Repository navigation
Conversation
…pi.md Automated existing-content review. Co-Authored-By: Claude <[email protected]>
pulumi-bot
added
the
content-review/judgment
github-actions
Bot
added
the
review:triaging
Sentinel — merge gate status (preview)Warning
|
| Gate | What it needs | |
|---|---|---|
| ✅ | G1 review-ran | Nothing to do: review current at 91b7a9926. |
| ✅ | G2 findings-answered | Nothing to do: every finding answered. |
| ✅ | G3 right-approver | Nothing to do: approved by CamSoper, who has write access. |
| ➖ | G4 infra-evidence | Doesn't apply to this PR: no changed path affects the deploy. |
| ➖ | G5 oversized-ack | Doesn't apply to this PR: not oversized. |
Evaluated at head 91b7a9926.
github-actions
Bot
added
domain:docs
github-actions
Bot
removed
the
review:triaging
|
Your site preview for commit 91b7a99 is ready! 🎉 http://www-testing-pulumi-docs-origin-pr-22195-91b7a992.s3-website.us-west-2.amazonaws.com Changed pages: |
|
@claude no review ran on this PR #new-review Generated by Claude Code |
github-actions
Bot
added
the
review:in-progress
|
@claude the last #new-review never published (fixed in #22201) #new-review Generated by Claude Code |
Reviewer's guide v1 — not for the authorTip Check the PR author: nothing here is yours. Your to-do list is the "Author action guide" comment. Review requested from: @pulumi/docs-guild — an approval from anyone with write access satisfies the merge gate. Note What this PR changes:
A wrong default endpoint or variable name would leave a self-hosting operator unable to connect the API service to its database. Claim verification and the frontmatter/link sweep ran; the sibling read was not extended beyond this page. Review confidence:
|
Author action guide v1 — nothing blocks mergeNote Nothing here needs an answer. Automation opened this PR; a human reviewer still approves the merge. An automated content-review fix to two lines of the self-hosted API service page; the review checked the edited facts, frontmatter, and links. Full evidence: verification trail, investigation log, review history. Review v1 · updated 2026-10-08T22:15:51Z · head commit 91b7a99 Please don't edit or delete this comment; it's the review's record. |
github-actions
Bot
added
review:no-blockers
Important
This PR requires a human review decision — auto-merge is NOT armed. Its fixes include judgment-class changes (claim corrections, structural repairs), so approving does not merge it by itself: the PR-review sweep arms auto-merge only after its own gates pass, or a human merges manually.
Why this page
content/docs/administration/self-hosting/components/api.md→ /docs/administration/self-hosting/components/api/no_retire: false)CLICKSTREAM.FCT_PAGEVIEWS)attempts: 0)This section is composed deterministically from the selection queue; do not edit it.
Fixes applied
pulumi-db:3306, and it can be changed by settingPULUMI_LOCAL_DATABASE_NAMEand `PULUMI_LOC…PULUMI_LOCAL_DATABASE_NAMEtoPULUMI_LOCAL_DATABASE_HOST(L31).run-ee.shbuildsPULUMI_DATABASE_ENDPOINTfromPULUMI_LOCAL_DATABASE_HOST(defaultpulumi-db) andPULUMI_LOCAL_DATABASE_PORT(default3306) and never readsPULUMI_LOCAL_DATABASE_NAME; confirmed against the script this run.PULUMI_LOCAL_KEYSis a folder path that contains a random 32-byte key.PULUMI_LOCAL_KEYS=${PULUMI_DATA_PATH}/localkeys, tests it with[ -f "$PULUMI_LOCAL_KEYS" ], and writes the key withhead -c 32 /dev/random >$PULUMI_LOCAL_KEYS— a file, not a folder; confirmed against the script this run.Findings not applied
deterministic_fix; "master key" is generic key-management terminology here, and picking a replacement ("root key", "encryption key") is a wording judgment.deterministic_fix; "customer master key" is AWS's former official name for a KMS key (now "KMS key"), so rewording it is a terminology judgment, not a mechanical swap.PULUMI_API_CONTAINER_MODEdetermines the server function mode with options FULL (API and Background Jobs), API (only API), and JOBS (only Ba… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: Only the reviewed file states this ("defaults toFULL", modes FULL/API/JOBS), and it can't serve as its own evidence. The API service is closed-source, and m…)PULUMI_API_CONTAINER_MODEvalues are FULL (Pulumi API & Background Jobs), API (only Pulumi API), and JOBS (only Background Jobs). — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only place I found the FULL/API/JOBS values was the reviewed page itself (L55-61), which can't serve as its own evidence. The self-hosted API service sourc…)PULUMI_LICENSE_KEYis a JWT string whose value should be enclosed in single-quotes. