{
  "slug": "pulumi-pcl-config-blocks-mark-values-as-secrets-77d22cf5ce2d",
  "title": "Pulumi PCL config blocks mark values as secrets",
  "tools": [
    "pulumi"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-03-04T22:51:28.000Z",
  "announced_at": "2026-03-04T22:51:28.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When a PCL config value should be read as a secret, set `secret = true` in its `config` block; Pulumi v3.225.0 includes program generation support for Go, Node, and Python.",
    "examples": [
      "config \"aNumber\" \"number\" {\n  secret = true\n}"
    ],
    "gotchas": [
      "Version: v3.225.0",
      "secret: Boolean indicating whether the config value should be read as a secret; set to `true`.",
      "Prerequisite: The conformance test supplies the config value `aNumber` as a secure value.",
      "The supplied note describes program generation support for Go, Node, and Python."
    ]
  },
  "why_it_matters": "Generate Go, Node, or Python Pulumi code from PCL that reads a configuration value as a secret.",
  "sources": [
    "https://github.com/pulumi/pulumi/releases/tag/v3.225.0",
    "https://github.com/pulumi/pulumi/pull/22066",
    "https://raw.githubusercontent.com/pulumi/pulumi/v3.225.0/pkg/testing/pulumi-test-language/tests/testdata/l1-config-secret/main.pp",
    "https://raw.githubusercontent.com/pulumi/pulumi/v3.225.0/pkg/codegen/pcl/config.go",
    "https://raw.githubusercontent.com/pulumi/pulumi/v3.225.0/pkg/testing/pulumi-test-language/tests/l1_config_secret.go"
  ],
  "rank": 0.95028,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-dac08aba15282235-3:gate",
    "evidence_hash": "a9c6b99297f8199a09a0dca513bf58c054a8876b8124414c9edaf71d9e3c91b9"
  },
  "review": {
    "draft_hash": "18efcfe1b1e2e5b4b4a511b160daf69046a109c09a35157cd7fd12dfdb15948b",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.95 >= 0.9; 2 needed) and Jev gave 0.65 (>= 0.6 needed)."
  }
}