so, after hitting my head against the wall a couple of times: The name is deterministically generated by pulumi (i.e. doesn't need the resource to exist to get a name), it doesn't know to wait to fetch the web app publishing credentials, the trick is to include the

webApp.id

in the output interpolation like

pulumi.all([resourceGroup.name, webApp.name, webApp.id])

even if it's not used, so it's forced to wait