[CONTENT SPRINT] Provider Upgrade Game Days with Pulumi

[sicarul]

Why this content is interesting

• It reframes provider upgrades as game days instead of routine dependency bumps.
• It is scheduled for 2026-07-09 as part of the content sprint's two-post-per-week cadence.

What we took into account

• We considered lockfile pinning, canary stacks, preview JSON risk reports, batch rollouts, and recovery boundaries.
• We avoided unsupported customer claims, certification guarantees, and obsolete product naming.
• We kept the metadata and social copy curated around the post's concrete reader outcome.

Why it is useful to an end user

• End users get a safer process for provider upgrades before production stacks are on the line.
• The post is written to help practitioners recognize the problem, understand why it matters, and leave with an actionable Pulumi workflow.

Design need

• This PR is labeled needs-design because the post needs a final meta image before publication.
• Existing feature.png and meta.png files are placeholders unless Design chooses to reuse or adapt them.

Metadata

• Title: Provider Upgrade Game Days with Pulumi
• Meta description: Run a provider upgrade game day with Pulumi: pin dependencies, build a canary stack, scan preview JSON, batch rollouts, and recover safely.

🤖 Generated with OpenCode

[github-actions]

Social Media Review

content/blog/upgrading-cloud-providers-without-breaking-production/index.md

X — PASS

LinkedIn — PASS

Bluesky — PASS

---

Suggestions (advisory)

These are stylistic notes — they don't block the post.

X

• Second paragraph names all three techniques and the outcome ("catch risky replacements before prod changes") — the article's methodology is delivered; withhold the specific tools and let the reader find them in the article
• Missing pointer — the post reads as a standalone tip; add a line that signals there's more in the article

LinkedIn

• Second paragraph lists every step in the game day sequence (pin dependencies, canary, mine JSON, batch by risk, recovery path) — the article has nothing left to reveal; drop the step list and leave the reader wanting the how
• Missing pointer — the post just ends; add a line that connects to the full article

Bluesky

• "Here is a Pulumi workflow for canaries, preview gates, and safer batch rollouts" names all the techniques without building tension; remove the technique list and point to the discovery instead

Updated for commit e86cb44d8d3f12e1681216899c69512eea4932af (short: e86cb44) at 2026-05-13 21:55 UTC.

[claude]

Docs review for PR #18953

Thanks for shipping this, Pablo. The "Provider Upgrade Game Days" post is the strongest piece in the PR — the game-day framing, the five-step rhythm, and the jq risk-report snippet land well. A few items, grouped by importance.

Blocking / scope

The PR contains a lot more than the post in the title. Per the PR title ([CONTENT SPRINT] Provider Upgrade Game Days with Pulumi), I'd expect only content/blog/upgrading-cloud-providers-without-breaking-production/. The diff also adds:

1. .sisyphus/ (1117-line plan, evidence files, notepads, boulder.json with absolute paths like /Users/pabloseibelt/dev/docs/..., run-continuation session JSON). This is agent-internal state from OpenCode and shouldn't be committed. If you want to keep these locally, consider adding .sisyphus/ to .gitignore (or .git/info/exclude for a personal exclusion).
2. new_content.md at the repo root — looks like a research/exploration document, not website content. The Hugo build serves only files under content/, so this would just sit in the repo root indefinitely.
3. content/blog/multi-source-secrets-with-pulumi-esc/ — an entire second blog post that isn't mentioned in the PR title or description. If it's intended to ship, it should be a separate PR; if not, it should be removed.

Recommend splitting this PR down to just the provider-upgrade post and opening separate PRs for anything else you want to ship.

Provider Upgrade Game Days (content/blog/upgrading-cloud-providers-without-breaking-production/index.md)

• L46 — The claim that "Pulumi documents [the version resource option] as an override that should rarely be used directly during normal operations" should be hyperlinked to that documentation page. Without a citation, the assertion is harder to trust.

