Bump golang.org/x/net in the go_modules group across 1 directory

Bumps the go_modules group with 1 update in the / directory: [golang.org/x/net](https://github.com/golang/net).


Updates `golang.org/x/net` from 0.53.0 to 0.55.0
- [Commits](https://github.com/golang/net/compare/v0.53.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/release.yml

@@ -5,70 +5,63 @@ on:
     tags:
       - "v*"
   workflow_dispatch:
+    inputs:
+      tag_name:
+        description: 'Tag name for the release (e.g., v1.0.0)'
+        required: true
+        type: string
 
 permissions:
   contents: write
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE26: 'true'
+  RELEASE_TAG: ${{ github.event.inputs.tag_name || github.ref_name }}
 
 jobs:
-  build-debian:
-    name: Build Debian 13
+  build-linux-amd64:
+    name: Build Linux amd64
     runs-on: ubuntu-latest
-    container:
-      image: debian:13-slim
     steps:
-      - name: Install dependencies
-        run: |
-          apt-get update && apt-get install -y git golang-go ca-certificates
       - name: Checkout Code
         uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.26.3'
       - name: Build
-        run: go build -v -o gh-repo-bootstrap-linux-debian13-amd64 main.go
+        env:
+          CGO_ENABLED: '0'
+          GOOS: linux
+          GOARCH: amd64
+        run: go build -v -o gh-repo-bootstrap-linux-amd64 main.go
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
         with:
-          name: gh-repo-bootstrap-linux-debian13-amd64
-          path: gh-repo-bootstrap-linux-debian13-amd64
+          name: gh-repo-bootstrap-linux-amd64
+          path: gh-repo-bootstrap-linux-amd64
 
-  build-arch:
-    name: Build Arch Linux
-    runs-on: ubuntu-latest
-    container:
-      image: archlinux:latest
+  build-linux-arm64:
+    name: Build Linux arm64
+    runs-on: ubuntu-24.04-arm
     steps:
-      - name: Install dependencies
-        run: |
-          pacman -Syu --noconfirm git go ca-certificates
       - name: Checkout Code
         uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.26.3'
       - name: Build
-        run: go build -v -o gh-repo-bootstrap-linux-arch-amd64 main.go
+        env:
+          CGO_ENABLED: '0'
+          GOOS: linux
+          GOARCH: arm64
+        run: go build -v -o gh-repo-bootstrap-linux-arm64 main.go
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
         with:
-          name: gh-repo-bootstrap-linux-arch-amd64
-          path: gh-repo-bootstrap-linux-arch-amd64
-
-  build-fedora:
-    name: Build Fedora 44
-    runs-on: ubuntu-latest
-    container:
-      image: fedora:44
-    steps:
-      - name: Install dependencies
-        run: |
-          dnf install -y git golang ca-certificates
-      - name: Checkout Code
-        uses: actions/checkout@v4
-      - name: Build
-        run: go build -v -o gh-repo-bootstrap-linux-fedora44-amd64 main.go
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: gh-repo-bootstrap-linux-fedora44-amd64
-          path: gh-repo-bootstrap-linux-fedora44-amd64
+          name: gh-repo-bootstrap-linux-arm64
+          path: gh-repo-bootstrap-linux-arm64
 
   build-windows:
     name: Build Windows
@@ -108,7 +101,11 @@ jobs:
 
   release:
     name: Create Release
-    needs: [build-debian, build-arch, build-fedora, build-windows, build-macos]
+    needs:
+      - build-linux-amd64
+      - build-linux-arm64
+      - build-windows
+      - build-macos
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -125,7 +122,7 @@ jobs:
         run: |
           mkdir release-assets
           find bin-artifacts -type f -exec cp {} release-assets/ \;
-          
+
           cd release-assets
           echo "## SHA256 Checksums" > ../release_notes.txt
           echo "" >> ../release_notes.txt
@@ -135,14 +132,14 @@ jobs:
             sha=$(sha256sum "$file" | cut -d' ' -f1)
             echo "| \`$file\` | \`$sha\` |" >> ../release_notes.txt
           done
-          
+
           cat ../release_notes.txt
 
