Pulumi.XX.yaml

- name: Prepare Pulumi
        run: |
          cd ./.cicd/pulumi
          npm ci
          npx --yes @REACTED/REDACTED-cicd pulumi:prepareGhaJobMatrixStep
        env:
          CICD_PULUMI_STACK_NAME: ${{ matrix.tenantConfig.stack-name }}
      - name: Pulumi Update
        uses: pulumi/actions@v4
        with:
          work-dir: ./.cicd/pulumi
          command: up
          stack-name: ${{ matrix.tenantConfig.stack-name }}

the basic prep skeleton (we use our own CLI injection drivers but this will give you a good picture:
export class PrepareGhaJobMatrixStep extends ShellCommand {

	public name = 'prepareGhaJobMatrixStep';
	public help = 'Prepares a GHA deployment step by consuming the tenant or environment partitioned output from "pulumi:createGhaJobMatrix".';
	public arguments = [{ help: 'Inputs are consumed from .env.CICD_PULUMI_STACK_NAME; this must be a fully qualified stack name. Ex.: REDACTED/pmb-main/stag. conditional: CICD_PULUMI_SHARED_SERVICES=true', synopsis: 'roleName' }];

	async action(_: CommandParameters): Promise<void> {

		const SHARED_SERVICES = !!process.env.CICD_PULUMI_SHARED_SERVICES;
		const STACK_NAME = process.env.CICD_PULUMI_STACK_NAME || '';
		console.log(`Preparing matrix deployment step for ${STACK_NAME}`);

		const PROJECT_NAME = STACK_NAME.match(/([^/]+)\/[^/]+$/)![1];
		const TENANT_OR_ENV_NAME = STACK_NAME.match(/([^/]+)$/)![1];
		const outputString = `pulumi stack output active${SHARED_SERVICES ? 'Shared' : 'Tenant'}Info --stack REDACTED/glob-infra/engineering`;
		console.log(`Executing: ${outputString}`);
		const output = execSync(outputString).toString();
		console.log(`Reesult: ***`);
		const json = JSON.parse(output);
		
		const tenantOrEnvData = json[TENANT_OR_ENV_NAME];

		if(!tenantOrEnvData.stacks[PROJECT_NAME])
			throw new Error(`Project ${PROJECT_NAME} appears to not be configured for ${TENANT_OR_ENV_NAME}`)
		
		const overridesString = (() => {
			const overrides = tenantOrEnvData.stacks[PROJECT_NAME]['overrides'];
		
			if(!overrides)
			return '';
		
			const overrideKeys = Object.keys(overrides);
			let output = `${PROJECT_NAME}:${overrideKeys[0]}: ${overrides[overrideKeys[0]]}`
			if(overrideKeys.length > 1)
				overrideKeys.splice(1).forEach(key => { output += `\n  ${PROJECT_NAME}:${key}: ${overrides[key]}` })
			return output;
		})();
		
			const escEnv = tenantOrEnvData.stacks[PROJECT_NAME]['esc-env'];
		
const escEnvString = escEnv ? `environment:
  - ${escEnv}` : ''
		
const configString = `${escEnvString}
config:
  aws:region: ${tenantOrEnvData.region}
  ${PROJECT_NAME}:mode: ${tenantOrEnvData.stacks[PROJECT_NAME].mode || 'development'}
  ${overridesString}
`;
		
		const configFileName = `Pulumi.${TENANT_OR_ENV_NAME}.yaml`
		const ecrLoginString = `aws ecr get-login-password --region ${tenantOrEnvData.region} | docker login --username AWS --password-stdin ${tenantOrEnvData.awsAccountId}.dkr.ecr.${tenantOrEnvData.region}.amazonaws.com`;
		console.log(`Executing: ${ecrLoginString}`);
		const ecrLoginResult = execSync(ecrLoginString).toString();
		console.log(`Result: ${ecrLoginResult}`);
		console.log(`Writing to file: ${configFileName}`);
		fs.writeFileSync(configFileName, configString, 'utf-8');
		console.log(`Setup Complete!`);
	}