• L46 — "easier to audit and easier to roll back" — STYLE-GUIDE.md flags "easy" and "simple" (see STYLE-GUIDE.md:32). The comparative form is borderline; consider rewording to dodge the rule entirely:

  Avoid scattering one-off provider versions through resource options. The `version` resource option exists, but [Pulumi documents it as an override](https://www.pulumi.com/docs/iac/concepts/options/version/) that should rarely be used directly during normal operations. For fleet upgrades, package pins and lockfiles are auditable in a single commit and reversible with one revert.
  

  (Verify the URL — pick whichever canonical page documents the version resource option.)

• L129 — "The safest recovery is usually not state import. It is stopping before pulumi up..." — this is the "It's not X, it's Y" contrastive pattern flagged by the AI-writing rubric. One instance is fine, but consider rewording:

  The safest recovery rarely involves state import. Stop before `pulumi up`, revert the lockfile, and confirm the old provider still previews cleanly. Reserve state import for controlled recovery, not as a routine undo button.
  

• L41–43 — The snippet runs npm install @pulumi/aws@6.66.0, then a bare npm install, then pulumi plugin install resource aws 6.66.0. The bare npm install between the two is redundant — npm install <pkg>@version already updates the lockfile. Also worth noting: modern Pulumi auto-installs plugins via the SDK, so pulumi plugin install is usually only needed in airgapped or CI-cache scenarios. Consider trimming to one npm install line and explaining the explicit plugin install as the airgapped/CI variant.

• First-mention hyperlinking — Per the blog rubric, first mention of every product/tool should link. The post never links "Pulumi" (first appears L19) to /docs/. Adding that link would satisfy the rule.

• Verified: jq operations (replace, delete, delete-replaced) are valid pulumi preview --json step ops; protect: true resource option is correct; engineVersion: \"16.3\" is a real Postgres version; pulumi stack export/import flags are correct.

Multi-Source Secrets in Pulumi ESC (if it stays in this PR)

• L2 — date: 2099-01-01T12:00:00-06:00 is a placeholder and must be set before merge.
• L21, L32, L86, L92 — All H2 headings use Title Case. AGENTS.md requires sentence case for H2+. Compare to existing ESC blog posts (e.g., automate-azure-app-secret-rotation-with-esc/index.md uses ## Setup, ## How it works, ## Learn more):
  • ## The Challenge of Secret Sprawl → ## The challenge of secret sprawl
  • ## Composing a Multi-Source Environment → ## Composing a multi-source environment
  • ## Namespacing and Precedence → ## Namespacing and precedence
  • ## Consuming the Resolved View → ## Consuming the resolved view
• Frontmatter — No social: block. Without it, the post won't be promoted on social media (per the blog rubric, this is a warning, not a blocker).
• Verified: The ESC YAML composition is structurally correct — get:/secretId for AWS, read:/path for Vault, get:/ref for 1Password all match documented usage. Nice job on that.

Publishing readiness — upgrading-cloud-providers-without-breaking-production

• social: block present with twitter/linkedin/bluesky copy
• meta_image set but is the same placeholder as multi-source-secrets-with-pulumi-esc/meta.png (identical byte size) — needs-design label is on the PR, so this is expected
• meta_image uses current Pulumi logos — can't verify until Design replaces the placeholder
• <!--more--> break present (L23)
• Author pablo-seibelt exists in data/team/team/ with avatar at static/team/team/pablo-seibelt.jpg
• No external links to validate
• Code blocks have language specifiers (bash, typescript)
• No animated GIFs
• [n/a] No screenshots
• Title 39 chars (≤60)

Publishing readiness — multi-source-secrets-with-pulumi-esc

• No social: block
• meta_image is placeholder
• <!--more--> break present (L19)
• Author exists with avatar
• Code blocks have yaml and bash specifiers
• Title 35 chars (≤60)

---

Mention me (@claude) if you want another pass after the scope is tightened, the placeholder date is set, or the headings are fixed.

