clean up

.github/workflows/deploy.yml

@@ -7,22 +7,31 @@ jobs:
   deploy:
     name: Deploy
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v5
-      - name: Setup QEMU
-        uses: docker/setup-qemu-action@v3
       - name: Setup Node
         uses: actions/setup-node@v5
         with:
           node-version: 24
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@v2
+        with:
+          install_components: gke-gcloud-auth-plugin
       - name: Install Packages
         run: npm install
         working-directory: ./pulumi
+      - name: Authenticate Pulumi
+        uses: pulumi/auth-actions@v1
+        with:
+          organization: meiermade
+          requested-token-type: urn:pulumi:token-type:access_token:personal
+          scope: user:meiermade
       - name: Deploy
         uses: pulumi/actions@v6
         with:
           work-dir: ./pulumi
           command: up
           stack-name: prod
-        env:
-          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_TOKEN }}

.github/workflows/preview.yml

@@ -30,6 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
       pull-requests: write
     needs:
       - test
@@ -39,9 +40,19 @@ jobs:
         uses: actions/setup-node@v5
         with:
           node-version: 24
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@v2
+        with:
+          install_components: gke-gcloud-auth-plugin
       - name: Install Packages
         run: npm install
         working-directory: ./pulumi
+      - name: Authenticate Pulumi
+        uses: pulumi/auth-actions@v1
+        with:
+          organization: meiermade
+          requested-token-type: urn:pulumi:token-type:access_token:personal
+          scope: user:meiermade
       - name: Preview
         uses: pulumi/actions@v6
         with:
@@ -50,5 +61,3 @@ jobs:
           stack-name: prod
           diff: true
           comment-on-pr: true
-        env:
-          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_TOKEN }}

.github/workflows/publish.yml

@@ -9,6 +9,9 @@ jobs:
   publish:
     name: Publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v5
       - name: Setup dotnet
@@ -24,8 +27,12 @@ jobs:
       - name: Install Packages
         run: dotnet paket install
         working-directory: ./sln
+      - name: Authenticate Pulumi
+        uses: pulumi/auth-actions@v1
+        with:
+          organization: meiermade
+          requested-token-type: urn:pulumi:token-type:access_token:personal
+          scope: user:meiermade
       - name: Publish
-        run: ./fake.sh PushNugets
+        run: pulumi env run fsharpviewengine/nuget -- ./fake.sh PushNugets
         working-directory: ./sln
-        env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}

pulumi/index.ts

@@ -1,4 +1,3 @@
-import './src/aws'
 import './src/cloudflare'
 import './src/docker'
 import './src/k8s'

pulumi/package.json

@@ -5,7 +5,6 @@
         "@types/node": "^24.10.9"
     },
     "dependencies": {
-        "@pulumi/aws": "^7.16.0",
         "@pulumi/cloudflare": "^6.10.0",
         "@pulumi/docker-build": "^0.0.15",
         "@pulumi/kubernetes": "^4.18",

pulumi/src/config.ts

@@ -5,23 +5,24 @@ export const rootDir = path.dirname(path.dirname(__dirname))
 
 export const identifier = 'fsharpviewengine'
 
-const rawAwsConfig = new pulumi.Config('aws')
-const rawCloudflareConfig = new pulumi.Config('cloudflare')
-const rawK8sConfig = new pulumi.Config('k8s')
+const rawDockerConfig = new pulumi.Config('docker')
 
-export const awsConfig = {
-    accountId: rawAwsConfig.require('platformAccountId'),
-    region: rawAwsConfig.require('region'),
-    eksNodeManagerArn: rawAwsConfig.require('eksNodeManagerArn')
+export const dockerConfig = {
+    registryUri: rawDockerConfig.require('registryUri'),
+    registryAccessToken: rawDockerConfig.requireSecret('registryAccessToken'),
 }
 
+const rawCloudflareConfig = new pulumi.Config('cloudflare')
+
 export const cloudflareConfig = {
     accountId: rawCloudflareConfig.require('accountId'),
     apiToken: rawCloudflareConfig.requireSecret('apiToken'),
     zoneName: rawCloudflareConfig.require('zoneName'),
     cloudflaredVersion: '2026.2.0'
 }
 
+const rawK8sConfig = new pulumi.Config('k8s')
+
 export const k8sConfig = {
     namespace: rawK8sConfig.require('namespace'),
 }

pulumi/src/docker/image.ts

@@ -1,22 +1,28 @@
 import * as pulumi from '@pulumi/pulumi'
-import * as docker from '@pulumi/docker-build'
+import * as dockerBuild from '@pulumi/docker-build'
 import * as path from 'path'
 import { provider } from './provider'
-import { repo, credentials } from '../aws/repository'
 import * as config from '../config'
 
-export const image = new docker.Image(config.identifier, {
-    tags: [pulumi.interpolate `${repo.repositoryUrl}:latest`],
-    push: true,
+const registryUri = config.dockerConfig.registryUri
+const registryHost = registryUri.split('/')[0]
+
+export const image = new dockerBuild.Image(config.identifier, {
+    tags: [
+        pulumi.interpolate`${registryUri}/${config.identifier}`
+    ],
     context: {
         location: path.join(config.rootDir, 'sln'),
     },
-    platforms: ['linux/arm64'],
+    platforms: [
+        dockerBuild.Platform.Linux_amd64
+    ],
+    push: true,
     registries: [{
-        address: repo.repositoryUrl,
-        username: credentials.userName,
-        password: credentials.password
-    }]
+        address: registryHost,
+        username: 'oauth2accesstoken',
+        password: config.dockerConfig.registryAccessToken,
+    }],
 }, { provider })
 
 export const imageRef = image.ref

pulumi/src/docker/provider.ts

@@ -1,3 +1,3 @@
-import * as docker from '@pulumi/docker-build'
+import * as dockerBuild from '@pulumi/docker-build'
 
-export const provider = new docker.Provider('default')
+export const provider = new dockerBuild.Provider('default')