{"record":{"id":"0d8948189b94411b","repo":"jdx/mise","slug":"bootstrap-secret-name-has-invalid-environment","errorCode":null,"errorMessage":"bootstrap secret '{name}' has invalid environment variable name '{env}'","messagePattern":"bootstrap secret '(.+?)' has invalid environment variable name '(.+?)'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/secrets.rs","lineNumber":436,"sourceCode":"    Ok(value)\n}\n\nfn declaration_from_toml(name: String, declaration: SecretTomlConfig) -> Result<SecretDeclaration> {\n    if name.is_empty()\n        || !name\n            .chars()\n            .all(|character| character.is_ascii_alphanumeric() || \"_.-\".contains(character))\n    {\n        bail!(\"invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'\");\n    }\n    let (env, description, allow_empty) = match declaration {\n        SecretTomlConfig::Env(env) => (env, None, false),\n        SecretTomlConfig::Options(options) => {\n            (options.env, options.description, options.allow_empty)\n        }\n    };\n    if !valid_env_name(&env) {\n        bail!(\"bootstrap secret '{name}' has invalid environment variable name '{env}'\");\n    }\n    Ok(SecretDeclaration {\n        name,\n        env,\n        description,\n        allow_empty,\n    })\n}\n\nfn valid_env_name(name: &str) -> bool {\n    let mut characters = name.chars();\n    characters\n        .next()\n        .is_some_and(|first| first == '_' || first.is_ascii_alphabetic())\n        && characters.all(|character| character == '_' || character.is_ascii_alphanumeric())\n}\n\nfn env_state(declaration: &SecretDeclaration) -> SecretState {","sourceCodeStart":418,"sourceCodeEnd":454,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/secrets.rs#L418-L454","documentation":"Each bootstrap secret declaration names an environment variable that the resolved value will be written to. mise validates that this is a legal environment variable name; if not, the declaration is rejected so the value never silently fails to export.","triggerScenarios":"declaration_from_toml parses a secret whose `env` option (or inline env form) is empty or contains characters invalid for environment variable names, such as spaces, hyphens, or leading digits.","commonSituations":"Writing env = \"MY-KEY\" (hyphens are invalid in most shells), leaving env empty in the Options form, or confusing the secret name with the env var name and copying a '-'-containing key into env.","solutions":["Change the secret's env field to a valid environment variable name (letters, digits, underscore, not starting with a digit)","Do not leave env empty; if using the options form, always set env explicitly","Rename with underscores where you used hyphens or spaces"],"exampleFix":"# before\n[bootstrap.secrets.api_key]\nenv = \"MY-API-KEY\"\n# after\n[bootstrap.secrets.api_key]\nenv = \"MY_API_KEY\"","handlingStrategy":"validation","validationCode":"fn valid_env_name(s: &str) -> bool {\n    !s.is_empty()\n        && s.chars().next().map(|c| c.is_ascii_alphabetic() || c == '_').unwrap_or(false)\n        && s.chars().all(|c| c.is_ascii_alphanumeric() || c == '_')\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use UPPER_SNAKE_CASE for env var names; never hyphens or spaces","Always set env explicitly in the options form of a secret declaration","Cross-check names against shell restrictions (bash/sh) on target platforms"],"tags":["validation","env-var","secrets","config"],"backgroundTag":"invalid-env-var-value","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}