ci(release): rebuild Pulumi venv on prod runner; exclude it from artifact (#979)

The Pulumi venv built in merge.yml lives at pulumi/venv and was being
shipped wholesale inside pulumi.tbz. Its bin/python is an absolute
symlink into /opt/hostedtoolcache/Python/<patch>/x64/bin/python, which
only resolves on the runner that built it. When release.yml extracts
the artifact on a different runner whose Python tool cache was
refreshed to a different 3.13.x patch, the symlink dangles and Pulumi
fails with:

  fork/exec /home/runner/work/.../pulumi/venv/bin/python:
    no such file or directory

This bit r-0437's prod publish (run 27723066505); prior releases
worked only when the stage and prod runners happened to have the
same cached patch version.

- merge.yml: exclude pulumi/venv from the tarball. Shrinks pulumi.tbz
  from ~55 MB to ~10 KB and stops shipping a non-portable venv.
- release.yml: rebuild the venv from requirements.txt on the prod
  runner after extraction. The rm -rf venv keeps already-published
  drafts (whose artifact still contains the stage-runner venv)
  working without re-cutting the release.

Recovery for r-0437 after this merges: convert the release back to
draft and re-publish to re-fire release.yml against the fixed
workflow.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: aatchison

.github/workflows/merge.yml

@@ -197,7 +197,12 @@ jobs:
         if: env.BUILD_ACCOUNTS == 'true'
         shell: bash
         run: |
-          tar -cvjf pulumi.tbz pulumi/
+          # Exclude the venv: it was built on THIS runner with bin/python as an
+          # absolute symlink into /opt/hostedtoolcache/Python/<patch>/..., so it
+          # isn't portable to the prod runner (different cached patch version =>
+          # dangling symlink => pulumi fails on venv/bin/python). release.yml
+          # rebuilds the venv from requirements.txt on the prod runner.
+          tar --exclude='pulumi/venv' -cvjf pulumi.tbz pulumi/
 
       - name: Archive the Pulumi artifact
         id: iac-archive

.github/workflows/release.yml

@@ -74,12 +74,30 @@ jobs:
         shell: bash
         run: |
           tar -xvf pulumi.tbz
-      
+
       - name: Set up Python ${{ vars.PYTHON_VERSION}}
         uses: actions/setup-python@v5
         with:
           python-version: ${{ vars.PYTHON_VERSION}}
 
+      # Build the Pulumi venv on THIS runner. Older pulumi.tbz artifacts shipped
+      # a venv built on the stage runner, whose bin/python was an absolute
+      # symlink into /opt/hostedtoolcache/Python/<patch>/... — that path doesn't
+      # exist on the prod runner whenever the cached patch version differs, and
+      # pulumi blows up trying to call venv/bin/python. We now exclude the venv
+      # from the artifact (see merge.yml) and rebuild here. The `rm -rf venv`
+      # handles already-published drafts whose artifact still contains the
+      # stage-runner venv.
+      - name: Rebuild Pulumi venv on prod runner
+        shell: bash
+        run: |
+          cd pulumi
+          rm -rf venv
+          python -m pip install virtualenv
+          virtualenv ./venv
+          source ./venv/bin/activate
+          pip install -Ur requirements.txt
+
       - name: Install Pulumi
         shell: bash
         run: |