Reading from process.env was the solution here: https://github.com/pulumi/pulumi/issues/8265#issuecomment-1958438888 Embedding the username/password and the authentication function would also work, but then we can never change the password on the account. If refresh doesn't call my code, then I think I have three options • Make a fully-blown static provider • Embed a static token, then call my own API to do the auth • Stop doing refreshes entirely and just do

up

Update: pulling from

process.env

, even during

up

, doesn't appear to be working. We've devised an evil scheme, however, that just might work: • When our code runs, write the token to

/tmp/${provider}_${resource_name}.txt

• Read from said file in the provider (I'm guessing process.env didn't work because the provider runs in a different process) • Since we're using the automation API, we can call the subset of our code that does said writing before passing to pulumi for the

refresh

. This is extremely hacky, but avoids all embedded credentials, and we can "test" the creds before getting pulumi involved at all. (fail fast!) The only failure case I can think of is serializing

'node:fs'

. We've tried and miserably failed in the past trying to get

URL()

to work post-serialization. If we can't use node built-ins in the provider, we'll have to rely on globals, and do something with

fetch

and a local http listener think I hope that's not the case

Another update - it looks like

LocalWorkspaceOptions

takes an

envVars

option. We still need to break our pulumi programs into

preBuild

and

build

to populate tokens, but then we can use

process.env

again and avoid the

node:fs

tangle entirely!