This message was deleted.

config is pulled from "Pulumi.<stack>.yaml" files checked in next to Pulumi.yaml.

is it safe to push them to git repo?

Should be, just use "--secret" when setting an sensitive config values so they get encrytped