skills.rest
aitchwhy
aitchwhyCOMMUNITY
Explore all skills by this author →
GitHub

pulumi-esc

Retrieve Pulumi ESC secrets and stack outputs via GitHub OIDC in GitHub Actions.

Updated Aug 23, 2026
Search Tags:#security#config#secrets#pulumi#oidc#esc
One-click install
npx skills add https://github.com/aitchwhy/dotfiles --skill pulumi-esc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pulumi-esc
Source: https://github.com/aitchwhy/dotfiles/tree/main/config/agents/skills/pulumi-esc
Command: npx skills add https://github.com/aitchwhy/dotfiles --skill pulumi-esc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides hybrid OIDC architecture for secure config management using Pulumi ESC; separates identity, config, and secrets.

Core Features & Use Cases

  • Structured environment layout (base/dev/staging/prod)
  • Clear separation of concerns; no stored credentials
  • Supports direnv integration for local dev

Quick Start

Open and configure an environment with ESC, e.g., open org/project/staging, then reference stacks and secrets as needed.

Frequently Asked Questions about pulumi-esc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I securely manage Pulumi infrastructure secrets in CI/CD without storing credentials?▼

Pulumi ESC with GitHub OIDC enables ephemeral credential retrieval directly in GitHub Actions workflows. ESC composes environment variables from Pulumi stacks and AWS Secrets Manager using federated identity, eliminating stored secrets entirely while maintaining identity separation between staging and production environments.

Can I use GitHub OIDC to authenticate Pulumi deployments across multiple environments?▼

Yes. GitHub OIDC integrates with Pulumi ESC to provide identity-based access across dev, staging, and production. ESC environments structure config hierarchically, applying different AWS credentials and secrets per stack while routing all requests through a single federated identity provider.

What's the difference between storing secrets in code versus using Pulumi ESC with AWS Secrets Manager?▼

Storing secrets in code creates exposure risk; Pulumi ESC centralizes retrieval through AWS Secrets Manager with GitHub OIDC authentication, keeping secrets out of repositories entirely. ESC fetches and composes them at runtime using ephemeral credentials, satisfying zero-secret-leak requirements.

How do I set up environment variables for multiple Pulumi stacks in GitHub Actions?▼

Configure a Pulumi ESC environment with pulumi-stacks and aws-secrets providers, structuring configs for base, dev, staging, and prod. ESC reads stack outputs and secrets on demand, then assembles environment variables for each workflow run without duplicating configuration across jobs.

Does Pulumi ESC work with local development workflows outside GitHub Actions?▼

Yes. Pulumi ESC supports direnv integration for local dev, allowing developers to use the same ESC environments defined for CI/CD. Local authentication still uses federated identity or AWS credentials, maintaining consistency with production configuration patterns.

Related Skills

Explore More Software Engineering Skills→
diriendirien
19

pulumi-typescript

Scaffold Pulumi TypeScript projects with ESC, OIDC, and ComponentResources.

Community
Advanced
shinmcshinmc
3

logs

Fetch and stream Elastic Beanstalk logs and environment events via EB CLI and CloudWatch integration.

Community
Intermediate
diriendirien
19

pulumi-python

Generate Pulumi Python projects and infrastructure code for AWS, Azure, and GCP.

Community
Advanced
Patasse97Patasse97

secrets-vault-manager

Automate HashiCorp Vault secret infrastructure management with Python scripts.

Community
Advanced