[pulumi-bot]

Your site preview for commit 0f7b5dd is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-18953-0f7b5dd6.s3-website.us-west-2.amazonaws.com

[sicarul]

@claude please review again. I rewrote this branch history to a single clean commit on current origin/master, removed all non-blog files from the PR diff, fixed social frontmatter paragraph formatting, and addressed the review feedback that applied to this post.

[pulumi-bot]

Claude finished @sicarul's task in 1m 28s —— View job

---

Re-review for PR #18953

Thanks Pablo — the rewrite landed clean. Verified end-to-end against the previous review.

Scope — ✅ resolved

The PR is now a single commit (e86cb44) on top of current master containing exactly three files:

content/blog/upgrading-cloud-providers-without-breaking-production/feature.png
content/blog/upgrading-cloud-providers-without-breaking-production/index.md
content/blog/upgrading-cloud-providers-without-breaking-production/meta.png

No .sisyphus/, no new_content.md, no second ESC blog post. Matches the PR title.

Prior feedback — ✅ all addressed in the post

• version option citation (L53) — Now linked: [Pulumi documents it as an override](/docs/iac/concepts/resources/options/version/). Verified the target exists at content/docs/iac/concepts/resources/options/version.md.
• "easier to audit / easier to roll back" (L53) — Reworded to "auditable in a single commit and reversible with one revert". The "easy/easier" form is gone — grep confirms no remaining hits.
• "It is not X. It is Y." contrastive pattern (L136) — Reworded to "The safest recovery rarely involves state import. Stop before pulumi up, revert the lockfile...". No contrastive AI-tell pattern remains.
• First-mention Pulumi link (L28) — [Pulumi](/docs/) provider upgrades... ✅
• npm/plugin install redundancy (L50) — Trimmed to a single npm install @pulumi/aws@6.66.0 line, dropping the redundant bare npm install and the airgapped-only pulumi plugin install. Good call.

Social frontmatter — ✅ paragraph formatting fixed

All three blocks now have two paragraphs separated by blank lines, matching the social-media-review suggestions:

• twitter — 2 paragraphs, ~166 chars
• linkedin — 2 paragraphs, ~301 chars
• bluesky — 2 paragraphs, ~143 chars

Publishing readiness — upgrading-cloud-providers-without-breaking-production

• social: block present and properly formatted
• `` break at L32
• Author pablo-seibelt exists in data/team/team/pablo-seibelt.toml with avatar at static/images/team/pablo-seibelt.jpg
• Code blocks have language specifiers (bash, typescript)
• Headings: H1 Title Case, H2 sentence case
• Title 38 chars (≤60)
• All internal links resolve (/docs/, /docs/iac/concepts/resources/options/version/)
• meta_image is still a placeholder (27,253 B feature, 138,149 B meta) — needs-design label is on the PR, so expected.

Nothing blocking

The post is in good shape. The only remaining item is the design pass on meta.png / feature.png, which is already tracked by the needs-design label.
• branch: blog/upgrading-cloud-providers-without-breaking-production

[sicarul]

@claude please review again. Branch history is now a single clean commit on current origin/master. The PR diff contains only content/blog/upgrading-cloud-providers-without-breaking-production/index.md plus feature.png and meta.png. Social-review is passing, and actionable content feedback has been addressed.

[pulumi-bot]

Claude finished @sicarul's task in 57s —— View job

---

Re-review for PR #18953

Verified the current state of the branch — everything checks out.

