Pulumi Provider for Paramify

A native Pulumi provider for Paramify, generated from Paramify's OpenAPI spec using pulschema (spec → Pulumi schema + CRUD metadata) and pulumi-provider-framework (the generic REST provider runtime).

Resources

| Resource | API endpoints | | --------------------------------------- | ------------------------------------------- | | paramify:validators:Validator | /validators | | paramify:scripts:Script | /scripts | | paramify:issues:Issue | /issues | | paramify:issues:Recommendation | /issues/{issueId}/recommendations | | paramify:issues:Deviation | /issues/{issueId}/deviations | | paramify:issues:Milestone | /issues/{issueId}/milestones | | paramify:evidence:Evidence | /evidence | | paramify:evidence:Artifact | /evidence/{evidenceId}/artifacts/url (URL artifacts only) |

Read-only Paramify objects (projects/programs, assessments, audit assessments, solution capabilities, elements, stacks) are exposed as invoke functions (get*), not resources.

Deliberately not covered: file-upload artifacts (multipart bytes are not IaC-shaped), OSCAL export, the associate actions, assessment intake endpoints, and the custom-tags endpoints (bulk names[] bodies keyed by a composite {entity}/{entityId} path with no per-item id — not resource-shaped).

Configuration

| Config | Description | | ------------------ | ---------------------------------------------------------------------------------- | | paramify:apiKey | Paramify API key (secret). Also read from PARAMIFY_API_KEY. Sent as Authorization: Bearer <key>. |

pulumi config set --secret paramify:apiKey <key>

Example

import * as paramify from '@silkline/pulumi-paramify';

const script = new paramify.scripts.Script('tls-check', {
  name: 'Check TLS configuration',
  code: 'echo checking',
});

See examples/simple for a runnable program.

How the spec is vendored

provider/cmd/pulumi-gen-paramify/openapi.yml is generated — do not edit it by hand. It is produced from the componentized Paramify spec maintained in the client-app repo (client/packages/paramify-sdk/paramify-openapi.json) by scripts/prepare-spec.mjs, which applies the pulschema/kin-openapi-specific conditioning (RE2-incompatible regexes, non-standard marker keys, OpenAPI 3.1 null-union branches, operationId normalization for CRUD pairing, security-scheme cleanup, Validator union flattening). The header comment in that script documents each rule.

To refresh after a spec update:

node scripts/prepare-spec.mjs <path-to>/paramify-openapi.json
make gen generate_schema     # rebuilds the embedded spec + schema.json/metadata.json
make build                   # regenerates the language SDKs
make test_provider

Building

Prerequisites: Go, NodeJS + Yarn, Python 3, .NET, pulumictl, the Pulumi CLI.

make gen generate_schema   # OpenAPI spec → Pulumi schema
make provider              # build the provider binary
make build                 # generate all language SDKs
make test_provider         # Go unit tests

Releasing

Push a v* tag (plus an sdk/v* tag for the Go SDK). GitHub Actions runs goreleaser to attach the provider binaries to the GitHub release and publishes the language SDKs — see .github/workflows/release.yml for the required repository secrets (npm, PyPI, NuGet tokens).

The Pulumi engine downloads the plugin binary from this repository's GitHub releases (pluginDownloadURL: github://api.github.com/Silkline). The repository is private, so every plugin download needs a GITHUB_TOKEN environment variable with contents:read on this repo — locally, GITHUB_TOKEN=$(gh auth token) pulumi ...; Pulumi Cloud deployments get it from the deployment settings. Every published SDK version needs a matching release tag. The npm package itself is public (access: public in the release workflow).