{"record":{"id":"3f14a79b145829ef","repo":"pulumi/pulumi","slug":"opening-esc-environments-w","errorCode":null,"errorMessage":"opening ESC environments: %w","messagePattern":"opening ESC environments: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/backend/httpstate/policypack.go","lineNumber":301,"sourceCode":"\tenvs backend.EnvironmentsBackend,\n\torgName string,\n) engine.PolicyEnvironmentResolver {\n\treturn &localPolicyEnvironmentResolver{envs: envs, orgName: orgName}\n}\n\nfunc (r *localPolicyEnvironmentResolver) ResolveEnvironments(\n\tctx context.Context,\n\tenvironments []string,\n) (*engine.ResolvedPolicyEnvironment, error) {\n\tif len(environments) == 0 {\n\t\treturn nil, nil\n\t}\n\n\tyaml := workspace.NewEnvironment(environments).Definition()\n\n\tenv, diags, err := r.envs.OpenYAMLEnvironment(ctx, r.orgName, yaml, 2*time.Hour, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"opening ESC environments: %w\", err)\n\t}\n\tif len(diags) != 0 {\n\t\tvar diagMsgs strings.Builder\n\t\tfor _, d := range diags {\n\t\t\tfmt.Fprintf(&diagMsgs, \"  %s\\n\", d.Summary)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"opening ESC environments:\\n%s\", diagMsgs.String())\n\t}\n\n\tresult := &engine.ResolvedPolicyEnvironment{}\n\n\tif policyConfigVal, ok := env.Properties[\"policyConfig\"]; ok {\n\t\tpolicyConfig, err := escValueToConfigMap(policyConfigVal)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"extracting policyConfig from ESC environment: %w\", err)\n\t\t}\n\t\tresult.Config = policyConfig\n\t}","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/backend/httpstate/policypack.go#L283-L319","documentation":"localPolicyEnvironmentResolver.ResolveEnvironments opens a synthetic ESC environment importing the environments passed to a local policy pack. An error returned from OpenYAMLEnvironment (transport failure, client error) is wrapped here. Unlike 168, this path reports hard errors rather than evaluation diagnostics.","triggerScenarios":"A policy pack run specifies ESC environments and r.envs.OpenYAMLEnvironment returns err — unreachable Pulumi Cloud endpoint, invalid org name, or the environment import fails at the API level.","commonSituations":"Offline or proxied CI that cannot reach Pulumi Cloud; wrong org name configured; token expired mid-session; DNS/network failures.","solutions":["Check connectivity to Pulumi Cloud (`curl -sI https://api.pulumi.com`).","Verify login: `pulumi whoami` and re-run `pulumi login`.","Confirm the org name in the URL/config is correct.","Check proxy env vars (HTTPS_PROXY) and corporate CA configuration."],"exampleFix":"// before (unreachable endpoint)\nexport PULUMI_API=https://pulumi.internal.example.com\n// after\npulumi login https://api.pulumi.com","handlingStrategy":"retry","validationCode":"// preflight connectivity\nif resp, err := http.Get(\"https://api.pulumi.com\"); err != nil {\n    return fmt.Errorf(\"Pulumi Cloud unreachable: %w\", err)\n} else { resp.Body.Close() }","typeGuard":"null","tryCatchPattern":"var resolved *engine.ResolvedPolicyEnvironment\nerr := policy.ResolveEnvironments(ctx)\nif err != nil && strings.Contains(err.Error(), \"opening ESC environments:\") {\n    // transient network errors: retry with backoff\n    time.Sleep(time.Second * 5)\n    resolved, err = retryResolve(ctx, policy, 3)\n}","preventionTips":["Pin PULUMI_API to a reachable endpoint","Configure proxy/CA env vars in CI","Refresh `pulumi login` credentials before long jobs"],"tags":["esc","network","environment-resolution","pulumi-cloud"],"backgroundTag":"esc-environment-open-failed","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}