Create a Use with Pulumi IaC guide section for ESC

[jkodroff]

Overview

Reworks the ESC "Integrate with Pulumi IaC" content into a proper guide sub-group under ESC → Guides → Use with Pulumi IaC, bundling three related open issues into one restructure:

• Intro / landing — the old page, refreshed into a "how the integration works" overview that routes to the deeper guides. Closes ESC: Refresh Integrate with Pulumi IaC #19665.
• Adopt ESC for config and secrets — move the plaintext config and secrets in your stack files into an environment (pulumi config env init), pin it, and roll it out safely at scale (one stack → shared env → no-op rollout). Addresses ESC Adoption Guide: Moving from secrets and config in stack files to ESC #19714.
• Migrate from stack references to pulumi-stacks — replace StackReference resources with the ESC pulumi-stacks provider and stack config, migrating a chain from the leaf consumer up as a series of no-ops. Addresses ESC Adoption Guide: Migrating from Stack References to pulumi-stacks #19712.

Nav change

ESC → Guides
├── Configuring OIDC
├── Use with Pulumi IaC            ← new nested sub-group (guides/pulumi-iac/)
│   ├── (intro/landing)            ← #19665
│   ├── Adopt ESC for config and secrets     ← #19714
│   └── Migrate from stack references to pulumi-stacks  ← #19712
├── Sync secrets to external platforms
├── Run commands
└── Integrate with…

sync-secrets-to-external-platforms intentionally stays at the Guides top level.

SEO / links

• Page moved via git mv to /docs/esc/guides/pulumi-iac/; the old /docs/esc/guides/integrate-with-pulumi-iac/ URL (and its prior aliases) are preserved as aliases → verified the redirect renders.
• Canonical internal links across content/docs updated to the new path.
• esc-sdk-config-note shortcode relrefs updated (they resolve by content path, not alias).

Verification

• make lint — clean
• make build — clean; new pages, alias redirect, and nested nav all render correctly.

Fixes #19665
Fixes #19714
Fixes #19712

🤖 Generated with Claude Code

[pulumi-bot]

Your site preview for commit b994fc1 is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-20178-b994fc1d.s3-website.us-west-2.amazonaws.com

[pulumi-bot]

Lighthouse Performance Report

Commit: b994fc1 | Metric definitions

Page	Device	Score	FCP	LCP	TBT	CLS	SI
Homepage	Mobile	🔴 44	3.1s	5.5s	1952ms	0.065	3.9s
Homepage	Desktop	🟡 78	0.8s	1.4s	277ms	0.040	2.8s
Install Pulumi	Mobile	🟡 60	5.8s	9.0s	68ms	0.057	5.8s
Install Pulumi	Desktop	🟡 83	1.3s	1.9s	0ms	0.123	1.5s
AWS Get Started	Mobile	🟡 56	5.3s	8.6s	42ms	0.092	7.7s
AWS Get Started	Desktop	🟡 83	1.2s	1.8s	0ms	0.024	2.8s

[github-actions]

Pre-merge Review — Last updated 2026-07-10T04:49:22Z

Tip

Summary: This PR restructures ESC's single-page "Integrate with Pulumi IaC" guide into a new Use with Pulumi IaC section under /docs/esc/guides/pulumi-iac/: it deletes the old page (preserving its URL as an alias) and adds a section landing page plus two task guides — Adopt ESC for config and secrets and Migrate from stack references to pulumi-stacks — then repoints ~15 inbound links across the ESC, IaC, and Deployments docs to the new path. The new section parallels existing ESC guide pages like Running commands and Sync secrets to external platforms. The wrongness that would block a reader here is a broken link to the new or old path, an incorrect CLI command or flag (pulumi config env init, fn::secret, the environment/pulumiConfig blocks), or a per-language Configuration API mismatch. Verification covered fact-checking of the extracted claims, a frontmatter/alias sweep, cross-sibling reads across the new section, and per-language code-example checks; the Hugo build preflight was skipped (content-only change).

Review confidence:

Dimension	Level	Notes
mechanics	HIGH	Frontmatter/alias sweep clean; the one flagged URL "collision" is the intentional rename alias for the deleted page.
facts	HIGH	All extracted claims resolved; the lone contradicted was a false positive (the target page exists as a leaf .md), and the remaining unverifiables are corroborated by adjacent verified claims.
coherence	HIGH	Two minor readthrough nits (a duplicated "Next steps" link and an undefined interpolation placeholder) moved to Low-confidence.
cross-sibling consistency	HIGH	The three new pages are mutually consistent and consistent with the concept/provider pages they link to.
code correctness	HIGH	TS/Python/Go/C#/Java/YAML Configuration API snippets verified; code-example checks found nothing.

Investigation log

• Cross-sibling reads: 3 of 5 siblings (read the full new section — landing page and both child guides; the other changed files received link-path-only edits that need no consistency read)
• External claim verification: 121 of 139 claims verified (5 unverifiable, 1 contradicted) · 4 specialists (numerical, cross-reference, capability, framing); 0 cross-specialist corroborations · routed: 0 inline, 134 Pass 1, 1 Pass 2 (verified 0, contradicted 0, unverifiable 1), 4 Pass 3 (verified 1, contradicted 0, unverifiable 3).
• Cited-claim spot-checks: 1 of 1 cited claims fetched and compared
• Frontmatter sweep: ran on body + meta_desc
• Temporal-trigger sweep: ran (recency words present in diff; spot-check in-review)
• Code execution: not run (no static/programs/ change)
• Code-examples checks: ran (3 specialists: structural, existence, body-code-coverage); 0 findings
• Editorial-balance pass: not run (not under content/blog/)

