upstream-patches
Create, amend, remove, and rebase patches for Terraform provider submodules using ./scripts/upstream.sh. Use when upgrade-provider or manual patch work needs owning-patch lookup, patch conflict fixes, patch/hunk removal, or upstream rebase.
- Installs
- 634
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/pulumi/agent-skills --skill upstream-patches- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads upstream-patches automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Upstream Patches
upstream/ is a git submodule pointing to the upstream Terraform provider. patches/ contains patch files applied on top of it. Use ./scripts/upstream.sh to manage patch state.
Default Behavior
- If fixing a regression introduced by an existing patch, amend the owning patch commit.
- Do not create a new patch unless the user explicitly asks.
Commands Reference
| Command | Description |
|---|---|
./scripts/upstream.sh init | Initialize upstream and apply patches to working directory |
./scripts/upstream.sh init -f | Destructively discard checkout/rebase state and re-initialize upstream |
./scripts/upstream.sh checkout | Create branch with patches as commits for editing |
./scripts/upstream.sh rebase -i | Interactively edit patch commits |
./scripts/upstream.sh rebase -o <commit> | Rebase patches onto a new upstream commit |
./scripts/upstream.sh check_in | Write commits back to patches and exit checkout mode |
Guardrails
- Never commit directly to
upstream/withoutcheckout/check_in. - Direct edits under
upstream/outside checkout are ephemeral duringupgrade-provider; the tool resets submodule state. - Do not hand-edit
patches/*.patchunless intentionally doing raw patch surgery. - Prefer non-interactive rewrite flow over interactive rebase for agents.
Find Owning Patch First
Before editing patch content, identify the owning patch/commit.
./scripts/upstream.sh checkout
# Find candidate patch files by touched file path or unique hunk text
rg -n "path/to/file|unique_symbol" patches/*.patch
# Optional: inspect candidate patch header/hunks
sed -n '1,120p' patches/00NN-Example.patch
# Map patch file to commit in upstream checkout branch
patch=patches/00NN-Example.patch
subject=$(sed -n 's/^Subject: \[PATCH\] //p' "$patch" | head -n1)
cd upstream
git log --oneline pulumi/patch-checkout --grep "$subject"
# If needed, disambiguate by touched path
git log --oneline pulumi/patch-checkout -- path/to/file
cd ..
If rg is unavailable, use grep -En for the patch search. Set target_sha to the owning commit and edit that commit, not HEAD.
Amend Existing Patch (Preferred, Non-Interactive)
./scripts/upstream.sh checkout
cd upstream
target_sha=<owning-commit-sha>
base_sha=$(git rev-parse "${target_sha}^")
tmp_branch="rewrite-${target_sha:0:8}"
# Rebuild history from parent of target commit
git checkout -b "$tmp_branch" "$base_sha"
git cherry-pick "$target_sha"
# Apply fix and amend target commit
# ...edit files...
git add <files>
git commit --amend --no-edit
# Replay remaining commits
git cherry-pick "${target_sha}..pulumi/patch-checkout"
# If cherry-pick conflicts occur:
# resolve files
# git add <resolved files>
# git cherry-pick --continue
# Move checkout branch to rewritten history
git branch -f pulumi/patch-checkout HEAD
git checkout pulumi/patch-checkout
git branch -D "$tmp_branch"
cd ..
Interactive fallback:
./scripts/upstream.sh checkout
./scripts/upstream.sh rebase -i
# mark target commit as edit, amend, then continue
Remove Entire Patch
Use when a patch should be deleted completely.
rm patches/00NN-Description.patch
./scripts/upstream.sh checkout
./scripts/upstream.sh check_in
Remove Part of a Patch
Use when only selected hunks/files should be removed from an existing patch.
- Find owning patch/commit (
target_sha) and use the amend workflow above. - Revert only unwanted changes from the target commit, then amend.
Example during amend step:
cd upstream
# Restore specific docs-only files from parent of amended commit
git checkout HEAD^ -- path/to/docs-only-file path/to/another-doc-file
git add path/to/docs-only-file path/to/another-doc-file
git commit --amend --no-edit
cd ..
Create New Patch (Only If Requested)
./scripts/upstream.sh checkout
cd upstream
# ...make changes...
git add <files>
git commit -m "Describe new patch"
cd ..
./scripts/upstream.sh check_in
Rebasing Patches to a New Upstream Version
./scripts/upstream.sh checkout
# Rebase onto the new upstream commit
./scripts/upstream.sh rebase -o <new_commit_sha>
# Resolve any conflicts that arise
# Write updated patch files
./scripts/upstream.sh check_in
Verification Checklist
Before check_in:
- Confirm expected patch count change (
0by default;-1for full patch removal). - Confirm whether target patch should remain present (default yes) or be removed (explicit deletion case).
- Confirm you are editing the owning commit, not adding a new commit by accident.
After check_in:
- Verify patch count matches expectation.
- Verify target patch number/purpose is still present when expected.
- Verify no unexpected new
00NN-*.patchwas introduced.
Interrupted Checkout or Rebase
Preserve work by default. Inspect git -C upstream status, complete the active git am/rebase, verify that every patch was applied, and run ./scripts/upstream.sh check_in before rerunning automation. An interrupted checkout invokes git am separately for each patch, so later patch files may not have been reached.
Use ./scripts/upstream.sh init -f only when intentionally discarding all interrupted work. It can remove conflict resolution, patch commits, operation metadata, and untracked files; it is not routine recovery for a stuck checkout.
