(the stock standard way)

my gitlab-ci looks like

.pulumi:
  before_script:
    - pulumi login
    - pulumi stack init prod || true
    - pulumi stack select prod
    - pulumi config set digitalocean:token $DIGITALOCEAN_TOKEN --secret

pulumi-preview:
  extends: .pulumi
  stage: infrastructure-update
  script:
    - pulumi preview
  only:
    - merge_requests

pulumi-up:
  extends: .pulumi
  stage: infrastructure-update
  script:
    - pulumi up --yes
  # Create an artifact archive with just the pulumi log file,
  # which is created using console-redirection in run-pulumi.sh.
  artifacts:
    paths:
    - pulumi-log.txt
    # This is just a sample of how artifacts can be expired (removed) automatically in GitLab.
    # You may choose to not set this at all based on your organization's or team's preference.
    expire_in: 1 week
  # This job should only be created if the pipeline is created for the master branch.
  only:
  - master

Note the

pulumi stack init prod || true

which is required in the script for pulumi to work (I assume its because the

~/.pulumi

need to exists for preview to work)