Add Pulumi preview to CI infra job

Infra now always runs unit tests + vet on PRs, and additionally runs
`pulumi preview --diff` (posted as a PR comment) when the infra, gui, or
api code changes — since any of those can change what gets deployed.

.gitea/workflows/ci.yml

@@ -1,7 +1,9 @@
 # Runs on pull requests: unit tests plus a compile check.
 # Split into separate jobs (Odin, API, Infra) so they can run concurrently,
 # and gated by changed paths so each only runs when its code changes.
-# Infra always runs regardless of what changed.
+# Infra always runs (unit tests + vet) regardless of what changed; its Pulumi
+# preview (posted as a PR comment) runs when the infra, gui, or api code
+# changed, since any of those can change what gets deployed.
 
 name: CI
 
@@ -28,6 +30,8 @@ jobs:
     outputs:
       odin: ${{ steps.filter.outputs.odin }}
       api: ${{ steps.filter.outputs.api }}
+      infra: ${{ steps.filter.outputs.infra }}
+      preview: ${{ steps.decide.outputs.run }}
     steps:
       - uses: dorny/paths-filter@v4
         id: filter
@@ -38,6 +42,19 @@ jobs:
               - 'scripts/**'
             api:
               - 'api/**'
+            infra:
+              - 'infra/**'
+
+      - name: Decide whether to run the infra preview
+        id: decide
+        run: |
+          if [ "${{ steps.filter.outputs.infra }}" = "true" ] || \
+             [ "${{ steps.filter.outputs.odin }}" = "true" ] || \
+             [ "${{ steps.filter.outputs.api }}" = "true" ]; then
+            echo "run=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run=false" >> "$GITHUB_OUTPUT"
+          fi
 
   odin:
     name: Odin unit tests and build
@@ -97,8 +114,13 @@ jobs:
           cargo fmt --all --check
 
   infra:
-    name: Infra unit tests and vet
+    name: Infra unit tests, vet, and preview
+    needs: changes
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     steps:
       - uses: actions/checkout@v6
         with:
@@ -118,3 +140,70 @@ jobs:
         run: |
           cd infra
           go vet ./...
+
+      # Pulumi CLI. State uses the local file backend (infra/Pulumi.yaml ->
+      # file://~/.pulumi), so no Pulumi Cloud token is needed. Preview diffs
+      # the current source against the last-known stack state; on an ephemeral
+      # runner the self-hosted environment must persist ~/.pulumi to get a
+      # meaningful diff (otherwise preview shows the pending creates).
+      - name: Install Pulumi
+        if: ${{ needs.changes.outputs.preview == 'true' }}
+        run: |
+          curl -fsSL https://get.pulumi.com | sh
+          echo "$HOME/.pulumi/bin" >> "$GITHUB_PATH"
+
+      # The runner must reach the on-prem k3s cluster for preview to diff
+      # against live state. For a self-hosted runner this is the ambient
+      # kubeconfig; otherwise populate it from the KUBECONFIG secret here.
+      - name: Configure kubeconfig
+        if: ${{ needs.changes.outputs.preview == 'true' }}
+        run: |
+          mkdir -p "$HOME/.kube"
+          if [ -n "$KUBECONFIG_B64" ]; then
+            printf '%s' "$KUBECONFIG_B64" | base64 -d > "$HOME/.kube/config"
+          fi
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG }}
+
+      - name: Pulumi preview
+        if: ${{ needs.changes.outputs.preview == 'true' }}
+        working-directory: infra
+        env:
+          PULUMI_SKIP_UPDATE_CHECK: 'true'
+        run: |
+          go mod download
+          pulumi preview --diff 2>&1 | tee /tmp/pulumi-preview.txt || true
+
+      - name: Comment preview on PR
+        if: ${{ needs.changes.outputs.preview == 'true' }}
+        env:
+          GITEA_API: ${{ gitea.api_url }}
+          REPO: ${{ gitea.repository }}
+          TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          python3 - <<'PY'
+          import json, os, urllib.request
+
+          with open('/tmp/pulumi-preview.txt') as f:
+              preview = f.read().strip() or '(no changes)'
+
+          body = "### Pulumi preview\n\n```\n" + preview + "\n```"
+          payload = json.dumps({"body": body}).encode()
+
+          url = (
+              f"{os.environ['GITEA_API']}/repos/{os.environ['REPO']}"
+              f"/issues/{os.environ['PR_NUMBER']}/comments"
+          )
+          req = urllib.request.Request(
+              url,
+              data=payload,
+              method='POST',
+              headers={
+                  'Authorization': f"token {os.environ['TOKEN']}",
+                  'Content-Type': 'application/json',
+              },
+          )
+          urllib.request.urlopen(req)
+          print('Posted Pulumi preview comment')
+          PY