Pinned, checksummed mirrors of the third-party binaries our toolchain installs at deploy time — the Pulumi CLI and the Pulumi provider plugins.
Nothing is built here. Every release is a byte-for-byte copy of an upstream artifact, re-hosted so that what we deploy with is served by us and cannot change or disappear underneath a pinned release.
On 2026-08-14 every scheduled inforge deploy against prd began failing. No
inforge release had changed — the same binary succeeded one day and failed the
next. The cause was that inforge drives Pulumi through the Automation API, which
shells out to whatever pulumi is on PATH, and nothing installed one. A GitHub
runner-image roll moved the preinstalled CLI 3.253.0 → 3.256.0, and the new CLI
could not write our R2 state (InvalidDigest, 400).
An undeclared, unpinned, externally-hosted binary was in the deploy path. Pinning the version (inforge#276) stopped the drift. This repo closes the rest: we host the bytes.
One release per mirrored artifact version. The tag is the upstream version, so it is immutable and self-describing:
| Tag | Contents |
|---|---|
pulumi-v3.253.0 |
Pulumi CLI tarballs for the platforms we run |
plugin-hcloud-v1.38.0 |
pulumi-resource-hcloud tarballs |
Every release carries a SHA256SUMS we generate ourselves. Consumers must
verify against it — mirroring without verification just moves the trust, it does
not establish it.
Only the platforms we actually run are mirrored: linux-x64, linux-arm64,
darwin-arm64. Windows and darwin-x64 are deliberately omitted.
Run the Mirror Pulumi CLI or Mirror provider plugin workflow
(workflow_dispatch) with the version. It:
- downloads the upstream assets,
- verifies them against upstream's own published checksums,
- re-uploads them here with a
SHA256SUMSof what we actually stored.
Mirror at the moment you adopt a version, not lazily — if upstream removes a release before we have copied it, there is nothing left to mirror.
Pulumi and its providers are Apache-2.0, which permits redistribution provided the license and notices travel with it. Each release body records the upstream source URL, the version, and the license. We redistribute unmodified artifacts only.
This repo mirrors what our own toolchain consumes. It is not a general-purpose file host.