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The Pulumi Cloud API service that parses PULUMI_LICENSE_KEY is closed-source, so nothing public confirms the JWT format. The public installers pass the key str…)Content-Encoding: gzip… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this. The Pulumi Cloud API service code is closed source, and searches of pulumi/* issues and PRs for "Content-Encoding gzip", S3, MinIO and "…)AWS_REGIONshould be set to any valid AWS region (e.g.us-west-2) ev… — unverifiable — Unverifiable: the claim restates the page itself and the API service source is private, so no independent source confirms or contradicts it; needs a reviewer with product-source access. (context: The claim accurately restates api.md L99-102 ("If your Minio configuration doesn't require a region, you should still specify theAWS_REGIONwith any valid A…)PULUMI_CHECKPOINT_BLOB_STORAGE_ENDPOINT,PULUMI_POLICY_PACK_BLOB_STORAGE_ENDPOINT, `PULUMI_ENGINE_EVENTS_BL… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The fetched GoCloud page (HTTP 200) is truncated before its S3 section. The visible text only covers general URL-based bucket opening and query parameters such…)PULUMI_ENGINE_EVENTS_BLOB_STORAGE_ENDPOINTpersists large engine events, and configuring it is recommended to improve performance and reduce MySQL database s… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only place I found this wording is the reviewed page itself (L109/L118: "The storage endpoint for persisting large engine events. We recommend configuring …)PULUMI_SERVICE_METADATA_BLOB_STORAGE_ENDPOINTpersists authorization policies and large config values, and is recommended to enable OIDC trust or if programs… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The env var exists: pulumi/pulumi-self-hosted-installers sets it (e.g. ecs-hosted/go/application/service/apiService.go: `CreateEnvVar("PULUMI_SERVICE_METADATA…)_kms:Encrypt,kms:Decrypt,kms:GenerateDataKey, andkms:GenerateDataKeyWithoutPlaintext, otherwise the se… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The Pulumi service code that would define which KMS actions it needs is private, so I couldn't check this list. The official ECS installer, pulumi-self-hosted-…)PULUMI_KMS_KEYis the ARN for the AWS KMS customer master key resource. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The doc table (L148) says "PULUMI_KMS_KEY | ARN for the AWS KMS customer master key resource." I couldn't confirm this against independent product source. The …)PULUMI_AZURE_KV_URIis the Azure KeyVault URI andPULUMI_AZURE_KV_KEY_NAMEis the key name; the key must be an RSA key type, with a key size of 2048 recomm… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The reviewed file says (L170-171) "PULUMI_AZURE_KV_URI | Azure KeyVault URI" and "PULUMI_AZURE_KV_KEY_NAME | The name of the key in KeyVault. The key must be a…)AWS_REGION,AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_PROFILEandAWS_ROLE_ARNare supported by the API service; the… — unverifiable — Unverifiable: the claim restates the page itself and the API service source is private, so no independent source confirms or contradicts it; needs a reviewer with product-source access. (context: The claim accurately restates the env-var table in api.md (L183-187: "the KMS key must exist in this region... there must be a writable cluster in this region"…)AZURE_CLIENT_IDmust have access to Key Management operationsGet,EncryptandDecryptof the KeyVault. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The Azure KeyVault permission requirements belong to the closed-source Pulumi Cloud service, and the code search came back rate-limited (HTTP 429). The same pa…)AZURE_STORAGE_DOMAINis not provided, the default Azure public domainblob.core.windows.netis used. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: (escalated from pass1) This claim is about how Pulumi's self-hosted API service behaves by default when AZURE_STORAGE_DOMAIN is unset. Only the product source …)GITLAB_OAUTH_ENDPOINTdefaults tohttps://gitlab.com;GITLAB_OAUTH_IDandGITLAB_OAUTH_SECRETconfigure GitLab OAuth sign in. — unverifiable — Unverifiable: the fetched URL didn't contain the relevant content (truncated, generic, or placeholder), and the behavior lives in the private API service; nothing to correct with confidence. (context: The pre-fetched page is the GitLab homepage (https://gitlab.com, HTTP 200, title "GitLab - Speed with control for agentic software engineering"). It says nothi…)PULUMI_CORS_ALLOWED_ORIGINSis a comma-separated list of origins in<scheme>://<host>[:<port>]form with no path and no default port, accepts the keywords … — unverifiable — Unverifiable: the fetched URL didn't contain the relevant content (truncated, generic, or placeholder), and the behavior lives in the private API service; nothing to correct with confidence. (context: The pre-fetched URL https://pulumiconsole.acmecorp.com did not resolve ("Name or service not known"). It's an acmecorp placeholder used as an example value, no…)Originheader, such as from thepulumiCLI, are unaffected byPULUMI_CORS_ALLOWED_ORIGINS, and each rejected request is logged asCO… — unverifiable** — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. _(context: The only public hit forcors.origin_mismatchis the reviewed docs file itself ("Each rejected request is logged asCORS origin mismatch` and counted by the …)_Originheader, such as from thepulumiCLI, are unaffected byPULUMI_CORS_ALLOWED_ORIGINS, and each rejected request is logged asC… — unverifiable** — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. _(context: In public pulumi/* code,cors.origin_mismatch` shows up only in the docs file under review (api.md L232). The Pulumi Cloud API service that would implement th…)_PULUMI_DISABLE_SSRF_PROTECTIONtakes a comma-separated list of scopesESC,AGENTS_BYOK,OIDC_ISSUER,VCS,WEBHOOKS; it is unset by default (protect… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The API service that readsPULUMI_DISABLE_SSRF_PROTECTIONis closed source (pulumi-service is private), so I couldn't check this against product code. A gh P…)PULUMI_PASSKEY_CEREMONY_KEYmust be the standard-base64 encoding of exactly 32 random bytes (44 characters including padding), the API service fails to boot … — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only place I found this behavior described is the reviewed file itself (api.md L238), and that page can't be used to verify its own claim. The code for the…)PULUMI_PASSKEY_CEREMONY_KEYinvalidates passkey ceremonies in progress (each with a five-mi… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this claim. The doc at L238 says passkeys are "gated by a platform-level setting outside this variable's control" and that rotating the key "i…)PULUMI_PASSKEY_CEREMONY_KEY, so routes may return 404 even once it is set. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only placesPULUMI_PASSKEY_CEREMONY_KEYturns up in the pulumi org are docs pages: the reviewed api.md and accounts.md. Neither page mentions any other p…)RECAPTCHA_SECRET_KEYis used for password reset requests and is generated by creating a Cloudflare Turnstile Widget to obtain the Secret Key. — unverifiable — Unverifiable: the fetched URL didn't contain the relevant content (truncated, generic, or placeholder), and the behavior lives in the private API service; nothing to correct with confidence. (context: The cited page returned 200, but the fetched body is truncated to its title, "Cloudflare Turnstile - Easy CAPTCHA Alternative". That confirms Turnstile is a CA…)SAML_CERTIFICATE_PUBLIC_KEYis the public key used by the IdP to sign SAML assertions andSAML_CERTIFICATE_PRIVATE_KEYis the private key used by Pulumi to… — Contradicted at medium confidence, but the correct wording needs interpretation: persaml-sso.mdboth keys are the API service's own (service-provider) key pair used to sign and validate requests/responses, so both table descriptions need rewriting, not a value swap. Needs a human againstsaml-sso.md. (context: In Pulumi's self-hosted installers, both keys are one self-signed key pair generated for the API service's own domain (`new SsoCertificate("service", { apiDoma…)PULUMI_DISABLE_SSRF_PROTECTIONare case-insensitive and unknown names are ignored with a warning in the API service logs. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this claim. The only place it appears is the page under review (L247: "Names are case-insensitive and unknown names are ignored with a warning…)ESCSSRF scope covers Pulumi ESC providers and rotators that call a configured URL: Vault, Infisical, Terraform state, GitHub login, and external provide… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The ESC SSRF scope and which providers/rotators it covers are set in the Pulumi Cloud service code, which is private, so I couldn't check them. Public search t…)OIDC_ISSUERSSRF scope covers registering an OIDC issuer and fetching its signing keys. