chore: pulumi refresh workflow

.github/workflows/refresh_production_resource.yml

@@ -0,0 +1,47 @@
+name: Refresh pulumi resource
+
+on:
+  workflow_call:
+    inputs:
+      commit:
+        description: "Leave blank to use current HEAD, or provide an override commit SHA"
+        type: string
+        required: false
+    secrets:
+      PULUMI_ACCESS_TOKEN:
+        required: true
+
+jobs:
+  ref:
+    name: Load Commit Ref
+    runs-on: ubuntu-latest
+    steps:
+      - id: ref
+        shell: bash
+        # Default to HEAD of the branch from
+        # which this workflow was triggered
+        run: |
+          echo "refspec=${{ inputs.commit || github.sha }}" >> $GITHUB_OUTPUT
+    outputs:
+      refspec: ${{ steps.ref.outputs.refspec }}
+  refresh_pulumi_resources:
+    name: Refresh Pulumi Resources
+    runs-on: ubuntu-latest
+    permissions: write-all
+    needs: [ref]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          ref: ${{ needs.ref.outputs.refspec }}
+          fetch-depth: 0
+      - name: Prepare to Deploy to AWS
+        uses: ./.github/actions/prepare_deploy_to_aws
+      - name: Refresh Pulumi resources
+        uses: pulumi/actions@v3
+        id: pulumi
+        with:
+          command: refresh
+          stack-name: production
+          upsert: false
+          work-dir: infra/aws