       - name: Create GitHub Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release create "${{ github.ref_name }}" \
-            --title "${{ github.ref_name }}" \
+          gh release create "${{ env.RELEASE_TAG }}" \
+            --title "${{ env.RELEASE_TAG }}" \
             --notes-file release_notes.txt \
             release-assets/*

README.md

@@ -29,7 +29,9 @@ gh extension install JMR-dev/gh-repo-bootstrap
 release. You also need:
 
 - [`pulumi`](https://www.pulumi.com/docs/iac/download-install/) on `PATH`
-- `gh` already authenticated (`gh auth login`)
+- `gh` already authenticated (`gh auth login`), or a `GITHUB_TOKEN`
+  exported in the environment — the extension uses `GITHUB_TOKEN`
+  when it is set and otherwise falls back to `gh auth token`
 
 ## Use
 
@@ -112,9 +114,11 @@ A single `--config FILE` can describe everything. When `--config`
 is used, **no other flags are allowed**:
 
 ```toml
-owner = "JMR-dev"
-name  = "my-new-app"
-mode  = "create"      # or "manage", or "data" (default)
+owner     = "JMR-dev"
+name      = "my-new-app"
+mode      = "create"   # or "manage", or "data" (default)
+action    = "apply"    # or "plan", or "destroy" (default: apply)
+state_dir = "./state"  # optional; overrides the default per-repo state dir
 
 [repo]
 visibility             = "private"

go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/BurntSushi/toml v1.6.0
 	github.com/pulumi/pulumi-github/sdk/v6 v6.14.0
 	github.com/pulumi/pulumi/sdk/v3 v3.243.0
-	golang.org/x/term v0.42.0
+	golang.org/x/term v0.43.0
 )
 
 require (
@@ -106,13 +106,13 @@ require (
 	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/crypto v0.51.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect

go.sum

@@ -289,8 +289,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
+golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -305,8 +305,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -328,16 +328,16 @@ golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=

internal/runner/runner.go

@@ -82,6 +82,11 @@ func Run(ctx context.Context, opts *cli.Options) error {
 	if err := os.MkdirAll(stateDir, 0o700); err != nil {
 		return fmt.Errorf("creating state dir: %w", err)
 	}
+	absStateDir, err := filepath.Abs(stateDir)
+	if err != nil {
+		return fmt.Errorf("resolving state dir: %w", err)
+	}
+	stateDir = absStateDir
 
 	// --- Auth: prefer caller-supplied GITHUB_TOKEN, else borrow from gh ---
 	if os.Getenv("GITHUB_TOKEN") == "" {
@@ -203,7 +208,44 @@ func Run(ctx context.Context, opts *cli.Options) error {
 	default:
 		return fmt.Errorf("unknown action: %s", opts.Action)
 	}
-	return err
+	if err != nil {
+		return err
+	}
+	if opts.RepoMode == cli.RepoModeCreate && opts.Action == cli.ActionApply {
+		if err := setGitRemoteAndPush(opts.Owner, opts.Repo); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// setGitRemoteAndPush wires the newly created GitHub repo as the "origin"
+// remote of the current git working tree and pushes all local commits.
+// If the working directory is not inside a git repo the step is skipped.
+func setGitRemoteAndPush(owner, repo string) error {
+	if err := execCommand("git", "rev-parse", "--is-inside-work-tree").Run(); err != nil {
