Hi, is it safe to commit the Pulumi.stack.yaml file to git even if it contains secrets?

Yes it is safe, provided you set the secret with the

--secret

flag. It is a good idea to commit your stack config files.

Even to public repositories? Will someone be able to access my secrets when they try to run the Pulumi program? I'm assuming the secret is encrypt with a key unique to my account

That's right. The secret is encrypted using a key material that is specific to your stack. It's not portable to another stack. Even you cannot simply copy/paste your encrypted config value between your own stacks. You have to have the plaintext value in order to re-encrypt for another stack.

Okay, thank you

And yes, committing your stack config to public repos is fine. Again, remember to use

--secret

for secret configs. If you accidentally set your secret as a plain config value and commit it to your VCS you should rotate that secret value and discard the one you accidentally committed in plaintext to your VCS (regardless of the repo visibility.)

Got it, thanks