Custom support-request form at /support/new with Intercom-backed /api/support

.github/workflows/support-form-tests.yml

@@ -0,0 +1,118 @@
+name: Support form tests
+
+# Runs the unit suites for the support form -- both halves. The server suite
+# covers the /api/support Lambda (payload validation, the handler's status
+# paths, the Intercom client); the client suite drives theme/src/ts/
+# support-form.ts against jsdom (draft recovery, query-param prefill,
+# validation, submission). They are separate packages with separate
+# toolchains, so they run as separate steps.
+#
+# The suite existed before this workflow did, and nothing ran it: `make test`
+# covers only the example programs, and `make ci_pull_request` previews the
+# Pulumi stack without compiling or testing infrastructure/ on its own. That
+# gap was not theoretical -- when the Intercom client replaced the logging stub,
+# three handler tests started reaching api.intercom.io with no credentials and
+# failing, and CI stayed green because nothing was running them.
+#
+# Deliberately standalone rather than folded into the PR gate: ci_pull_request
+# needs AWS and Pulumi credentials and degrades to a plain build without them,
+# so it skips on fork PRs. A dependency-free unit suite should run for everyone.
+#
+# The filter is the whole of infrastructure/, not just support-form/, because
+# tsconfig.json's `files` array starts at index.ts: `tsc -p tsconfig.json`
+# type-checks the entire Pulumi program, so a type error in index.ts or
+# supportForm.ts fails this suite. Filtering to support-form/** would let that
+# PR go green and land the breakage on the next unrelated support-form PR, which
+# would then look like the culprit.
+#
+# versioned-docs is excluded because it is a separate Pulumi program with its
+# own Pulumi.yaml, package.json and tsconfig.json, and the main program only
+# reaches it by stack reference — `tsc -p tsconfig.json` never compiles a line
+# of it. Without the exclusion this job would run, pass, and report green on a
+# PR it had not examined at all, which is worse than not running: a check that
+# looks like coverage and isn't. Nothing in CI type-checks that program today —
+# see pulumi/docs#21136, which is what would make the directory genuinely
+# covered rather than merely matched by a filter.
+on:
+  pull_request:
+    paths:
+      - 'infrastructure/**'
+      - '!infrastructure/versioned-docs/**'
+      # The shared "did every suite actually run" guard, used by both halves.
+      - 'scripts/check-test-suites-compiled.js'
+      - 'theme/src/ts/support-form.ts'
+      # Every *.test.ts under theme/src/ts, not just this one. The guard walks
+      # the whole tree at any depth and fails on a suite missing from
+      # tsconfig.test.json's `files` array, so watching only the named file
+      # would let the PR that adds theme/src/ts/lightbox.test.ts land green and
+      # turn this job red on the next unrelated support-form PR -- the same
+      # failure the server filter above was widened to avoid. Scoped to test
+      # files rather than all of theme/src/ts because, unlike the Pulumi
+      # program, tsconfig.test.json compiles a fixed three-file list: an
+      # unrelated theme module cannot break this suite, only an unregistered
+      # suite can.
+      - 'theme/src/ts/**/*.test.ts'
+      - 'theme/tsconfig.test.json'
+      - 'theme/package.json'
+      # The client suite asserts the layout still provides the ids it binds to.
+      - 'layouts/page/support-new.html'
+      - '.github/workflows/support-form-tests.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: support-form-tests-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Run support-form test suite
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24.x'
+          cache: 'yarn'
+          cache-dependency-path: |
+            infrastructure/yarn.lock
+            theme/yarn.lock
+      - name: Install deps
+        run: |
+          yarn --cwd infrastructure install --frozen-lockfile
+          yarn --cwd theme install --frozen-lockfile
+      # Tee'd rather than run bare so the count can be asserted afterwards.
+      # check-test-suites-compiled.js proves every suite will be reached; this proves
+      # the runner actually executed assertions once it got there. A suite whose
+      # tests were all commented out would satisfy the first check and not this
+      # one. `pipefail` keeps a genuine test failure failing the step, which a
+      # bare pipe into tee would otherwise mask.
+      - name: Run server suite
+        shell: bash
+        run: |
+          set -o pipefail
+          yarn --cwd infrastructure test-support-form 2>&1 | tee /tmp/support-form-tests.log
+
+      - name: Run client suite
+        shell: bash
+        run: |
+          set -o pipefail
+          yarn --cwd theme test-support-form 2>&1 | tee /tmp/support-form-client-tests.log
+
+      - name: Assert both suites actually ran
+        shell: bash
+        run: |
+          for suite in server:/tmp/support-form-tests.log client:/tmp/support-form-client-tests.log; do
+            name=${suite%%:*}
+            log=${suite#*:}
+            count=$(grep -oP '^# tests \K\d+|^ℹ tests \K\d+' "$log" | tail -1)
+            if [ -z "$count" ] || [ "$count" -eq 0 ]; then
+              echo "::error::The $name suite reported ${count:-no} tests. Something is not running."
+              exit 1
+            fi
+            echo "$name suite ran $count tests."
+          done

