pulumi up prompts for confirmation and renders a live-updating tree view by default. In a CI environment without a TTY the tree view degrades but the confirmation prompt still blocks, so a job appears to hang until its timeout.
Pass --yes to skip confirmation and --non-interactive to force the plain, line-oriented output that is readable in a CI log. Pulumi sets non-interactive automatically when it detects CI=true, which most providers set, but relying on that detection fails on self-hosted runners that do not.
Authentication in CI uses PULUMI_ACCESS_TOKEN for Pulumi Cloud; without it the CLI attempts a browser login. For the local file backend, pulumi login file:// plus PULUMI_CONFIG_PASSPHRASE is the equivalent pair. pulumi stack select --create is the idempotent way to ensure the target stack exists in an ephemeral environment. Adding --suppress-outputs keeps stack outputs, which may include secrets in some configurations, out of the job log.