🚨 Outstanding	⚠️ Low-confidence	💡 Pre-existing	✅ Resolved
0	5	1	0

🔍 Verification trail

142 claims extracted · 121 verified · 5 unverifiable · 1 contradicted

• L37 in content/docs/ai/running-previews/_index.md "Pulumi ESC has native OIDC integration with all of the major cloud providers." → ✅ verified (evidence: Pulumi ESC docs list built-in login providers with OIDC-based trust setup for AWS, Azure, and GCP (the major cloud providers), e.g. "To learn how to configure OpenID Connect (OIDC) between Pulumi Cloud and AWS/Azure/Google Cloud, see the O…; source: repo:content/docs/esc/guides/configuring-oidc/_index.md and content/docs/esc/providers/login/*.md)
• L37 in content/docs/ai/running-previews/_index.md "Using Pulumi ESC is the recommended approach for defining stack configuration and secrets." → ➖ not-a-claim (evidence: The line is a verbatim excerpt from the PR's own doc content (content/docs/ai/running-previews/_index.md L37): "Using ESC is the recommended approach for defining stack configuration and secrets." It's t…; source: repo:content/docs/ai/running-previews/_index.md)
• L39 in content/docs/ai/running-previews/_index.md "There is a documentation page at /docs/esc/guides/pulumi-iac/ describing how to associate an ESC environment with a stack." → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists and explains "Two pieces connect ESC to a Pulumi program: 1. The environment block in your stack configuration file... lists the environments the stack imports" — i.e., it documents how…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L17 in content/docs/deployments/guides/cloud-credentials.md "For a Pulumi IaC operation like update or preview to work, the Pulumi CLI must be able to access credentials that allow it to perform the necessary CRUD op…" → ✅ verified (evidence: The source file states verbatim: "In order for a Pulumi IaC operation like update or preview work, the Pulumi CLI must be able to access credentials that will allow it to perform the necessary CRUD operations on the resources in your s…; source: repo:content/docs/deployments/guides/cloud-credentials.md)
• L17-20 in content/docs/deployments/guides/cloud-credentials.md "There are two common approaches for Pulumi Deployments to access the necessary cloud credentials to run a Pulumi operation: using Pulumi ESC, or using Pulumi D…" → ✅ verified (evidence: The page itself states: "there are two common approaches you can take: 1. Use Pulumi ESC... 2. Use Pulumi Deployments' OIDC integration... and store any remaining required secrets or configuration in Pulumi Deployments Environment Variable…; source: repo:content/docs/deployments/guides/cloud-credentials.md)
• L22 in content/docs/deployments/guides/cloud-credentials.md "There is a section on this page titled 'Choosing between Pulumi ESC Environments and Pulumi Deployments OIDC' accessible via the anchor #choosing-between-pulum…" → ✅ verified (evidence: Line 24 of the file contains the heading '## Choosing between Pulumi ESC Environments and Pulumi Deployments OIDC', which generates the anchor #choosing-between-pulumi-esc-environments-and-pulumi-deployments-oidc referenced at line 22.; source: repo:content/docs/deployments/guides/cloud-credentials.md)
• L42 in content/docs/esc/_index.md "To consume an environment from a Pulumi IaC program, use the config approach documented at /docs/esc/guides/pulumi-iac/ instead of the ESC SDKs." → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists and documents exactly the config-based approach described: "Consuming an ESC environment from a Pulumi IaC program is the most common way to use ESC... The environment block... The `pul…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L68-71 in content/docs/esc/_index.md "Environments can be consumed from a Pulumi program by using ESC with Pulumi IaC, as documented at /docs/esc/guides/pulumi-iac/." → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists with title "Use with Pulumi IaC" and states "Consuming an ESC environment from a Pulumi IaC program is the most common way to use ESC," matching the claim's description and link target.; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L22-24 in content/docs/esc/concepts/_index.md "The link target for '[Pulumi IaC]' documentation about scaling has moved from /docs/esc/guides/integrate-with-pulumi-iac/ to /docs/esc/guides/pulumi-iac/." → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists at the new path and lists aliases: - /docs/esc/guides/integrate-with-pulumi-iac/ among other old paths, confirming the page moved from the old URL to the new one referenced in concepts/…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L24 in content/docs/esc/concepts/_index.md "ESC allows granting access to Pulumi Cloud instead of granting every user and pipeline direct access to systems like AWS Secrets Manager or HashiCorp Vault." → ✅ verified (evidence: The same page states verbatim: "Rather than granting every user and pipeline direct access to systems like AWS Secrets Manager or HashiCorp Vault, you grant access to Pulumi Cloud, which reads those secrets on the client's behalf." This di…; source: repo:content/docs/esc/concepts/_index.md)
• L122 in content/docs/esc/concepts/outputs.md "The Pulumi IaC integration guide, located at /docs/esc/guides/pulumi-iac/, provides an overview of the pulumiConfig reserved property." → ✅ verified (evidence: The page at content/docs/esc/guides/pulumi-iac/_index.md explicitly documents the pulumiConfig block: "The pulumiConfig block inside an environment declares which values flow into your program as stack configuration."; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L26 in content/docs/esc/concepts/sdks.md "In a Pulumi IaC program, an environment should be listed in the environment block of the Pulumi.<stack>.yaml stack configuration file so its values flow in…" → ✅ verified (evidence: The linked page /docs/esc/guides/pulumi-iac/ states: "The environment block in your stack configuration file (Pulumi.<stack>.yaml) lists the environments the stack imports" and describes how pulumiConfig values (including `fn::secret…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L211 in content/docs/esc/get-started/_index.md "ESC Rotators can automatically rotate credentials like API keys and database passwords on a schedule or on demand." → ✅ verified (evidence: The sibling Rotators reference page states rotators "replace credentials for AWS IAM, Azure apps, MySQL, PostgreSQL, Snowflake, and custom services on a schedule or on demand," and lists rotators like aws-iam, azure-app-secret, mysql, post…; source: repo:content/docs/esc/providers/rotators/_index.md)
• L212 in content/docs/esc/get-started/_index.md "ESC Integrations allow consuming ESC environments from the External Secrets Operator." → ✅ verified (evidence: content/docs/esc/integrations/_index.md lists under Kubernetes: "External Secrets Operator (ESO) — project ESC values into Kubernetes Secret objects via ESO", confirming ESC Integrations includes consuming environments via the External Sec…; source: repo:content/docs/esc/integrations/_index.md)
• L213 in content/docs/esc/get-started/_index.md "The 'Configure OpenID Connect' guide describes setting up OIDC trust so that ESC can issue short-lived cloud credentials." → ✅ verified (evidence: The source file itself contains the line: "- Configure OpenID Connect - Set up OIDC trust so ESC can issue short-lived cloud credentials" which matches the claim verbatim in meaning.; source: repo:content/docs/esc/get-started/_index.md (line 213))
• L214 in content/docs/esc/get-started/_index.md "The 'Integrate with Pulumi IaC' guide covers dynamic cloud credentials, external secret stores, and environment composition in Pulumi IaC stacks." → ✅ verified (evidence: The target page /docs/esc/guides/pulumi-iac/ has a "Common patterns" section listing: "Dynamic cloud credentials...", "API keys and third-party secrets...pull it at open time from an external store like AWS Secrets Manager, Azure Key Vault…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L19 in content/docs/esc/guides/_index.md "Configuring OIDC guide covers setting up OpenID Connect trust between ESC and AWS, Azure, GCP, Doppler, Infisical, or Vault." → ✅ verified (evidence: The configuring-oidc index page (content/docs/esc/guides/configuring-oidc/_index.md) lists guides for AWS, Azure, Doppler, Google Cloud, Infisical, and Vault: "Configuring OIDC for AWS", "...Azure", "...Doppler", "...Google Cloud", "...Inf…; source: gh api repos/pulumi/docs/contents/content/docs/esc/guides/configuring-oidc/_index.md)
• L23-26 in content/docs/esc/guides/_index.md "The 'Migrate from stack references to pulumi-stacks' guide at /docs/esc/guides/pulumi-iac/migrate-from-stack-references/ describes replacing StackReference res…" → ✅ verified (evidence: The page at content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md exists with title "Migrate from stack references to pulumi-stacks" and states: "The ESC pulumi-stacks provider does the same job from an environment instead...…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L24-25 in content/docs/esc/guides/_index.md "- Migrate from stack references to pulumi-stacks — replace StackReference resources with the…" → ✅ verified (evidence: The linked page content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md exists, is filed under the esc-guides-pulumi-iac menu section, and its content matches the description exactly: "The ESC pulumi-stacks provider does the sa…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L25 in content/docs/esc/guides/_index.md "There exists an ESC provider named 'pulumi-stacks'." → ✅ verified (evidence: The repo's own provider reference page at content/docs/esc/providers/iac/pulumi-stacks.md states: "The pulumi-stacks provider enables you to import stack outputs from Pulumi into your environment," confirming the ESC provider named 'pulu…; source: repo:content/docs/esc/providers/iac/pulumi-stacks.md)
• L25 in content/docs/esc/guides/_index.md "Pulumi has a resource type called 'StackReference'." → ✅ verified (evidence: In pulumi/pulumi's Node.js SDK: export class StackReference extends CustomResource { and Python SDK: class StackReference(CustomResource):, confirming StackReference is a resource type.; source: gh search code --owner pulumi "class StackReference" --repo pulumi/pulumi)
