is there a way to programmatically update the stack config files?

Assuming you mean

Pulumi.<stack>.yaml

etc., you have a few options. From the CLI/scripts,

pulumi config set [--path] [--secret]

will help. In code, Pulumi Automation's

Stack

will let you

setAllConfig

, etc. Inside a stack itself, you can only read config (AFAIK) -- updating in a stack would (I imagine) potentially lead to edge cases where Pulumi can't reach stability on what the desired state should be.

ok thanks.

using pulumi automation api via python we are doing something like:

# Create our stack using a local program in the work_dir
    print("initializing stack...")
    stack = pulumi.automation.create_or_select_stack(
        stack_name=stack_name_fqdn, work_dir=PULUMI_WORK_DIR
    )

    print("setting up stack config...")
    stack.set_config("aws:region", pulumi.automation.ConfigValue(value=region))
    stack.set_config(
        "aws:skipCredentialsValidation", pulumi.automation.ConfigValue(value="true")
    )
    stack.set_config(
        "aws:skipMetadataApiCheck", pulumi.automation.ConfigValue(value="false")
    )
    stack.set_config(
        "aws:assumeRole",
        pulumi.automation.ConfigValue(
            json.dumps(
                {
                    "roleArn": "arn:aws:iam::xxxx:role/iac/gitlab/deployment-job",
                    "sessionName": "gitlab-deployment",
                }
            )
        ),
    )

which creates our stack config files dynamically