From 9344ced3869b8fae790d16cdd3ba2ddc8cf2d11a Mon Sep 17 00:00:00 2001
From: Adrian Garcia Badaracco <1755071+adriangb@users.noreply.github.com>
Date: Thu, 7 May 2026 20:42:57 -0500
Subject: [PATCH] Add GCP auth and Pulumi stack config to CI preview jobs

The infra-preview and services-preview jobs were missing the GCP
authentication and pulumi config steps that the deploy workflows
already use, so pulumi preview couldn't authenticate to GCP and the
services stack was missing its required githubToken config.

Mirror the same setup the deploy jobs use (deploy-infra.yml for
infra and build-and-deploy.yml's deploy job for services) so PR
previews succeed for same-repo PRs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ca8d24..0116226 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,6 +41,16 @@ jobs:
           node-version: '20'
           cache: 'npm'
 
+      - uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.GCP_SERVICE_ACCOUNT_EMAIL }}
+
+      - uses: google-github-actions/setup-gcloud@v2
+
+      - name: Install gke-gcloud-auth-plugin
+        run: gcloud components install gke-gcloud-auth-plugin
+
       - name: Install dependencies
         run: npm ci
 
@@ -50,6 +60,13 @@ jobs:
           requested-token-type: urn:pulumi:token-type:access_token:personal
           scope: user:${{ vars.PULUMI_USER }}
 
+      - name: Configure Pulumi stack
+        working-directory: infra
+        run: |
+          pulumi stack select --create ${{ vars.PULUMI_ORG }}/dev
+          pulumi config set gcp:project ${{ vars.GCP_PROJECT_ID }}
+          pulumi config set gcp:region ${{ vars.GCP_REGION }}
+
       - uses: pulumi/actions@v5
         with:
           command: preview
@@ -70,6 +87,15 @@ jobs:
           node-version: '20'
           cache: 'npm'
 
+      - uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.GCP_SERVICE_ACCOUNT_EMAIL }}
+
+      - uses: google-github-actions/setup-gcloud@v2
+        with:
+          install_components: gke-gcloud-auth-plugin
+
       - name: Install dependencies
         run: npm ci
 
@@ -79,6 +105,19 @@ jobs:
           requested-token-type: urn:pulumi:token-type:access_token:personal
           scope: user:${{ vars.PULUMI_USER }}
 
+      - name: Configure Pulumi stack
+        working-directory: services
+        run: |
+          pulumi stack select --create ${{ vars.PULUMI_ORG }}/dev
+          pulumi config set gcp:project ${{ vars.GCP_PROJECT_ID }}
+          pulumi config set gcp:region ${{ vars.GCP_REGION }}
+          pulumi config set --secret githubToken '${{ secrets.GH_CONTROLLER_TOKEN }}'
+          if [ -n "${{ secrets.LOGFIRE_TOKEN }}" ]; then
+            pulumi config set --secret logfireToken '${{ secrets.LOGFIRE_TOKEN }}'
+          fi
+          pulumi config set imageTag ${{ github.sha }}
+          pulumi config set runnerRepoUrl '${{ github.server_url }}/${{ github.repository }}'
+
       - uses: pulumi/actions@v5
         with:
           command: preview