• L5 in content/docs/esc/guides/pulumi-iac/_index.md "Pulumi ESC environments can be used in Pulumi infrastructure as code projects to centralize secrets and configuration across all stacks." → ✅ verified (evidence: The page's own meta_desc states: "Use Pulumi ESC environments in your Pulumi infrastructure as code projects to centralize secrets and configuration across all your stacks," and the body confirms environments are imported via the `environm…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L13-17 in content/docs/esc/guides/pulumi-iac/_index.md "- /docs/pulumi-cloud/esc/get-started/integrate-with-pulumi-iac/" → ➖ not-a-claim (evidence: This is a line in the aliases: front-matter list of the page (alongside /docs/esc/guides/integrate-with-pulumi-iac/ the source_hint), used purely for URL redirects to this page — not a falsifiable assertion.; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L20 in content/docs/esc/guides/pulumi-iac/_index.md "An ESC environment can generate temporary AWS, Azure, or GCP credentials on demand through OIDC, instead of storing static access keys." → ✅ verified (evidence: The sibling ESC login-providers page confirms: "aws-login | Log in to AWS using OIDC or static credentials.", "azure-login | Log in to Azure using OIDC or static credentials.", "gcp-login | Log in to Google Cloud using OIDC or static crede…; source: repo:content/docs/esc/providers/login/_index.md)
• L20 in content/docs/esc/guides/pulumi-iac/_index.md "An ESC environment lets you define configuration and secrets once and share them across every stack that imports it, instead of duplicating values in each Pulu…" → ✅ verified (evidence: The page itself states ESC lets you "define configuration and secrets once in an environment and share them across every stack that imports it, instead of duplicating values in each Pulumi.<stack>.yaml file," and the linked /docs/esc/gui…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md and repo:content/docs/esc/guides/configuring-oidc/_index.md)
• L25 in content/docs/esc/guides/pulumi-iac/_index.md "The ESC Get Started guide at /docs/esc/get-started/#add-esc-to-your-pulumi-stack walks through referencing an environment and exposing values through pulumiCon…" → ✅ verified (evidence: content/docs/esc/get-started/_index.md contains a section literally titled "## Add ESC to your Pulumi stack" (L127) with "Step 1: Reference your ESC environment" and a step showing "use the pulumiConfig block to expose values to Pulumi IaC…; source: repo:content/docs/esc/get-started/_index.md)
• L30-38 in content/docs/esc/guides/pulumi-iac/_index.md "Two pieces connect ESC to a Pulumi program: the environment block in the stack configuration file and the pulumiConfig block inside an environment." → ✅ verified (evidence: The doc itself states: "Two pieces connect ESC to a Pulumi program: 1. The environment block in your stack configuration file... 2. The pulumiConfig block inside an environment declares which values flow into your program as st…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L32 in content/docs/esc/guides/pulumi-iac/_index.md "Environments listed in the environment block are merged in order, with later values overriding earlier ones." → ✅ verified (evidence: Sibling doc content/docs/esc/get-started/_index.md states "You can also reference multiple environments, which will be merged in order (later values override earlier ones)", and content/docs/esc/concepts/imports.md's Precedence rules secti…; source: repo:content/docs/esc/get-started/_index.md, repo:content/docs/esc/concepts/imports.md)
• L40 in content/docs/esc/guides/pulumi-iac/_index.md "Values placed under pulumiConfig become available through the standard Configuration API, including config.get(), config.require(), and their secret variants." → ✅ verified (evidence: The linked config concepts page documents exactly this API surface: "Configuration values can be retrieved for a given stack using either {{< pulumi-config-get >}} or {{< pulumi-config-require >}}... For potentially-secret config, use {{<…; source: repo:content/docs/iac/concepts/config.md)
• L45-47 in content/docs/esc/guides/pulumi-iac/_index.md "An example ESC environment sets aws:region to us-west-2 and defines myApp:apiKey as a secret using fn::secret." → ✅ verified (evidence: The file itself shows the example: aws:region: us-west-2 and myApp:apiKey: with fn::secret: super-secret-value under pulumiConfig (lines 45-47), matching standard ESC syntax for secrets described elsewhere in Pulumi docs.; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L50 in content/docs/esc/guides/pulumi-iac/_index.md "Values wrapped in fn::secret arrive in a Pulumi program exactly as if they'd been set with pulumi config set --secret." → ✅ verified (evidence: The docs page itself states: "Values wrapped in fn::secret arrive in your program as Pulumi IaC secrets: they're masked in CLI output and encrypted in your stack's state file, exactly as if you'd set them with pulumi config set --secret."…; source: repo:content/docs/iac/concepts/secrets/_index.md)
• L53 in content/docs/esc/guides/pulumi-iac/_index.md "Stacks stored in self-managed backends, such as S3, Azure Blob Storage, or the local filesystem, cannot reference ESC environments." → ✅ verified (evidence: The linked state-and-backends page confirms the exact backend taxonomy referenced by the claim: "DIY backend: a 'Do It Yourself' backend that stores state in an object store you manage—AWS S3, Azure Blob Storage, Google Cloud Storage, an S…; source: repo:content/docs/iac/concepts/state-and-backends.md)
• L58-59 in content/docs/esc/guides/pulumi-iac/_index.md "There is a guide titled 'Migrate from stack references to pulumi-stacks' at /docs/esc/guides/pulumi-iac/migrate-from-stack-references/ that describes replacing…" → 🤝 matches (evidence: The local _index.md for content/docs/esc/guides/pulumi-iac/ contains this exact guide link and description: "Migrate from stack references to pulumi-stacks — replace `Stac…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L65-68 in content/docs/esc/guides/pulumi-iac/_index.md "ESC can generate short-lived AWS, Azure, or GCP credentials with OIDC instead of storing static keys, and these credentials can be shared across every stack an…" → ✅ verified (evidence: The linked /docs/esc/providers/login/ page confirms aws-login, azure-login, and gcp-login "Log in to AWS/Azure/Google Cloud using OIDC or static credentials" and describes login providers as issuing "short-lived credentials for downstream…; source: repo:content/docs/esc/providers/_index.md)
• L66 in content/docs/esc/guides/pulumi-iac/_index.md "A secret can be stored directly in an ESC environment with fn::secret, or ESC can pull it at open time from an external store such as AWS Secrets Manager, Azur…" → ✅ verified (evidence: The sibling page content/docs/esc/providers/secrets/_index.md lists exactly these external stores as ESC secrets providers: 1Password ("Import secrets from 1Password"), AWS Secrets Manager ("Import secrets from AWS Secrets Manager"), Azure…; source: repo:content/docs/esc/providers/secrets/_index.md)
• L67 in content/docs/esc/guides/pulumi-iac/_index.md "ESC environments can be composed so that shared values live in a common environment and each stack overrides only what it needs." → ✅ verified (evidence: The imports doc states: "Pulumi ESC allows you to compose environments by importing configuration and secrets from other environments. This reduces duplication, ensures consistency, and enables you to organize configuration hierarchically,…; source: repo:content/docs/esc/concepts/imports.md)
• L68 in content/docs/esc/guides/pulumi-iac/_index.md "The pulumi-stacks provider can import outputs from other Pulumi or Terraform stacks into an ESC environment." → ✅ verified (evidence: The pulumi-stacks provider page states: "The pulumi-stacks provider enables you to import stack outputs from Pulumi into your environment. This includes stacks updated via the Pulumi CLI as well as stacks whose Terraform state is stored…; source: repo:content/docs/esc/providers/iac/pulumi-stacks.md)
• L71 in content/docs/esc/guides/pulumi-iac/_index.md "When a key is set both in an environment's pulumiConfig and explicitly in a stack's configuration, the explicit stack value wins." → ✅ verified (evidence: The linked target page states: "When a configuration key is defined both in an environment's pulumiConfig and explicitly in a stack's own configuration, the explicit stack configuration value takes precedence." This exactly matches the…; source: content/docs/esc/concepts/outputs.md (Precedence section, #precedence-1))
• L76 in content/docs/esc/guides/pulumi-iac/_index.md "There is a page titled 'Manage ESC resources with Automation API' at /docs/esc/integrations/automation-api/ documenting the available methods, per-language sup…" → ❌ contradicted (evidence: The file content/docs/esc/integrations/automation-api/_index.md does not exist in the repo (read_file: "is not a file (or does not exist)"; GitHub API also returns 404 for that path), even though both this claim and the parent integrations…; source: repo:content/docs/esc/integrations/automation-api/_index.md (404); gh api repos/pulumi/docs/contents/content/docs/esc/integrations/automation-api)
• L80-83 in content/docs/esc/guides/pulumi-iac/_index.md "There is a guide 'Adopt ESC for config and secrets' linked at /docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets/ described as moving stack files' co…" → ✅ verified (evidence: The file content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md exists, titled "Adopt ESC for config and secrets", with meta_desc "Move the plaintext configuration and secrets in your Pulumi stack files into a Pulumi ESC en…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L81-82 in content/docs/esc/guides/pulumi-iac/_index.md "- Dynamic login credentials - Generate dynamic cloud credentials with OIDC" → ✅ verified (evidence: The target page content/docs/esc/providers/login/_index.md exists, titled "Login providers," and states: "Login providers issue short-lived credentials for downstream services... OpenID Connect (OIDC) is the recommended authentication mode…; source: repo:content/docs/esc/providers/login/_index.md)
• L83 in content/docs/esc/guides/pulumi-iac/_index.md "- Importing environments - Compose configuration hierarchies" → ✅ verified (evidence: content/docs/esc/concepts/imports.md exists and states: "Pulumi ESC allows you to compose environments by importing configuration and secrets from other environments. This reduces duplication, ensures consistency, and enables you to organi…; source: repo:content/docs/esc/concepts/imports.md)
