[woksin]

Changed

• The Pulumi guarded action now refuses, before running Pulumi, commands whose output is plaintext configuration or environment values: config get, env/esc open, get and run, and --show-secrets anywhere in the arguments. All other commands and their options pass through unchanged. A refused command fails the step with a generic message that echoes no values.

[woksin]

Notes for reviewers

• Admission is a token scan rather than an option parser: Pulumi identifies commands only by literal tokens (no prefix matching; env and esc are aliases), so these reads cannot run without the refused tokens. Known trade-off: an argument value that is literally get, open or run after config/env/esc is refused too; no existing caller passes such values.
• Existing caller shapes (refresh with import pairs, up, destroy --yes --skip-preview --non-interactive) keep working; covered by specs.
• Local checks: pulumi-guarded specs, shellcheck, repository-wide actionlint, workflow-templates specs and git diff --check pass. workflow-lint specs need zizmor, which is not installed locally; CI covers it.
• Reviewed in three rounds (last round on the token scan: no blocking findings). Label patch: no previously working non-secret invocation is refused.