.gitignore

@@ -214,3 +214,9 @@ assets/images/generated/
 # Written to the repo root (prettier resolves --ignore-path patterns relative to
 # the ignore file's own directory) and removed when the run exits.
 /.prettierignore.union
+
+# Compiled output for the theme unit tests (see theme/tsconfig.test.json).
+/theme/bin-test/
+
+# Playwright MCP session artifacts (browser snapshots written into the repo root).
+.playwright-mcp/

content/blog/hidden-costs-of-infrastructure-management/index.md

@@ -99,7 +99,7 @@ With Pulumi IaC, your teams can tackle the growing complexity of modern architec
 
 When you’re scaling your organization, you’ll need an IaC backend that makes team onboarding efficient. DIY backends often involve ad-hoc onboarding with bespoke identity solutions, requiring custom documentation and training to troubleshoot unique problems. This can slow down onboarding and reduce end-user productivity. Additionally, DIY backends place the internal support burden on your team, requiring them to assist users in navigating the system.
 
-In contrast, Pulumi Cloud offers standardized, well-documented capabilities and integrates seamlessly with identity systems, leading to efficient onboarding and increased productivity for new employees. Pulumi Cloud provides [12x5 or 24x7 support](https://support.pulumi.com/hc/en-us), ensuring your organization receives immediate assistance with any architectural, cloud-related, or Pulumi best-practices issues. Furthermore, Pulumi Cloud includes built-in RBAC, simplifying the onboarding and scaling of new users.
+In contrast, Pulumi Cloud offers standardized, well-documented capabilities and integrates seamlessly with identity systems, leading to efficient onboarding and increased productivity for new employees. Pulumi Cloud provides [12x5 or 24x7 support](/pricing/), ensuring your organization receives immediate assistance with any architectural, cloud-related, or Pulumi best-practices issues. Furthermore, Pulumi Cloud includes built-in RBAC (Enterprise edition and above), simplifying the onboarding and scaling of new users.
 
 {{% notes type="tip" %}}
 **BMW Group** used Pulumi to build a scalable and resilient hybrid cloud implementation that could handle more than eleven thousand developers.

content/blog/journaling-ga/index.md

@@ -68,4 +68,4 @@ This data already shows the expected significant improvement in update times, es
 
 While this was an opt-in process using the `PULUMI_ENABLE_JOURNALING` environment variable, this opt-in is no longer required. Just upgrade your Pulumi CLI to v3.225.0+ and use the Pulumi Cloud backend, and journaling will automatically speed up your updates.
 
-If you encounter any issues, reach out on the [Pulumi Community Slack](https://slack.pulumi.com/) or through [Pulumi Support](https://support.pulumi.com/hc/en-us).  You can also set the `PULUMI_DISABLE_JOURNALING=true` env variable to opt out of journaling.
+If you encounter any issues, reach out on the [Pulumi Community Slack](https://slack.pulumi.com/) or through [Pulumi Support](/support/new/).  You can also set the `PULUMI_DISABLE_JOURNALING=true` env variable to opt out of journaling.

content/blog/journaling/index.md

@@ -325,7 +325,7 @@ The full documentation of the algorithm can be found in our [developer docs](htt
 - We implemented the replay interface inside the `pulumi` CLI, and ran it in parallel with the current snapshotting implementation in our tests. The snapshots were then compared automatically, and tests made to fail when the result didn't match.
 - Since tests can't cover all possible edge cases, the next step was to run the journaler in parallel with the current snapshotting implementation internally. This was still without sending the results to the service. However we would compare the snapshot, and send an error event to the service if the snapshot didn't match. In our data warehouse we could then inspect any mismatches, and fix them. Since this does involve the service in a minor way, we would only do this if the user is using the Cloud backend.
 - Next up was adding a feature flag for the service, so journaling could be turned on selectively for some orgs. At the same time we implemented an opt-in environment variable in the CLI (`PULUMI_ENABLE_JOURNALING`), so the feature could be selectively turned on by users, if both the feature flag is enabled and the user sets the environment variable. This way we could slowly start enabling this in our repos, e.g. first in the integration tests for `pulumi/pulumi`, then in the tests for `pulumi/examples` and `pulumi/templates`, etc.
-- Allow users to start opting in.  If you want to opt-in with your org, please reach out to us, either on the [Community Slack](https://slack.pulumi.com/), or through our [Support channels](https://support.pulumi.com/hc/en-us), and we'll opt your org into the feature flag. Then you can begin seeing the performance improvements by setting the `PULUMI_ENABLE_JOURNALING` env variable to true.
+- Allow users to start opting in.  If you want to opt-in with your org, please reach out to us, either on the [Community Slack](https://slack.pulumi.com/), or through our [Support channels](/support/new/), and we'll opt your org into the feature flag. Then you can begin seeing the performance improvements by setting the `PULUMI_ENABLE_JOURNALING` env variable to true.
 - Turn on the feature flag for everyone, but still require the `PULUMI_ENABLE_JOURNALING` env variable to be set to true. (We are here right now).
 - Flip the feature on by default, but still allow users to opt out using a `PULUMI_DISABLE_JOURNALING` env variable.
 

