From e1f12d6b71535b1d27c2eb437bb170213ea93961 Mon Sep 17 00:00:00 2001
From: Radoslav Dimitrov <radoslav@stacklok.com>
Date: Tue, 30 Sep 2025 18:45:13 +0300
Subject: [PATCH] Add a workflow for cancelling stuck pulumi locks (#589)

<!-- Provide a brief summary of your changes -->

## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR adds an easy way to cancel stuck pulumi jobs (could be
temporary).

## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->

## Breaking Changes
<!-- Will users need to update their code or configurations? -->

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
---
 .github/workflows/cancel-pulumi-lock.yml | 72 ++++++++++++++++++++++++
 1 file changed, 72 insertions(+)
 create mode 100644 .github/workflows/cancel-pulumi-lock.yml

diff --git a/.github/workflows/cancel-pulumi-lock.yml b/.github/workflows/cancel-pulumi-lock.yml
new file mode 100644
index 0000000..a83d647
--- /dev/null
+++ b/.github/workflows/cancel-pulumi-lock.yml
@@ -0,0 +1,72 @@
+name: Cancel Pulumi Lock
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment to cancel lock for'
+        required: true
+        type: choice
+        options:
+          - staging
+          - production
+
+permissions:
+  contents: read
+
+env:
+  PULUMI_VERSION: "3.188.0"
+
+jobs:
+  cancel-lock:
+    name: Cancel Pulumi Lock
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+
+      - name: Setup Pulumi
+        uses: pulumi/actions@cc7494be991dba0978f7ffafaf995b0449a0998e
+        with:
+          pulumi-version: ${{ env.PULUMI_VERSION }}
+
+      - name: Authenticate to Google Cloud (Staging)
+        if: inputs.environment == 'staging'
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          credentials_json: ${{ secrets.GCP_STAGING_SERVICE_ACCOUNT_KEY }}
+
+      - name: Authenticate to Google Cloud (Production)
+        if: inputs.environment == 'production'
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093
+        with:
+          credentials_json: ${{ secrets.GCP_PROD_SERVICE_ACCOUNT_KEY }}
+
+      - name: Setup Google Cloud SDK (Staging)
+        if: inputs.environment == 'staging'
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
+        with:
+          project_id: mcp-registry-staging
+
+      - name: Setup Google Cloud SDK (Production)
+        if: inputs.environment == 'production'
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
+        with:
+          project_id: mcp-registry-prod
+
+      - name: Cancel Pulumi Lock (Staging)
+        if: inputs.environment == 'staging'
+        working-directory: ./deploy
+        run: |
+          echo "${{ secrets.PULUMI_STAGING_PASSPHRASE }}" > passphrase.staging.txt
+          pulumi login gs://mcp-registry-staging-pulumi-state
+          PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.staging.txt pulumi cancel --stack gcpStaging --yes
+
+      - name: Cancel Pulumi Lock (Production)
+        if: inputs.environment == 'production'
+        working-directory: ./deploy
+        run: |
+          echo "${{ secrets.PULUMI_PROD_PASSPHRASE }}" > passphrase.prod.txt
+          pulumi login gs://mcp-registry-prod-pulumi-state
+          PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi cancel --stack gcpProd --yes
\ No newline at end of file