Scope — ✅

HEAD is a single commit e86cb44 containing exactly three files, matching the PR title:

content/blog/upgrading-cloud-providers-without-breaking-production/feature.png    27,253 B
content/blog/upgrading-cloud-providers-without-breaking-production/index.md       6,514 B (140 lines)
content/blog/upgrading-cloud-providers-without-breaking-production/meta.png       138,149 B

Prior feedback — ✅ all addressed (re-verified against the file on disk)

• L53 — version resource option citation — Linked: [Pulumi documents it as an override](/docs/iac/concepts/resources/options/version/). Target file content/docs/iac/concepts/resources/options/version.md exists.
• L53 — "easier to audit / easier to roll back" — Reworded to "auditable in a single commit and reversible with one revert". grep -niE '\b(easy|easier|simply|simple)\b' returns no hits.
• L136 — "It is not X. It is Y." contrastive pattern — Reworded to "The safest recovery rarely involves state import. Stop before pulumi up...". grep -niE 'it is not |it'\''s not |not just|rather than' returns no hits.
• L28 — First-mention Pulumi link — [Pulumi](/docs/) provider upgrades... ✅
• L50 — npm/plugin install redundancy — Now a single npm install @pulumi/aws@6.66.0 line. Redundant bare npm install and the airgapped-only pulumi plugin install are gone.

Social frontmatter — ✅

Each block has two paragraphs separated by a blank line (L13–L25). Social-media-review bot is PASSing on the latest commit per the prior comment.

Publishing readiness

• social: block formatted correctly
• `` break at L32
• Author pablo-seibelt exists (data/team/team/pablo-seibelt.toml) with avatar (static/images/team/pablo-seibelt.jpg)
• H1 Title Case; H2s sentence case (steps 1–5, "The game day scenario", "Conclusion")
• Code blocks tagged bash and typescript
• Internal links resolve (/docs/, /docs/iac/concepts/resources/options/version/)
• Title 38 chars (≤60)
• meta_image / feature_image are still placeholders — needs-design label is on the PR, so expected

Nothing blocking

The post is ready for the Design pass on meta.png / feature.png. No further content changes needed from me.
· branch: blog/upgrading-cloud-providers-without-breaking-production

[sicarul]

@claude please review again. This request is after the latest pushed head commit e86cb44d. The branch has a single clean commit on current origin/master, and the PR diff is limited to content/blog/upgrading-cloud-providers-without-breaking-production/index.md, feature.png, and meta.png.

[pulumi-bot]

Claude finished @sicarul's task in 1m 14s —— View job

---

Re-review for PR #18953

Verified the current state of the branch at e86cb44 — everything continues to check out.

Scope — ✅

HEAD is a single commit (e86cb44) and the commit touches exactly the three expected files, matching the PR title:

content/blog/upgrading-cloud-providers-without-breaking-production/feature.png    27,253 B
content/blog/upgrading-cloud-providers-without-breaking-production/index.md       140 lines
content/blog/upgrading-cloud-providers-without-breaking-production/meta.png       138,149 B

One small caveat on "on current origin/master": origin/master has advanced since this branch was rebased (now at ab85a1d — "Split Python SDK docs per-package"). The branch parent (a853d02) is no longer in origin/master. That's not a problem for the PR diff (GitHub computes it against the merge base), but you'll want a quick git pull --rebase origin master before merge so CI runs against the latest base.

Prior feedback — ✅ all addressed (verified against the file on disk)

• L53 — version resource option citation — Linked: [Pulumi documents it as an override](/docs/iac/concepts/resources/options/version/). Target page exists at content/docs/iac/concepts/resources/options/version.md.
• L53 — "easier to audit / easier to roll back" — Reworded to "auditable in a single commit and reversible with one revert". grep -niE '\b(easy|easier|simply|simple)\b' returns no hits.
• L136 — "It is not X. It is Y." contrastive pattern — Reworded to "The safest recovery rarely involves state import. Stop before pulumi up...". grep -niE 'it is not |it'\''s not |not just |rather than ' returns no hits.
• L28 — First-mention Pulumi link — [Pulumi](/docs/) provider upgrades... ✅
• L50 — npm/plugin install redundancy — Single npm install @pulumi/aws@6.66.0 line. The redundant bare npm install and the airgapped-only pulumi plugin install are gone.

Social frontmatter — ✅

Each block has two paragraphs separated by a blank line (L13–L25). Social-media-review bot is PASSing on the latest commit per the prior bot comment.