FAQ
What does the upstream-patches skill do?
Create, amend, remove, and rebase patches for Terraform provider submodules using ./scripts/upstream.sh. Use when upgrade-provider or manual patch work needs owning-patch lookup, patch conflict fixes, patch/hunk removal, or upstream rebase.
How do I install upstream-patches?
Run npx skills add https://github.com/pulumi/agent-skills --skill upstream-patches in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/upstream-patches/ (personal) or .claude/skills/upstream-patches/ (project).
Which AI agents can use upstream-patches?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is upstream-patches safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains upstream-patches?
It is published by pulumi in pulumi/agent-skills, and it is an official skill from the maker of the technology it covers. It has 634 recorded installs.
More from pulumi/agent-skills
pulumi-best-practices
pulumi/agent-skills
Load when the user is writing, reviewing, or debugging Pulumi TypeScript/Python programs; asks about Output or apply() usage; wants to create ComponentResource classes; needs to refactor resources without destroying them (aliases); is setting up secrets or config; or is configuring a pulumi preview/up CI workflow. Also load for questions about resource dependency order, parent/child resource relationships, or pulumi.interpolate.
pulumi-arm-to-pulumi
pulumi/agent-skills
Convert or migrate Azure ARM (Azure Resource Manager) templates, Bicep templates, or code to Pulumi, including importing existing Azure resources. This skill MUST be loaded whenever a user requests migration, conversion, or import of ARM templates, Bicep templates, ARM code, Bicep code, or Azure resources to Pulumi.
pulumi-component
pulumi/agent-skills
Guide for authoring Pulumi ComponentResource classes. Use when creating reusable infrastructure components, designing component interfaces, setting up multi-language support, or distributing component packages.
pulumi-esc
pulumi/agent-skills
Guidance for working with Pulumi ESC (Environments, Secrets, and Configuration). Use when users ask about managing secrets, configuration, environments, short-term credentials, configuring OIDC for AWS, Azure, GCP, integrating with secret stores (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, 1Password), or using ESC with Pulumi stacks.
pulumi-automation-api
pulumi/agent-skills
Load this skill when a user asks how to run Pulumi programmatically, embed Pulumi in an application, orchestrate multiple stacks in code, build a self-service infrastructure portal, replace pulumi CLI shell scripts with code, or use the Pulumi Automation API (LocalWorkspace, createOrSelectStack, inline programs). Also load for questions about multi-stack sequencing, parallel deployments, or passing outputs between stacks via code.
pulumi-terraform-to-pulumi
pulumi/agent-skills
Migrate Terraform/OpenTofu projects to Pulumi, including translating HCL source code and/or importing Terraform state into a Pulumi stack. Use when a user wants to convert Terraform to Pulumi, migrate from HCL, or import tfstate into Pulumi. Do NOT trigger for general Terraform-vs-Pulumi comparisons or questions about using both tools side-by-side.
Popular ai & agents skills
google-agents-cli-publish
google/agents-cli
This skill should be used when the user wants to "publish an agent", "publish my ADK agent", "register an agent with Gemini", "publish to Gemini" (formerly Gemini Enterprise), or needs guidance on the agents-cli publish gemini command. Also use when the user wants to "manage agents in Agent Registry", "list/update/delete registered agents", or "register an MCP server". Covers ADK vs A2A registration modes, programmatic and interactive usage, flag reference, auto-detection from deployment metadata, Agent Registry fleet management, and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment (use google-agents-cli-deploy).
google-agents-cli-eval
google/agents-cli
This skill should be used when the user wants to "run an evaluation", "evaluate my agent", "evaluate my ADK agent", "write an eval dataset", "analyze eval failures", "compare eval results", "optimize agent", or needs guidance on the Gemini platform eval methodology and the Quality Flywheel. Covers eval metrics, dataset schema, LLM-as-judge scoring, and common failure causes. Applies to any agents-cli project, whatever framework the agent is written in. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), deployment (use google-agents-cli-deploy), or project scaffolding (use google-agents-cli-scaffold).
skill-creator
anthropics/skills
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
codex-pet
prime-skills/runcomfy-agent-skills
Codex Pet generator on RunComfy. Build a Codex-compatible Codex Pet spritesheet.webp + pet.json from a single reference image, drop it into ${CODEXHOME:-$HOME/.codex}/pets/ / and Codex picks it up as a custom Codex Pet next to the 8 built-ins. This skill produces the exact Codex Pet atlas Codex expects (1536x1872 PNG/WebP, 8 cols x 9 rows, 192x208 cells, 9 animation states — idle, running-right, running-left, waving, jumping, failed, waiting, running, review). Calls OpenAI GPT Image 2 edit ONCE via the local RunComfy CLI as runcomfy run openai/gpt-image-2/edit to produce a canonical Codex Pet pose, then assembles all 9 animation rows programmatically with ImageMagick micro-transforms — no Codex Pro, no $imagegen, no OPENAIAPIKEY required, only RUNCOMFYTOKEN. Triggers on "codex pet", "create codex pet", "make codex pet", "hatch codex pet", "/hatch image", "desktop pet codex", "codex pets", "spritesheet.webp", or any explicit ask to build a custom pet for OpenAI Codex.
full-output-enforcement
leonxlnx/taste-skill
Overrides default LLM truncation behavior. Enforces complete code generation, bans placeholder patterns, and handles token-limit splits cleanly. Apply to any task requiring exhaustive, unabridged output.
executing-plans
obra/superpowers
Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available