How do you set stack config values when creating a deployment? Adding

pulumi config

cli calls in the pre-run commands?

Yup, that is the only way at the moment. We’ll likely add first class support at some point. You can also use env vars to control behavior.

Seems fine. Biggest gap I can see is encoding secret values in plaintext logs.

There is secrets redaction in the logs, but we do need to know that a value is secret in order for that to work. You could set an env var in deployment settings and mark it as secret, and then reference that env var in the pre run commands and there should be no plaintext secrets in any logs.