@stocky-restaurant-98004 thanks, yes, the Workflow is sourced from a GitHub repo. I could store the config (its an Aiven-hosted OpenSearch URL and PORT) in the GCP Secrets Manager.
I agree with you and would've expected direct support.
I will use the Secrets Manager approach for now, thanks again.
(My experience with Pulumi AU has been ok'ish)