Repository: pulumi/actions (ts)

Issue:
Support the `--exclude-protected` on destroy
## Hello!
<!-- Please leave this section as-is, it's designed to help others in the community know how to interact with our GitHub issues. -->

- Vote on this issue by adding a 👍 reaction
- If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

## Issue details

<!-- Enhancement requests are most helpful when they describe the problem you're having as well as articulating the potential solution you'd like to see built. -->
For similar reasons outlined in the [issue](https://github.com/pulumi/pulumi/issues/6539) that resulted in the `--exclude-protected` being added to the CLI, it would be good to be able to provide this flag in the GitHub Action.


Pull request description:
feat: Support `exclude-protected` on `destroy`
Support passing the `--exclude-protected` flag to `pulumi destroy`. Requires the latest version of `@pulumi/pulumi` where the option is now available in Automation API (see https://github.com/pulumi/pulumi/pull/12734).

Fixes #628

Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e5ca70..9bd3f3a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## HEAD (Unreleased)
 
+- feat: Support `exclude-protected` on `destroy`.
+  ([#925](https://github.com/pulumi/actions/pull/925))
+
 --
 
 ## 4.2.1 (2023-04-11)
diff --git a/README.md b/README.md
index 1fcf1b8..0604fe5 100644
--- a/README.md
+++ b/README.md
@@ -121,6 +121,9 @@ The action can be configured with the following arguments:
   control as part of the action if you wish to perform any further tasks with
   that stack.
 
+- `exclude-protected` - (optional) Skip destroying protected resources. Only
+  valid when `command` is `destroy`.
+
 By default, this action will try to authenticate Pulumi with
 [Pulumi Cloud](https://app.pulumi.com/). If you have not specified a
 `PULUMI_ACCESS_TOKEN` then you will need to specify an alternative backend via
diff --git a/action.yml b/action.yml
index ebb98b9..86654e2 100644
--- a/action.yml
+++ b/action.yml
@@ -89,6 +89,10 @@ inputs:
     description: 'Colorize output. Choices are: always, never, raw, auto'
     required: false
     default: 'auto'
+  exclude-protected:
+    description: 'Skip destroying protected resources. Only valid when command is destroy.'
+    required: false
+    default: 'false'
 outputs:
   output:
     description: Output from running command
diff --git a/package.json b/package.json
index 6abface..302dd60 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "husky": "^8.0.3",
     "jest": "~26.6.3",
     "jest-playback": "^3.0.0",
-    "lint-staged": "^13.2.1",
+    "lint-staged": "^13.2.2",
     "prettier": "^2.8.8",
     "rimraf": "~5.0.0",
     "ts-jest": "~26.5.6"
@@ -47,7 +47,7 @@
     "@actions/github": "^5.1.1",
     "@actions/io": "^1.1.3",
     "@actions/tool-cache": "^2.0.1",
-    "@pulumi/pulumi": "3.64.0",
+    "@pulumi/pulumi": "3.65.1",
     "actions-parsers": "^1.0.2",
     "dedent": "^0.7.0",
     "envalid": "^7.3.1",
diff --git a/src/config.ts b/src/config.ts
index 70c21db..b75815e 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -68,6 +68,7 @@ export function makeConfig() {
       color: getUnionInput('color', {
         alternatives: ['always', 'never', 'raw', 'auto'] as const,
       }),
+      excludeProtected: getBooleanInput('exclude-protected'),
     },
   };
 }
diff --git a/yarn.lock b/yarn.lock
index a0fc778..ae7cd9f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -887,10 +887,10 @@
   resolved "https://registry.yarnpkg.com/@protobufjs/utf8/-/utf8-1.1.0.tgz#a777360b5b39a1a2e5106f8e858f2fd2d060c570"
   integrity sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw==
 
