pulumi-typescript_skill

Overview

This skill provides practical guidance and patterns for building Pulumi projects using TypeScript and integrating Pulumi ESC for centralized configuration and secrets. It covers project setup, TypeScript resource and component patterns, ESC environment workflows, async patterns, and multi-language component packaging. Use it to accelerate secure, reusable Node.js infrastructure code and to adopt OIDC and dynamic secrets in deployments.

How this skill works

The skill describes a standard TypeScript Pulumi project layout, commands to create stacks and link ESC environments, and example ESC YAML for dynamic OIDC credentials and secrets retrieval. It shows idiomatic TypeScript code: resource creation, ComponentResource patterns, StackReference usage, working with Outputs, and top-level async exports. It also explains how to run Pulumi commands with ESC-injected environment variables and how to publish multi-language components.

When to use it

• When creating a new Pulumi TypeScript project or cloud-specific template (AWS/Azure/GCP).
• When you need centralized secrets and config using Pulumi ESC instead of stack config files.
• When implementing OIDC authentication and short-lived credentials for deployments.
• When building reusable infrastructure patterns as TypeScript ComponentResources.
• When publishing TypeScript components for consumption by other Pulumi languages.

Best practices

• Store all secrets in ESC environments; never commit secrets to stack config files.
• Prefer OIDC and dynamic, short-lived credentials over static keys; apply least-privilege IAM.
• Use ComponentResource for reusable stacks and TypeScript types (pulumi.Input<T>) for args.
• Keep stack-specific settings in ESC and use stack references for cross-stack dependencies.
• Run pulumi preview before pulumi up and version/tag ESC environments for releases.

Example use cases

• Bootstrap an aws-typescript project, link an ESC environment, and run pulumi up with injected OIDC credentials.
• Create a SecureBucket ComponentResource that enforces encryption, versioning, and standardized tags, then publish it as a multi-language package.
• Reference networking outputs from a shared networking stack using StackReference and consume them in an application stack.
• Run CI tests that require secrets by using pulumi env run <env> -- npm test to inject secrets at runtime.