is there any good way to debug why one CI server reports different results from

pulumi preview --refresh

than another CI server?

Check to see what backend they're each logged into, and what credentials each is using.

Turned out they used different versions of plugins