is there a reference anywhere to how the

pulumi

command itself reads its configuration (e.g., from

~/.pulumi/config.json

)? we'd like to set a default organization on a repo-wide basis, but trying to google basically any combination of "pulumi" and "config" comes up with stuff about pulumi project config handling.

Pulumi doesn't have a default organization, and Pulumi's internal configuration wouldn't set that. The organization is stack-level only. I don't think policy-as-code can check your stack backend and login details. You could require that all projects check and assert on the current stack string prefix? However, that would mean that your projects couldn't have local out-of-org stacks created by developers. Which mightn't be a problem, or it might be....

i mean, pulumi's internal configuration definitely has and sets a default organization:

% cat ~/.pulumi/config.json 
{
    "backends": {
        "<https://api.pulumi.com>": {
            "defaultOrg": "ohai"
        }
    }
}

the issue we're running into is that various automation APIs behave differently depending on whether or not you have a default org set

I have never seen that file. I don't have it in any of my development environments. How did it get created?

i imagine with `pulumi org set-default`: https://www.pulumi.com/docs/cli/commands/pulumi_org_set-default/

I've never seen that. Seems like a bad idea. It means that two different people could create what they think is the same stack, but they'll end up in different organizations. Scary.

i was just looking for a place to put the config file, tbh. there needs to be a backend in there, but we only use the one backend so it's not a long journey from supplying a common pulumi config to linking a repo to an org

Yep. Well it's a tough one, since the existing support puts the file outside the repo. You could write ~/.pulumi/config.json from a script that you ensure is run regularly or before each deployment.

the answer seems to be to set

PULUMI_CREDENTIALS_PATH

, although I'm not sure that helps us much. https://github.com/pulumi/pulumi/blob/3b4715ae1b825edf8283a94c4990faf679964521/sdk/go/common/workspace/creds.go#L269-L286

I tried to work back from there to see when that's being called, but it dead-ends at

GetBackendConfigDefaultOrg()

. And since that's just getting the default, and not checking that the actual set value matches the default, it's not likely to do everything you need. You may be in a roll-your-own situation.