| command | Pulumi command to run, eg. up | no | — |
| stack-name | Which stack you want to apply to, eg. dev | no | — |
| pulumi-version | Install a specific version of the Pulumi CLI | no | — |
| pulumi-version-file | File containing the version of the Pulumi CLI to install. Example: .pulumi.version | no | — |
| work-dir | Location of your Pulumi files. Defaults to ./ | no | ./ |
| comment-on-pr | If true, a comment will be created with results | no | false |
| comment-on-pr-number | Overrides the PR used to comment on | no | — |
| comment-on-summary | If true, a comment on the GitHub step summary will be created | no | false |
| github-token | Github Token | no | ${{ github.token }} |
| cloud-url | A cloud URL to log in to | no | — |
| secrets-provider | The type of the provider that should be used to encrypt and decrypt secrets. Possible choices: default, passphrase, awskms, azurekeyvault, gcpkms, hashivault | no | — |
| parallel | Allow P resource operations to run in parallel at once (1 for no parallelism). Defaults to unbounded. | no | — |
| message | Optional message to associate with the update operation | no | — |
| config-map | Config to use during the operations | no | — |
| expect-no-changes | Return an error if any changes occur during this update | no | false |
| diff | Display operation as a rich diff showing the overall change | no | false |
| replace | Specify resources to replace. Multiple resources can be specified one per line | no | — |
| exclude | Specify a single resource URN to ignore. Multiple resources can be specified one per line | no | — |
| exclude-dependents | Allows ignoring of dependent targets discovered but not specified in exclude. | no | false |
| target | Specify a single resource URN to update. Other resources will not be updated. Multiple resources can be specified one per line | no | — |
| target-dependents | Allows updating of dependent targets discovered but not specified in target. | no | false |
| policyPacks | Run one or more policy packs as part of this update. | no | — |
| policyPackConfigs | Path to JSON file containing the config for the policy pack of the corresponding "--policy-pack" flag. | no | — |
| refresh | Execute the operation with the `--refresh` option | no | false |
| upsert | Create the stack if it currently does not exist | no | false |
| remove | Delete the stack after a destroy operation | no | false |
| edit-pr-comment | Edit previous PR comment instead of posting new one | no | true |
| color | Colorize output. Choices are: always, never, raw, auto | no | auto |
| exclude-protected | Skip destroying protected resources. Only valid when command is destroy. | no | false |
| plan | Where to either save an Update Plan or read an Update Plan from | no | — |
| suppress-outputs | Suppress display of stack outputs (in case they contain sensitive values). | no | false |
| suppress-progress | Suppress display of periodic progress dots to limit logs length | no | false |
| always-include-summary | If comments must be trimmed, trim them from the front. This ensures the resources summary is always included in the comment | no | false |
| continue-on-error | Continue running the update even if an error is encountered | no | false |
| log-verbosity | Enable verbose logging (1-11; >3 is very verbose) | no | — |
| log-flow | Flow log settings to child processes (like plugins) | no | false |
| debug | Print detailed debugging output during resource operations | no | false |