{"record":{"id":"3ecb9d1fbf015c5c","repo":"oven-sh/bun","slug":"buildkite-token-not-found-set-buildkite-agent-tok","errorCode":null,"errorMessage":"Buildkite token not found: set BUILDKITE_AGENT_TOKEN or grant this machine access to the buildkite agent-token secret","messagePattern":"Buildkite token not found: set BUILDKITE_AGENT_TOKEN or grant this machine access to the buildkite agent-token secret","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"scripts/agent.mjs","lineNumber":302,"sourceCode":"\n  async function start() {\n    const cloud = await getCloud();\n\n    let token = getEnv(\"BUILDKITE_AGENT_TOKEN\", false);\n    if (!token && cloud === \"aws\") {\n      token = await getAwsSecret(BUILDKITE_TOKEN_SECRET);\n    }\n    if (!token && cloud === \"azure\") {\n      token = await getAzureSecret(AZURE_KEYVAULT, AZURE_TOKEN_SECRET);\n    }\n    // Images baked before the secret stores existed only had the tag.\n    if (!token && cloud) {\n      token = await getCloudMetadataTag(\"buildkite:token\");\n    }\n\n    const hasCfg = isMacOS && existsSync(cfgPath);\n    if (!token && !hasCfg) {\n      throw new Error(\n        \"Buildkite token not found: set BUILDKITE_AGENT_TOKEN or grant this machine access to the buildkite agent-token secret\",\n      );\n    }\n\n    let shell;\n    if (isWindows) {\n      // Command Prompt has a faster startup time than PowerShell.\n      // Also, it propogates the exit code of the command, which PowerShell does not.\n      const cmd = which(\"cmd\", { required: true });\n      shell = `\"${cmd}\" /S /C`;\n    } else {\n      const sh = which(\"sh\", { required: true });\n      shell = `${sh} -elc`;\n    }\n\n    const distroVersion = getDistroVersion();\n    const flags = [\"enable-job-log-tmpfile\", \"no-feature-reporting\"];\n    const options = {","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/scripts/agent.mjs#L284-L320","documentation":"Thrown by the CI agent bootstrap script when it cannot find a Buildkite agent token anywhere. The script resolves the token from (in order) the BUILDKITE_AGENT_TOKEN env var, AWS Secrets Manager, Azure KeyVault, a cloud VM metadata tag 'buildkite:token', and finally a macOS buildkite-agent.cfg file. When every source is empty and there is no macOS config file, the agent cannot authenticate to Buildkite, so startup aborts.","triggerScenarios":"Running scripts/agent.mjs on a Linux or Windows CI host where BUILDKITE_AGENT_TOKEN is unset, the machine has no grant for the agent-token secret in AWS Secrets Manager or Azure KeyVault, and (on cloud VMs) the 'buildkite:token' metadata tag was never baked into the image. The cfg-file fallback only applies on macOS (hasCfg = isMacOS && existsSync(cfgPath)).","commonSituations":"A new CI machine or docker image was never granted the buildkite agent-token secret; the secret was renamed or deleted in the secret store; older VM images baked before the secret stores existed only carry the metadata tag; a local dev run without the env var set.","solutions":["Export BUILDKITE_AGENT_TOKEN in the shell or pipeline environment before running the script","Grant the machine/role read access to the Buildkite agent-token secret in AWS Secrets Manager (or the configured Azure KeyVault secret)","For cloud VM images, set the 'buildkite:token' instance metadata tag on the image","On macOS agents, ensure buildkite-agent.cfg exists at the path the script checks (cfgPath)"],"exampleFix":"// before\n$ bun scripts/agent.mjs\nError: Buildkite token not found: set BUILDKITE_AGENT_TOKEN or grant this machine access to the buildkite agent-token secret\n\n// after\n$ export BUILDKITE_AGENT_TOKEN=bkua_xxx\n$ bun scripts/agent.mjs","handlingStrategy":"validation","validationCode":"import { existsSync } from 'node:fs';\nconst cfgPath = process.env.BUILDKITE_AGENT_CFG_PATH ?? '/usr/local/etc/buildkite-agent/buildkite-agent.cfg';\nconst hasToken = Boolean(process.env.BUILDKITE_AGENT_TOKEN);\nconst hasCfg = process.platform === 'darwin' && existsSync(cfgPath);\nif (!hasToken && !hasCfg) {\n  console.error('agent bootstrap will fail: no BUILDKITE_AGENT_TOKEN, secret-store grant, metadata tag, or macOS cfg');\n  process.exit(1);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Wire BUILDKITE_AGENT_TOKEN through the pipeline environment from day one","Bake the 'buildkite:token' metadata tag into cloud VM images so fresh instances self-provision","Document which secret store (AWS vs Azure) each cloud runner type reads"],"tags":["ci","buildkite","secrets","configuration","agent"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}