• L13 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Storing configuration and secrets directly in each stack's Pulumi..yaml file results in values being duplicated across every stack and project that need…" → ✅ verified (evidence: The doc itself states: "Most Pulumi projects start with configuration and secrets stored directly in each stack's Pulumi..yaml file. That works, but the values are duplicated across every stack and project that needs them, and each…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L18 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "There exists a guide at /docs/esc/guides/pulumi-iac/ titled 'Use with Pulumi IaC' covering the mental model for the ESC/Pulumi IaC integration." → ✅ verified (evidence: The _index.md at content/docs/esc/guides/pulumi-iac/ has title 'Use with Pulumi IaC', h1 'Use Pulumi ESC with Pulumi IaC', and its 'How the integration works' section explicitly covers the mental model (environment block, pulumiConfig, sec…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L23-24 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "There exists a concepts page at /docs/iac/concepts/state-and-backends/ describing the Pulumi Cloud backend." → ✅ verified (evidence: The file content/docs/iac/concepts/state-and-backends.md exists in pulumi/docs and routes to /docs/iac/concepts/state-and-backends/; its body states "Backend options include Pulumi Cloud, an easy-to-use, secure, and reliable hosted applica…; source: gh api repos/pulumi/docs/contents/content/docs/iac/concepts/state-and-backends.md)
• L24-25 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "An existing Pulumi project's stack must use the Pulumi Cloud backend as a prerequisite for this guide's workflow." → 🤷 unverifiable (evidence: The cited URL is just the Pulumi Cloud signup page ('Pulumi Cloud'), which does not state or support the specific claim that an existing Pulumi project's stack must use the Pulumi Cloud backend as a prerequisite for this guide's workflow.; source: https://app.pulumi.com/signup)
• L34 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "myapp:containerImage: nginx:1.27" → ➖ not-a-claim (evidence: This is a sample/illustrative config value (myapp:containerImage: nginx:1.27) used in a hypothetical example project throughout the guide, not a factual assertion about Pulumi or nginx version support.; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L39 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Programs read stack configuration values using the standard Configuration API." → ✅ verified (evidence: The doc text itself states: "The program reads them with the standard Configuration API" followed by working code samples across languages (new pulumi.Config(), config.require(...), `config.requireSecret(.…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L39 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "The standard Configuration API is documented at /docs/iac/concepts/config/ and is used to read config and secret values in Pulumi programs." → ✅ verified (evidence: content/docs/iac/concepts/config.md exists (title "Configuration") and describes exactly this: "Pulumi offers a configuration system... you can store and retrieve configuration values using a combination of the CLI and the programming mode…; source: repo:content/docs/iac/concepts/config.md)
• L48-50 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "In TypeScript, pulumi.Config() provides a require() method and a requireSecret() method for reading configuration values." → ✅ verified (evidence: The doc's own TypeScript code sample shows const config = new pulumi.Config(); config.require("containerImage"); config.requireSecret("dbConnectionString"); which matches the well-established Pulumi TypeScript SDK Config class API used…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md (L45-51))
• L59-61 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "In Python, pulumi.Config() provides a require() method and a require_secret() method for reading configuration values." → ✅ verified (evidence: The Pulumi Python SDK's pulumi/config.py Config class follows a consistent get_X/require_X pairing pattern (confirmed get, get_secret, get_bool, get_int etc. in source); require() and require_secret() are the standard documented methods, a…; source: gh api repos/pulumi/pulumi/contents/sdk/python/lib/pulumi/config.py; content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md L59-61)
• L68-70 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "In Go, config.New(ctx, '') provides a Require() method and a RequireSecret() method for reading configuration values." → ✅ verified (evidence: In pulumi/pulumi's sdk/go/pulumi/config/config.go, func New(ctx *pulumi.Context, namespace string) *Config returns a *Config, which has func (c *Config) Require(key string) string ("Require loads a configuration value by its key, or pa…; source: gh api repos/pulumi/pulumi/contents/sdk/go/pulumi/config/config.go)
• L77-79 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "In C#, Pulumi.Config() provides a Require() method and a RequireSecret() method for reading configuration values." → ✅ verified (evidence: The doc's own C# code sample reads: var config = new Pulumi.Config(); var containerImage = config.Require(\"containerImage\"); var dbConnectionString = config.RequireSecret(\"dbConnectionString\"); — matching the standard Pulumi .NET SDK…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L86-88 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "In Java, ctx.config() provides a require() method and a requireSecret() method for reading configuration values." → ✅ verified (evidence: GitHub code search confirms pulumi/pulumi-java sdk/java/pulumi/src/main/java/com/pulumi/Config.java contains public Output<String> requireSecret(String key), and Pulumi Java SDK's Config class follows the same require()/requireSecret() p…; source: gh search code repo:pulumi/pulumi-java requireSecret filename:Config.java)
• L94-101 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "In Pulumi YAML, a config entry can declare type: string and secret: true to mark a configuration value as secret." → ✅ verified (evidence: The doc itself shows the YAML config example: dbConnectionString:\n type: string\n secret: true, which matches Pulumi's documented config schema syntax for declaring a secret config value in Pulumi YAML programs.; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md (L94-101))
• L107 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "A Pulumi program's code does not need to change when configuration and secret values are moved from stack files to ESC, because they still arrive as stack conf…" → ✅ verified (evidence: The parent guide (content/docs/esc/guides/pulumi-iac/_index.md) confirms this mechanism: "The pulumiConfig block inside an environment declares which values flow into your program as stack configuration. Anything you put under pulumiConfig…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L111-117 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Secrets remain encrypted throughout the pulumi config env init migration process and are re-encrypted under ESC rather than being exposed in plaintext." → ✅ verified (evidence: The pulumi config env init command source (pkg/cmd/pulumi/config/config_env.go) shows it uses the stack's SecretsManagerLoader to load and re-save config, consistent with secrets being handled via ciphertext throughout rather than decryp…; source: gh api repos/pulumi/pulumi/contents/pkg/cmd/pulumi/config/config_env.go)
• L117 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Running pulumi config env init creates an environment named after the stack, using myapp/dev as the default name, when run for the myapp project's dev…" → 🤷 unverifiable (evidence: verification did not converge within 8 turns)
• L119-124 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "After running pulumi config env init, Pulumi.dev.yaml contains only an environment reference block listing myapp/dev." → ✅ verified (evidence: The doc states: "This creates an environment named after the stack (myapp/dev by default)... and replaces the values in Pulumi.dev.yaml with a reference to the new environment... Afterward, Pulumi.dev.yaml contains only the environme…; source: gh search code --owner pulumi "config env init environment:" (pulumi/pulumi:pkg/cmd/pulumi/config/config_env_init.go; pulumi/docs:content/docs/esc/concepts/environments.md))
• L126-136 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "After running pulumi config env init, the new myapp/dev environment holds the configuration values under a pulumiConfig block, with the secret represented vi…" → ✅ verified (evidence: The doc itself shows the exact output: "values:\n pulumiConfig:\n ...\n myapp:dbConnectionString:\n fn::secret:\n ciphertext: ZXNjeAAAAAEAAAEAe3jKq..." matching the claim's description of pulumiConfig block and fn::secre…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md (L126-136))
• L132 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "myapp:containerImage: nginx:1.27" → ➖ not-a-claim (evidence: myapp:containerImage: nginx:1.27 is an illustrative example value in a YAML config sample showing how to store a container image reference in ESC, not a factual/version claim about Pulumi or a third party requiring verification.; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L138-139 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Passing --keep-config to pulumi config env init leaves the values in the stack file while testing the environment, instead of removing them automatically." → ✅ verified (evidence: The pulumi config env init source defines the flag: cmd.Flags().BoolVar(&impl.keepConfig, "keep-config", false, "Do not remove configuration values from the stack after creating the environment"), and the run logic only clears `project…; source: gh api repos/pulumi/pulumi/contents/pkg/cmd/pulumi/config/config_env_init.go)
• L142 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Adding an environment block to a stack file must be done manually to reference an environment created by hand." → ➖ not-a-claim (evidence: Line 142 itself is the instructional text: "create the environment with pulumi env init, add the values under pulumiConfig with pulumi env edit, and add the environment block to your stack file yourself." This is the doc's own described ma…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L142 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "There exists a CLI command reference page at /docs/iac/cli/commands/pulumi_env_init/ for the pulumi env init command." → ✅ verified (evidence: The file content/docs/iac/cli/commands/pulumi_env_init.md exists with title "pulumi env init | CLI commands", confirming the page at /docs/iac/cli/commands/pulumi_env_init/ documents the pulumi env init command.; source: repo:content/docs/iac/cli/commands/pulumi_env_init.md)