content/blog/short-lived-access-tokens/index.md

@@ -62,4 +62,4 @@ curl \
 
 We invite you to try out the new short lived access tokens in Pulumi Cloud. As always, we value your feedback and look forward to hearing how this feature helps streamline your workflows and enhances security.
 
-For more details, check out [our documentation](/docs/administration/access-identity/access-tokens/) and [API reference docs](/docs/reference/cloud-rest-api/). If you have any questions or need assistance, [our support team](https://support.pulumi.com/hc/en-us) is here to help.
+For more details, check out [our documentation](/docs/administration/access-identity/access-tokens/) and [API reference docs](/docs/reference/cloud-rest-api/). If you have any questions or need assistance, [our support team](/support/new/) is here to help.

content/contact/_index.md

@@ -19,7 +19,7 @@ quick_links:
         - label: Already a customer?
           description: File a support ticket for a fast response from our team.
           cta_label: Get support
-          url: https://support.pulumi.com/hc/en-us/requests/new
+          url: /support/new/
 
 form:
     - key: general
@@ -39,6 +39,6 @@ form:
       hubspot_form_id: cta1
       cta:
         label: Submit a Request
-        url: https://support.pulumi.com/hc/en-us/requests/new
+        url: /support/new/
 
 ---

content/docs/administration/concepts/organizations.md

@@ -112,7 +112,7 @@ To update your organization's display name:
 
 Updating the display name requires the `organization:rename` permission, which is granted to organization admins.
 
-If you need a legal entity name on invoices that is different from your organization's product-facing display name, [contact support](https://support.pulumi.com/).
+If you need a legal entity name on invoices that is different from your organization's product-facing display name, [contact support](/support/new/).
 
 ## Transferring stacks
 

content/docs/administration/guides/saml/auth0.md

@@ -62,4 +62,4 @@ To configure Pulumi with the SAML metadata:
 
 Auth0 troubleshooting: [SAML app error messages](https://auth0.com/docs/troubleshoot/authentication-issues/troubleshoot-saml-configurations)
 
-For additional help, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](https://support.pulumi.com/).
+For additional help, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](/support/new/).

content/docs/administration/guides/saml/entra.md

@@ -115,4 +115,4 @@ sign in to your Entra ID instance, and then immediately be redirected back to Pu
 
 ## Troubleshooting
 
-For help resolving SAML SSO configuration issues, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](https://support.pulumi.com/).
+For help resolving SAML SSO configuration issues, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](/support/new/).

content/docs/administration/guides/saml/gsuite.md

@@ -102,4 +102,4 @@ name of your Pulumi organization.
 
 Google Workspace SAML troubleshooting: [SAML app error messages](https://support.google.com/a/answer/6301076)
 
-For additional help, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](https://support.pulumi.com/).
+For additional help, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](/support/new/).

content/docs/administration/guides/saml/okta.md

@@ -138,4 +138,4 @@ name of your Pulumi organization.
 
 ## Troubleshooting
 
-For help resolving SAML SSO configuration issues, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](https://support.pulumi.com/).
+For help resolving SAML SSO configuration issues, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](/support/new/).

content/docs/administration/guides/saml/onelogin.md

@@ -110,4 +110,4 @@ name of your Pulumi organization.
 
 ## Troubleshooting
 
-For help resolving SAML SSO configuration issues, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](https://support.pulumi.com/).
+For help resolving SAML SSO configuration issues, see the [SAML SSO troubleshooting guide](/docs/administration/guides/saml/troubleshooting/) or [contact support](/support/new/).

content/docs/administration/guides/saml/troubleshooting.md

@@ -16,7 +16,7 @@ aliases:
 
 ## Locked out of your organization
 
-If you are locked out of your Pulumi organization due to a SAML configuration error or an expired certificate, a [SAML admin](/docs/administration/guides/saml/saml-admin/) can log in using an alternative login method to resolve the issue. If your organization does not have a SAML admin configured, [contact support](https://support.pulumi.com/).
+If you are locked out of your Pulumi organization due to a SAML configuration error or an expired certificate, a [SAML admin](/docs/administration/guides/saml/saml-admin/) can log in using an alternative login method to resolve the issue. If your organization does not have a SAML admin configured, [contact support](/support/new/).
 
