I’m seeing some odd behavior of values being declared a secret even though they shouldn’t be, specifically with stack reference values. For example, in one stack I have:

bucket, err := s3.NewBucket(ctx, fmt.Sprintf("my-bucket-%s", region), nil)
		if err != nil {
			return err
		}

		ctx.Export("bucket", bucket.ID())

And then in another stack:

infraStack, err := pulumi.NewStackReference(ctx, "...", nil)
infraBucket := infraStack.GetStringOutput(pulumi.String("bucket"))
auditLogLocation := pulumi.Sprintf("<s3://%s/audit-logs>", infraBucket)

auditLogLocation

is now a secret (i.e. if I export it, it shows up as a secret), and I have to explicitly do

pulumi.Unsecret(…).(pulumi.StringOutput)

on it. This happens for any value that comes from the other stack. This is with Pulumi 3.3.0.

That is strange. Mind opening an issue at github.com/pulumi/pulumi ?

@gentle-diamond-70147 of course - here you go: https://github.com/pulumi/pulumi/issues/7157