Deployment

How the pulumi/pulumi repo itself is built, packaged, signed, and published. (For user deployments — pulumi up's own behavior — see systems/engine instead.)

Active contributors

Active contributors: Justin Van Patten, Pulumi Bot, Ian Wahbe, Thomas Gummerer

Pipeline overview

graph TD
    PR[Pull request] -->|on-pr.yml| Tests[ci.yml<br/>matrix]
    Tests --> Merge[Squash merge to master]
    Merge -->|on-merge.yml| Draft[Draft GitHub Release<br/>updated with binaries]
    Draft -->|set-version.py freeze PR| Frozen[Frozen draft]
    Frozen -->|manual publish| Release[Tag + Release<br/>release.yml + sign.yml]
    Release --> Brew[Homebrew tap]
    Release --> Direct[get.pulumi.com]
    Release --> NPM[npmjs.com]
    Release --> PyPI[pypi.org]
    Release --> NuGet[nuget.org]
    Release --> Docs[trigger-release-docs-event.yml]

CI workflows

Located in .github/workflows/:

Workflow	Trigger	Purpose
ci.yml	every PR / push	Master matrix: build × test_all × lint, all OSes, all language SDKs
ci-build-binaries.yml	reusable	Cross-platform CLI builds (Linux/macOS/Windows × x86_64/arm64)
ci-build-sdks.yml	reusable	Per-language SDK packaging
ci-run-test.yml	reusable	Test runner
ci-lint.yml	every PR	Lint matrix
ci-info.yml	reusable	Pre-flight: compute version, matrix, etc.
ci-performance-gate.yml	every PR	Benchmarks vs baseline
ci-prepare-release.yml	manual	Pre-release prep
ci-dev-release.yml	manual	Dev/preview release
cron-direct-build.yml	schedule	Build matrix without tests
cron-test-all.yml	schedule	Nightly full test
download-pulumi-cron.yml	schedule	Sanity-check get.pulumi.com
release.yml	tag push	Goreleaser-driven publish
sign.yml	reusable	Codesign macOS, GPG-sign artifacts
release-pr.yml	post-release	Auto-PR for go.mod cleanups
release-homebrew-tap.yml	post-release	Update homebrew
trigger-homebrew-event.yml	post-release	Bump tap
trigger-release-docs-event.yml	post-release	Notify docs repo
pr-test-acceptance-on-dispatch.yml	manual	Run acceptance tests on a PR
command-dispatch.yml	issue/pr comment	/test, /build, etc.
on-merge.yml / on-push.yml / on-pr.yml / on-pr-default.yml / on-pr-close.yml / on-community-pr.yml / on-release.yml	events	Routers that dispatch reusable workflows
rebase.yml	issue comment	/rebase automation

The big one is ci.yml — it's the gate every PR has to pass.

Goreleaser

.goreleaser.yml describes the release artifacts:

• pulumi CLI for Linux/macOS/Windows × x86_64/arm64.
• Tarball naming, archive contents, checksums.
• Homebrew formula stub.
• Signature attachments (via sign.yml).

scripts/prep-for-goreleaser.sh arranges the working tree before goreleaser runs.

SDK distribution

Language	Registry	Package
Node	npmjs.com	@pulumi/pulumi
Python	pypi.org	pulumi
Go	(none — Go modules use git tags directly)	github.com/pulumi/pulumi/sdk/v3
.NET	nuget.org	Pulumi (separate repo)
Java	maven central	com.pulumi:pulumi (separate repo)

For Node: scripts/publish_npm.sh handles the publish. For Python: uv publish from sdk/python/. For Go: tagging is the publish.

Signing

sign.yml does:

• macOS notarization for the CLI binary.
• GPG signature on tarballs.
• The release public key is checked in at .github/workflows/release.pub.

Versioning

sdk/.version (currently 3.234.0) is the canonical version. scripts/set-version.py <new-version> updates it across the tree:

./scripts/set-version.py 3.235.0

This also updates package.json, pyproject.toml, and Go module pseudo-versions where applicable. The pre-release suffix (e.g. -alpha.NNN) is computed by scripts/pulumi-version.sh based on the current commit and tag.

Release flow (from CONTRIBUTING.md)

1. Last commit before release: bump sdk/.version to next-patch-version via scripts/set-version.py. This freezes the current draft release.
2. Run examples and templates test suites (in pulumi/examples and pulumi/templates) to gain confidence.
3. Open the GitHub Releases page, find the frozen draft, untick "Set as a pre-release", tick "Set as the latest release" + "Create a discussion", click Publish.
4. pulumi-bot follows up with a go.mod cleanup PR that auto-merges.

Renovate

renovate.json5 controls automated dependency updates. PRs land with the pulumi-renovate[bot] author. There's a custom scripts/renovate-changelog.py that generates changelog entries for renovate PRs automatically.

Direct download endpoint

https://get.pulumi.com ships an installer that fetches the right binary. Maintained by Pulumi-the-company; this repo just produces the artifacts it serves.

See also

• Tooling
• Development workflow — the inner loop before this pipeline kicks in.