Support --refresh=false to override refresh: always from Pulumi.yaml

[vallentishka]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Currently, the refresh input is a boolean that only supports adding --refresh flag when set to true. There is no way to pass --refresh=false to explicitly disable refresh when Pulumi.yaml has refresh: always configured.

Use case

We have refresh: always set in Pulumi.yaml because it's valuable for local development and non-CI execution - developers running pulumi up locally always get fresh state without remembering to add the flag.

However, in GitHub Actions, we want to skip refresh in certain scenarios:

1. Running pulumi up from a saved plan file - The plan was already created with refreshed state during pulumi preview --save-plan. Running refresh again during pulumi up --plan= is redundant and adds unnecessary execution time.
2. Time-sensitive deployments - When we know state is current and want faster execution.

Current behavior

# Pulumi.yaml
  options:
    refresh: always

  # GitHub Actions workflow
  - uses: pulumi/actions@v6
    with:
      command: up
      refresh: false  # This does NOT pass --refresh=false, it simply doesn't add --refresh

The CLI supports --refresh=false to override the project setting (see io.go#L118-L139), but the action cannot leverage this.

Proposed solution

Change the refresh input from boolean to a string that accepts:

• "true" - Pass --refresh (or --refresh=true)
• "false" - Pass --refresh=false (explicitly disable, overriding Pulumi.yaml)
• "" (empty/omitted) - Don't pass any refresh flag (current default behavior)

This would require a corresponding change in the Pulumi Automation API to support passing --refresh=false, since the action uses the Automation API under the hood.

Affected area/feature

• refresh input option
• Possibly upstream: Pulumi Automation API refresh option (currently boolean, would need to support explicit false vs undefined)

Workaround

Currently, the only workaround is to bypass the action and call the CLI directly:

  - name: Pulumi up without refresh
    run: pulumi up --yes --refresh=false --plan=plan.json
    env:
      PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}

This loses the benefits of the action (PR comments, outputs, etc.).