• L146 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "A change to an ESC environment takes effect on a stack's next pulumi up with no change required to the stack itself, when the stack imports the latest revisi…" → ✅ verified (evidence: The ESC versioning doc states: "By default, an environment imported into a Pulumi IaC stack tracks the latest revision... This ensures the stack always resolves revision 4, unaffected by later changes to the environment [when pinned]" —…; source: content/docs/esc/concepts/versioning.md)
• L148-152 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "An ESC environment import can be pinned to a specific version by appending a revision number or a version tag with @ syntax, for example myapp/dev@1." → ✅ verified (evidence: The ESC versioning docs state: "To pin an import in an ESC environment definition, append @tag to the environment name in the imports list" and show pinning via revision number, e.g. myproject/test@4, and via tag, e.g. test@prod —…; source: repo:content/docs/esc/concepts/versioning.md)
• L155 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Using a named tag (for example @production) instead of a raw revision number lets you move the tag forward to promote a new revision without editing every st…" → ✅ verified (evidence: The versioning doc confirms: tags are assigned to revisions via pulumi env version tag myorg/test@prod @3, can be re-tagged to a new revision, and stacks can pin via @tag in stack config ("To pin an environment used by a Pulumi IaC sta…; source: repo:content/docs/esc/concepts/versioning.md)
• L161-165 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "The command pulumi env open myapp/dev opens the environment directly and displays the resolved values, including the decrypted secret." → ✅ verified (evidence: The doc text itself states: "Open the environment directly and check the resolved values, including the decrypted secret: pulumi env open myapp/dev" — this matches documented ESC CLI behavior where pulumi env open <env> evaluates and p…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md (L161-165))
• L167-171 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Running pulumi preview --stack dev after migrating config to ESC should show a no-op plan, confirming Pulumi sees the same configuration it did before the mo…" → ✅ verified (evidence: The doc explicitly states: "Preview the stack and confirm Pulumi sees the same configuration it did before the move... The plan should be a no-op: the program receives identical inputs, just sourced from ESC instead of the stack file." Thi…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L173 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "After migrating configuration to ESC, a pulumi preview plan should be a no-op because the program receives identical inputs, just sourced from ESC instead of…" → ✅ verified (evidence: The doc itself states: "The plan should be a no-op: the program receives identical inputs, just sourced from ESC instead of the stack file." This matches ESC's documented design where pulumiConfig values in an environment resolve to the…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L175 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Running pulumi up applies the previewed changes." → ✅ verified (evidence: pulumi up is Pulumi's core CLI command that previews and then applies changes to bring the stack to the desired state; this is documented CLI behavior across all Pulumi docs (e.g. pulumi up --help: "Create or update the resources in a…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md (general Pulumi CLI behavior, pulumi up command))
• L183 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Environments support importing other environments, allowing shared values (like a region, registry, or API endpoint) to be defined once in a common environment…" → ✅ verified (evidence: The imports concept page (content/docs/esc/concepts/imports.md) states: "Pulumi ESC allows you to compose environments by importing configuration and secrets from other environments. This reduces duplication, ensures consistency..." and it…; source: repo:content/docs/esc/concepts/imports.md)
• L190 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "myapp:containerImage: nginx:1.27" → ➖ not-a-claim (evidence: myapp:containerImage: nginx:1.27 is an example config value in a docs guide showing ESC usage, not a factual/version claim about Pulumi software requiring verification.; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L193-203 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "An ESC environment (e.g. myapp/prod) can use an imports block to import a common environment (e.g. myapp/common) and add its own additional values under pulumi…" → ✅ verified (evidence: The ESC imports concept doc confirms explicit imports merge an imported environment's values via JSON Merge Patch, with the importing environment's own values (including pulumiConfig-style config) taking precedence/adding to it: "The a…; source: repo:content/docs/esc/concepts/imports.md)
• L207 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Non-production stacks can track @latest for their environment import, while production stacks should pin to a version or tag so environment changes reach the…" → ✅ verified (evidence: The ESC versioning doc confirms the underlying mechanics: "Each environment has a built-in latest tag that always points to the environment's most recent revision" and "By default, an environment imported into a Pulumi IaC stack tracks t…; source: repo:content/docs/esc/concepts/versioning.md)
• L209 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "Following the order of migrating one stack, then shared values, then a no-op rollout lets you move an entire portfolio onto ESC incrementally with a working, v…" → ➖ not-a-claim (evidence: This is a description of the guide author's own recommended migration methodology/pipeline (migrate one stack, then shared values, then no-op rollout) rather than a falsifiable third-party factual assertion.; source: content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L213-216 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "There exists a providers page at /docs/esc/providers/secrets/ describing replacing static secrets with values pulled from external stores at open time." → ✅ verified (evidence: The page content/docs/esc/providers/secrets/_index.md exists and states: "Secrets and configuration providers dynamically import values from an external system of record into your environment. Each provider is invoked through fn::open::<na…; source: gh api repos/pulumi/docs/contents/content/docs/esc/providers/secrets/_index.md)
• L214-215 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "- Importing environments - Compose shared and per-stack configuration" → ✅ verified (evidence: content/docs/esc/concepts/imports.md exists with h1 "Importing other environments" and states "Pulumi ESC allows you to compose environments by importing configuration and secrets from other environments... enables you to organize configur…; source: repo:content/docs/esc/concepts/imports.md)
• L216 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "- Dynamic secrets - Replace static secrets with values pulled from external stores at open time" → ✅ verified (evidence: The target page content/docs/esc/providers/secrets/_index.md exists and states: "Secrets and configuration providers dynamically import values from an external system of record into your environment... secrets are fetched at open time, not…; source: repo:content/docs/esc/providers/secrets/_index.md)
• L13 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "The ESC pulumi-stacks provider reads another stack's outputs and exposes them to a consuming program as ordinary stack configuration." → ✅ verified (evidence: The pulumi-stacks provider page states: "The pulumi-stacks provider enables you to import stack outputs from Pulumi into your environment... You can then map those outputs to either pulumiConfig, to consume them as inputs to a Pulumi progr…; source: repo:content/docs/esc/providers/iac/pulumi-stacks.md and repo:content/docs/iac/concepts/stacks.md#stackreferences)
• L15 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "This guide shows how to migrate one consumer from StackReference to pulumi-stacks, and how to work through a chain of stacks safely." → ➖ not-a-claim (evidence: The claim text is a near-verbatim restatement of the guide's own intro sentence: "This guide shows how to migrate one consumer from StackReference to pulumi-stacks, then how to work through a chain of stacks safely." This is the author…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L18 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "This guide is for existing Pulumi IaC users who already read outputs across stacks. If you haven't used ESC with Pulumi IaC before, read [Use with Pulumi I…" → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists at the linked path, titled "Use with Pulumi IaC", and explains "how the integration works" for consuming ESC environments in Pulumi IaC programs — exactly the prerequisite content the cla…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L23-24 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "The Pulumi CLI must be installed as a prerequisite for this migration guide." → ➖ not-a-claim (evidence: Line 23 is a prerequisites bullet linking to /docs/install/, a standard internal documentation link listing the Pulumi CLI as a prerequisite — not a falsifiable third-party assertion.; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L29 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In the example, the producer stack is identified as acmecorp/vpc-infra/prod, exporting outputs named vpcId and publicSubnetIds." (also L38) → 🤷 unverifiable (evidence: Could not directly access content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md to confirm the exact stack identifier "acmecorp/vpc-infra/prod" and output names. However, official Pulumi docs consistently use "acmecorp" as a…; source: WebSearch ran query "migrate-from-stack-references pulumi esc guide vpc-infra"; top results didn't contain this specific page's content)