}

export class CreateGhaJobMatrixCommand extends ShellCommand {

	public name = 'createGhaJobMatrix';
	public help = 'Prepares a GHA deployment matrix. Downstream consumer: "pulumi:prepareGhaJobMatrixStep" ESC namespace: "glob-infra:tenants" OR "glob-infra:shared';
	public arguments = [{ help: 'Inputs are consumed from env.CICD_PULUMI_INCLUDE_TENANTS/ENVIRONMENTS, env.CICD_PULUMI_EXCLUDE_TENANTS/ENVIRONMENTS and env.CICD_PULUMI_PROJECT_NAME conditional: CICD_PULUMI_SHARED_SERVICES=true', synopsis: 'roleName' }];

	async action(_: CommandParameters): Promise<void> {

		const SHARED_SERVICES = !!process.env.CICD_PULUMI_SHARED_SERVICES;
		const whitelist = SHARED_SERVICES ? process.env.CICD_PULUMI_INCLUDE_ENVIRONMENTS : process.env.CICD_PULUMI_INCLUDE_TENANTS; 
		const blacklist = SHARED_SERVICES ? process.env.CICD_PULUMI_EXCLUDE_ENVIRONMENTS : process.env.CICD_PULUMI_EXCLUDE_TENANTS;
		const PROJECT_NAME = process.env.CICD_PULUMI_PROJECT_NAME || ''; 

		if (!PROJECT_NAME || PROJECT_NAME === '') {
			throw new Error('CICD_PULUMI_PROJECT_NAME environment variable required');
		}

		const output = execSync(`pulumi stack output active${SHARED_SERVICES ? 'Shared' : 'Tenant'}Info --stack REDACTED/glob-infra/engineering`).toString();

		const json = JSON.parse(output);

		const activeTenantsOrEnvironments = Object.keys(json);

		const applicableTenants = (() => {
			if (whitelist && blacklist) {
				throw new Error('Please use only one of: CICD_PULUMI_INCLUDE_TENANTS, CICD_PULUMI_EXCLUDE_TENANTS');
			}

			if (whitelist) {
				return activeTenantsOrEnvironments.filter(t => whitelist.includes(t));
			} else if (blacklist) {
				return activeTenantsOrEnvironments.filter(t => !blacklist.includes(t));
			}
			return activeTenantsOrEnvironments;
		})();

		const pulumiStackList = execSync('pulumi stack ls').toString();

		const extractStacks = (output: string): string[] => {
			return output.split('\n')
				.filter(line => line.includes(PROJECT_NAME))
				.map(line => {
					const parts = line.split('/');
					return parts[parts.length - 1].trim();
				});
		};

		const existingEnvironmentsOrTenants = extractStacks(pulumiStackList);

		const matrixJobArrayJson: {
			'aws-region': string,
			'aws-role': string,
			'stack-name': string,
			'tenant'?: string,
			'environment'?: string,
		}[] = [];

		applicableTenants.forEach(tenantOrEnvironment => {
			const tenantData = json[tenantOrEnvironment];

			if (!tenantData.stacks[PROJECT_NAME]) {
				return;
			}

			if (!existingEnvironmentsOrTenants.includes(tenantOrEnvironment)) {
				execSync(`pulumi stack init REDACTED/${PROJECT_NAME}/${tenantOrEnvironment}`);
			}

			matrixJobArrayJson.push(SHARED_SERVICES ? {
				'aws-region': tenantData.region,
				'aws-role': tenantData.iamRoleArn,
				'stack-name': `REDACTED/${PROJECT_NAME}/${tenantOrEnvironment}`,
				'environment': tenantOrEnvironment.toUpperCase(),
			} : {
			
				'aws-region': tenantData.region,
				'aws-role': tenantData.iamRoleArn,
				'stack-name': `REDACTED/${PROJECT_NAME}/${tenantOrEnvironment}`,				
				'tenant': tenantOrEnvironment.toUpperCase(),
			});
		});
		console.dir(matrixJobArrayJson, { depth: null });
	}

}

FooTeam

Foo (Stg)

Foo (Prd)

Project == Stack

npx projen

Pulumi.xxx.yaml

Pulumi.yaml

Pulumi.$stackName.yaml