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this against product source. The SSRF scopes are implemented in the private Pulumi Cloud service, and GitHub code search hit rate limits. The …)HTTPS_PROXY,HTTP_PROXYandNO_PROXY; the API service checks the destination before handing the request to the … — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The Pulumi Cloud API service source is private, and code search turned up only pulumi/docs content. The self-hosting changelog partly backs the claim ("support…)API_TLS_CERTIFICATEmust be X.509 PEM encoded,API_TLS_PRIVATE_KEYmust be PEM encoded, andAPI_MIN_TLS_VERSIONtakes<major>.<minor>format such as `1… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check the PEM/X.509 format requirements because the Pulumi service source isn't public. The only public product evidence is the self-hosted installe…)DATABASE_CA_CERTIFICATEmust be PEM encoded and set to the certificate value itself, not a filepath;DATABASE_MIN_TLS_VERSIONtakes<major>.<minor>forma… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The doc table (L303-304) says the CA cert "must be PEM encoded… set to the value of the certificate itself and not a filepath", and that the min TLS version …)DATABASE_MIN_TLS_VERSIONis in<major>.<minor>format, e.g.1.2. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: Line 304 of the page says "(must be in <major>.<minor> format, e.g.1.2)", the same wording used for API_MIN_TLS_VERSION on L284. The page can't verify its…)MYSQL_ROOT_USERNAMEdefaults toroot, and variables includeMYSQL_ROOT_PASSWORD, `MYSQ… — unverifiable — Unverifiable: the claim restates the page itself and the API service source is private, so no independent source confirms or contradicts it; needs a reviewer with product-source access. (context: The claim matches what the doc's Migrations table says (L308–318), but the doc can't be used to verify itself. The migrations image (pulumi/migrations) is buil…)MYSQL_ROOT_USERNAMEdefaults toroot. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this claim. The doc's table (L313) says "The root username to log in to the MySQL database. Defaults toroot." The default lives in the migr…)AUDIT_LOGS_DYNAMOin the pulumi org is the docs page under review ("Audit Logs are persisted in MySQL by default. Alternative backends can…)PULUMI_AUDIT_LOGS_DYNAMO_TABLE, the table must have hashKeyorg_id, rangeKeytimestamp_id, and a global seconda… — unverifiable — Unverifiable: the fetched URL didn't contain the relevant content (truncated, generic, or placeholder), and the behavior lives in the private API service; nothing to correct with confidence. (context: The cited URL loaded (HTTP 200), but it is the general Amazon DynamoDB marketing page ("Fast NoSQL Key-Value Database – Amazon DynamoDB – AWS"). It says nothin…)org_id, rangeKeytimestamp_id, and a global secondary indexorg_userwith hashKeyorg_user_id, rangeKey … — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this independently. The schema (hashKey org_id, rangeKey timestamp_id, GSI org_user on org_user_id/timestamp_id, projection ALL, all attribute…)OTEL_EXPORTER_OTLP_ENDPOINTis required (no-op metrics and traces if unset),OTEL_EXPORTER_OTLP_PROTOCOLacceptshttporgrpcand defaults togrpc,… — unverifiable** — Unverifiable: the fetched URL didn't contain the relevant content (truncated, generic, or placeholder), and the behavior lives in the private API service; nothing to correct with confidence. _(context: The pre-fetch returned HTTP 404 with an empty body. But https://api.pulumi.com/metrics is the authenticated metrics endpoint the doc describes (it needsAutho…)_OTEL_EXPORTER_OTLP_ENDPOINTis not set, the API service uses no-op metrics and traces. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only place I found this is the reviewed page itself (L363): "If not set, the API service will use no-op metrics and traces." That page can't verify its own…)OTEL_EXPORTER_OTLP_PROTOCOLvalid values arehttporgrpc, defaulting togrpc. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this. The doc (L364) says "Valid values arehttporgrpc. Defaults togrpc." The env var is parsed by the self-hosted Pulumi Service API…)PULUMI_ENABLE_DEPRECATED_METRICScontrols continued emission of API service metrics in a log-based format and defaults totrue. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only place I found this is the reviewed page itself (L365: "Whether to continue emitting API service metrics in a log-based format. Defaults totrue."), …)webhook-token, notBearer. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this claim against an independent source. The page agrees with itself: L366 says "Authorization: webhook-token <METRICS_WEBHOOK_SECRET>", and …)METRICS_WEBHOOK_SECRETto authenticate to the/metricsendpoint. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The page says the same thing elsewhere (L366: "METRICS_WEBHOOK_SECRET | Required to successfully authenticate to the/metricsendpoint"; L372: the endpoint "…)webhook-tokenand the Prometheus scrape config withauthorization.type: webhook-tokenauthen… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this against product source. The/metricsauth lives in the private Pulumi service code, and GitHub code search returned HTTP 429 (rate limi…)PULUMI_SERVICE_METADATA_BLOB_STORAGE_ENDPOINTorPULUMI_LOCAL_OBJECTSobject storage, and customer-mana… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I could only partly corroborate the runner requirement, and only from a sibling docs page, not product source. That page says "Self-hosted Pulumi Cloud install…)PULUMI_SERVICE_METADATA_BLOB_STORAGE_ENDPOINTorPULUMI_LOCAL_OBJECTSobject storage and one of the encryption … — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only source that states this is the reviewed page itself (L517-521: "In order to enable Pulumi ESC, the following must be configured: `PULUMI_SERVICE_METAD…)PULUMI_SERVICE_METADATA_BLOB_STORAGE_ENDPOINTorPULUMI_LOCAL_OBJECTSobject storage and one of the encry… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. _(context: The/docs/esclink works: content/docs/esc/index.md exists and says "Pulumi ESC (Environments, Secrets, and Configuration) provides centralized secrets mana…)PULUMI_REGISTRY_PUBLIC_BLOB_STORAGE_ENDPOINTandPULUMI_REGISTRY_PRIVATE_BLOB_STORAGE_ENDPOINTpersist public and private registry artifacts, using `s3://<… — unverifiable — Unverifiable: the claim restates the page itself and the API service source is private, so no independent source confirms or contradicts it; needs a reviewer with product-source access. (context: The claim restates api.md L534-542 accurately, but GitHub code search across the pulumi org finds these env vars only in this docs file. They don't appear in t…)PULUMI_TFE_DOMAINon the API service enables the Terraform-compatible API for use as a Terraform/OpenTofu state backend; when unset, the API is disab… — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only placePULUMI_TFE_DOMAINappears in public pulumi/* code is the reviewed docs file itself, which can't serve as evidence for its own claim. The Pulum…)PULUMI_TFE_DOMAINis the domain serving the Terraform-compatible API; when unset, the Terraform-compatible API is disabled and its routes are not registered. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: The only public mentions of PULUMI_TFE_DOMAIN are pulumi/docs PRs (docs: document PULUMI_TFE_DOMAIN for self-hosted Terraform state backend #21944, Document PULUMI_TFE_DOMAIN for self-hosted operators #18783). The code that implements it is in the private Pulumi Cloud service, so I co…)PULUMI_TFE_DOMAINmay be set to the same value asPULUMI_API_DOMAIN, and its DNS record should point to the same host that servesPULUMI_API_DOMAIN. — unverifiable — Unverifiable: the behavior lives in the closed-source API service and no public source confirms or contradicts it; no correction to apply, needs a reviewer with product-source access. (context: I couldn't check this claim. The service that implements PULUMI_TFE_DOMAIN is private (pulumi/pulumi-service returns 404), and code search was rate-limited. No…)#anchoror relative path) rather than relying on 'above'/'… — Needs an authored anchor link to the target section; judgment-level, left for glow-up. (context: Directional reference ('see Minimum System Requirements below') -- link directly to the target (an#anchoror relative path) rather than relying on 'above'/'…)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Minimum System Requirements' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'What's In The Container?' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Function Mode' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Environment Variables for Core Infrastructure' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Azure Storage' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Cloud Provider Authentication' should use sentence case (capitalize only the first word and proper nouns).)#anchoror relative path) rather than relying on 'above'/'below' (brand guide: writing… — Needs an authored anchor link to the target section; judgment-level, left for glow-up. (context: Directional reference ('See above') -- link directly to the target (an#anchoror relative path) rather than relying on 'above'/'below' (brand guide: writing…)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Sending Emails' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Other Environment Variables {#other-env-vars}' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'TLS Environment Variables' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'API Service' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Database Connections' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'API Service' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Audit Logs' should use sentence case (capitalize only the first word and proper nouns).)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Pulumi IDP Registry' should use sentence case (capitalize only the first word and proper nouns).)#anchoror relative path) rather than relying on 'above'/'below' (brand guide: writing… — Needs an authored anchor link to the target section; judgment-level, left for glow-up. (context: Directional reference ('see below') -- link directly to the target (an#anchoror relative path) rather than relying on 'above'/'below' (brand guide: writing…)deterministic_fix; re-casing changes the heading's generated#anchor(e.g. L51 links#tls-environment-variables, L120 links#azure), so it needs a coordinated anchor/link update — glow-up work. (context: Heading 'Azure Storage' should use sentence case (capitalize only the first word and proper nouns).)PULUMI_LOCAL_DATABASE_NAMEandPULUMI_LOCAL_DATABASE_PORTaccordingly (see Script Variables…" — Readthrough findings are never applied in the fix lane (structural repair needs whole-page review); banked for the glow-up lane. (context: Replace '(see Script Variables.)' with a link to the page that documents those script variables, or add a short definition of PULUMI_LOCAL_DATABASE_NAME / PULU…)run-ee.sh" — Readthrough findings are never applied in the fix lane (structural repair needs whole-page review); banked for the glow-up lane. (context: In the L30 bullet, add a sentence telling the reader to create a named Docker network first. Also say briefly whatrun-ee.shis, or link to the installation …)The items above are banked for the automated glow-up lane, which executes a page's accumulated deferrals under human review — or run
/glow-up content/docs/administration/self-hosting/components/api.mdto work them now.Screenshot check
No images. The page source references no screenshots, diagrams, or other content images (only the generic shared
meta_imagecard, if any), so there is nothing to verify. (Determined from the source; the screenshot pass was skipped.)Rendered content
Ran
make buildand checkedpublic/docs/administration/self-hosting/components/api/index.htmlandindex.md. Render-time residue: theself-hosting-trial-noteshortcode text ("If you would like to evaluate the self-hosted Pulumi Cloud, request a Proof of Concept (PoC) or contact us.") and thepulumi_cloud_feature: self-hostingcallout ("available in the Enterprise edition"). Both are clean:data/pulumi_pricing.yamlhasself-hostingavailable_from: enterprise, and the shortcode's link targets/product/self-hosted/#self-hosted-trial(anchor present in the built page) and/contact/both exist. No shared-source fixes applied (the shortcode is used on 18 content pages). Observation for the templating owner, not fixed here: theindex.mdview flattens the nested bullets under the L30 prerequisite into top-level items.Verification
make lint: ✅make lintre-verified by the workflow on91b7a99.verified-claims.json: 111 verdict(s); 3 contradicted/mismatch, 67 unverifiable.vale-findings.json: 47 finding(s).readthrough-findings.json: ran=True, 4 finding(s).frontmatter-validation.json: 1 file(s); 0 alias collision(s)