-"@pulumi/pulumi@3.64.0":
-  version "3.64.0"
-  resolved "https://registry.yarnpkg.com/@pulumi/pulumi/-/pulumi-3.64.0.tgz#8b599b6bb53dcee935192e154e3cf56ae3b30178"
-  integrity sha512-yKEABPiNqOXAlZcGiBSbYElwDrx82IjDUS07R+K3g05EzEttMN5YKv/NjTZsiSWtOGuGscStJnwEWWCjj4GhGQ==
+"@pulumi/pulumi@3.65.1":
+  version "3.65.1"
+  resolved "https://registry.yarnpkg.com/@pulumi/pulumi/-/pulumi-3.65.1.tgz#2e8e1a30ac8f543db9250a5ae771751bcbb50254"
+  integrity sha512-XhyBtrA8dvgpiMt7jTnhIuRKIVQ0e/P89WRcsPdkYpnJVM3dc7YdMrFPZ4ceWrDdbNuNgq/fNOCsnxjo5BM/WA==
   dependencies:
     "@grpc/grpc-js" "^1.3.8"
     "@logdna/tail-file" "^2.0.6"
@@ -4074,10 +4074,10 @@ lines-and-columns@^1.1.6:
   resolved "https://registry.yarnpkg.com/lines-and-columns/-/lines-and-columns-1.2.4.tgz#eca284f75d2965079309dc0ad9255abb2ebc1632"
   integrity sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==
 
-lint-staged@^13.2.1:
-  version "13.2.1"
-  resolved "https://registry.yarnpkg.com/lint-staged/-/lint-staged-13.2.1.tgz#9d30a14e3e42897ef417bc98556fb757f75cae87"
-  integrity sha512-8gfzinVXoPfga5Dz/ZOn8I2GOhf81Wvs+KwbEXQn/oWZAvCVS2PivrXfVbFJc93zD16uC0neS47RXHIjXKYZQw==
+lint-staged@^13.2.2:
+  version "13.2.2"
+  resolved "https://registry.yarnpkg.com/lint-staged/-/lint-staged-13.2.2.tgz#5e711d3139c234f73402177be2f8dd312e6508ca"
+  integrity sha512-71gSwXKy649VrSU09s10uAT0rWCcY3aewhMaHyl2N84oBk4Xs9HgxvUp3AYu+bNsK4NrOYYxvSgg7FyGJ+jGcA==
   dependencies:
     chalk "5.2.0"
     cli-truncate "^3.1.0"
@@ -4091,7 +4091,7 @@ lint-staged@^13.2.1:
     object-inspect "^1.12.3"
     pidtree "^0.6.0"
     string-argv "^0.3.1"
-    yaml "^2.2.1"
+    yaml "^2.2.2"
 
 listr2@^5.0.7:
   version "5.0.8"
@@ -6001,7 +6001,7 @@ yallist@^4.0.0:
   resolved "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72"
   integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==
 
-yaml@^2.2.1:
+yaml@^2.2.2:
   version "2.2.2"
   resolved "https://registry.yarnpkg.com/yaml/-/yaml-2.2.2.tgz#ec551ef37326e6d42872dad1970300f8eb83a073"
   integrity sha512-CBKFWExMn46Foo4cldiChEzn7S7SRV+wqiluAb6xmueD/fGyRHIhX8m14vVGgeFWjN540nKCNVj6P21eQjgTuA==


Test patch:
diff --git a/src/__tests__/config.test.ts b/src/__tests__/config.test.ts
index e3333b4..57d6346 100644
--- a/src/__tests__/config.test.ts
+++ b/src/__tests__/config.test.ts
@@ -15,6 +15,7 @@ const defaultConfig: Record<string, string> = {
   'expect-no-changes': 'false',
   diff: 'false',
   'target-dependents': 'false',
+  'exclude-protected': 'false',
 };
 
 function setupMockedConfig(config: Record<string, string>) {
@@ -44,6 +45,7 @@ describe('config.ts', () => {
         "options": Object {
           "color": undefined,
           "diff": false,
+          "excludeProtected": false,
           "expectNoChanges": false,
           "message": "",
           "parallel": undefined,