{"record":{"id":"371c54a3901b8111","repo":"larksuite/cli","slug":"environment-variable-q-is-missing-or-empty","errorCode":null,"errorMessage":"environment variable %q is missing or empty","messagePattern":"environment variable %q is missing or empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/secret_resolve.go","lineNumber":101,"sourceCode":"// resolveEnvRef handles {source:\"env\"} SecretRef.\nfunc resolveEnvRef(ref *SecretRef, pc *ProviderConfig, getenv func(string) string) (string, error) {\n\t// Check allowlist if configured\n\tif len(pc.Allowlist) > 0 {\n\t\tallowed := false\n\t\tfor _, name := range pc.Allowlist {\n\t\t\tif name == ref.ID {\n\t\t\t\tallowed = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif !allowed {\n\t\t\treturn \"\", fmt.Errorf(\"environment variable %q is not allowlisted in provider\", ref.ID)\n\t\t}\n\t}\n\n\tvalue := getenv(ref.ID)\n\tif value == \"\" {\n\t\treturn \"\", fmt.Errorf(\"environment variable %q is missing or empty\", ref.ID)\n\t}\n\treturn value, nil\n}\n","sourceCodeStart":83,"sourceCodeEnd":105,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/secret_resolve.go#L83-L105","documentation":"resolveEnvRef reads the allowlisted environment variable via getenv and throws this error when the value is empty or unset. The library requires a non-empty value because an empty secret is almost always a misconfiguration rather than a legitimate secret. This is thrown after the allowlist check passed.","triggerScenarios":"resolveSecretRef is called with a SecretRef whose ID is allowlisted, but os.LookupEnv/getenv returns \"\" — the variable is not exported in the process environment, is exported as an empty string, or the process was started without it (e.g. missing --env-file).","commonSituations":"Running locally without the .env file the deploy environment uses; CI job missing a secret definition; variable exported in a shell that didn't propagate to the child process; docker/systemd unit not passing the var through; var set to empty string by a previous script step.","solutions":["Export the environment variable with a non-empty value before running the process (export DB_PASSWORD=...)","Check for typos in the variable name and confirm with `env | grep NAME` in the same context the process runs","If using an env file, ensure it is actually loaded (e.g. --env-file, dotenv import) and contains the key","If empty is legitimately valid, store the value in a non-env secret source instead of relying on an empty env var"],"exampleFix":"// before (shell)\n./app  # DB_PASSWORD unset\n\n// after (shell)\nexport DB_PASSWORD=\"s3cr3t\"\n./app","handlingStrategy":"validation","validationCode":"// check before calling the library\nif v := os.Getenv(\"DB_PASSWORD\"); v == \"\" {\n    return fmt.Errorf(\"DB_PASSWORD must be exported and non-empty before startup\")\n}","typeGuard":null,"tryCatchPattern":"val, err := resolveSecretRef(ctx, ref)\nif err != nil {\n    if strings.Contains(err.Error(), \"missing or empty\") {\n        return fmt.Errorf(\"startup aborted: export %s in your environment or env-file\", ref.ID)\n    }\n    return err\n}","preventionTips":["Load your env file explicitly (.env, --env-file) and verify with `env | grep` in the same shell/user context the process runs in","Declare required env vars in a startup checklist or fail-fast config validation","In CI, define the secret in the job's secret store and map it to the exact variable name"],"tags":["secrets","env","configuration"],"backgroundTag":"missing-env-var","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}