Support the --exclude-protected on destroy

[garethbudden]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

For similar reasons outlined in the issue that resulted in the --exclude-protected being added to the CLI, it would be good to be able to provide this flag in the GitHub Action.

[RobbieMcKinstry]

Hi @garethbudden , thanks for opening this issue.
I think you're definitely right, that would be a very useful feature to have! I'm wondering if the solution to allow an escape hatch with an args parameter, allowing users to specify other CLI flags beyond --exclude-protected. There are a lot of other CLI flags to which this same position applies.

What do you think @cobraz?

[CmdrSharp]

@RobbieMcKinstry I don't miss this flag specifically, but I agree that either command needs to support string input, or an args / extraArgs input needs to be supported to handle flags. There are plenty of use cases, including --save-plan or --config-file for example.

We now have to resort to installing Pulumi CLI.

[RobbieMcKinstry]

Hm, yeah... I wonder about adding command: raw, perhaps? Then we'd specify an args: List[string] input. Maybe that still feels better than running the CLI directly.

[CmdrSharp]

That's definitely a decent option!
I'd definitely prefer the action over the CLI. Just the comment-on-pr feature of the action alone saves some work compared to running the Vault CLI.

But, having read through the action-code in an effort to make a PR; I still don't see how you feed that into pulumi-automation. From what I gather, only very specific fields are taken into account there. Perhaps it just requires a PR to that module as well :)

[RobbieMcKinstry]

Sorry to talk across you on two threads, Commander! I'm going to link this related conversation here just for posterity, in which we discuss a possible approach to side-step automation API.

[joey-jonko-paypal]

This functionality in the GHA would be great
https://www.pulumi.com/blog/announcing-public-preview-update-plans/