Add test stack and workflow for exercising pulumi.yml

Lightweight AWS resources (EC2 key pair, IAM role, CW log group) to
test `--patch` diff output, job summaries, and PR comments. Caller
workflow dispatches against the reusable workflow with `uses: ./.github/...`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: ryan-williams

.github/workflows/test.yml

@@ -0,0 +1,31 @@
+name: Test
+run-name: 'test: pulumi ${{ inputs.cmd }}'
+
+on:
+  workflow_dispatch:
+    inputs:
+      cmd:
+        description: 'Pulumi command'
+        required: true
+        default: 'preview'
+        type: choice
+        options:
+          - preview
+          - up
+          - refresh
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+  actions: read
+
+jobs:
+  pulumi:
+    uses: ./.github/workflows/pulumi.yml
+    with:
+      cmd: ${{ inputs.cmd }}
+      stack: test
+      project: pulumi-v1-test
+      working-directory: test
+    secrets: inherit

test/Pulumi.test.yaml

@@ -0,0 +1,2 @@
+config:
+  aws:region: us-east-1

test/Pulumi.yaml

@@ -0,0 +1,5 @@
+name: pulumi-v1-test
+description: Test stack for the pulumi-v1 reusable workflow
+runtime: python
+backend:
+  url: gs://oa-pulumi

test/__main__.py

@@ -0,0 +1,41 @@
+"""Test stack for the pulumi-v1 reusable workflow.
+
+Creates lightweight, free AWS resources to exercise `pulumi preview --patch`
+diff output, job summaries, and PR comments.
+"""
+import pulumi
+import pulumi_aws as aws
+import pulumi_tls as tls
+
+config = pulumi.Config()
+env = pulumi.get_stack()
+
+# EC2 Key Pair (via TLS-generated key)
+key = tls.PrivateKey("test-key", algorithm="ED25519")
+key_pair = aws.ec2.KeyPair("test-key-pair",
+    key_name=f"pulumi-v1-test-{env}",
+    public_key=key.public_key_openssh,
+)
+
+# IAM Role (no trust policy; just exists for diff testing)
+role = aws.iam.Role("test-role",
+    name=f"pulumi-v1-test-{env}",
+    assume_role_policy="""{
+        "Version": "2012-10-17",
+        "Statement": [{
+            "Effect": "Deny",
+            "Principal": {"Service": "none.amazonaws.com"},
+            "Action": "sts:AssumeRole"
+        }]
+    }""",
+)
+
+# CloudWatch Log Group
+log_group = aws.cloudwatch.LogGroup("test-log-group",
+    name=f"/pulumi-v1/test/{env}",
+    retention_in_days=1,
+)
+
+pulumi.export("key_pair_name", key_pair.key_name)
+pulumi.export("role_arn", role.arn)
+pulumi.export("log_group_name", log_group.name)

test/requirements.txt

@@ -0,0 +1,3 @@
+pulumi>=3.0.0
+pulumi-aws>=6.0.0
+pulumi-tls>=5.0.0