{"record":{"id":"57c11a45df4580cc","repo":"JuliusBrussee/caveman","slug":"cache-replay-gemini-api-key-unavailable","errorCode":null,"errorMessage":"cache-replay: GEMINI_API_KEY unavailable","messagePattern":"cache-replay: GEMINI_API_KEY unavailable","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cacheengine/cmd/cache-replay/main.go","lineNumber":385,"sourceCode":"\nfunc validateProviderCredentials(records []cachebench.TraceRecord) error {\n\tproviders := map[string]bool{}\n\tfor _, record := range records {\n\t\tproviders[record.Provider] = true\n\t}\n\tfor provider := range providers {\n\t\tswitch provider {\n\t\tcase \"openai\":\n\t\t\tif os.Getenv(\"OPENAI_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: OPENAI_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"anthropic\":\n\t\t\tif os.Getenv(\"ANTHROPIC_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: ANTHROPIC_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"gemini\":\n\t\t\tif os.Getenv(\"GEMINI_API_KEY\") == \"\" {\n\t\t\t\treturn errors.New(\"cache-replay: GEMINI_API_KEY unavailable\")\n\t\t\t}\n\t\tcase \"bedrock\":\n\t\t\tif os.Getenv(\"AWS_BEARER_TOKEN_BEDROCK\") == \"\" && (os.Getenv(\"AWS_ACCESS_KEY_ID\") == \"\" || os.Getenv(\"AWS_SECRET_ACCESS_KEY\") == \"\") {\n\t\t\t\treturn errors.New(\"cache-replay: Bedrock bearer token or AWS access credentials unavailable\")\n\t\t\t}\n\t\tdefault:\n\t\t\treturn fmt.Errorf(\"cache-replay: unsupported provider %q\", provider)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc verifierEnvironment(extra []string) ([]string, error) {\n\tallowed := map[string]bool{\"PATH\": true, \"LANG\": true, \"LC_ALL\": true, \"TMPDIR\": true}\n\tblocked := map[string]bool{\n\t\t\"OPENAI_API_KEY\": true, \"ANTHROPIC_API_KEY\": true, \"GEMINI_API_KEY\": true,\n\t\t\"AWS_BEARER_TOKEN_BEDROCK\": true, \"AWS_ACCESS_KEY_ID\": true, \"AWS_SECRET_ACCESS_KEY\": true, \"AWS_SESSION_TOKEN\": true,\n\t}","sourceCodeStart":367,"sourceCodeEnd":403,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/cacheengine/cmd/cache-replay/main.go#L367-L403","documentation":"Returned by validateProviderCredentials when the trace contains gemini requests but GEMINI_API_KEY is empty in the cache-replay process. It is the Gemini branch of the per-provider pre-flight credential check run during -execute validation.","triggerScenarios":"Trace with provider \"gemini\" records and no GEMINI_API_KEY in the tool's environment.","commonSituations":"Google AI key stored as GOOGLE_API_KEY in existing infra and not aliased; new provider added to a workload without updating secret provisioning; CI matrix jobs sharing a config where only some jobs get the Gemini secret.","solutions":["Export GEMINI_API_KEY for the cache-replay process","If your org uses GOOGLE_API_KEY, bridge it: export GEMINI_API_KEY=\"$GOOGLE_API_KEY\"","Remove gemini records from the trace if Gemini replay is out of scope"],"exampleFix":"# before\ncache-replay -execute ...\n\n# after\nexport GEMINI_API_KEY=\"$GOOGLE_AI_STUDIO_KEY\"\ncache-replay -execute ...","handlingStrategy":"validation","validationCode":"if providers[\"gemini\"] && os.Getenv(\"GEMINI_API_KEY\") == \"\" {\n\treturn errors.New(\"set GEMINI_API_KEY before live replay\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Alias existing Google secrets: export GEMINI_API_KEY=\"$GOOGLE_API_KEY\" in run scripts","Keep an env manifest listing every var the tool may check per provider"],"tags":["go","credentials","environment","cli"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}