Remove token-based authorization from Pulumi GitHub actions

[bsweger]

Last year, Pulumi released a GitHub action that allows authorization to Pulumi via OIDC 🎉

https://www.pulumi.com/blog/oidc-trust-github-action/

Our current Pulumi workflows use my personal Pulumi token stored as a repo secret, so we should switch to OIDC: https://github.com/hubverse-org/hubverse-infrastructure/blob/main/.github/workflows/pulumi_update.yaml#L43

Edit 2025-02-08: To use OIDC at the hubverse organization level, we'd need to upgrade our Pulumi account 😞
So am updating the title of this ticket to a more general "stop using token-based access in the Pulumi actions"

Definition of done

• pulumi_update and pulumi_preview workflows no longer require secrets.BSWEGER_PULUMI_DEMO for Pulumi authentication
• README.md is updated with information that explains how the Pulumi authentication works

[bsweger]

I went down the road of setting up an OIDC issuer in Pulumi, and it will only let us create OIDC issuers at the individual level (because our account type doesn't permit teams 😞 )

I didn't bother trying this with my personal account, because it's admin/write, and we don't want that level of access in the pull request "pulumi preview" workflow.

We could create generic "preview" and "update" Pulumi accounts, set up OIDC issuers for each one, and use those in the GitHub actions. But we'd still have the problem of needed to update the passwords for those accounts when someone leaves.

I'll try the Pulumi GitHub app next.

[bsweger]

Using Pulumi's GitHub app looks promising. We currently use a Pulumi GitHub action that essentially allows us to interact with Pulumi via its CLI commands (e.g., pulumi preview, pulumi up).

An alternate way to mange AWS resources via CI/CD is to create a Pulumi deployment for the Hubverse.

When setting up the deployment, we can configure OIDC to assume the AWS hubverse-infrastructure-write-role already in place (we would have to add a trust policy to that role before the Pulumi action is allowed to assume it).

The setup steps would be something like:

• Done: Add the Pulumi GitHub app to hubverse-org
• In AWS: add an OIDC identity provider for Pulumi
• In AWS: add a trust policy to the existing hubverse-infrastructure-write-role that would allow the Pulumi GitHub app to assume it
• In Pulumi: create a deployment and tell Pulumi to configure the hubverse-infrastructure-write-role (see screenshot)