From 3ac7453171ea8a35f9e491415ac6118f84aa7b18 Mon Sep 17 00:00:00 2001 From: Adam Tauber Date: Thu, 8 Oct 2026 09:00:06 +0200 Subject: [PATCH 1/3] docs: GCP is simulated by plugin-gcp from CLI v0.6.18 (ENG-1193) Name the three dialects, the per-resource project order and the --organization fallback (through extra-args, no input yet), what happens to an auto-named Pulumi resource, and the Linro Release 2026.10.1 floor. Co-Authored-By: Claude Opus 5.5 --- README.md | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index d541173..1bbbb43 100644 --- a/README.md +++ b/README.md @@ -96,7 +96,7 @@ below. |---|---|---| | `account` | | AWS account the resources deploy to. | | `region` | | AWS region. | -| `project` | | GCP project. | +| `project` | | GCP project, for a GCP resource whose plan states none. A fallback, not an override: one that contradicts the project a provider states refuses the run. See [GCP](#gcp). | | `domain` | | T Cloud Public domain: the 32-hex id or the account name. Must match your connector's spelling exactly — see below. | | `stack-export` | | `pulumi stack export` document, to recover the account/region a preview cannot carry. A scope hint — its resources are **not** simulated. | | `allow-mock-account` | `false` | Submit with no resolved account. Identities are then derived from a placeholder, so nothing matches your real inventory. Not for a gate. | @@ -134,9 +134,10 @@ quietly turn off the gate you added it for. A Terraform plan carries its provider configuration, so `account` and `region` are often recoverable from the plan alone. A **Pulumi preview carries none** — -if you simulate a preview, pass `account`/`region` (and `project` for GCP, or -`domain` for T Cloud Public), or the resources are identified against the wrong -scope. +if you simulate a preview, pass `account`/`region` (or `domain` for T Cloud +Public), or the resources are identified against the wrong scope. The GCP +project is the exception: a preview carries the stack's config, and CLI v0.6.18 +and later read `gcp:project` from it. The split is plan vs preview, not provider. What differs per provider is how many ways a *plan* can state the value: @@ -145,7 +146,8 @@ many ways a *plan* can state the value: |---|---| | AWS region | the plan's provider config, a per-resource hint, then `region` | | AWS account | an `assume_role` role ARN in the provider config, `stack-export`, then `account` | -| GCP project | a constant `project` in the `google` provider block, then `project` | +| GCP project | the resource's own `project`, then a constant `project` in **its** provider block (a Pulumi preview: an explicit provider's `project` input, else the stack's `gcp:project`), then `project` | +| GCP organization | the resource's own `org_id` / `organization` / `organizations/…` parent, then `--organization` (through `extra-args`) | | T Cloud Public domain | a constant `domain_id`/`domain_name` in the `opentelekomcloud` provider block, then `domain`. **That is all.** | And only a value **written in the provider block** reaches the plan. A provider @@ -229,6 +231,49 @@ checking anything more. region: eu-central-1 ``` +## GCP + +From CLI **v0.6.18**, GCP resources are simulated by **plugin-gcp**, the plugin +your install inventories them with, so a simulated resource gets the same +identity as the live one. All three dialects go through it: Terraform +(`google` and `google-beta`), Pulumi's bridged `gcp` package, and Pulumi +`google-native`. The action's default `version` predates this, so set it. + +```yaml + - uses: linro-io/simulation-github-action@v1 + with: + version: v0.6.19 + plan: plan.json + server: ${{ vars.LINRO_SERVER }} + token: ${{ secrets.LINRO_TOKEN }} + project: my-gcp-project # only where the plan states none + extra-args: --organization 123456 # only for organization-level resources +``` + +- **Project.** Read per resource, from the plan first (see the scope table + above). `project` fills in only where nothing states one. With no project at + all, the run is refused by name rather than submitted with a malformed + identity. A resource whose own project the plan hides (a reference to + something not yet created, a redacted value) is **skipped** with that reason; + it is never guessed into another project. +- **Organization.** An organization-level resource (an org policy, for one) + takes the organization it states. `--organization 123` (or + `organizations/123`) fills in where the parent is a folder, a project, or + unknown until apply. A contradiction refuses. There is no `organization` + input yet, so pass it through `extra-args`. +- **Pulumi auto-naming.** A Pulumi program that leaves `name` out gets a name + the provider draws for the preview, and the apply draws a different one. The + resource is simulated under the preview's name: its findings are real, but it + can never match a live resource. An update keeps the live name. Set `name` + explicitly if you want a create to line up with what lands. A resource whose + name the plan cannot state at all (unknown until apply, redacted) is reported + as skipped, and resources that reference it are still simulated. +- **Install version.** A resource the plan does not change is submitted with + fallback columns, and the CLI refuses to send them to an install older than + Linro Release **2026.10.1**: an older install composes those columns empty, + which a check would read as compliant. The refusal says so; upgrade the + install. This applies to every provider, not only GCP. + ## Trying it without an install ```yaml From 8bb04c76821d2b9e556d46c29a8d93c3ceca41da Mon Sep 17 00:00:00 2001 From: Adam Tauber Date: Thu, 8 Oct 2026 11:43:10 +0200 Subject: [PATCH 2/3] docs: v0.6.18+ is not on marketplace.linro.io yet; the per-package Pulumi project key (ENG-1193) Co-Authored-By: Claude Opus 5.5 --- README.