Anyone have a good strategy for updating Cloudflare Worker secrets automatically when a Pulumi ESC environment changes?

Env web hook that triggers a gha would be my first thought

Only thing I haven't figured out with a deployment is we use Cloudflare Builds, I don't think i can instantiate the worker in Pulumi without providing a script (the workers JS)

@hallowed-baker-22997 any ideas here?

hmmm, I think you could potentially have the ESC update webhook trigger a job that basically runs

wrangler secret put

(something like this), to update the secret independent of the deployments you do via CF Builds