{"record":{"id":"10ce0d07fe94614c","repo":"hashicorp/nomad","slug":"must-not-be-nil","errorCode":null,"errorMessage":"must not be nil","messagePattern":"must not be nil","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/workload_id.go","lineNumber":453,"sourceCode":"\t}\n\n\tif wi.Name == \"\" {\n\t\twi.Name = WorkloadIdentityDefaultName\n\t}\n\n\t// The default identity is only valid for use with Nomad itself.\n\tif wi.Name == WorkloadIdentityDefaultName {\n\t\twi.Audience = []string{IdentityDefaultAud}\n\t}\n\n\tif wi.ChangeSignal != \"\" {\n\t\twi.ChangeSignal = strings.ToUpper(wi.ChangeSignal)\n\t}\n}\n\nfunc (wi *WorkloadIdentity) Validate() error {\n\tif wi == nil {\n\t\treturn fmt.Errorf(\"must not be nil\")\n\t}\n\n\tvar mErr multierror.Error\n\n\tif !validIdentityName.MatchString(wi.Name) {\n\t\terr := fmt.Errorf(\"invalid name %q. Must match regex %s\", wi.Name, validIdentityName)\n\t\tmErr.Errors = append(mErr.Errors, err)\n\t}\n\n\tfor i, aud := range wi.Audience {\n\t\tif aud == \"\" {\n\t\t\tmErr.Errors = append(mErr.Errors, fmt.Errorf(\"an empty string is an invalid audience (%d)\", i+1))\n\t\t}\n\t}\n\n\tswitch wi.ChangeMode {\n\tcase \"\", WIChangeModeNoop, WIChangeModeRestart:\n\t\t// Treat \"\" as noop. Make sure signal isn't set.","sourceCodeStart":435,"sourceCodeEnd":471,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/workload_id.go#L435-L471","documentation":"WorkloadIdentity.Validate guards against being called on a nil *WorkloadIdentity and returns this plain error if so. Since the method has a pointer receiver and tolerates nil, callers can invoke it on a nil value, and Nomad surfaces this as a validation failure rather than panicking.","triggerScenarios":"Calling wi.Validate() when wi is nil — e.g. a task block without a workload identity resolving to a nil pointer that is still validated, as exercised by TestWorkloadIdentity_Nil.","commonSituations":"Code that iterates over an identity map/slice containing nil entries; job parsing producing no WorkloadIdentity but downstream validation still running; misbuilt structs where the identity pointer was never assigned.","solutions":["Ensure the WorkloadIdentity is constructed and assigned before validation.","Check upstream logic that populates identities so nil pointers are skipped or defaulted.","If nil is expected, guard the call site before invoking Validate."],"exampleFix":"// before\nerr := wi.Validate() // wi may be nil\n// after\nif wi != nil {\n    err = wi.Validate()\n}","handlingStrategy":"type-guard","validationCode":"if wi == nil {\n    return errors.New(\"workload identity not defined\")\n}\nreturn wi.Validate()","typeGuard":"func hasIdentity(wi *structs.WorkloadIdentity) bool {\n    return wi != nil\n}","tryCatchPattern":"if err := wi.Validate(); err != nil && err.Error() == \"must not be nil\" {\n    // skip or construct a default identity\n}","preventionTips":["Nil-check identity pointers before calling Validate.","Ensure task blocks define identities when validation is expected to run.","In loops over identities, skip nil entries."],"tags":["nomad","workload-identity","validation","nil-pointer"],"backgroundTag":"nil-pointer-validation","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}