| name | golden-path-service |
| description | Scaffold a new service on our golden path — a Pulumi project wired to ESC for config, OIDC for cloud auth (no static keys), standard tags, and a preview-before-apply workflow. Use when someone asks to start a new service, stack, or infrastructure-as-code project, or to "follow the golden path". |
| metadata | {"owner":"platform-team","version":"0.1.0"} |
Golden path: new service
This skill encodes how our team starts a new service. It builds on the Pulumi
agent skills (pulumi-typescript / pulumi-python, pulumi-cli, pulumi-esc) —
lean on those for the raw Pulumi mechanics; this skill adds our conventions on top.
When to use
A teammate says any of: "start a new service", "new Pulumi stack for X", "scaffold
infra for Y", "set this up on the golden path".
Procedure
-
Gather the inputs (ask, don't assume):
- service name (kebab-case)
- cloud:
aws | gcp | azure
- language:
typescript | python | go
- environments needed (default:
dev, prod)
-
Scaffold the project using the Pulumi CLI skill:
pulumi new <cloud>-<language> --name <service> --dir <service>-infra
-
Move config + secrets into ESC — never Pulumi.<stack>.yaml secrets, never
.env on a laptop. Create one environment per stack and import a shared base:
pulumi env init <org>/<service>/base
pulumi env init <org>/<service>/dev
pulumi env init <org>/<service>/prod
Reference the env from Pulumi.<stack>.yaml with environment:.
-
Use OIDC for cloud auth. Configure the ESC environment to mint short-lived
credentials via OIDC. Do not create a long-lived IAM user / service-account key.
-
Apply standard tags to every resource (use a transformation / default tags):
team, service, env, managed-by=pulumi, cost-center.
-
Never run pulumi up unprompted. Always pulumi preview first, show the diff,
and wait for explicit confirmation before applying.
Safety defaults
- Preview before apply, every time.
- No static credentials anywhere — OIDC + ESC only.
prod requires an explicit, separate confirmation from dev.
What good looks like
A new repo with a Pulumi project, ESC environments wired for config + OIDC, standard
tags applied, and a clean pulumi preview for dev. Hand off to pulumi-neo-handoff
or open a PR for review — don't apply to prod without a human.
