This message was deleted.

Are you using the plaintextValue property? Try using only the encryptedValue property and see if the behaviour improves.

It actually is not encrypted since I read the secret from an env variable in the repository triggering this change (I have a core repo maintaining every other repo).

I can't think of an explanation for this. You should raise an issue in the pulumi-github repo.

Yeah, I will try to do that (currently sitting on two possible issues), just need to find the time 👍