my understanding is that setting PULUMI_CONFIG_PASSPHRASE env would use that for new stack creation and

upsert: true

option creates the stack if not existing already