[object Object] in pulumi config

[AlexXi19]

What happened?

Using pulumi up in github actions, but discovered that the config got serialized incorrectly.

Expected Behavior

Configs are set and serialized correctly.

Steps to reproduce

Put gcp config json (or any json) in github action secrets. pass that secret into the action using the config param.

      - uses: pulumi/actions@v4.4.0
        with:
          command: up
          comment-on-pr: true
          stack-name: ${{ steps.extract_branch.outputs.branch }}
          work-dir: infrastructure_generation/gcp  
          upsert: true
          refresh: true
          config-map: |
            {
              gcsCreds: {value: ${{ secrets.GCLOUD_SERVICE_ACCOUNT_JSON_DEV }}, secret: false},
            }

Use pulumi config refresh locally to see the config, it shows as

gcsCreds: |-
    [object Object]

Output of pulumi about

Found no pending operations associated with alex-pulumi-cleanup

Backend Name pulumi.com URL https://app.pulumi.com/alexxi19 User alexxi19 Organizations alexxi19

Additional context

Seems like a json serialization issue with the input. Saw something in the changelog and tried to use - uses: pulumi/actions@v4.4.0 but that also didn't work.

Contributing

Vote on this issue by adding a 👍 reaction. To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[simenandre]

config-map currently needs to be defined using YAML, as we only support that.

Using you're example, we can rewrite that as such:

- uses: pulumi/actions@v4.4.0
        with:
          command: up
          comment-on-pr: true
          stack-name: ${{ steps.extract_branch.outputs.branch }}
          work-dir: infrastructure_generation/gcp  
          upsert: true
          refresh: true
          config-map: |
             gcsCreds: 
               value: ${{ secrets.GCLOUD_SERVICE_ACCOUNT_JSON_DEV }}
               secret: false

Notice that | is still there, as it is actually a string that is later parsed to YAML.

Off-topic on GCP Credentials: I suggest you pass Google Credentials using application default credentials. Passing GCP credentials can be unsafe and should be avoided (google-github-actions/auth is really nice for this when working with application default and Github Action). Further, you should consider dropping JSON keys in favour of authenticating via Workload Identity Federation.