{"record":{"id":"860c193a7f2334ff","repo":"oven-sh/bun","slug":"azure-secret-not-found-name","errorCode":null,"errorMessage":"Azure secret not found: ${name}","messagePattern":"Azure secret not found: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/azure.mjs","lineNumber":25,"sourceCode":" * @typedef {Object} AzureConfig\n * @property {string} tenantId\n * @property {string} clientId\n * @property {string} clientSecret\n * @property {string} subscriptionId\n * @property {string} resourceGroup\n * @property {string} location\n * @property {string} galleryName\n */\n\n/** @returns {AzureConfig} */\nfunction getConfig() {\n  const env = (name, fallback) => {\n    if (isCI) {\n      try {\n        return getSecret(name, { required: !fallback }) || fallback;\n      } catch {\n        if (fallback) return fallback;\n        throw new Error(`Azure secret not found: ${name}`);\n      }\n    }\n    return process.env[name] || fallback;\n  };\n\n  return {\n    tenantId: env(\"AZURE_TENANT_ID\"),\n    clientId: env(\"AZURE_CLIENT_ID\"),\n    clientSecret: env(\"AZURE_CLIENT_SECRET\"),\n    subscriptionId: env(\"AZURE_SUBSCRIPTION_ID\"),\n    resourceGroup: env(\"AZURE_RESOURCE_GROUP\", \"BUN-CI\"),\n    location: env(\"AZURE_LOCATION\", \"eastus2\"),\n    galleryName: env(\"AZURE_GALLERY_NAME\", \"bunCIGallery2\"),\n  };\n}\n\nlet _config;\nfunction config() {","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/scripts/azure.mjs#L7-L43","documentation":"getConfig()'s env() helper on CI resolves config from the secret store: getSecret(name, { required: !fallback }). For required keys (AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID — the ones without fallbacks) a missing/unreadable secret is caught and re-thrown with this message. Off CI it reads process.env and never throws this.","triggerScenarios":"Running an azure.mjs command with isCI true while the AZURE_* secret is absent from the store or the runtime identity lacks read permission on it; keys with fallbacks (resourceGroup, location) never trigger this.","commonSituations":"New CI environment never seeded with the Azure secrets; secret renamed; managed identity / workload identity missing the KeyVault GET secret permission.","solutions":["Add the named AZURE_* secret to the CI secret store with the exact expected name","Grant the CI identity read (get) permission on that secret","Run with a fallback value where the key supports one (e.g. AZURE_LOCATION has 'eastus2')","For local runs, ensure isCI is false so plain env vars are used"],"exampleFix":"// before\nconst tenantId = env('AZURE_TENANT_ID'); // throws if secret missing on CI\n\n// after\n// provide the secret, or supply a fallback when a default is acceptable\nconst location = env('AZURE_LOCATION', 'eastus2');","handlingStrategy":"validation","validationCode":"const required = ['AZURE_TENANT_ID', 'AZURE_CLIENT_ID', 'AZURE_CLIENT_SECRET', 'AZURE_SUBSCRIPTION_ID'];\nconst missing = required.filter(k => !process.env[k]);\nif (missing.length) {\n  console.error('azure config incomplete, missing:', missing.join(', '));\n  process.exit(1);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Seed all required AZURE_* secrets before enabling the azure.mjs jobs on a new CI environment","Grant the CI identity get on each secret in the store","Prefer explicit env values locally so isCI fallbacks never mask gaps"],"tags":["azure","secrets","configuration","ci"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}