+		fmt.Println(">>> Not inside a git repository; skipping remote setup.")
+		return nil
+	}
+
+	remoteURL := fmt.Sprintf("https://github.com/%s/%s.git", owner, repo)
+	fmt.Printf(">>> Setting git remote origin → %s\n", remoteURL)
+
+	if execCommand("git", "remote", "get-url", "origin").Run() == nil {
+		if out, err := execCommand("git", "remote", "set-url", "origin", remoteURL).CombinedOutput(); err != nil {
+			return fmt.Errorf("updating git remote: %s: %w", strings.TrimSpace(string(out)), err)
+		}
+	} else {
+		if out, err := execCommand("git", "remote", "add", "origin", remoteURL).CombinedOutput(); err != nil {
+			return fmt.Errorf("adding git remote: %s: %w", strings.TrimSpace(string(out)), err)
+		}
+	}
+
+	fmt.Println(">>> Pushing local commits to origin...")
+	if out, err := execCommand("git", "push", "-u", "origin", "HEAD").CombinedOutput(); err != nil {
+		return fmt.Errorf("pushing to remote: %s: %w", strings.TrimSpace(string(out)), err)
+	}
+	return nil
 }
 
 // runCreatePrompts asks the user for any missing required --create values

internal/runner/runner_test.go

@@ -40,35 +40,59 @@ func TestHelperProcess(t *testing.T) {
 	}
 
 	command := args[0]
-	if command != "gh" {
-		fmt.Fprintf(os.Stderr, "expected 'gh', got: %s\n", command)
-		os.Exit(2)
-	}
-
-	subCmd := args[1]
-	switch subCmd {
-	case "auth":
-		if len(args) >= 3 && args[2] == "token" {
-			fmt.Print("gh_mock_token\n")
-		} else {
-			fmt.Fprintf(os.Stderr, "unknown auth subcommand\n")
-			os.Exit(2)
-		}
-	case "api":
-		if len(args) >= 3 {
-			path := args[2]
-			switch {
-			case path == "users/octocat":
-				fmt.Print(`{"id":583234}`)
-			case path == "orgs/JMR-dev/teams/release":
-				fmt.Print(`{"id":98765}`)
-			default:
-				fmt.Fprintf(os.Stderr, "unknown path: %s\n", path)
+	switch command {
+	case "gh":
+		subCmd := args[1]
+		switch subCmd {
+		case "auth":
+			if len(args) >= 3 && args[2] == "token" {
+				fmt.Print("gh_mock_token\n")
+			} else {
+				fmt.Fprintf(os.Stderr, "unknown auth subcommand\n")
 				os.Exit(2)
 			}
+		case "api":
+			if len(args) >= 3 {
+				path := args[2]
+				switch {
+				case path == "users/octocat":
+					fmt.Print(`{"id":583234}`)
+				case path == "orgs/JMR-dev/teams/release":
+					fmt.Print(`{"id":98765}`)
+				default:
+					fmt.Fprintf(os.Stderr, "unknown path: %s\n", path)
+					os.Exit(2)
+				}
+			}
+		default:
+			fmt.Fprintf(os.Stderr, "unknown gh command: %s\n", subCmd)
+			os.Exit(2)
+		}
+	case "git":
+		if os.Getenv("MOCK_GIT_ENABLED") != "1" {
+			fmt.Fprintf(os.Stderr, "git not mocked in this test\n")
+			os.Exit(2)
+		}
+		subCmd := args[1]
+		switch subCmd {
+		case "rev-parse":
+			// success — we're in a mock git repo
+		case "remote":
+			if len(args) >= 3 && args[2] == "get-url" {
+				// Simulate "no origin" by default; set MOCK_GIT_ORIGIN_EXISTS=1 to override.
+				if os.Getenv("MOCK_GIT_ORIGIN_EXISTS") != "1" {
+					os.Exit(1)
+				}
+			}
+			// add / set-url: exit 0 (success)
+		case "push":
+			// success
+		default:
+			fmt.Fprintf(os.Stderr, "unknown git subcommand: %s\n", subCmd)
+			os.Exit(2)
 		}
 	default:
-		fmt.Fprintf(os.Stderr, "unknown command: %s\n", subCmd)
+		fmt.Fprintf(os.Stderr, "unknown command: %s\n", command)
 		os.Exit(2)
 	}
 }
@@ -81,6 +105,24 @@ func mockExec(command string, args ...string) *exec.Cmd {
 	return cmd
 }
 
+// mockExecWithGit is like mockExec but also enables the git mock.
+func mockExecWithGit(command string, args ...string) *exec.Cmd {
+	cs := []string{"-test.run=TestHelperProcess", "--", command}
+	cs = append(cs, args...)
+	cmd := exec.Command(os.Args[0], cs...)
+	cmd.Env = append(os.Environ(), "GO_WANT_HELPER_PROCESS=1", "MOCK_GIT_ENABLED=1")
+	return cmd
+}
+
+// makeRecordingExec wraps a delegate exec function and records every call.
+func makeRecordingExec(delegate func(string, ...string) *exec.Cmd) (func(string, ...string) *exec.Cmd, *[][]string) {
+	calls := &[][]string{}
+	return func(name string, args ...string) *exec.Cmd {
+		*calls = append(*calls, append([]string{name}, args...))
+		return delegate(name, args...)
+	}, calls
+}
+
 // mockStack implements stackInterface.
 type mockStack struct {
 	setConfigCalls map[string]string
@@ -117,6 +159,63 @@ func (m *mockStack) Destroy(ctx context.Context, opts ...optdestroy.Option) (aut
 	return auto.DestroyResult{}, nil
 }
 
+// TestRun_RelativeStateDir verifies that a relative state_dir (e.g. "./state"
+// from a TOML config) does not cause a "state/state" double-path in the
+// file:// backend URL. Before the fix, upsertStack was called with a relative
+// file:// URL that Pulumi resolved against its WorkDir, producing the wrong path.
+func TestRun_RelativeStateDir(t *testing.T) {
+	oldExec := execCommand
+	oldGithubExec := githubapi.ExecCommand
+	oldUpsert := upsertStack
+	execCommand = mockExec
+	githubapi.ExecCommand = mockExec
+	defer func() {
+		execCommand = oldExec
+		githubapi.ExecCommand = oldGithubExec
+		upsertStack = oldUpsert
+	}()
+
+	// Capture the PULUMI_BACKEND_URL env var passed to upsertStack.
+	var capturedBackendURL string
+	mStack := &mockStack{setConfigCalls: make(map[string]string)}
+	upsertStack = func(ctx context.Context, stackName, projectName string, program pulumi.RunFunc, opts ...auto.LocalWorkspaceOption) (stackInterface, error) {
+		// Apply options to a scratch workspace to extract env vars.
+		ws, err := auto.NewLocalWorkspace(ctx, opts...)
+		if err == nil {
+			env := ws.GetEnvVars()
+			capturedBackendURL = env["PULUMI_BACKEND_URL"]
+		}
+		return mStack, nil
+	}
+
+	parent := t.TempDir()
+	oldWd, _ := os.Getwd()
+	_ = os.Chdir(parent)
+	defer os.Chdir(oldWd)
+
+	opts := &cli.Options{
+		Owner:        "JMR-dev",
+		Repo:         "test-repo",
+		Branch:       "main",
+		Action:       cli.ActionApply,
+		StateDir:     "./state",
+		Environments: []*cli.EnvSpec{{Name: "production"}},
+	}
+
+	oldToken := os.Getenv("GITHUB_TOKEN")
+	os.Setenv("GITHUB_TOKEN", "test-token")
+	defer os.Setenv("GITHUB_TOKEN", oldToken)
+
+	if err := Run(context.Background(), opts); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	want := "file://" + filepath.Join(parent, "state")
+	if capturedBackendURL != want {
+		t.Errorf("PULUMI_BACKEND_URL = %q, want %q", capturedBackendURL, want)
+	}
+}
+
 func TestRun_Apply(t *testing.T) {
 	oldExec := execCommand
 	oldGithubExec := githubapi.ExecCommand
