You are running Pulumi in a CI/CD pipeline with GitHub Actions deploying to AWS. The pipeline takes 15 minutes for a large stack with 200+ resources. How do you optimize Pulumi deployment performance and implement safe CI/CD practices?
Quick Answer
Optimize by splitting large stacks into smaller ones by service boundary, using `--target` for targeted updates, enabling parallel resource operations, caching provider plugins, and implementing preview-on-PR with apply-on-merge workflows with proper state locking and drift detection.
Detailed Answer
Stack Splitting Strategy
A single stack with 200+ resources is a red flag. Split it into logical stacks by service boundary or infrastructure layer: networking (VPC, subnets), compute (EKS, ECS), data (RDS, ElastiCache), and per-service stacks. Each stack deploys independently and faster because Pulumi only refreshes and diffs resources within that stack. Use stack references for cross-stack dependencies. This also reduces blast radius: a bad change to one service's stack doesn't risk the entire infrastructure.
Pulumi Performance Tuning
Pulumi deploys resources in parallel by default, respecting dependency order. You can increase parallelism with pulumi up --parallel <N> (default is 10). For independent resources, this dramatically reduces deployment time. Cache provider plugins in CI by persisting ~/.pulumi/plugins between runs. Use pulumi up --refresh=false when you're confident no out-of-band changes occurred (saves the refresh phase). For targeted updates during incident response, use pulumi up --target <urn> to update only specific resources.
CI/CD Pipeline Design
Implement a two-phase workflow: pulumi preview runs on every PR and posts the diff as a PR comment for review. pulumi up runs only on merge to main (or on manual approval for production). Use Pulumi's GitHub Actions integration which provides the preview comment natively. Implement environment promotion: dev deploys automatically on merge, staging requires manual approval, production requires two approvals and a change window.
Safety Mechanisms
Run pulumi up --diff to see a detailed diff before applying. Enable drift detection by running pulumi refresh periodically (not on every deploy for performance) to detect out-of-band changes. Use --expect-no-changes in scheduled drift detection runs to alert when actual state diverges from desired state. Implement stack policies that prevent accidental deletion of critical resources using the protect resource option.