I did manage to get this to work while I was playing around:

package main

import (
	compute "<http://github.com/pulumi/pulumi-google-native/sdk/go/google/compute/v1|github.com/pulumi/pulumi-google-native/sdk/go/google/compute/v1>"
	"<http://github.com/pulumi/pulumi/sdk/v3/go/pulumi|github.com/pulumi/pulumi/sdk/v3/go/pulumi>"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		computeNetwork, err := compute.NewNetwork(ctx, "network",
			&compute.NetworkArgs{
				AutoCreateSubnetworks: pulumi.Bool(true),
			},
		)
		if err != nil {
			return err
		}

		_, err = compute.NewFirewall(ctx, "firewall",
			&compute.FirewallArgs{
				Network: computeNetwork.SelfLink,
				Allowed: compute.FirewallAllowedItemArray{compute.FirewallAllowedItemArgs{
					IpProtocol: pulumi.String("tcp"),
					Ports: pulumi.StringArray{
						pulumi.String("22"),
						pulumi.String("80"),
					},
				},
				}})
		if err != nil {
			return err
		}

		return nil
	})
}

I've spent a fair amount of time using the Python Pulumi toolkit and now trying to get to know the Golang one.

I suspect I find this particular endeavor a bit confusing because while I know enough Go to be dangerous, I haven't had to dive into reflection before. Inspecting this, much of the magic that is going on here appears to revolve around reflection. As I try to follow type hints in my editor, it definitely leads me in the wrong direction. The "fake" array using compute.FirewallAllowedItemArray{} really breaks my brain.

After more futzing, I think I understand the general operating pattern.