. ESC composes environment variables from Pulumi stacks and AWS Secrets Manager using federated identity, eliminating stored secrets entirely while maintaining identity separation between staging and production environments.

Can I use GitHub OIDC to authenticate Pulumi deployments across multiple environments?▼

Yes. GitHub OIDC integrates with Pulumi ESC to provide identity-based access across dev, staging, and production. ESC environments structure config hierarchically, applying different AWS credentials and secrets per stack while routing all requests through a single federated identity provider.

What's the difference between storing secrets in code versus using Pulumi ESC with AWS Secrets Manager?▼

Storing secrets in code creates exposure risk; Pulumi ESC centralizes retrieval through AWS Secrets Manager with GitHub OIDC authentication, keeping secrets out of repositories entirely. ESC fetches and composes them at runtime using ephemeral credentials, satisfying zero-secret-leak requirements.

How do I set up environment variables for multiple Pulumi stacks in GitHub Actions?▼

Configure a Pulumi ESC environment with pulumi-stacks and aws-secrets providers, structuring configs for base, dev, staging, and prod. ESC reads stack outputs and secrets on demand, then assembles environment variables for each workflow run without duplicating configuration across jobs.

Does Pulumi ESC work with local development workflows outside GitHub Actions?▼

Yes. Pulumi ESC supports direnv integration for local dev, allowing developers to use the same ESC environments defined for CI/CD. Local authentication still uses federated identity or AWS credentials, maintaining consistency with production configuration patterns.