Skip to content

Pulumi preview and new helper action to save on job executions #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zendern merged 7 commits into from
Jan 16, 2026
Merged

Pulumi preview and new helper action to save on job executions #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ea93ccb
Add preview comment on PR
zendern Jan 13, 2026
8dfe40a
Bring in the check skip duplicate job logic
zendern Jan 13, 2026
9b5504d
Accidentaly copied the get-values file and thus its symlinked. Fixed
zendern Jan 13, 2026
cbe2f85
Needs shell
zendern Jan 13, 2026
efbf643
Single quotes are good and bad 😂
zendern Jan 13, 2026
ba82a1a
Cleanup unneeded items
zendern Jan 14, 2026
7c21006
Use env vars instead
zendern Jan 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions template/.github/actions/update-devcontainer-hash/action.yml.jinja-base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,6 @@ inputs:
description: 'Branch to checkout and update'
required: true

permissions:
contents: write

outputs:
new-sha:
description: 'The SHA of the branch tip after update'
Expand Down
44 changes: 44 additions & 0 deletions template/template/.github/actions/check-skip-duplicates/action.yml.jinja-base
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
{% raw %}name: Check Skip Duplicates
description: 'Check that will output a variable to allow you to skip duplicate runs. Example: If you have both push and pull_request triggers enabled and you dont want to run 2 jobs for the same commit if a PR is already open you can add this to your jobs to skip that extra execution.'

outputs:
should-run:
description: 'Flag that determines if this execution should run or not'
value: ${{ steps.check.outputs.should_run }}

runs:
using: composite
steps:
- name: Check if push has associated open PR
id: check
env:
GH_TOKEN: ${{ github.token }}
REF_NAME: ${{ github.ref_name }}
REPO_NAME: ${{ github.repository }}
EVENT_NAME: ${{ github.event_name }}
shell: bash
run: |
# For non-push events, always run
if [ "$EVENT_NAME" != "push" ]; then
echo "should_run=true" >> $GITHUB_OUTPUT
echo "Event is $EVENT_NAME, will run CI"
exit 0
fi

# For push events, check if there's an open PR for this branch
pr_json=$(gh pr list \
--repo "$REPO_NAME" \
--head "$REF_NAME" \
--state open \
--json number \
--limit 1)

pr_number=$(echo "$pr_json" | jq -r '.[0].number // ""')
Comment on lines +29 to +36
Copy link

@coderabbitai coderabbitai bot Jan 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Consider adding error handling for gh pr list failures.

If gh pr list fails (network error, rate limit, permission issue), the script silently continues with an empty result, defaulting to should_run=true. While fail-open is a safe default, silent failures could mask configuration problems.

♻️ Optional: Add basic error checking 
         # For push events, check if there's an open PR for this branch
-        pr_json=$(gh pr list \
+        if ! pr_json=$(gh pr list \
           --repo "${{ github.repository }}" \
           --head "${{ github.ref_name }}" \
           --state open \
           --json number \
-          --limit 1)
+          --limit 1); then
+          echo "::warning::Failed to query PRs, defaulting to run CI"
+          echo "should_run=true" >> $GITHUB_OUTPUT
+          exit 0
+        fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
pr_json=$(gh pr list \
--repo "${{ github.repository }}" \
--head "${{ github.ref_name }}" \
--state open \
--json number \
--limit 1)
pr_number=$(echo "$pr_json" | jq -r '.[0].number // ""')
if ! pr_json=$(gh pr list \
--repo "${{ github.repository }}" \
--head "${{ github.ref_name }}" \
--state open \
--json number \
--limit 1); then
echo "::warning::Failed to query PRs, defaulting to run CI"
echo "should_run=true" >> $GITHUB_OUTPUT
exit 0
fi
pr_number=$(echo "$pr_json" | jq -r '.[0].number // ""')
🤖 Prompt for AI Agents 
In
`@template/template/.github/actions/check-skip-duplicates/action.yml.jinja-base`
around lines 26 - 33, Check the exit status of the gh pr list call that
populates pr_json and handle failures: after running the gh pr list command (the
variable pr_json), test its exit code and/or whether pr_json is valid JSON
before proceeding to extract pr_number; on error capture and emit a clear
diagnostic (to stderr or via echo) including gh's stderr output, and set a
distinct failure flag or explicit empty pr_number so the script documents the
failure rather than silently continuing (leave the existing fail-open behavior
if desired, but ensure the error is logged and a failure indicator variable is
set so callers can detect the problem).