@@ -392,3 +491,114 @@ func TestRun_CreateModeInteractive(t *testing.T) {
 		t.Errorf("expected Description to be 'my repo description', got: %v", opts.RepoSettings.Description)
 	}
 }
+
+func TestRun_CreateMode_SetsRemoteAndPushes(t *testing.T) {
+	oldExec := execCommand
+	oldGithubExec := githubapi.ExecCommand
+	oldUpsert := upsertStack
+	defer func() {
+		execCommand = oldExec
+		githubapi.ExecCommand = oldGithubExec
+		upsertStack = oldUpsert
+	}()
+
+	githubapi.ExecCommand = mockExec
+
+	recorder, calls := makeRecordingExec(mockExecWithGit)
+	execCommand = recorder
+
+	mStack := &mockStack{setConfigCalls: make(map[string]string)}
+	upsertStack = func(ctx context.Context, stackName, projectName string, program pulumi.RunFunc, opts ...auto.LocalWorkspaceOption) (stackInterface, error) {
+		return mStack, nil
+	}
+
+	stateDir := t.TempDir()
+	oldToken := os.Getenv("GITHUB_TOKEN")
+	os.Setenv("GITHUB_TOKEN", "test-token")
+	defer os.Setenv("GITHUB_TOKEN", oldToken)
+
+	desc := "test repo"
+	opts := &cli.Options{
+		Owner:    "JMR-dev",
+		Repo:     "new-repo",
+		Branch:   "main",
+		Action:   cli.ActionApply,
+		RepoMode: cli.RepoModeCreate,
+		StateDir: stateDir,
+		RepoSettings: cli.RepoSettings{
+			Visibility:  "private",
+			Description: &desc,
+		},
+	}
+
+	if err := Run(context.Background(), opts); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	// Verify the expected git command sequence was issued.
+	wantRemoteURL := "https://github.com/JMR-dev/new-repo.git"
+	checkCmd := func(want []string) {
+		t.Helper()
+		for _, c := range *calls {
+			if len(c) == len(want) {
+				match := true
+				for i := range want {
+					if c[i] != want[i] {
+						match = false
+						break
+					}
+				}
+				if match {
+					return
+				}
+			}
+		}
+		t.Errorf("expected command %v not found in recorded calls: %v", want, *calls)
+	}
+
+	checkCmd([]string{"git", "rev-parse", "--is-inside-work-tree"})
+	checkCmd([]string{"git", "remote", "get-url", "origin"})
+	checkCmd([]string{"git", "remote", "add", "origin", wantRemoteURL})
+	checkCmd([]string{"git", "push", "-u", "origin", "HEAD"})
+}
+
+func TestRun_NonCreateMode_NoRemoteSetup(t *testing.T) {
+	oldExec := execCommand
+	oldUpsert := upsertStack
+	defer func() {
+		execCommand = oldExec
+		upsertStack = oldUpsert
+	}()
+
+	recorder, calls := makeRecordingExec(mockExec)
+	execCommand = recorder
+
+	mStack := &mockStack{setConfigCalls: make(map[string]string)}
+	upsertStack = func(ctx context.Context, stackName, projectName string, program pulumi.RunFunc, opts ...auto.LocalWorkspaceOption) (stackInterface, error) {
+		return mStack, nil
+	}
+
+	stateDir := t.TempDir()
+	oldToken := os.Getenv("GITHUB_TOKEN")
+	os.Setenv("GITHUB_TOKEN", "test-token")
+	defer os.Setenv("GITHUB_TOKEN", oldToken)
+
+	opts := &cli.Options{
+		Owner:    "JMR-dev",
+		Repo:     "existing-repo",
+		Branch:   "main",
+		Action:   cli.ActionApply,
+		RepoMode: cli.RepoModeData,
+		StateDir: stateDir,
+	}
+
+	if err := Run(context.Background(), opts); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	for _, c := range *calls {
+		if len(c) > 0 && c[0] == "git" {
+			t.Errorf("expected no git commands for non-create mode, got: %v", c)
+		}
+	}
+}