@cfxlabsinc/nx-pulumi

Workspace-internal Nx plugin that contributes Pulumi targets to any project that has a pulumi/Pulumi.yaml.

Inferred targets

The plugin's createNodesV2 watches for **/pulumi/Pulumi.yaml. When it finds one alongside the project's project.json, it contributes:

• pulumi-up (dependsOn: ["build"])
• pulumi-preview (dependsOn: ["build"])
• pulumi-cancel
• pulumi-refresh
• pulumi-destroy
• pulumi-stack-init

Each target has dev and prod configurations (defaultConfiguration: "dev") wired to the right AWS profile and S3 backend bucket.

Doppler auth

Every target except pulumi-stack-init exports DOPPLER_TOKEN from the local CLI (doppler configure get token --plain) before running Pulumi. The Doppler provider reads only DOPPLER_TOKEN or the OIDC pair — never ~/.doppler — so without this, any stack whose program calls doppler.getSecrets() fails with Missing authentication configuration.

An already-set DOPPLER_TOKEN or DOPPLER_OIDC_IDENTITY wins, and a logged-out or missing CLI leaves the value empty (which the provider treats as unset). CI is unaffected: ci-pulumi.yml / cd-pulumi.yml call pulumi/actions directly with OIDC, not these targets.

The full executor and command live in this plugin — no targetDefaults indirection. To change the Pulumi command shape, edit src/plugin.ts.

Registration

Plugin is registered in workspace nx.json under plugins:

{
  "plugin": "@cfxlabsinc/nx-pulumi",
  "options": {}
}
Copy

Resolves through the path mapping in tsconfig.base.json:

"@cfxlabsinc/nx-pulumi": ["./packages/nx-pulumi/src/index.ts"]
Copy