I am running

pulumi preview

on my laptop and in my new CI/CD pipeline in github. While the commit hash is the exact same, I get a different result from each command. Any idea what might cause this to appear as drift even though the code is the same? See screen shots. Is there something wrong with how I'm configuring things or is this just some weird version mismatch?

You may be able to figure this out by looking at the changing resources. It might be that environment variables are different, or there is code that checks the execution environment, or similar. Your Pulumi project is a normal program, and it can produce different outputs in different circumstances just like other programs.

The changing resource is a k8s service tht is a part of a helm chart. There are two env vars in the helm chart, both pulumi cloud secrets so that shouldn't change. If it did, it wouldn't let the helm chart run at all and the other resources would also delete. Something is different about running this in an automated pipeline vs on my laptop. Any ideas?

Yes, and the difference may be in the code. Are there any conditionals that would cause that bit of code (the one that contains the "-1" resource in the 2nd screenshot) to not be run?

Not that I can see. It's just a straight up

const const blah = new k8s.helm.v3.Chart('blah, {
chart: 'blah',
  fetchOpts: {
    repo: '<http://helm.blah.com>',
  },
  values: {
    targetSystem: 'linux',
    env: ['stage'],
    blah: {
      apm: {
        enabled: true,
        portEnabled: true,
      },
      apiKey: config.requireSecret('blahApiKey'),
      appKey: config.requireSecret('blahAppKey'),
      logs: {
        enabled: true,
        containerCollectAll: true,
      },
      clusterAgent: {
        enabled: true,
        metricsProvider: {
          enabled: true,
        },
      },
    },
  },
})

The chart is being deleted when run from CI, even though the code is unconditionally included? That isn't possible, I think.

The chart isn't, only the k8s service that's a part of the chart. But not the replicaset or daemonset that's a part of the chart.

When you're back, check the code that creates the service. It's not being run, so something must be causing that.