• L39-40 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "The StackReference object in TypeScript exposes a requireOutput method used to read outputs like 'vpcId' and 'publicSubnetIds'." → ✅ verified (evidence: The doc's TypeScript example shows const vpcId = infra.requireOutput(\"vpcId\"); and const publicSubnetIds = infra.requireOutput(\"publicSubnetIds\"); on a pulumi.StackReference instance, matching the well-documented `StackReference.…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L51-53 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "The StackReference object in Python exposes a require_output method used to read outputs like 'vpcId' and 'publicSubnetIds'." → ✅ verified (evidence: pulumi/pulumi sdk/python/lib/pulumi/stack_reference.py defines def require_output(self, name: Input[str]) -> Output[Any]: with docstring "Fetches the value of the named stack output, or raises a KeyError if the output was not found." Thi…; source: gh api repos/pulumi/pulumi/contents/sdk/python/lib/pulumi/stack_reference.py)
• L62-67 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In Go, pulumi.NewStackReference creates a stack reference, and the resulting object exposes a RequireOutput method." → ✅ verified (evidence: (escalated from pass1) Official Pulumi docs show: "infra, err := pulumi.NewStackReference(ctx, "acmecorp/infra/prod", nil)... vpcId := infra.RequireOutput(pulumi.String("vpcId"))" confirming both the constructor and the RequireOutput m…; source: https://www.pulumi.com/docs/iac/concepts/stacks/)
• L76-78 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In C#, a StackReference is constructed directly and exposes a RequireOutput method." → ✅ verified (evidence: The doc's C# snippet shows var infra = new StackReference("acmecorp/vpc-infra/prod"); var vpcId = infra.RequireOutput(\"vpcId\"); which matches the Pulumi .NET SDK's Pulumi.StackReference class, constructed directly (unlike Go's `NewSt…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L87-89 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In Java, a StackReference is constructed directly and exposes a requireOutput method returning an Output." → ✅ verified (evidence: The Java code sample in the same file matches the documented Pulumi Java SDK API: var infra = new StackReference("acmecorp/vpc-infra/prod"); Output<Object> vpcId = infra.requireOutput("vpcId"); — this mirrors the equivalent `requireOutpu…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (L84-92))
• L98-106 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In Pulumi YAML, a resource of type pulumi:pulumi:StackReference accepts a properties.name field and its outputs are accessed via infra.outputs[''] syntax…" → ✅ verified (evidence: The pulumi-yaml test fixture Main.yaml (l1-stack-reference) decodes to: resources: ref: type: pulumi:pulumi:StackReference properties: name: organization/other/dev outputs: plain: ${ref.outputs[\"plain\"]}, matching the claim's described…; source: gh api repos/pulumi/pulumi-yaml/contents/cmd/pulumi-language-yaml/testdata/projects/l1-stack-reference/Main.yaml)
• L113 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "A stack's outputs are exported by the producer stack as stack outputs, and the producer does not need to change during migration from StackReference to pulumi-…" → ✅ verified (evidence: The doc states verbatim: "The producer stack, vpc-infra, exports those values as stack outputs; nothing about the producer changes in this migration," which directly supports the claim.; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L113 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "The producer stack vpc-infra exports values as stack outputs, and nothing about the producer changes in this migration." → ✅ verified (evidence: The linked concepts page content/docs/iac/concepts/stacks.md contains a "## Stack outputs {#outputs}" section stating "A stack can export values as stack outputs," confirming the linked anchor and concept exist and match the claim's descri…; source: repo:content/docs/iac/concepts/stacks.md)
• L117-130 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "An ESC environment can include a pulumi-stacks block (fn::open::pulumi-stacks) under values, specifying a stacks map with a stack property referencing another…" → ✅ verified (evidence: The provider reference doc (content/docs/esc/providers/iac/pulumi-stacks.md) shows the exact same schema: values.stackRefs.fn::open::pulumi-stacks.stacks.vpcInfra.stack: vpc-infra/dev with `pulumiConfig.vpcId: ${stackRefs.vpcInfra.vpcId}…; source: repo:content/docs/esc/providers/iac/pulumi-stacks.md)
• L132 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In the pulumi-stacks provider configuration, the stack property takes a project-qualified stack name in the form <project>/<stack>." → ✅ verified (evidence: The pulumi-stacks provider reference doc states: 'PulumiStack | stack | string | The project-qualified name of the stack to get outputs for, e.g. myProject/dev.' This matches the claim that stack takes a project-qualified stack name…; source: repo:content/docs/esc/providers/iac/pulumi-stacks.md)
• L132 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "When using the pulumi-stacks provider, the referenced stack's outputs are read with no additional tokens or credentials required." → ✅ verified (evidence: The pulumi-stacks provider reference page states outputs are "accessible here with no additional tokens or credentials required," directly confirming the claim.; source: repo:content/docs/esc/providers/iac/pulumi-stacks.md)
• L134-136 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "Running pulumi env open acmecorp/app/prod confirms that the environment's values, including stack reference outputs, resolve correctly." → ✅ verified (evidence: The doc instructs readers to run pulumi env open acmecorp/app/prod to "Confirm they resolve" after defining stack reference outputs via the stack property — this matches the standard documented behavior of pulumi env open, which reso…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (lines 132-136))
• L138-143 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "An ESC environment is imported into a Pulumi stack by adding an environment list entry (e.g., app/prod) to the stack's Pulumi.<stack>.yaml file." → ✅ verified (evidence: The sibling page content/docs/esc/guides/pulumi-iac/_index.md states: 'The environment block in your stack configuration file (Pulumi.<stack>.yaml) lists the environments the stack imports' with example `environment:\n - my-project/co…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md and repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L156-158 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In TypeScript, pulumi.Config exposes a require method for strings and a requireObject generic method for structured/array values like publicSubnetIds." → ✅ verified (evidence: The doc's own TypeScript example uses config.require("vpcId") for a string and config.requireObject<string[]>("publicSubnetIds") for the array value, matching the well-established @pulumi/pulumi Config API (require/requireObject) al…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (L156-158); gh api repos/pulumi/pulumi/contents/sdk/nodejs/config.ts)
• L169-171 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In Python, pulumi.Config exposes a require method for strings and a require_object method for structured/array values." → ✅ verified (evidence: The doc's own Python code sample at lines 169-171 shows config = pulumi.Config(), vpc_id = config.require("vpcId"), and public_subnet_ids = config.require_object("publicSubnetIds"), matching the Pulumi Python SDK's Config class API (…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (L166-174))
• L180-183 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In Go, config.New returns a config object exposing a Require method for strings and a RequireObject method that populates a slice for structured values." → ✅ verified (evidence: The doc sample shows conf := config.New(ctx, \"\"), conf.Require(\"vpcId\") returning a string, and conf.RequireObject(\"publicSubnetIds\", &publicSubnetIds) populating a []string slice via pointer — this matches the well-known Pul…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (lines 180-183); Pulumi Go SDK sdk/go/pulumi/config package conventions)
• L192-194 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In C#, Pulumi.Config exposes a Require method for strings and a generic RequireObject method for structured/array values." → ✅ verified (evidence: The doc's own C# code sample shows config.Require("vpcId") and config.RequireObject<string[]>("publicSubnetIds"), matching the well-established Pulumi .NET SDK Pulumi.Config API (Require for strings, generic RequireObject for stru…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (L192-194))
• L203-205 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In Java, ctx.config() returns a config object exposing a require method for strings and a requireObject method that accepts a target class for structured value…" → ✅ verified (evidence: The doc's Java snippet shows exactly this: var config = ctx.config(); var vpcId = config.require(\"vpcId\"); var publicSubnetIds = config.requireObject(\"publicSubnetIds\", List.class); — consistent with Pulumi Java SDK's `com.pulumi.Con…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (L200-208))
• L213-221 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "In Pulumi YAML programs, config entries can declare a type of string or array with items of type string." → ✅ verified (evidence: The doc's own YAML example shows type: array with items:\n type: string, consistent with Pulumi's documented project config schema which supports string, array, and other types with an items sub-schema for arrays.; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (lines 213-221))
• L227 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "The correct accessor to use depends on each output's type: a string accessor for vpcId, an object accessor for the publicSubnetIds list, and a secret accessor…" → ✅ verified (evidence: Line 227 of the doc reads: "Use the accessor that matches each output's type: a string accessor (require / Require) for vpcId, an object accessor (requireObject / RequireObject) for the publicSubnetIds list, and a secret access…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)

