No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

The conclusion I came to is that you can't have mutable tags - you need to tag things with a version (like a commit hash) and pass that version to Pulumi in an environment variable or similar

Or you don't use Pulumi for this, and use a task orchestrator like ansible or a custom script that triggers this.  Since, from the infrastructure perspective, nothing has changed