Publishing readiness — upgrading-cloud-providers-without-breaking-production

• social: block formatted correctly (twitter / linkedin / bluesky)
• `` break at L32
• Author pablo-seibelt exists (data/team/team/pablo-seibelt.toml) with avatar (static/images/team/pablo-seibelt.jpg)
• H1 Title Case; H2s sentence case ("The game day scenario", steps 1–5, "Conclusion")
• Code blocks tagged bash and typescript
• Internal links resolve (/docs/, /docs/iac/concepts/resources/options/version/)
• Title 38 chars (≤60)
• meta_desc present (179 chars)
• meta_image / feature_image are still placeholders (27,253 B / 138,149 B) — needs-design label is on the PR, so expected

Nothing blocking

The post is ready for the Design pass on meta.png / feature.png. Recommend a quick rebase on the latest origin/master before merge. No further content changes needed from me.
· branch: blog/upgrading-cloud-providers-without-breaking-production

[sicarul]

@claude please review again. This PR is now marked as draft, the needs-design label has been removed, and the latest pushed head is e86cb44d.

[pulumi-bot]

Claude finished @sicarul's task in 1m 29s —— View job

---

Re-review for PR #18953

Verified at e86cb44. Content is unchanged since the last re-review — all prior feedback remains addressed. But removing the needs-design label flips one item from "expected" to "blocker," so I want to surface it explicitly.

Scope — ✅

HEAD is still the single commit e86cb44 with exactly three files. Matches the PR title.

content/blog/upgrading-cloud-providers-without-breaking-production/feature.png    27,253 B
content/blog/upgrading-cloud-providers-without-breaking-production/index.md       140 lines
content/blog/upgrading-cloud-providers-without-breaking-production/meta.png       138,149 B

⚠️ Placeholder images — needs-design removed but images haven't been replaced

feature.png and meta.png are still the literal "100% Certified Placeholder Image" graphics — I rendered both to confirm:

• feature.png (942×628) — reads "100% Certified Placeholder Image" in Pulumi-purple
• meta.png (1200×628) — same text, OG-card dimensions

Byte sizes (27,253 / 138,149) are unchanged since the prior review when they were flagged as placeholders. With needs-design removed, the PR now reads as "ready to ship" — but if it lands like this, the blog index card and social previews will literally say "Placeholder Image."

A few ways forward, depending on intent:

1. Re-add needs-design if you're still waiting on Design — keeps the post in the queue without the placeholder shipping.
2. Generate proper images yourself — there's a /blog-meta-image skill in this repo that renders a feature template + composites the title onto a 1200×628 meta card. That would replace both files in one shot.
3. Reuse a recent themed image if the post fits an existing template (neo, platform, rocket, shield, lightbulb).

Since the PR is marked draft, this isn't urgent — just flagging that the label change doesn't match the file state.

Prior feedback — ✅ all addressed (re-verified against the file on disk)

• L53 — version resource option citation — Linked to /docs/iac/concepts/resources/options/version/. Target page exists.
• L53 — "easier to audit / easier to roll back" — Reworded to "auditable in a single commit and reversible with one revert". No easy|easier|simply|simple hits remain.
• L136 — "It is not X. It is Y." contrastive pattern — Reworded to "The safest recovery rarely involves state import. Stop before pulumi up...". No contrastive AI-tell pattern remains.
• L28 — First-mention Pulumi link — [Pulumi](/docs/) provider upgrades... ✅
• L50 — npm/plugin install redundancy — Single npm install @pulumi/aws@6.66.0 line.

Social frontmatter — ✅

Each block has two paragraphs separated by a blank line (L13–L25). Social-media-review bot was PASSing on e86cb44.

