feat(actions): add skip-refresh input to provision-parent-stack#355
Merged
Conversation
The provision-parent-stack action always ran a Pulumi refresh on real (non-dry-run) provisions: executeProvision hard-coded SkipRefresh to previewMode, and neither the action nor ProvisionParentStack read a SKIP_REFRESH signal. The sibling deploy-client-stack action already supported skip-refresh; this brings provision to parity. - action.yml: add `skip-refresh` input (default false) mapped to SKIP_REFRESH env. - ProvisionParentStack: read SKIP_REFRESH into OperationConfig.SkipRefresh. - executeProvision: honor config.SkipRefresh (SkipRefresh = config.SkipRefresh || previewMode), mirroring executeDeploy. Refresh stays on by default; opting out is explicit. Note skipping refresh on a parent/infra stack means Pulumi won't reconcile state against the cloud first, so out-of-band drift can cause stale-state surprises — use deliberately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Ilya Sadykov <smecsia@gmail.com>
universe-ops
requested review from
Cre-eD,
Laboratory and
smecsia
as code owners
Cre-eD
approved these changes
Jun 30, 2026
Semgrep Scan ResultsRepository:
Scanned at 2026-06-30 19:02 UTC |
📊 Statement coverageMeasured on the documented included set (see
Baseline: |
Security Scan ResultsRepository:
Scanned at 2026-06-30 17:48 UTC |
Cre-eD
approved these changes
Jun 30, 2026
smecsia
approved these changes
Jun 30, 2026
Laboratory
approved these changes
Jun 30, 2026
Cre-eD
added a commit
that referenced
this pull request
Jul 1, 2026
The p/ci rule yaml.github-actions.security.gha-curl-pipe-shell re-parses
each workflow run: block as Bash via a metavariable-pattern. GitHub
Actions ${{ }} expressions are not valid Bash, so the sub-parser emits
nondeterministic PartialParsing / Internal matching error engine errors
(24 on our workflows) that the scan action counts in .errors and fails
on - flaky red CI, not real findings. The same commit passed then failed
on consecutive runs (#355), and main went red post-merge for the same
reason.
Suppress it via the disabled-rules input. No coverage lost: the SC
shell-curl-pipe-to-shell rule already flags curl|wget | sh piping in
**/*.yml and **/*.yaml by regex, with no Bash sub-parse.
Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The provision-parent-stack action always ran a Pulumi refresh on real (non-dry-run) provisions: executeProvision hard-coded SkipRefresh to previewMode, and neither the action nor ProvisionParentStack read a SKIP_REFRESH signal. The sibling deploy-client-stack action already supported skip-refresh; this brings provision to parity.
skip-refreshinput (default false) mapped to SKIP_REFRESH env.Refresh stays on by default; opting out is explicit. Note skipping refresh on a parent/infra stack means Pulumi won't reconcile state against the cloud first, so out-of-band drift can cause stale-state surprises — use deliberately.