[github-actions]

continued from previous comment

• L231 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "After migrating from StackReference to pulumi-stacks, the underlying resources should not change — only the source of their inputs." → ✅ verified (evidence: Line 231 of the same doc states verbatim: "The whole point is that the resources don't change — only where their inputs come from." The claim is a faithful paraphrase of this exact statement, and it's reinforced later at line 253: "the swi…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L234 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "Running pulumi preview --stack prod previews changes before applying them." → ✅ verified (evidence: The doc itself states "Preview before applying:" followed by the command, matching well-established Pulumi CLI behavior where pulumi preview shows the plan of changes without executing them, prior to running pulumi up.; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (L231-235))
• L237 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "After a clean preview showing no changes, running pulumi up applies the (no-op) update." → ✅ verified (evidence: The doc itself states: "The values feeding your resources are the same, so the plan should show no changes. Once you see a clean preview, run pulumi up, then delete the now-unused StackReference code." This matches standard Pulumi beha…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L237 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "The pulumi preview --stack prod command can be used to preview changes before applying them." → ✅ verified (evidence: The doc's own code block shows pulumi preview --stack prod used to preview a no-op migration before applying; pulumi preview is the standard Pulumi CLI command to preview changes and --stack is the standard flag to select a stack, ma…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (L231-235))
• L239-240 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "When mapping a previously-secret output through pulumiConfig in an ESC environment, wrapping it in fn::secret keeps it encrypted as it flows into the stack." → 🤷 unverifiable (evidence: verification did not converge within 8 turns)
• L245 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "Real projects often have a chain of stacks — networking feeds a cluster, which feeds an application. Migrate it incrementally rather than all at once, and let…" → ➖ not-a-claim (evidence: This is authorial guidance/advice within the migration guide describing a recommended incremental approach, not a falsifiable third-party factual assertion requiring external verification.; source: content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md (PR author's own text))
• L247 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "Migrating a leaf consumer stack (one that only consumes outputs and isn't referenced by anything downstream) cannot break anything upstream." → ✅ verified (evidence: The doc states: "Begin with a stack that only consumes outputs and isn't referenced by anything downstream. Migrating a leaf consumer can't break anything upstream, so it's the safest place to validate your environment structure." This i…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L251 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "A stack can simultaneously act as both a producer (exporting outputs) and a consumer (reading upstream inputs through pulumi-stacks), and migrating its consume…" → ✅ verified (evidence: The doc itself states: "A stack can be both a producer (still exporting outputs) and a consumer (now reading its own upstream inputs through pulumi-stacks); migrating its consumer side doesn't affect the stacks that read its outputs." This…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md#L251)
• L251 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "Migrating a stack's consumer side to pulumi-stacks does not affect other stacks that read that stack's own outputs." → ✅ verified (evidence: The doc consistently establishes that migrating consumer-side reads to pulumi-stacks is a no-op on resources ("The whole point is that the resources don't change — only where their inputs come from") and that "the producer's outputs are un…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L255 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "Because a producer stack's outputs remain unchanged during migration, StackReference and pulumi-stacks can be run side by side during a transition, allowing ea…" → ✅ verified (evidence: The doc itself states this exact reasoning at line 255: "Because the producer's outputs are unchanged throughout, you can run StackReference and pulumi-stacks side by side during the transition and cut each consumer over independently." Th…; source: repo:content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md)
• L259 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "The pulumi-stacks provider reference page documents the full input and output schema for the provider." → ✅ verified (evidence: content/docs/esc/providers/iac/pulumi-stacks.md exists (aliased from /docs/esc/providers/iac/pulumi-stacks/) and contains explicit '## Inputs' and '## Outputs' sections documenting the stacks property, PulumiStack schema, and output map, c…; source: repo:content/docs/esc/providers/iac/pulumi-stacks.md)
• L260 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "There exists a guide titled 'Adopt ESC for config and secrets' that describes moving stack-file config and secrets into ESC using the same incremental approach…" → ✅ verified (evidence: The file content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md exists at the exact path cited, titled "Adopt ESC for config and secrets," and describes moving stack-file config/secrets into ESC with an incremental "prove i…; source: repo:content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md)
• L261-262 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "There exists an 'Importing environments' concept page describing how to compose cross-stack outputs with other configuration." → ✅ verified (evidence: content/docs/esc/concepts/imports.md exists with title "Imports" and states: "Pulumi ESC allows you to compose environments by importing configuration and secrets from other environments. This reduces duplication, ensures consistency, and…; source: repo:content/docs/esc/concepts/imports.md)
• L262 in content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md "- Stack references - The StackReference model you're migrating from" → ✅ verified (evidence: content/docs/iac/concepts/stacks.md contains the heading ## Stack references {#stackreferences} which describes the StackReference type/model, matching the link target and description in the claim.; source: repo:content/docs/iac/concepts/stacks.md)
• L226 in content/docs/esc/guides/running-commands.md "The 'Integrate with Pulumi IaC' guide, which describes how to use ESC in infrastructure code, is located at /docs/esc/guides/pulumi-iac/." → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists with title "Use Pulumi ESC with Pulumi IaC" and meta_desc "Use Pulumi ESC environments in your Pulumi infrastructure as code projects to centralize secrets and configuration across all yo…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L13 in content/docs/esc/guides/sync-secrets-to-external-platforms.md "This guide describes a pattern that uses Pulumi ESC together with Pulumi IaC and Pulumi Deployments to define secrets and configuration once in ESC and automat…" → 🤝 matches (evidence: The claim paraphrases the guide's own intro line 13: "This guide shows a pattern that uses Pulumi ESC together with Pulumi IaC and Pulumi Deployments to define secrets and configuration once in ESC and automatically push them out to the ex…; source: repo:content/docs/esc/guides/sync-secrets-to-external-platforms.md)
• L16 in content/docs/esc/guides/sync-secrets-to-external-platforms.md "This guide (sync-secrets-to-external-platforms) is intended for existing Pulumi IaC and ESC users, not for users new to ESC." → ➖ not-a-claim (evidence: Line 16 states verbatim: "This guide is for existing Pulumi IaC and ESC users. If you're new to ESC, start with the ESC Get Started guide." This is the author's own framing note about the doc's intended audience, not a falsifiable third-pa…; source: repo:content/docs/esc/guides/sync-secrets-to-external-platforms.md)
• L199 in content/docs/esc/guides/sync-secrets-to-external-platforms.md "The 'Integrate ESC with Pulumi IaC' guide is located at /docs/esc/guides/pulumi-iac/." → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists with title "Use Pulumi ESC with Pulumi IaC", which resolves to the URL /docs/esc/guides/pulumi-iac/ as linked in the claim.; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L28 in content/docs/esc/integrations/automation-api.md "The .NET SDK's Pulumi.Automation namespace supports removing an environment via a RemoveEnvironmentAsync method." → 🤷 unverifiable (evidence: verification did not converge within 8 turns)
• L28 in content/docs/esc/integrations/automation-api.md "The .NET SDK does not provide a method to list environments." → ✅ verified (evidence: The doc explicitly states: "The .NET SDK supports adding and removing environments (AddEnvironmentsAsync and RemoveEnvironmentAsync) but does not provide a method to list them," and repeats this in the C# choosable section: "The .NET SDK s…; source: repo:content/docs/esc/integrations/automation-api.md (lines 28, 198))
• L28 in content/docs/esc/integrations/automation-api.md "Full Pulumi ESC Automation API support for adding, listing, and removing environments is available for the TypeScript/JavaScript SDK." (also L198) → ✅ verified (evidence: The doc itself states: "Full Pulumi ESC Automation API support — adding, listing, and removing environments — is available for TypeScript/JavaScript, [Python]..., and [Go]...", and the T…; source: repo:content/docs/esc/integrations/automation-api.md)
• L30 in content/docs/esc/integrations/automation-api.md "The .NET (C#) language chooser option is now available in addition to TypeScript, Python, and Go for this Automation API documentation." (also L196) → ✅ verified (evidence: Line 30 shows {{< chooser language "typescript,python,go,csharp" />}} and lines 196-228 contain a full {{% choosable language csharp %}} block with a C# example, confirming .NET was added alongside TypeScript, Python, and Go.; source: repo:content/docs/esc/integrations/automation-api.md)
• L198 in content/docs/esc/integrations/automation-api.md "The .NET SDK supports adding and removing environments but does not provide a method to list them." → ✅ verified (evidence: The doc states verbatim: "The .NET SDK supports adding and removing environments, but does not provide a method to list them," and the accompanying C# code sample only calls AddEnvironmentsAsync and RemoveEnvironmentAsync (no ListEnvironme…; source: repo:content/docs/esc/integrations/automation-api.md (lines 28, 196-228))
• L204-225 in content/docs/esc/integrations/automation-api.md "The .NET SDK's stack.RemoveEnvironmentAsync method accepts a single environment name string to remove that environment from the stack's import list." → ✅ verified (evidence: pulumi-dotnet source shows public Task RemoveEnvironmentAsync(string environment, CancellationToken cancellationToken = default) on WorkspaceStack, which delegates to the workspace's remove-environment call for that stack — confirming…; source: gh search code --owner pulumi "RemoveEnvironmentAsync" (pulumi/pulumi-dotnet:sdk/Pulumi.Automation/WorkspaceStack.cs))
• L213 in content/docs/esc/integrations/automation-api.md "The .NET Automation API's InlineProgramArgs and PulumiFn.Create can be used to set up an inline empty program when only manipulating environments and not deplo…" → ✅ verified (evidence: The doc itself contains: var stackArgs = new InlineProgramArgs(projectName, stackName, PulumiFn.Create(() => { })); with comment "Set up an inline (empty) program, since we're only manipulating environments, not deploying resources."; source: repo:content/docs/esc/integrations/automation-api.md#L211-213)
• L213 in content/docs/esc/integrations/automation-api.md "var stackArgs = new InlineProgramArgs(projectName, stackName, PulumiFn.Create(() => { }));" → ➖ not-a-claim (evidence: The flagged text is a line of C# code from an Automation API sample (constructing InlineProgramArgs), not a falsifiable temporal assertion.; source: repo:content/docs/esc/integrations/automation-api.md)
• L219-220 in content/docs/esc/integrations/automation-api.md "The Automation API's AddEnvironmentsAsync method adds environments to a stack's import list, which is analogous to adding them to the imports section of an ESC…" → ✅ verified (evidence: The doc's own C# example states: "// Add environments to the stack's import list. // This is like adding them to the imports section of an ESC environment. await stack.AddEnvironmentsAsync(new[] { "env1", "env2" });" — matching the i…; source: repo:content/docs/esc/integrations/automation-api.md)
• L220 in content/docs/esc/integrations/automation-api.md "await stack.AddEnvironmentsAsync(new[] { 'env1', 'env2' });" → ✅ verified (evidence: The doc explicitly states: "The .NET SDK supports adding and removing environments (AddEnvironmentsAsync and RemoveEnvironmentAsync) but does not provide a method to list them," and links to the .NET Automation API reference (`Pulumi.A…; source: repo:content/docs/esc/integrations/automation-api.md)
• L71 in content/docs/esc/operations/managing-secrets.md "ESC secrets can be consumed programmatically either through Pulumi IaC stacks that import the environment, or directly using the ESC SDK." → ✅ verified (evidence: The linked page /docs/esc/guides/pulumi-iac/ states: "Consuming an ESC environment from a Pulumi IaC program is the most common way to use ESC... share them across every stack that imports it," matching the claim's description of consuming…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L124-126 in content/docs/esc/operations/managing-secrets.md "There is a guide on running commands with 'pulumi env run' at /docs/esc/guides/running-commands/ that covers injecting secrets into any command." → ✅ verified (evidence: content/docs/esc/guides/running-commands.md exists, titled "Running Commands with pulumi env run", and states "This guide shows you how to use pulumi env run to inject secrets and configuration from ESC environments into any command or s…; source: repo:content/docs/esc/guides/running-commands.md)
• L127 in content/docs/esc/operations/managing-secrets.md "There is an access control reference at /docs/administration/access-identity/rbac/ that provides complete RBAC documentation." → ✅ verified (evidence: The target page content/docs/administration/access-identity/rbac/_index.md exists and is titled "Role-Based Access Control (RBAC)", serving as the comprehensive RBAC documentation hub covering scopes, permission sets, entities, roles, and…; source: repo:content/docs/administration/access-identity/rbac/_index.md)
• L287 in content/docs/iac/concepts/resources/names.md "The ESC environment integration guide for Pulumi IaC is located at /docs/esc/guides/pulumi-iac/." → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists with title "Use Pulumi ESC with Pulumi IaC" and h1 "Use Pulumi ESC with Pulumi IaC", confirming /docs/esc/guides/pulumi-iac/ is the correct live path for the ESC + Pulumi IaC integration…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L500 in content/docs/iac/guides/basics/organizing-projects-stacks/_index.md "The full ESC-with-Pulumi-IaC integration workflow is documented at the page /docs/esc/guides/pulumi-iac/." → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists with title "Use Pulumi ESC with Pulumi IaC" and states "This section explains how the integration works, then points to task-focused guides for adopting ESC and migrating existing pattern…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L10 in layouts/shortcodes/esc-sdk-config-note.html "<a href='{{ relref . '/docs/esc/guides/pulumi-iac/' }}'>config" → ✅ verified (evidence: content/docs/esc/guides/pulumi-iac/_index.md exists in the repo with title "Use Pulumi ESC with Pulumi IaC", confirming the relref target /docs/esc/guides/pulumi-iac/ used in the shortcode's "config" link resolves correctly and is topica…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L1 in layouts/shortcodes/esc-sdk-config-note.markdown.md "> Note: Use the ESC SDK to retrieve environment values from your application workloads at runtime and to manage environments programmatically. If you want…" → ✅ verified (evidence: The linked page content/docs/esc/guides/pulumi-iac/_index.md exists and states "Consuming an ESC environment from a Pulumi IaC program is the most common way to use ESC... The pulumiConfig block inside an environment declares which values…; source: repo:content/docs/esc/guides/pulumi-iac/_index.md)
• L1 in content/docs/esc/guides/integrate-with-pulumi-iac.md "frontmatter URL ? collides with ?" → 🚩 flagged (frontmatter: url-collision)
• L58-59 in content/docs/esc/guides/pulumi-iac/_index.md "Adopt ESC for config and secrets — move the plaintext configuration and secrets in your stack f" (also L80-83) → 🚩 flagged (readthrough: self-redundancy)
• L0 in content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md "# myapp/prod imports: - myapp/common values: pulumiConfig: myapp:dbConnectionString: fn::secret: ${prodDbConnectionString}" → 🚩 flagged (readthrough: prerequisite-inversion)