Publishing readiness — upgrading-cloud-providers-without-breaking-production

• social: block formatted correctly (twitter / linkedin / bluesky)
• `` break at L32
• Author pablo-seibelt exists (data/team/team/pablo-seibelt.toml) with avatar (static/images/team/pablo-seibelt.jpg)
• H1 Title Case; H2s sentence case ("The game day scenario", steps 1–5, "Conclusion")
• Code blocks tagged bash and typescript
• Internal links resolve (/docs/, /docs/iac/concepts/resources/options/version/)
• Title 38 chars (≤60)
• meta_desc present (179 chars)
• meta_image / feature_image are still literal placeholder graphics — was previously OK because needs-design covered it; now that the label is off, this is a blocker for moving out of draft.

Summary

Content is publish-ready. The only blocker for un-drafting is the placeholder images — either re-add needs-design, or Fix this → generate them with /blog-meta-image.
· branch: blog/upgrading-cloud-providers-without-breaking-production

[sicarul]

@claude please review the latest pushed changes, including the generated blog feature and meta images.

[pulumi-bot]

Claude finished @sicarul's task in 1m 35s —— View job

---

Re-review for PR #18953 — generated images look good

Verified at 0f7b5dd (the branch was pushed again after the comment referenced e86cb44d — the current HEAD is what I checked). The previously-flagged placeholder images have been replaced with real generated artwork.

Scope — ✅

Single commit (0f7b5dd), three files, matches the PR title:

content/blog/upgrading-cloud-providers-without-breaking-production/feature.png    30,531 B
content/blog/upgrading-cloud-providers-without-breaking-production/index.md       6,514 B (140 lines)
content/blog/upgrading-cloud-providers-without-breaking-production/meta.png       222,023 B

Images — ✅ no longer placeholders

I rendered both to confirm:

• feature.png — 1884×1256, the rocket template from /blog-meta-image. Pulumi-purple background, stylized rocket icon, no placeholder text. Correct dimensions.
• meta.png — 1200×628, OG card with the title "Provider Upgrade Game Days with Pulumi" in white, the Pulumi wordmark + logo bottom-left, rocket icon repeated right side. Correct dimensions, title matches frontmatter, branding looks right.

Byte sizes shifted from 27,253 / 138,149 (placeholders) to 30,531 / 222,023 — confirming both files were regenerated, not just renamed.

Prior content feedback — ✅ all still addressed (re-verified against the file on disk)

• L53 — version resource option citation — [Pulumi documents it as an override](/docs/iac/concepts/resources/options/version/). Target page content/docs/iac/concepts/resources/options/version.md exists.
• L53 — "easier to audit / easier to roll back" — Reworded to "auditable in a single commit and reversible with one revert". No easy|easier|simply|simple hits remain.
• L136 — "It is not X. It is Y." contrastive pattern — Reworded to "The safest recovery rarely involves state import. Stop before pulumi up...". No contrastive AI-tell pattern remains.
• L28 — First-mention Pulumi link — [Pulumi](/docs/) provider upgrades... ✅
• L50 — npm/plugin install redundancy — Single npm install @pulumi/aws@6.66.0 line.

Publishing readiness — upgrading-cloud-providers-without-breaking-production

• social: block formatted correctly (twitter / linkedin / bluesky, each two paragraphs separated by a blank line)
• `` break at L32
• Author pablo-seibelt exists (data/team/team/pablo-seibelt.toml) with avatar (static/images/team/pablo-seibelt.jpg)
• H1 Title Case; H2s sentence case ("The game day scenario", steps 1–5, "Conclusion")
• Code blocks tagged bash and typescript
• Internal links resolve (/docs/, /docs/iac/concepts/resources/options/version/)
• Title 38 chars (≤60)
• meta_desc present (179 chars)
• feature_image / meta_image are real, branded, correctly-sized artwork

Summary

Nothing blocking. The post is fully publish-ready — images, content, social copy, and metadata all in good shape. Recommend taking the PR out of draft when you're ready to merge. A quick git pull --rebase origin master before merge wouldn't hurt since this branch's parent (a853d02) is behind the current origin/master (ab85a1d), but the diff itself is clean.
· branch: blog/upgrading-cloud-providers-without-breaking-production