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1bbbb43..9c47fee 100644 --- a/README.md +++ b/README.md @@ -137,7 +137,8 @@ are often recoverable from the plan alone. A **Pulumi preview carries none** — if you simulate a preview, pass `account`/`region` (or `domain` for T Cloud Public), or the resources are identified against the wrong scope. The GCP project is the exception: a preview carries the stack's config, and CLI v0.6.18 -and later read `gcp:project` from it. +and later read it for a default provider (`gcp:project`, or +`google-native:project` for native resources). The split is plan vs preview, not provider. What differs per provider is how many ways a *plan* can state the value: @@ -146,7 +147,7 @@ many ways a *plan* can state the value: |---|---| | AWS region | the plan's provider config, a per-resource hint, then `region` | | AWS account | an `assume_role` role ARN in the provider config, `stack-export`, then `account` | -| GCP project | the resource's own `project`, then a constant `project` in **its** provider block (a Pulumi preview: an explicit provider's `project` input, else the stack's `gcp:project`), then `project` | +| GCP project | the resource's own `project`, then a constant `project` in **its** provider block (a Pulumi preview: an explicit provider's `project` input; for a default provider only, the stack's `gcp:project` / `google-native:project`), then `project` | | GCP organization | the resource's own `org_id` / `organization` / `organizations/…` parent, then `--organization` (through `extra-args`) | | T Cloud Public domain | a constant `domain_id`/`domain_name` in the `opentelekomcloud` provider block, then `domain`. **That is all.** | @@ -239,6 +240,12 @@ identity as the live one. All three dialects go through it: Terraform (`google` and `google-beta`), Pulumi's bridged `gcp` package, and Pulumi `google-native`. The action's default `version` predates this, so set it. +**Availability.** As of 2026-10-08, `marketplace.linro.io` (the default +`marketplace-url`) does not serve v0.6.18 or v0.6.19 yet: the download answers +404 until the version is promoted to production. Until then the example below +works only against a marketplace that serves it, and the install it simulates +against must run Linro Release 2026.10.1 or later (see **Install version**). + ```yaml - uses: linro-io/simulation-github-action@v1 with: From 9b795eb69a01aa670b174847bb9c48e61f3da5a7 Mon Sep 17 00:00:00 2001 From: Adam Tauber Date: Thu, 8 Oct 2026 13:26:09 +0200 Subject: [PATCH 3/3] docs: scope is the plugin's, and the GCP section says only what a user needs (ENG-1193) Review on #5: the scope section read as AWS with GCP and OTC appended. It now says each plugin defines its scope and points at the plugin's Scopes tab in the marketplace; the per-provider table stays. The GCP intro is trimmed, and the availability note goes: the CLI is to be promoted to production instead. Co-Authored-By: Claude Opus 5.5 --- README.md | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 9c47fee..609e4ae 100644 --- a/README.md +++ b/README.md @@ -132,16 +132,20 @@ quietly turn off the gate you added it for. ### Scope: what a plan knows about itself -A Terraform plan carries its provider configuration, so `account` and `region` -are often recoverable from the plan alone. A **Pulumi preview carries none** — -if you simulate a preview, pass `account`/`region` (or `domain` for T Cloud -Public), or the resources are identified against the wrong scope. The GCP -project is the exception: a preview carries the stack's config, and CLI v0.6.18 -and later read it for a default provider (`gcp:project`, or -`google-native:project` for native resources). +Every resource is identified within a scope, and each plugin defines its own: +which values the scope is made of (an AWS account and region, a GCP project, a +T Cloud Public domain), and where a plan or a preview can state them. A +plugin's page in the marketplace lists its scope under **Scopes**, for example +[plugin-gcp](https://marketplace.linro.io/plugins/gcp). -The split is plan vs preview, not provider. What differs per provider is how -many ways a *plan* can state the value: +The scope inputs (`account`, `region`, `project`, `domain`) supply what the +plan or preview does not state itself. A value the scope cannot do without, and +that nothing states, refuses the run, unless you allow a placeholder where the +plugin offers one; a placeholder matches nothing in your inventory. How much a +source states differs by tool as well as by provider: a Terraform plan carries +its provider configuration, while a Pulumi preview generally carries far less. + +The current rules, per provider: | Value | Where it can come from, in order | |---|---| @@ -234,18 +238,10 @@ checking anything more. ## GCP -From CLI **v0.6.18**, GCP resources are simulated by **plugin-gcp**, the plugin -your install inventories them with, so a simulated resource gets the same -identity as the live one. All three dialects go through it: Terraform -(`google` and `google-beta`), Pulumi's bridged `gcp` package, and Pulumi +From CLI **v0.6.18**, GCP resources are simulated by **plugin-gcp**, in all three +dialects: Terraform (`google`, `google-beta`), Pulumi `gcp` and Pulumi `google-native`. The action's default `version` predates this, so set it. -**Availability.** As of 2026-10-08, `marketplace.linro.io` (the default -`marketplace-url`) does not serve v0.6.18 or v0.6.19 yet: the download answers -404 until the version is promoted to production. Until then the example below -works only against a marketplace that serves it, and the install it simulates -against must run Linro Release 2026.10.1 or later (see **Install version**). - ```yaml - uses: linro-io/simulation-github-action@v1 with: