Add blog categories taxonomy and consolidate tags

.claude/commands/new-blog-post.md

@@ -41,7 +41,19 @@ When this command is invoked, you should:
 - **Title**: The blog post title (will be Title Case in frontmatter). If the user doesn't have a title yet, ask for a working title or topic to generate a slug and suggested meta description/tags. Be clear that the user can update the title later before publishing.
 - **Author ID**: The author's ID (e.g., "jane-doe"). Prepopulate with the suggested author ID from git config if detected.
 - **Summary**: Suggest a concise, one-sentence meta description based on the post title (50-160 characters, optimized for SEO and social media)
-- **Tags**: Suggest 1-3 relevant tags based on the post title and similar existing blog posts. Common tags include: features, product-launches, pulumi-cloud, aws, azure, kubernetes, tutorials, announcements
+- **Tags**: Suggest 1-3 relevant tags based on the post title and similar existing blog posts. Tags are the topical axis (clouds, languages, products, scenarios). **Reuse existing tags from `data/blog_tags.yaml`** and avoid minting near-duplicates (e.g. use `kubernetes` not `k8s`, `infrastructure-as-code` not `iac`, `pulumi-cloud` not `pulumi-service`, `dotnet` not `c#`/`.net`). Common tags: features, releases, pulumi-cloud, aws, azure, kubernetes, ai, platform-engineering, security.
+- **Category**: Exactly one category is **required** (a second is allowed only in rare cross-kind cases). Categories are a CLOSED, lint-enforced set defined in `data/blog_categories.yaml`. Ask using AskUserQuestion, seeding the options from the allowed list with a smart default inferred from the title/tags:
+  - Question: "What kind of post is this?"
+  - Header: "Category"
+  - Options (label / description):
+    1. `agentic-infrastructure` / AI agents, Neo, Copilot, AI + IaC, MLOps
+    2. `product-launches` / Releases, new features, announcements, recaps
+    3. `engineering` / How we built it, deep dives, performance, internals
+    4. `tutorials` / Step-by-step how-tos and getting-started guides
+    5. `best-practices` / Architecture, IaC, and platform-engineering patterns
+    6. `security-governance` / Secrets/ESC, policy-as-code, compliance, IAM
+    7. `community` / Customers, case studies, guest posts, events, culture
+  - Do NOT invent categories or accept values outside this list.
 - **Date**: Publication date. Ask using AskUserQuestion with these options:
   - Question: "When should this blog post be published?"
   - Header: "Publish Date"
@@ -126,6 +138,10 @@ authors:
 tags:
     - tag1
     - tag2
+# Exactly one category from the closed set in data/blog_categories.yaml (a
+# second only in rare cross-kind cases). Enforced by `make lint`.
+categories:
+    - category-id
 schema_type: auto
 
 # Social media copy — auto-posted to X, LinkedIn, and Bluesky when merged to master.
@@ -159,6 +175,7 @@ Before finishing:
 - Verify index.md has valid YAML frontmatter
 - Verify the user is not committing to `master` directly (if so, warn them)
 - Check that all required fields are present (especially meta_desc, authors, tags)
+- Verify `categories` is present, contains exactly one value (two only in rare cross-kind cases), and that every value is a valid id from `data/blog_categories.yaml` — `make lint` will fail otherwise
 - If information was auto-populated, remind user to double-check author profile accuracy
 
 ### 5. Provide Next Steps

AGENTS.md

@@ -97,6 +97,17 @@ The reference pages under `content/docs/iac/concepts/resources/options/` show a
 
 ---
 
+## Blog categories and tags
+
+Blog posts carry two taxonomy axes (plus optional `series`):
+
+- **`categories`** — the *kind* of post. This is a **closed, lint-enforced** set defined in `data/blog_categories.yaml` (the single source of truth read by `scripts/lint/lint-markdown.js`). Every `content/blog/*/index.md` must declare **exactly one** category (a second only in rare cross-kind cases); `make lint` fails on a missing, empty, invalid, or >2 value. **Do not invent categories** — pick an id from the data file. To add/rename one, edit `data/blog_categories.yaml` in a PR and raise it in #blogs.
+- **`tags`** — the *topical* axis (clouds, languages, products, scenarios). Curated-but-open, **not** build-enforced. Reuse a tag from the canonical vocabulary in `data/blog_tags.yaml` and **avoid near-duplicates** (`kubernetes` not `k8s`, `infrastructure-as-code` not `iac`, `pulumi-cloud` not `pulumi-service`, `dotnet` not `c#`/`.net`). Tags are lowercase and hyphen-delimited.
+
+See `BLOGGING.md` for the author-facing version of these rules.
+
+---
+
 ## Dark mode (/docs)
 
 The `/docs` section supports a light/dark/system theme toggle. Dark is **light-first**: light is the baseline (unchanged from before) and dark is a pure override. The whole system lives in `theme/src/scss/docs/_docs-theme.scss` (read its header comment first) and is driven by semantic `--docs-*` tokens defined on `body.section-docs` and re-pointed under `html[data-theme="dark"]`. It is scoped entirely to docs pages; nothing here can affect a non-docs page.

BLOGGING.md

@@ -67,15 +67,42 @@ linktitle: This is the link text
 ---
 ```
 
+**Categories**
+
+Every post must declare **exactly one** `categories` value (a second is allowed only in the rare case where a post genuinely spans two kinds). Categories are the *kind of post* axis — distinct from topical tags and from reading-path series — and they are a **closed, lint-enforced set**. `make lint` fails any blog post whose `categories` is missing, empty, lists more than two values, or contains a value outside the allowed set.
+
+The allowed categories are the single source of truth in [`data/blog_categories.yaml`](./data/blog_categories.yaml):
+
+| id | use when |
+|---|---|
+| `agentic-infrastructure` | AI agents, Neo, Copilot, AI + IaC, MLOps |
+| `product-launches` | Releases, new features, announcements, launch recaps |
+| `engineering` | How we built it, deep technical dives, performance, internals |
+| `tutorials` | Step-by-step how-tos and getting-started guides |
+| `best-practices` | Architecture, IaC, and platform-engineering patterns and guidance |
+| `security-governance` | Secrets/ESC, policy-as-code, compliance, IAM |
+| `community` | Customers, case studies, guest posts, events, culture, year-in-review |
+
+Do **not** invent categories or add ad-hoc values to a post. To propose a new category (or rename/retire one), edit `data/blog_categories.yaml` in a PR and raise it in [#blogs](https://pulumi.slack.com/archives/CCBFCGU94) first. Topical buckets (clouds, languages, products) are *tags*, not categories — keep this axis tight.
+
 **Tags**
 
-Every tag added makes the overall tagging system harder to quickly grok and use. So, we strongly prefer using existing tags wherever possible. The tag system is as follows:
+Tags are the *topical* axis (subjects: clouds, languages, products, scenarios). Every tag added makes the overall tagging system harder to quickly grok, so we strongly prefer reusing an existing tag. The canonical, deduplicated vocabulary lives in [`data/blog_tags.yaml`](./data/blog_tags.yaml) — **pick a tag from there and avoid near-duplicates** (use `kubernetes`, not `k8s`; `infrastructure-as-code`, not `iac`; `pulumi-cloud`, not `pulumi-service`; `announcements`, not `pulumi-news`; `dotnet`, not `c#`/`.net`; `google-cloud`, not `gcp`). Tags are lowercase and hyphen-delimited. Unlike categories, the tag list is curated-but-open: only mint a new tag when nothing in the vocabulary fits, and only add a cloud-provider or feature tag if we expect multiple posts about it.
+
+The vocabulary is grouped roughly as:
+
+- **Pulumi:** `pulumi-cloud`, `pulumi-enterprise`, `pulumi-neo`, `copilot`, `esc`, `insights`, `automation-api`, `crossguard`, `announcements` (company news), `pulumi-events`, `pulumi-interns`, `releases`, `features`
+- **Cloud providers** (multiple-posts rule): `aws`, `azure`, `google-cloud`, `digitalocean`
+- **Languages:** `typescript`, `javascript`, `nodejs`, `python`, `go`, `dotnet`, `java`, `yaml`
+- **AI:** `ai`, `ai-agents`, `llm`, `ml`, `mlops`, `claude`, `claude-code`, `mcp`
+- **Kubernetes & containers:** `kubernetes`, `containers`, `docker`, `helm`, `eks`, `aks`, `gke`, `gitops`
+- **Platform engineering:** `platform-engineering`, `internal-developer-platform`, `developer-portals`, `developer-experience`, `cloud-engineering`, `infrastructure-as-code`, `best-practices`
+- **Security & governance:** `security`, `secrets`, `policy-as-code`, `compliance`, `governance`, `iam`, `rbac`, `oidc`
+- **Scenarios:** `serverless`, `continuous-delivery`, `ci-cd`, `github-actions`, `devops`, `migration`, `testing`
+
+**Series**
 
-- **Pulumi tags:** `pulumi-news` for company news (funding, certifications, etc.), `pulumi-events` for events we participate in or host, `pulumi-interns` for intern posts, `pulumi-enterprise` for enterprise-focused blog posts
-- **Cloud provider tags:** Only add a cloud provider tag if we expect to have multiple posts about the provider. Today, that means `aws`, `azure`, `google-cloud`, `digitalocean`
-- **Feature tags:** Only add a feature tag if we expect to have multiple posts about the feature. Today, that means `features` (for feature announcements), `aliases`, `continuous-delivery`, `logging`, `migration`, `native-providers`, `packages`, `policy-as-code`, `secrets`, `testing`.
-- **Technology/scenario tags:** Similar to feature tags, but focused on user scenarios. Today, that means `cloud-engineering`, `cloud-native`, `containers`, `data-and-analytics`, `development-environment`, `github-actions`, `kubernetes`, `serverless`.
-- **Language tags:** Any post that is language/ecosystem specific should have one or more of `.net`, `go`, `javascript`, `python`, `typescript`.
+A *series* is an ordered reading path across multiple posts (the third axis, alongside categories and tags). Series are defined in [`data/blog_series.yml`](./data/blog_series.yml) and surfaced at [`/blog/series/`](https://www.pulumi.com/blog/series/). To add a post to an existing series, set its `series` front-matter value to the series `slug`. To create a new series, add an entry to `data/blog_series.yml` (with `slug`, `title`, `description`, and optionally `prefix`/`meta_image`) and set `series` on each member post. Series are optional — most posts don't belong to one.
 
 **Canonical link**
 

archetypes/blog-post/index.md

@@ -35,9 +35,18 @@ authors:
     - joe-duffy
 
 # At least one tag is required. Lowercase, hyphen-delimited is recommended.
+# Tags are the topical axis (clouds, languages, products). Reuse an existing
+# tag from data/blog_tags.yaml and avoid near-duplicates.
 tags:
     - change-me
 
+# Exactly one category is required (a second is allowed only in rare cross-kind
+# cases). Categories are the "kind of post" axis and are a CLOSED, lint-enforced
+# set: agentic-infrastructure, product-launches, engineering, tutorials,
+# best-practices, security-governance, community. See data/blog_categories.yaml.
+categories:
+    - change-me
+
 # Schema type for structured data (SEO). Options: auto, faq, article, blog, howto, product, event, none
 # Leave as 'auto' (or omit) for intelligent detection based on content type.
 # Specify explicitly to override auto-detection. See SCHEMA.md for details.

content/blog/10-more-things-you-can-do-with-neo/index.md

@@ -13,6 +13,8 @@ tags:
     - pulumi-neo
     - aws
     - neo-things
+categories:
+    - agentic-infrastructure
 social:
     twitter: |
         Last fall we wrote up 10 things you could do with Pulumi Neo. Since then platform teams have handed Neo real work: drift, dependency upgrades, on-call triage from Slack.

content/blog/10-things-you-can-do-with-neo/index.md

@@ -12,6 +12,8 @@ tags:
     - pulumi-neo
     - aws
     - neo-things
+categories:
+    - agentic-infrastructure
 
 social:
     twitter: "10 concrete workflows you can use Pulumi Neo, our new infrastructure agent, for: auto-fix AWS config violations, upgrade Lambda runtimes across accounts, generate infrastructure templates, respond to CVEs. Neo generates PRs, not production changes."

content/blog/2018-year-at-a-glance/index.md

@@ -1,7 +1,8 @@
 ---
 title: "2018 Year at a Glance"
 authors: ["joe-duffy"]
-tags: ["pulumi-news"]
+tags: [announcements]
+categories: [community]
 meta_desc: "As we close out 2018, here are some of the exciting things at Pulumi. We've launched our open source community, with support for many major clouds."
 date: "2018-12-31"
 ---

content/blog/2019-year-at-a-glance/index.md

@@ -1,7 +1,8 @@
 ---
 title: "2019 Year at a Glance"
 authors: ["joe-duffy"]
-tags: ["pulumi-news"]
+tags: [announcements]
+categories: [community]
 meta_desc: "As 2019 winds down, let's review Pulumi's most exciting recent milestones. This includes 1.0, our 2.0 roadmap, and dozens of other major features."
 meta_image: "pulumi-new-year.png"
 date: "2019-12-31"

content/blog/2021-dec-hackathon/index.md

@@ -9,6 +9,8 @@ authors:
 tags:
     - hackathon
     - pulumi-culture
+categories:
+    - community
 ---
 
 Pulumi's [hackathon tradition](/blog/multi-lang-hackathon/) continued in the last weeks of 2021 with our 2021 December hackathon. For one solid week, we had teams from across the company focus on improvements across the Pulumi ecosystem, and we brought in people from outside the engineering org to get perspectives on different needs. While there were some projects that were focused on internal work, there were still quite a few open-source projects that we can talk about publicly. We'll get more details from some of those teams over a few more posts. In this post, however, we're going to explore a bit about how we worked.

content/blog/2021-end-of-year-review/index.md

@@ -7,7 +7,9 @@ meta_image: meta.png
 authors:
     - laura-santamaria
 tags:
-    - pulumi-news
+    - announcements
+categories:
+    - community
 ---
 
 It’s the end of the 2021 calendar year here at Pulumi, and like everyone, we’re counting down until 2022 while looking back at our year. We’ve had a very exciting year! In case you missed anything from our past year, here’s a rundown of the top stories from Pulumi:

content/blog/2022-03-10-hierarchical-config/index.md

@@ -6,7 +6,8 @@ draft: false
 meta_desc: In this article, Rawkode takes a look at how he'd manage project and organizational configuration for Pulumi programs.
 meta_image: meta.png
 authors: ["david-flanagan"]
-tags: ["config"]
+tags: [configuration]
+categories: [best-practices]
 ---
 
 > [!INFO]

content/blog/2022-03-30-introducing-pulumiverse/index.md

@@ -6,6 +6,7 @@ meta_desc: The Pulumiverse is a community organized project to help people contr
 meta_image: meta.png
 authors: ["david-flanagan"]
 tags: ["community"]
+categories: [community]
 ---
 Today, we're excited to announce that we're working with the Pulumi community to provide a place to interact and collaborate on Pulumi-based libraries, projects, and educational materials: the [Pulumiverse](https://github.com/pulumiverse).
 

content/blog/2022-03-31-go-generics-with-pulumi/index.md

@@ -6,6 +6,7 @@ meta_desc: In this article, @rawkode shows you how to take advantage of Go's lat
 meta_image: meta.png
 authors: ["david-flanagan"]
 tags: ["community"]
+categories: [tutorials]
 ---
 
 {{% notes type="warning" %}}

content/blog/2025-product-launches/index.md

@@ -11,6 +11,8 @@ tags:
     - features
     - product-launches
     - pulumi-cloud
+categories:
+    - product-launches
 ---
 
 The era of AI-accelerated development has arrived, creating both unprecedented opportunity and unprecedented challenge. Developers ship code faster than ever, but platform teams struggle to keep pace. The velocity gap threatens to become a bottleneck.

content/blog/7-ways-to-deal-with-application-secrets-in-azure/index.md

@@ -1,7 +1,8 @@
 ---
 title: "7 Ways to Deal with Application Secrets in Azure"
 authors: ["mikhail-shilkov"]
-tags: ["Azure", "Security"]
+tags: [azure, security]
+categories: [security-governance]
 date: "2019-07-26"
 updated: 2025-03-10
 meta_desc: Learn secure ways to manage application secrets in Azure. From Key Vault to environment variables, discover best practices to safeguard sensitive data.

content/blog/accelerate-revenue-growth-time-market-with-platform-engineering/index.md

@@ -8,6 +8,8 @@ authors:
     - marlowe-fenne
 tags:
     - platform-engineering
+categories:
+    - best-practices
 social:
     twitter:
     linkedin:

content/blog/adopting-existing-cloud-resources-into-pulumi/index.md

@@ -5,6 +5,7 @@ meta_desc: "Migrating from Terraform or another IaC tool? Learn how to adopt exi
 meta_image: "meta.png"
 authors: ["luke-hoban"]
 tags: ["migration"]
+categories: [tutorials]
 canonical_url: "https://www.pulumi.com/docs/iac/adopting-pulumi/migrating-to-pulumi/from-terraform/"
 ---
 

content/blog/advanced-aws-networking-part-1/index.md

@@ -32,6 +32,8 @@ tags:
     - hub-and-spoke
     - python
     - aws-networking-advanced
+categories:
+    - tutorials
 series: aws-networking-advanced
 ---
 

content/blog/advanced-aws-networking-part-2/index.md

@@ -38,6 +38,8 @@ tags:
     - hub-and-spoke
     - python
     - aws-networking-advanced
+categories:
+    - tutorials
 series: aws-networking-advanced
 
 # See the blogging docs at https://github.com/pulumi/docs/blob/master/BLOGGING.md.

content/blog/advanced-typescript-type-ftw/index.md

@@ -4,7 +4,8 @@ date: "2018-09-19"
 meta_desc: "TypeScript is great for cloud apps and infrastructure because of its rich type system. In this blog, learn how the type system works for infrastructure as code."
 meta_image: "completion-list.png"
 authors: ["cyrus-najmabadi"]
-tags: ["TypeScript"]
+tags: [typescript]
+categories: [engineering]
 ---
 
 We at Pulumi love TypeScript for cloud apps and infrastructure, because of its rich type system and great ahead-of-time

content/blog/agent-sprawl-iac-platform-is-the-answer/index.md

@@ -14,6 +14,8 @@ tags:
     - platform-engineering
     - devops
     - infrastructure-as-code
+categories:
+    - agentic-infrastructure
 social:
     twitter: |
         Somewhere in your company, a developer just wired an AI agent into production. The platform team doesn't know it exists.

content/blog/ai-assist-improvements/index.md

@@ -35,6 +35,8 @@ tags:
     - features
     - ai
     - data-and-analytics
+categories:
+    - product-launches
 
 # See the blogging docs at https://github.com/pulumi/docs/blob/master/BLOGGING.md
 # for details, and please remove these comments before submitting for review.

content/blog/ai-infrastructure-tools/index.md

@@ -12,7 +12,9 @@ tags:
     - infrastructure-as-code
     - platform-engineering
     - devops
-    - pulumi-news
+    - announcements
+categories:
+    - agentic-infrastructure
 ---
 
 The phrase "AI infrastructure" now means two different things. One is the GPUs, schedulers, and MLOps platforms that exist to run AI workloads. The other is AI that runs infrastructure: agents and assistants that generate, deploy, and govern cloud resources on your behalf. They're different markets with different vendors, and most teams need to think about both.

content/blog/ai-ml-on-kubernetes-google-cloud-llm-rag/index.md

@@ -39,7 +39,8 @@ tags:
     - llm
     - google-cloud
     - gke
-    - k8s
+categories:
+    - agentic-infrastructure
 
 # The social copy used to promote this post on Twitter and Linkedin. These
 # properties do not actually create the post and have no effect on the

content/blog/ai-predictions-2026-devops-guide/index.md

@@ -14,6 +14,8 @@ tags:
     - nova-forge
     - bedrock-agentcore
     - pulumi-neo
+categories:
+    - agentic-infrastructure
 
 social:
     twitter: "AI Predictions for 2026: What DevOps Engineers Need to Know. From IDE evolution to agent orchestration, local AI breakthroughs to machine-to-machine payments. Here's how to prepare for the AI-driven future."

content/blog/ai-slack-bot-adding-data-to-pinecone-using-s3-embedchain-and-pulumi-on-aws/index.md

@@ -11,6 +11,8 @@ tags:
 - chatbot
 - ai
 - ai-slack-bot
+categories:
+- agentic-infrastructure
 series: ai-slack-bot
 meta_desc: "Learn how to add data to Pinecone using S3, Embedchain and Pulumi on AWS for an AI Slack bot."
 date: 2024-04-10T17:00:00+01:00

content/blog/ai-slack-bot-to-chat-using-embedchain-and-pulumi-on-aws/index.md

@@ -10,6 +10,8 @@ tags:
 - chatbot
 - ai
 - ai-slack-bot
+categories:
+- agentic-infrastructure
 series: ai-slack-bot
 meta_desc: "Learn how to build an AI-powered Slack bot with Embedchain & Pulumi on AWS."
 date: 2024-03-18T17:21:02+01:00

content/blog/ai-slackbot-in-real-time-using-s3-sqs-and-pulumi-on-aws-uploading-documents/index.md

@@ -13,6 +13,8 @@ tags:
 - s3
 - ai
 - ai-slack-bot
+categories:
+- agentic-infrastructure
 series: ai-slack-bot
 meta_desc: "Uploading documents to your AI Slackbot in real-time using S3, SQS and Pulumi on AWS"
 date: 2024-06-03T17:21:02+01:00