How do I install the Trace Pulumi Diff skill?

Run npx skillmds@latest add marin-community/trace-pulumi-diff in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Trace Pulumi Diff safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Trace Pulumi Diff?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Trace Pulumi Diff free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Trace Pulumi Diff?

marin-community (@marin-community) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Trace Pulumi Diff by marin-community

Name: Trace Pulumi Diff
Author: marin-community

Trace Pulumi Diff

Run a read-only preview for a specified Marin infra/pulumi stack and trace each pending resource change to merged pull requests since its latest successful update when that update records a clean Git checkout. Use when a stack has unapplied changes or drift and someone needs to know which PRs explain the preview.

marin-community f545883 2 files · 2.8 KB Updated Sep 17, 2026

File contents

Trace a Pulumi diff

Work only with the marin-iac project in infra/pulumi. Require an explicit stack name.

Preview current main

Read infra/pulumi/README.md and satisfy its credentials and stack-specific prerequisites. Fetch origin/main and run from a clean checkout at that commit. Preserve existing work; use another worktree when necessary.

Prepare the environment from the repository root:

uv sync --package marin-iac --extra deploy --frozen
export PULUMI_PYTHON_CMD="$PWD/.venv/bin/python"

Run the preview without changing the selected stack:

pulumi -C infra/pulumi preview --stack <stack> --diff --color never

Keep the raw preview local. It may contain decrypted identifiers. If the preview is empty, report that the stack has no pending diff and stop.

Find the deployed commit

Read recent history without secrets:

pulumi -C infra/pulumi stack history \
  --stack <stack> --json --page-size 100 > /tmp/marin-pulumi-history-<stack>.json
jq -r '
  map(select(.kind == "update" and .result == "succeeded"))
  | first
  | [.startTime, .environment["git.head"], .environment["git.dirty"]]
  | @tsv
' /tmp/marin-pulumi-history-<stack>.json

Use git.head only when it is a commit on origin/main and git.dirty is false. If either condition fails, report that an exact Git baseline is unavailable and stop attribution.

Attribute the preview

List merged commits after the deployed commit:

git log --first-parent --format='%H%x09%s' <deployed-sha>..origin/main

Inspect each candidate with git show. Match concrete preview resource names and changed properties to the code or configuration diff. Do not attribute a change merely because its commit is in the range.

Map a matching commit to its pull request:

gh api repos/marin-community/marin/commits/<commit>/pulls \
  --jq '.[] | [.number, .title, .html_url] | @tsv'

Report each preview change with its matching PR and the file or hunk that explains it. Report changes with no matching commit as live drift or unresolved attribution. A preview can contain changes from multiple PRs.

Never run pulumi up, pulumi refresh, pulumi destroy, an import, or a state mutation. Call out any NodePool replacement or deletion from the preview.

---name: trace-pulumi-diffdescription: Run a read-only preview for a specified Marin infra/pulumi stack and trace each pending resource change to merged pull requests since its latest successful update when that update records a clean Git checkout. Use when a stack has unapplied changes or drift and someone needs to know which PRs explain the preview.---# Trace a Pulumi diffWork only with the `marin-iac` project in `infra/pulumi`. Require an explicit stack name.## Preview current mainRead `infra/pulumi/README.md` and satisfy its credentials and stack-specific prerequisites. Fetch `origin/main` and run from a clean checkout at that commit. Preserve existing work; use another worktree when necessary.Prepare the environment from the repository root:```bashuv sync --package marin-iac --extra deploy --frozenexport PULUMI_PYTHON_CMD="$PWD/.venv/bin/python"```Run the preview without changing the selected stack:```bashpulumi -C infra/pulumi preview --stack <stack> --diff --color never```Keep the raw preview local. It may contain decrypted identifiers. If the preview is empty, report that the stack has no pending diff and stop.## Find the deployed commitRead recent history without secrets:```bashpulumi -C infra/pulumi stack history \ --stack <stack> --json --page-size 100 > /tmp/marin-pulumi-history-<stack>.jsonjq -r ' map(select(.kind == "update" and .result == "succeeded")) | first | [.startTime, .environment["git.head"], .environment["git.dirty"]] | @tsv' /tmp/marin-pulumi-history-<stack>.json```Use `git.head` only when it is a commit on `origin/main` and `git.dirty` is `false`. If either condition fails, report that an exact Git baseline is unavailable and stop attribution.## Attribute the previewList merged commits after the deployed commit:```bashgit log --first-parent --format='%H%x09%s' <deployed-sha>..origin/main```Inspect each candidate with `git show`. Match concrete preview resource names and changed properties to the code or configuration diff. Do not attribute a change merely because its commit is in the range.Map a matching commit to its pull request:```bashgh api repos/marin-community/marin/commits/<commit>/pulls \ --jq '.[] | [.number, .title, .html_url] | @tsv'```Report each preview change with its matching PR and the file or hunk that explains it. Report changes with no matching commit as live drift or unresolved attribution. A preview can contain changes from multiple PRs.Never run `pulumi up`, `pulumi refresh`, `pulumi destroy`, an import, or a state mutation. Call out any NodePool replacement or deletion from the preview.

Frequently asked questions