No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Ok I finally pinned down what's changed.

`pulumi stack select` now needs to have PULUMI_CONFIG_PASSPHRASE configured, it didn't before and our build pipeline didn't read one from the key store until just before pulumi update / preview

so what I was seeing was the first pass with no resources worked fine, but once resources with secrets had been created it failed on all subsequent build runs on the stack select step