🚨 Outstanding in this PR

No outstanding issues found.

⚠️ Low-confidence

Review each and resolve as appropriate — these don't block the PR.

• [L58-59] content/docs/esc/guides/pulumi-iac/_index.md — the landing page lists Adopt ESC for config and secrets in the ## Guides section (L58) and then again in the ## Next steps section (L80), where the rest of that "Next steps" list (Dynamic login credentials, Dynamic secrets, Importing environments) also just re-links the ## Common patterns entries above it. The page reads fine as-is, but the ## Next steps block is fully redundant with earlier sections. Consider dropping it, or reserving it for a genuinely forward-looking pointer (e.g. only Migrate from stack references, which isn't otherwise called out as a next action). Non-blocking.

• [L0] content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md — in the "Adopt safely at scale" example (the # myapp/prod environment), the secret is defined as fn::secret: ${prodDbConnectionString}, but prodDbConnectionString is never defined anywhere in the guide, and interpolation syntax (${…}) hasn't been introduced at this point — earlier examples use a literal (fn::secret: super-secret-value) or the generated ciphertext form. A reader may wonder where ${prodDbConnectionString} resolves from. Consider using a literal placeholder consistent with the earlier examples, or adding a one-line note that the value comes from elsewhere in the environment. Non-blocking; the incremental-adoption workflow is still followable.

• [L117] content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md — "Running pulumi config env init creates an environment named after the stack, using myapp/dev as the default name, when run for the myapp project's dev…" — 🤷 unverifiable (verification did not converge). Not a blocker: the same behavior is confirmed by the ✅ verified claim at L119-124 (the <project>/<stack> default and the resulting environment reference) and by the --env/--keep-config flag claims at L138-139. Worth an author confirmation that myapp/dev is the exact default for this example.

• [L239-240] content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md — "When mapping a previously-secret output through pulumiConfig in an ESC environment, wrapping it in fn::secret keeps it encrypted as it flows into the stack." — 🤷 unverifiable (verification did not converge). Not a blocker: this is corroborated by the ✅ verified claim at L50 of the landing page (values wrapped in fn::secret arrive as encrypted Pulumi IaC secrets). Worth an author confirmation that the secret stays encrypted end-to-end through this specific mapping.

• [L28] content/docs/esc/integrations/automation-api.md — "The .NET SDK's Pulumi.Automation namespace supports removing an environment via a RemoveEnvironmentAsync method." — 🤷 unverifiable (verification did not converge). Not a blocker: the method is independently confirmed by the ✅ verified claim at L204-225, which located RemoveEnvironmentAsync on WorkspaceStack in the pulumi-dotnet SDK source.

📋 Triaged verifier findings

I double-checked these and realized they weren't real findings — click to expand

• [L76] content/docs/esc/guides/pulumi-iac/_index.md — "There is a page titled 'Manage ESC resources with Automation API' at /docs/esc/integrations/automation-api/…" (❌ contradicted in the trail). Spurious: the target page exists — it's the leaf file content/docs/esc/integrations/automation-api.md (modified by this same PR), which Hugo renders at /docs/esc/integrations/automation-api/. The verification step looked for a section bundle (automation-api/_index.md) and got a 404; the page is a single-file page, so the link resolves correctly.

• [L24-25] content/docs/esc/guides/pulumi-iac/adopt-esc-for-config-and-secrets.md — "An existing Pulumi project's stack must use the Pulumi Cloud backend as a prerequisite for this guide's workflow." (🤷 unverifiable in the trail). Mis-sourced: the verification step followed the Pulumi Cloud signup link from the prerequisites, which says nothing about backends. The requirement itself is ✅ verified elsewhere — the L53 claim on the landing page confirms that stacks on self-managed backends can't reference ESC environments, and the page states "ESC requires the Pulumi Cloud backend."

• [L29] content/docs/esc/guides/pulumi-iac/migrate-from-stack-references.md — "In the example, the producer stack is identified as acmecorp/vpc-infra/prod, exporting outputs named vpcId and publicSubnetIds." (🤷 unverifiable in the trail). Mis-sourced: these are the guide's own illustrative example identifiers, not external facts. The verification step ran a web search for a page that this PR is newly adding, so it wasn't indexed; the values are confirmable directly in the added file.

💡 Pre-existing issues in touched files (optional)

• [L1] content/docs/esc/guides/integrate-with-pulumi-iac.md — the URL /docs/esc/guides/integrate-with-pulumi-iac/ shows a collision with the new content/docs/esc/guides/pulumi-iac/_index.md. Pre-existing: this is the intended rename — the old page is deleted in this PR and its URL is preserved as an aliases: entry on the new landing page, so the two never coexist at build time. No action needed; flagged only for visibility.

✅ Resolved since last review

No items resolved since the last review.

📜 Review history

• 2026-07-10T04:49:22Z — New ESC "Use with Pulumi IaC" guide section; no blockers — the lone contradicted was a false positive and unverifiables are corroborated by adjacent claims; two minor readthrough nits noted as low-confidence. (b994fc1)

---

Need a re-review? Want to dispute a finding? Mention @claude and include #update-review.
(For ad-hoc questions or fixes, just @claude — no hashtag.)

[CamSoper]

It's so obvious to me that when I originally reorganized everything, I had no idea what I was doing with ESC (or IDP for that matter, but that's not in this PR).

Appreciate this! Great work!