{"record":{"id":"55cfd449f8d62aad","repo":"getsops/sops","slug":"error-loading-config-no-matching-creation-rules-f","errorCode":null,"errorMessage":"error loading config: no matching creation rules found","messagePattern":"error loading config: no matching creation rules found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config/config.go","lineNumber":602,"sourceCode":"\tvar rule *creationRule\n\n\tfor _, r := range conf.CreationRules {\n\t\tif r.PathRegex == \"\" {\n\t\t\trule = &r\n\t\t\tbreak\n\t\t}\n\t\treg, err := regexp.Compile(r.PathRegex)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not compile regexp: %w\", err)\n\t\t}\n\t\tif reg.MatchString(filePath) {\n\t\t\trule = &r\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif rule == nil {\n\t\treturn nil, fmt.Errorf(\"error loading config: no matching creation rules found\")\n\t}\n\n\tconfig, err := configFromRule(rule, kmsEncryptionContext)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn config, nil\n}\n\n// LoadCreationRuleForFile load the configuration for a given SOPS file from the config file at confPath. A kmsEncryptionContext\n// should be provided for configurations that do not contain key groups, as there's no way to specify context inside\n// a SOPS config file outside of key groups.\nfunc LoadCreationRuleForFile(confPath string, filePath string, kmsEncryptionContext map[string]*string) (*Config, error) {\n\tconf, err := loadConfigFile(confPath)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":584,"sourceCodeEnd":620,"githubUrl":"https://github.com/getsops/sops/blob/13442bb98183887d7a9ac09ec8ab0564673a59d8/config/config.go#L584-L620","documentation":"After iterating all creation_rules and compiling their path_regexes, sops builds a Config only when a rule matched the file path. If no rule matched (rule == nil), the config cannot be resolved and sops fails with this message. This is the config file's way of saying 'this file is not covered by any creation rule'.","triggerScenarios":"Encrypting a file whose path does not match any creation_rules entry's path_regex, running sops in a directory where the .sops.yaml rules use paths relative to a different root, or the config has an empty creation_rules list.","commonSituations":"Monorepo subdirectory run where .sops.yaml sits at the root and the regex assumes root-relative paths; renaming directories without updating path_regex; missing catch-all rule for new file types.","solutions":["Add or fix a creation rule's path_regex to match the file path you pass to sops (print the exact path with pwd)","Run sops from the directory containing .sops.yaml so relative matching behaves as authored","Add a default catch-all rule at the end of creation_rules (path_regex: '.*' with a key group) for uncovered files","Confirm the file extension type is included, e.g. add '.*\\.(env|yaml|yml|json)'"],"exampleFix":"# before\ncreation_rules:\n  - path_regex: 'secrets/.*\\.yaml$'\n    kms: 'arn:aws:kms:...'\n# after\ncreation_rules:\n  - path_regex: 'secrets/.*\\.yaml$'\n    kms: 'arn:aws:kms:...'\n  - path_regex: '.*'\n    kms: 'arn:aws:kms:...'","handlingStrategy":"validation","validationCode":"var matched bool\nfor _, r := range cfg.CreationRules {\n    if re, err := regexp.Compile(r.PathRegex); err == nil && re.MatchString(filePath) {\n        matched = true\n        break\n    }\n}\nif !matched {\n    return fmt.Errorf(\"no creation rule in %s matches %s\", confPath, filePath)\n}","typeGuard":null,"tryCatchPattern":"cfg, err := createConfigForFile(path, confPath, nil)\nif err != nil && strings.Contains(err.Error(), \"no matching creation rules\") {\n    return fmt.Errorf(\"add a creation rule matching %s in %s\", path, confPath)\n}","preventionTips":["Run sops from the repo root so relative paths in .sops.yaml match","Add a catch-all creation rule as the last entry for new/uncovered file types","Update path_regex entries whenever directories or extensions change","Dry-run the match locally with a small Go snippet or regex101 Golang flavor"],"tags":["config","creation-rules","path-matching","sops"],"backgroundTag":"no-matching-config-rule","analyzedSha":"13442bb98183887d7a9ac09ec8ab0564673a59d8","analyzedAt":"2026-09-01T03:53:00.447Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}