[jeffmerrick]

Proposed changes

Moves the paths proxied to pulumi/marketing-web into one list, infrastructure/marketingWebPaths.ts, which both the CloudFront behaviors and the cache-flush workflow read. The workflow also runs with noglob now, since bash was expanding /dev/* into the runner's device files and Dev Center subpages were never flushed.

• The distribution keeps the same 12 behaviors in the same order, so the preview should show no CDN changes.
• The workflow reads the new marketingWebPaths stack output, which doesn't exist until this deploys. A marketing-web deploy in between fails the flush, and re-running it after the deploy fixes it.
• invalidate-dev-cache.yml is renamed to invalidate-marketing-web-cache.yml. The repository_dispatch type is still dev-deployed, which is what marketing-web sends, so its deploys still trigger the workflow.

Unreleased product version (optional)

None.

Related issues (optional)

Follow-up to #22438. infra/www/index.ts and apps/www/docs/dev.md in pulumi/marketing-web still name the old workflow file.

Validation

Deployed 646673aa to pulumi-test.io (stack update v6444, marketingWebPaths output present).

• 34 URLs return the same status, origin, and redirect target on pulumi-test.io as on www.pulumi.com: the proxied pages, plus the S3 pages and redirects the wildcards could catch (/community/team/*, /community/community-engineering/*, /pricing/open-source-free-tier/, /updateplans/, /puluminaries/, /learn/, /tutorials/, /templates/).
• /community.md, /pricing.md, /dev/search-index.json, and /assets/favicon.svg are byte-identical to production.
• The workflow's pulumi stack output marketingWebPaths --json | jq line, run with noglob against the testing stack, yields the 12 paths unexpanded.
• The create-invalidation call itself is untested, since the renamed workflow can't be dispatched until it's on master and runs against production.

🤖 Generated with Claude Code

[github-actions]

Sentinel — merge gate status

All gates green — nothing is blocking this merge.

	Gate	What it needs
✅	G1 review-ran	Nothing to do: review current at 02b6e81d9.
✅	G2 findings-answered	Nothing to do: every finding answered.
✅	G3 right-approver	Nothing to do: approved by CamSoper, who has write access.
✅	G4 infra-evidence	Nothing to do: staging status green at 02b6e81d9 (by github-actions[bot]).
➖	G5 oversized-ack	Doesn't apply to this PR: not oversized.

_{Evaluated at head 02b6e81d9.}

---

Need help, or think a gate got it wrong? Ask in #docs on Slack.

[pulumi-bot]

Your site preview for commit 02b6e81 is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-22464-02b6e81d.s3-website.us-west-2.amazonaws.com

[github-actions]

Reviewer's guide v2 — not for the author

Tip

Check the ⚠️ items, then approve. Your approval covers only those; links, shortcodes, metadata, and verified claims were checked by machine (receipts on the evidence page). Code samples are read, not compiled.

PR author: nothing here is yours. Your to-do list is the "Author action guide" comment.

Review requested from: @pulumi/docs-tools — an approval from anyone with write access satisfies the merge gate.

Note

What this PR changes:

• infrastructure/marketingWebPaths.ts: new file that holds the single list of paths proxied to marketing-web.
• infrastructure/index.ts: builds the CloudFront behaviors from that list and exports it as the marketingWebPaths stack output.
• invalidate-marketing-web-cache.yml: reads the paths from the stack output instead of a hardcoded list.
• AGENTS.md / BUILD-AND-DEPLOY.md: point at the new file.

A wrong path list or a broken stack-output lookup would route pulumi.com pages to the wrong origin, or leave a stale CloudFront cache after marketing-web deploys. The fact-check and infra-domain passes ran. The workflow exits with an error if the stack output is empty, and that output only exists once this infra change has deployed.

Review confidence:

Dimension	Level	Notes
mechanics	MEDIUM	CloudFront behavior order and the stack output were read but not deployed; no staging evidence seen.
facts	MEDIUM	Couldn't verify whether /up is still being A/B tested (F1).

⚠️ Check these before approving

Nothing needs a human eye beyond the rubber-stamp list below.

✅ What you can rubber-stamp

• Facts: 4 factual claims checked — 3 verified clean, 1 settled — see the evidence page.
• Mechanics: no internal links added.
• Style: 0 advisory suggestions left with the author; never blocking.

Pre-existing issues in touched files: 0 — details on the evidence page.

Full evidence: verification trail, investigation log, review history.

_{Review v2 · updated 2026-10-23T15:26:27Z · head commit 02b6e81}

---

For the reviewer: something look wrong? Comment /update-review <your point> and the review re-checks with your input.

[github-actions]

Author action guide v2 — nothing blocks merge

Important

You = the PR author. Answer every item below before this PR can merge.

To answer: push a fix, or reply /update-review F1: <what you fixed, why it's wrong, or "accepting as-is — why">. A reply without /update-review at the start of a line doesn't count. Examples: How to answer at the bottom.

This PR moves the marketing-web proxied paths into infrastructure/marketingWebPaths.ts, exports them as a stack output that the cache-invalidation workflow reads, and updates AGENTS.md and BUILD-AND-DEPLOY.md to match. The review checked the factual claims in the doc changes and the workflow/infra wiring.

✅ Resolved since last review

1 resolved item — click to expand

ID	Where	Finding
F1	AGENTS.md L103	"- /up: the getting-started wizard, which is being A/B tested against…" — verdict: unverifiable. Nothing in this repo or in public sources confirms whether /up is still under an A/B test. — ✅ fixed in 02b6e81

Full evidence: verification trail, investigation log, review history.

_{Review v2 · updated 2026-10-23T15:26:27Z · head commit 02b6e81}

---

Please don't edit or delete this comment; it's the review's record.

[jeffmerrick]

/update-review I pushed a fix for F1

[CamSoper]

LGTM.