Automatically update policy pack reference docs

[jkodroff]

We need a GHA workflow to automatically update the reference docs for our pre-built policy packs, e.g. https://www.pulumi.com/docs/reference/pre-built-policy-packs/cis/aws/

Also:

• Add an intro page that explains what the policy packs are, since it's not as obvious given that they are not open source.
• Give each policy a clickable header so the page is scannable
• Do not display in a table since the full description renders so badly (maybe use the same format as REST API references?

[jkodroff]

@claude Didn't we fix this in #20274? It should have a schedule to update.

[pulumi-bot]

Claude finished @jkodroff's task in 1m 17s —— View job

---

Task list

• Gather context (issue + PR Generate pre-built policy pack pages from the Pulumi Cloud API #20274)
• Check whether PR Generate pre-built policy pack pages from the Pulumi Cloud API #20274 addressed this issue
• Check whether a schedule exists to keep the docs updated
• Respond with findings

Findings

Yes — PR #20274 (merged 2026-07-16) covers most of this issue:

• Automatic updates + schedule: .github/workflows/update-policy-packs.yml runs nightly on cron: "30 7 * * *" (07:30 UTC), refetches each pack's policies from the Pulumi Cloud API via scripts/fetch-policy-packs.js, and opens an auto-merging PR (gh pr merge --auto --squash) whenever a pack has changed. It also posts to Slack (#docs-ops) on failure. So the "schedule to update" is already in place.
• No more tables: pages are now generated from data/policy_packs.yaml + data/policy_pack_policies/*.json via content/docs/reference/pre-built-policy-packs/_content.gotmpl, rendering each policy as its own section rather than a giant Markdown table.
• Clickable, scannable headers: layouts/partials/policy-packs/policy-entry.html renders each policy as ### {{ policy.name }} (line 15), i.e. a real heading with an anchor, plus a "Policies by control" index at the top of each page that links down to those anchors (_content.gotmpl lines ~90-96) — similar in spirit to the REST API reference format.

One item from the original issue is still outstanding: the intro page explaining what the pre-built policy packs are (and that they aren't open source). There's no _index.md/landing content for /docs/reference/pre-built-policy-packs/ — the "Pre-built Policy Packs" nav entry (config/_default/menus.yml line 210) is just a menu grouping header with no URL, same as "SDKs" above it.

Let me know if you'd like me to add that intro page now, or if you'd rather track it separately — happy to implement either way.