{"record":{"id":"20c354ffd1e212f2","repo":"pulumi/pulumi","slug":"parsing-stack-name-w","errorCode":null,"errorMessage":"parsing stack name: %w","messagePattern":"parsing stack name: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/secrets/service/manager.go","lineNumber":223,"sourceCode":"func NewServiceSecretsManagerFromState(ctx context.Context, state json.RawMessage) (secrets.Manager, error) {\n\tvar s serviceSecretsManagerState\n\tif err := json.Unmarshal(state, &s); err != nil {\n\t\treturn nil, fmt.Errorf(\"unmarshalling state: %w\", err)\n\t}\n\n\taccount, err := getServiceSecretsAccount(s.URL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"getting access token: %w\", err)\n\t}\n\ttoken := account.AccessToken\n\n\tif token == \"\" {\n\t\treturn nil, fmt.Errorf(\"could not find access token for %s, have you logged in?\", s.URL)\n\t}\n\n\tstack, err := tokens.ParseStackName(s.Stack)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing stack name: %w\", err)\n\t}\n\n\tid := client.StackIdentifier{\n\t\tOwner:   s.Owner,\n\t\tProject: s.Project,\n\t\tStack:   stack,\n\t}\n\tc := client.NewClient(s.URL, token, s.Insecure, diag.DefaultSink(io.Discard, io.Discard, diag.FormatOptions{\n\t\tColor: colors.Never,\n\t}))\n\n\tcrypter := newServiceCrypter(ctx, c, id)\n\tcachedCrypter := config.NewCiphertextToPlaintextCachedCrypter(crypter, crypter)\n\treturn &serviceSecretsManager{\n\t\tstate:   state,\n\t\tcrypter: cachedCrypter,\n\t}, nil\n}","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/secrets/service/manager.go#L205-L241","documentation":"The stack name stored in the service secrets manager state could not be parsed by tokens.ParseStackName. This error wraps that failure with %w. ParseStackName splits a fully qualified stack reference into project and stack parts and fails on malformed names.","triggerScenarios":"NewServiceSecretsManagerFromState calling tokens.ParseStackName(s.Stack) when s.Stack from the persisted state is empty or not a valid <project>/<stack> (or org/project/stack) reference.","commonSituations":"Hand-edited or corrupted secrets-provider state, state migrated between backends with different naming conventions, legacy state containing a bare stack name without a project.","solutions":["Fix the `stack` field in the secrets provider state to a valid fully qualified name (e.g., \"myproject/dev\")","Restore the stack state from backup if it was corrupted","Check the wrapped error (%w detail) for the exact parsing rule violated","Re-create the stack's secrets provider if the state is unrecoverable: pulumi stack change-secrets-provider"],"exampleFix":"// before (state)\n{\"url\":\"https://app.pulumi.com\",\"stack\":\"dev\", ...}\n// after\n{\"url\":\"https://app.pulumi.com\",\"stack\":\"myproject/dev\", ...}","handlingStrategy":"validation","validationCode":"_, err := tokens.ParseStackName(stateStack)\nif err != nil {\n    return fmt.Errorf(\"state holds invalid stack name %q: %w\", stateStack, err)\n}","typeGuard":"func validQualifiedStackName(s string) bool {\n    _, err := tokens.ParseStackName(s)\n    return err == nil\n}","tryCatchPattern":"mgr, err := secrets.NewServiceSecretsManagerFromState(ctx, state)\nif err != nil && strings.Contains(err.Error(), \"parsing stack name\") {\n    return fmt.Errorf(\"repair the stack field in secrets-provider state: %w\", err)\n}","preventionTips":["Never hand-edit the stack field in secrets-provider state","Always use fully qualified project/stack names when migrating state","Validate state files after copying between backends","Restore from snapshot backups when state corruption is suspected"],"tags":["secrets","naming","state","pulumi-cloud"],"backgroundTag":"invalid-stack-name","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}