Enforce policies in CI/CD

Pulumi policies integrate with CI/CD pipelines to automatically enforce compliance and security rules on every deployment. When policy packs are enabled for your organization, they run during pulumi preview and pulumi up, including when these commands execute in CI/CD workflows. Non-compliant changes are blocked before they reach production.

How policy enforcement works in CI/CD

When your CI/CD pipeline runs Pulumi commands, policy enforcement happens automatically:

1. The pipeline runs pulumi preview or pulumi up.
2. Pulumi Cloud downloads the policy packs assigned to the stack via policy groups.
3. Each policy pack evaluates the proposed infrastructure changes.
4. If any policy in advisory mode detects a violation, a warning is logged but the operation continues.
5. If any policy in mandatory mode detects a violation, the operation fails and the pipeline stops.

You can also run policy packs locally in CI by passing the --policy-pack flag:

pulumi preview --policy-pack /path/to/policy-pack

Pulumi Deployments

Pulumi Deployments runs pulumi preview and pulumi up for you in Pulumi Cloud, triggered by a push to your repository, a pull request, a schedule, or an API call. Because Deployments runs the same commands, the policy packs in your stack’s policy groups apply with no extra setup: a mandatory violation fails the deployment, and advisory violations appear in its logs. If you use a custom executor image, make sure it includes the runtime your policy packs need.

Pulumi CI/CD integrations

Pulumi maintains integrations for two CI/CD systems. Both run the Pulumi CLI, so policy groups apply to them automatically.

GitHub Actions

The Pulumi GitHub Action installs the Pulumi CLI and runs Pulumi commands in your workflows. When your stack has policy packs enabled in Pulumi Cloud, the action enforces them.

GitHub Actions downloads policy packs on each workflow run. Cache the ~/.pulumi/policies directory to avoid downloading them again and speed up your workflows:

- name: Cache Pulumi policy packs
  uses: actions/cache@v4
  with:
    path: ~/.pulumi/policies
    key: ${{ runner.os }}-pulumi-policies-${{ hashFiles('**/package.json') }}
    restore-keys: |
      ${{ runner.os }}-pulumi-policies-

For complete workflow examples, see the GitHub Actions guide.

Azure Pipelines

The Pulumi Task Extension runs Pulumi commands in Azure Pipelines, and enforces the policy packs enabled for your stack. See the Azure DevOps guide.

Other CI/CD systems

Policy enforcement works in any CI/CD system that can run the Pulumi CLI, with no policy-specific configuration. Set up Pulumi in your pipeline by following the continuous delivery guide for your system. Once the pipeline runs pulumi preview or pulumi up, the policy packs enabled for the stack are enforced.

Best practices

• Use policy groups to vary enforcement by environment. Apply stricter (mandatory) policies to production stacks and advisory policies to development stacks. See policy groups for details.
• Test policy changes before enforcing. Publish policy pack updates and test them in advisory mode before switching to mandatory enforcement.
• Run pulumi preview in pull request checks. This catches policy violations early, before changes are merged.