Evidence record · captured 2026-10-11

Pulumi Best Practices

A set of numbered practices for Pulumi TypeScript/Python programs: never create resources inside apply(), pass Outputs directly as inputs, group related resources into ComponentResources with parent: this, encrypt secrets from day one (config --secret / ESC), use aliases when refactoring to avoid replacement, and always preview before deploying (including in CI). Each has incorrect/correct code examples.

Official publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

Seven correctness rules for Pulumi programs, each with detection signals and wrong-versus-right code. They let the agent review existing code for the mistakes that cause unplanned replacements, missing dependencies or leaked secrets.

Best for

Reviewing a Pulumi TypeScript program for resources created inside apply()
Refactoring resources into ComponentResource classes without destroying them
Adding a preview gate to a GitHub Actions deployment workflow

Strengths in the source

Each practice lists detection signals, such as resource constructors inside .apply() or pulumi.all callbacks, that an agent can search for.
Shows alias forms for rename, parent change and full URN, with a lifecycle for removing aliases after all stacks update.
Explains how to read preview output and treats an unexpected replace as a warning sign.
Ends with a validation checklist mapping each practice to a concrete code check.

Limitations

The description mentions Python, but every code example is TypeScript.
Applying its advice requires the Pulumi CLI and cloud credentials; the CI example uses a PULUMI_ACCESS_TOKEN for Pulumi Cloud.
Deeper component authoring, ESC and Automation API guidance is deferred to other skills in the Pulumi pack.

When not to use it

Terraform or CDK codebases.
Pulumi YAML programs, which the examples do not address.

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

pulumi/skills/pulumi-best-practices/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

The skill folder bundles no executable scripts. Retenta has not run a security scan.

Pinned publisher source: pulumi/skills/pulumi-best-practices/SKILL.md
Revision: 2517e28e4bc029424e9c9ee48016394296be0f6a
License evidence: Apache-2.0Retenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-06-02
Independent verification: Published by Pulumi, but not independently verified by a third-party reviewer.
Upstream repository: Open publisher repository