 ## Validation error while trying to save an IdP-provided metadata XML in Pulumi Cloud
 

content/docs/administration/guides/scim/troubleshooting.md

@@ -22,7 +22,7 @@ This page describes how to resolve issues that may occur when configuring SCIM p
 
 ## User provisioning failures
 
-These errors can occur when attempting to create (POST), replace (PUT), or update (PATCH) a user. If you encounter difficulties resolving these issues, please contact our [customer support](https://support.pulumi.com/) for assistance.
+These errors can occur when attempting to create (POST), replace (PUT), or update (PATCH) a user. If you encounter difficulties resolving these issues, please contact our [customer support](/support/new/) for assistance.
 
 ### Email already in use
 

content/docs/administration/self-hosting/components/api.md

@@ -73,8 +73,8 @@ between the API and the database. The API also supports [exporting OpenTelemetry
 | PULUMI_DATABASE_NAME     | The name of the database on the database server.                                                                                             |
 | PULUMI_API_DOMAIN        | The internet or network-local domain using which the API service can be reached, e.g. `pulumiapi.acmecorp.com`. Default is `localhost:8080`. |
 | PULUMI_CONSOLE_DOMAIN    | The internet or network-local domain using which the Console can be reached, e.g. `pulumiconsole.acmecorp.com`. Default is `localhost:3000`. |
-| PULUMI_ENGINE_EVENTS_SCHEMA_V2 | Set this environment variable to `true` for fresh installs. **If you have an existing installation and the environment variable is currently not set or set to `false`, contact [Pulumi support](https://support.pulumi.com/) before setting it to `true`.** |
-| PULUMI_ENGINE_EVENTS_LEGACY_WRITE | Set this environment variable to `false` for fresh installs. **If you have an existing installation and the environment variable is currently not set or set to `true` in your installation, contact [Pulumi support](https://support.pulumi.com/) before setting it to `false`.** |
+| PULUMI_ENGINE_EVENTS_SCHEMA_V2 | Set this environment variable to `true` for fresh installs. **If you have an existing installation and the environment variable is currently not set or set to `false`, contact [Pulumi support](/support/new/) before setting it to `true`.** |
+| PULUMI_ENGINE_EVENTS_LEGACY_WRITE | Set this environment variable to `false` for fresh installs. **If you have an existing installation and the environment variable is currently not set or set to `true` in your installation, contact [Pulumi support](/support/new/) before setting it to `false`.** |
 
 ## Object storage
 

content/docs/iac/get-started/terraform/next-steps.md

@@ -349,7 +349,7 @@ Reach out to us via these support channels:
 
 * **[Pulumi Community Slack](https://slack.pulumi.com/)**: Real-time community support
 * **[GitHub Issues](https://github.com/pulumi/pulumi/issues)**: Bug reports and feature requests
-* **[Pulumi Support](https://support.pulumi.com/)**: Professional support for Pulumi Cloud customers
+* **[Pulumi Support](/support/new/)**: Professional support for Pulumi Cloud customers
 
 ### Open source contributions
 

content/docs/iac/guides/building-extending/packages/publishing-packages.md

@@ -80,7 +80,7 @@ If you don't need the full customization of a published package — you just wan
 Popular Terraform providers also surface in the public Pulumi Registry as **dynamically-bridged** listings (for example, [Honeycomb](/registry/packages/honeycombio/) and [Supabase](/registry/packages/supabase/)); consumers still generate the SDK locally with `pulumi package add`. The rest of this guide covers authoring and publishing a full package; if the Any Terraform Provider path fits your needs, follow that guide instead.
 
 {{% notes type="info" %}}
-Registry listings for dynamically-bridged Terraform providers are generated automatically and don't include a logo by default. To have a logo added to your provider's Registry page, reach out to [Pulumi support](https://support.pulumi.com/) with a link to a web-accessible SVG (wordmarks preferred, with all surrounding whitespace removed).
+Registry listings for dynamically-bridged Terraform providers are generated automatically and don't include a logo by default. To have a logo added to your provider's Registry page, reach out to [Pulumi support](/support/new/) with a link to a web-accessible SVG (wordmarks preferred, with all surrounding whitespace removed).
 {{% /notes %}}
 
 ## Author your resources or components