if [ -n "$pr_number" ]; then
echo "should_run=false" >> $GITHUB_OUTPUT
echo "Push to branch with open PR #$pr_number detected, skipping (PR event will run CI)"
else
echo "should_run=true" >> $GITHUB_OUTPUT
echo "Push to branch without open PR, will run CI"
fi{% endraw %}
28 changes: 25 additions & 3 deletions ...ons/{% if template_uses_pulumi %}pulumi_ephemeral_deploy{% endif %}/action.yml.jinja-base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,11 @@ inputs:
default: true
required: false
description: Whether or not to install the Pulumi CLI
show-preview-comment-on-pr:
type: boolean
default: false
required: false
description: Whether or not to add a comment on to the PR with the pulumi preview details.



Expand Down Expand Up @@ -74,6 +79,23 @@ runs:
aws-region: ${{ inputs.aws-region }}

- name: Run CLI
working-directory: ${{ github.workspace }}/${{ inputs.project-dir }}
run: uv run python -m ${{ inputs.deploy-script-module-name }}.${{ inputs.deploy-script-name }} --stack=${{ inputs.stack-name }} ${{ inputs.cli-action }}
shell: bash{% endraw %}
# apparently getting the stdout is nigh impossible in GHA, so this action helps
uses: mathiasvr/command-output@34408ea3d0528273faff3d9e201761ae96106cd0 # ratchet:mathiasvr/command-output@v2.0.0
id: pulumi-run
with:
# can't use working-directory with this action, so specifying it in the uv command
run: uv --directory ${{ github.workspace }}/${{ inputs.project-dir }} run python -m ${{ inputs.deploy-script-module-name }}.${{ inputs.deploy-script-name }} --stack=${{ inputs.stack-name }} ${{ inputs.cli-action }}
shell: bash

- name: Comment the Preview on the Pull Request
if: ${{ inputs.show-preview-comment-on-pr == 'true' }}
# pin this sha (v3.0.1) for extra security since this action has some permissions to write to the pull request comments
uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b
with:
message: |
:eyes: **Pulumi Preview for ${{ inputs.deploy-script-module-name }}:** :eyes:

```bash
${{ steps.pulumi-run.outputs.stdout }}
```
comment-tag: previewonpr-${{ inputs.deploy-script-module-name }}{% endraw %}
7 changes: 7 additions & 0 deletions ...plate/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,11 @@ on:
required: false
default: ''
type: string
SHOW_PREVIEW_COMMENT_ON_PR:
description: 'Shows the pulumi preview details on the PR, note this is dependent on the pull_request event'
required: false
default: false
type: boolean
secrets:
iac-github-api-tokens:
description: 'API tokens to use for Github IaC deployment when not using AWS Secrets Manager'
Expand All @@ -99,6 +104,7 @@ env:
permissions:
id-token: write # needed to assume OIDC roles (e.g. for downloading from CodeArtifact)
contents: write # needed for mutex
pull-requests: write # needed to post the preview on the PR as a comment

jobs:
pulumi:
Expand Down Expand Up @@ -154,6 +160,7 @@ jobs:
deploy-script-name: ${{ inputs.DEPLOY_SCRIPT_NAME }}
aws-region: ${{ inputs.AWS_REGION }}
aws-account-id: ${{ inputs.AWS_ACCOUNT_ID }}
show-preview-comment-on-pr: ${{ inputs.SHOW_PREVIEW_COMMENT_ON_PR }}
timeout-minutes: 5 # apparently timeout-minutes only accepts literal values, it cannot evaluate expressions (e.g. workflow inputs)

- name: Refresh
Expand Down