Michael Solla — Cloud Platform Engineer

Architecture

flowchart LR
  Human[Human] --> GH[GitHub]
  Agent[Cloud agent] --> GH
  GH --> Copy[GitHub Action copies git to GitLab]
  Copy --> GL[GitLab CI + WIF]
  GL --> CR[Cloud Run]
  CR --> DNS[resume.solla.app]
  GH -.-> Kind[kind — local lab]
  GH -.-> GKE[GKE Autopilot — on demand]

A person or a cloud agent lands work on GitHub. A GitHub Action copies the same git branch to GitLab. GitLab CI runs Pulumi against GCP. GitHub Actions never deploys.

Why these trade-offs

Pulumi, not Terraform. One TypeScript program for Cloud Run, kind, and Autopilot. This repo is Pulumi-first on purpose — not a second language for the same graph.
Cloud Run is the public site. Always-on and cheap. GKE Autopilot is an on-demand lab, destroyed when idle: the control-plane credit does not cover Pods, and an HTTP(S) load balancer would add about $15–20/month. No public GKE URL.
GitHub for humans and cloud agents, GitLab for deploy. A person and a Cursor Cloud Agent both open PRs on GitHub — GitLab.com Free cannot issue the project access tokens those agents need. A GitHub Action copies each branch to GitLab; shared runners plus GCP Workload Identity Federation run pulumi up. GitHub Actions never deploys.

Security

GCP is keyless WIF — no service-account JSON in CI. Pulumi Cloud uses a GitLab PULUMI_ACCESS_TOKEN (masked, not Protected) so feature-branch preview can log in. That is acceptable on a solo personal repo; a team would typically use Pulumi OIDC/ESC and protected branches. The token lives only on GitLab.