[woksin]

Added

• Add an optional output-file input to the Pulumi guarded action, so a workflow can use a command's output as data (for example stack output <name> or preview --json) without printing it to the log. The output is written to a workspace-relative path with private permissions, only after the command succeeds and both its output and error streams pass the secret scan; otherwise no file is left behind. Commands the action refuses stay refused in this mode.

[woksin]

Notes for reviewers

• Builds on the admission change in Refuse plaintext Pulumi reads in the guarded action #236; admission is unchanged here.
• The destination is validated before Pulumi runs and again right before publication (resolved parent must match and stay inside the workspace; final component must not be a symlink or directory); the file is staged in that directory and moved with mv -f -T. -T is GNU mv, so output-file mode targets Linux runners; existing modes are unaffected.
• Local checks: pulumi-guarded specs (60), shellcheck, repository-wide actionlint, workflow-templates specs and git diff --check pass. workflow-lint specs need zizmor, which is not installed locally; CI covers it. The hosted self-test in verify-pulumi-guarded runs in CI.
• Reviewed in two rounds (security focus); the second round had no blocking findings.