CLI and SDK rollup: pulumi new, pulumi do, and more

We shipped a bunch of new features and improvements in the Pulumi CLI and SDK this month. A few highlights:

• A redesigned interactive pulumi new that asks for a cloud provider and language instead of listing every template, then confirms your project, stack, and config defaults in a single step (v3.258, v3.259)
• Opt-in encryption of stored credentials with a key protected by your operating system, selected with PULUMI_CREDENTIAL_STORE (v3.258)
• A new pulumi state get command to inspect an individual resource in your state (v3.257)
• A new pulumi state promote command that turns the stateful snippets created by pulumi do into Pulumi program code (v3.260)
• An --ignore-protect flag for pulumi up, pulumi preview, and pulumi destroy that deletes protected resources without unprotecting them in state first (v3.256)
• Full-stack validation for Go policy packs via policyx.NewStackValidationPolicy (v3.258)
• A PULUMI_DEFAULT_ORGANIZATION environment variable to set your default organization (v3.259)
• Support for Go 1.27 (v3.260)

We also retired the AI mode of pulumi new in favor of pulumi neo (v3.256), and made a raft of improvements to pulumi do as well.

See the Releases page on GitHub and the pulumi do docs for details.