pass through additional secret outputs from the provider schema

CHANGELOG_PENDING.md

@@ -1,3 +1,5 @@
 ### Improvements
 
 ### Bug Fixes
+
+- Fields marked as secret in the provider schema are now correctly handled as secrets. [#526](https://github.com/pulumi/pulumi-yaml/pull/526)

pkg/pulumiyaml/run.go

@@ -1075,9 +1075,6 @@ func (e *programEvaluator) registerResource(kvp resourceNode) (lateboundResource
 		return p, isPoison
 	}
 
-	if v.Options.AdditionalSecretOutputs != nil {
-		opts = append(opts, pulumi.AdditionalSecretOutputs(listStrings(v.Options.AdditionalSecretOutputs)))
-	}
 	if v.Options.Aliases != nil {
 		var aliases []pulumi.Alias
 		for _, s := range v.Options.Aliases.Elements {
@@ -1236,6 +1233,14 @@ func (e *programEvaluator) registerResource(kvp resourceNode) (lateboundResource
 		state = &r
 		res = &r
 	}
+	if v.Options.AdditionalSecretOutputs != nil {
+		opts = append(opts, pulumi.AdditionalSecretOutputs(listStrings(v.Options.AdditionalSecretOutputs)))
+	}
+	for _, prop := range resourceSchema.Properties {
+		if prop.Secret {
+			opts = append(opts, pulumi.AdditionalSecretOutputs([]string{prop.Name}))
+		}
+	}
 
 	if !overallOk || e.sdiags.HasErrors() {
 		return nil, false

pkg/pulumiyaml/run_test.go

@@ -175,6 +175,16 @@ func newMockPackageMap() PackageLoader {
 							Name: "foo",
 							Type: schema.StringType,
 						})
+					case "test:resource:with-secret":
+						return inputProperties(typeName, schema.Property{
+							Name: "foo",
+							Type: schema.StringType,
+						}, schema.Property{
+							Name:   "bar",
+							Type:   schema.StringType,
+							Secret: true,
+						})
+
 					default:
 						return inputProperties(typeName)
 					}
@@ -1864,6 +1874,36 @@ resources:
 	})
 }
 
+func TestResourceWithSecret(t *testing.T) {
+	t.Parallel()
+
+	text := `
+name: test-secret
+runtime: yaml
+resources:
+  sec:
+    type: test:resource:with-secret
+    properties:
+      foo: baz
+      bar: frotz
+`
+	tmpl := yamlTemplate(t, strings.TrimSpace(text))
+	mocks := &testMonitor{
+		NewResourceF: func(args pulumi.MockResourceArgs) (string, resource.PropertyMap, error) {
+			assert.Equal(t, "bar", args.RegisterRPC.GetAdditionalSecretOutputs()[0])
+			return args.Name, args.Inputs, nil
+		},
+	}
+	err := pulumi.RunErr(func(ctx *pulumi.Context) error {
+		runner := newRunner(tmpl, newMockPackageMap())
+		err := runner.Evaluate(ctx)
+		assert.Len(t, err, 0)
+		assert.Equal(t, err.Error(), "no diagnostics")
+		return nil
+	}, pulumi.WithMocks("project", "stack", mocks))
+	assert.NoError(t, err)
+}
+
 func TestGetConfNodesFromMap(t *testing.T) {
 	t.Parallel()
 	tests := []struct {