Merge pull request #4489 from pulumi/jaxxstorm/ordered_secrets

Order secret outputs in stack references

CHANGELOG.md

@@ -3,6 +3,9 @@ CHANGELOG
 
 ## HEAD (unreleased)
 
+- Order secretOutputNames when used in stack references
+  [#4489](https://github.com/pulumi/pulumi/pull/4489)
+
 - Add support for a `PULUMI_CONSOLE_DOMAIN` environment variable to override the
   behavior for how URLs to the Pulumi Console are generated.
   [#4410](https://github.com/pulumi/pulumi/pull/4410)

pkg/resource/deploy/builtins.go

@@ -3,6 +3,7 @@ package deploy
 import (
 	"context"
 	"fmt"
+	"sort"
 
 	"github.com/pkg/errors"
 	uuid "github.com/satori/go.uuid"
@@ -209,6 +210,11 @@ func (p *builtinProvider) readStackReference(inputs resource.PropertyMap) (resou
 		}
 	}
 
+	// Sort the secret outputs so the order is deterministic, to avoid spurious diffs during updates.
+	sort.Slice(secretOutputs, func(i, j int) bool {
+		return secretOutputs[i].String() < secretOutputs[j].String()
+	})
+
 	return resource.PropertyMap{
 		"name":              name,
 		"outputs":           resource.NewObjectProperty(outputs),