I find myself having to manually do a

pulumi state delete $urn

when ever I update a secret, Pulumi tells me everything was okay creating a new and deleting the old secret, but every time it only deletes the secret without creating the new one. After removing it from the state it works as expected (until next time I change secrets) https://www.pulumi.com/registry/packages/github/api-docs/actionssecret/

Are you using the plaintextValue property? Try using only the encryptedValue property and see if the behaviour improves.

It actually is not encrypted since I read the secret from an env variable in the repository triggering this change (I have a core repo maintaining every other repo).

I can't think of an explanation for this. You should raise an issue in the pulumi-github repo.

Yeah, I will try to do that (currently sitting on two possible issues), just need to find the time 👍