{"record":{"id":"b2db64b7d2442256","repo":"pulumi/pulumi","slug":"new-passphrase-must-be-provided","errorCode":null,"errorMessage":"new passphrase must be provided","messagePattern":"new passphrase must be provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sdk/go/auto/local_workspace.go","lineNumber":646,"sourceCode":"\t}\n\tfor _, s := range stacks {\n\t\tif s.Current {\n\t\t\treturn &s, nil\n\t\t}\n\t}\n\treturn nil, nil\n}\n\n// ChangeStackSecretsProvider edits the secrets provider for the given stack.\nfunc (l *LocalWorkspace) ChangeStackSecretsProvider(\n\tctx context.Context, stackName, newSecretsProvider string, opts *ChangeSecretsProviderOptions,\n) error {\n\targs := []string{\"stack\", \"change-secrets-provider\", \"--stack\", stackName, newSecretsProvider}\n\n\tvar reader io.Reader\n\tif newSecretsProvider == \"passphrase\" {\n\t\tif opts == nil || opts.NewPassphrase == nil {\n\t\t\treturn errors.New(\"new passphrase must be provided\")\n\t\t}\n\t\treader = strings.NewReader(*opts.NewPassphrase)\n\t}\n\tstdout, stderr, errCode, err := l.runPulumiInputCmdSync(ctx, reader, nil, nil, args...)\n\tif err != nil {\n\t\treturn newAutoError(fmt.Errorf(\"failed to change secrets provider: %w\", err), stdout, stderr, errCode)\n\t}\n\treturn nil\n}\n\n// CreateStack creates and sets a new stack with the stack name, failing if one already exists.\nfunc (l *LocalWorkspace) CreateStack(ctx context.Context, stackName string) error {\n\targs := []string{\"stack\", \"init\", stackName}\n\tif l.secretsProvider != \"\" {\n\t\targs = append(args, \"--secrets-provider\", l.secretsProvider)\n\t}\n\tif l.remote {\n\t\targs = append(args, \"--no-select\")","sourceCodeStart":628,"sourceCodeEnd":664,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/sdk/go/auto/local_workspace.go#L628-L664","documentation":"ChangeStackSecretsProvider requires a NewPassphrase when switching a stack to the 'passphrase' secrets provider. If opts is nil or opts.NewPassphrase is nil, this plain error is returned before any CLI invocation. It is a client-side argument validation error.","triggerScenarios":"Calling LocalWorkspace.ChangeStackSecretsProvider(ctx, stackName, \"passphrase\", nil) or with &ChangeSecretsProviderOptions{} (NewPassphrase left nil).","commonSituations":"Migrating a stack from a cloud/cloudpassphrase provider to a local passphrase provider and forgetting the options struct; copying example code that used a non-passphrase target provider.","solutions":["Pass &auto.ChangeSecretsProviderOptions{NewPassphrase: &passphrase} when newSecretsProvider is \"passphrase\"","Choose a different provider type if no passphrase is intended (e.g. \"cloud\")","Store the passphrase securely (env var/secret manager) and reference it rather than hardcoding"],"exampleFix":"// before\nerr := ws.ChangeStackSecretsProvider(ctx, stackName, \"passphrase\", nil)\n// after\npassphrase := os.Getenv(\"STACK_PASSPHRASE\")\nerr := ws.ChangeStackSecretsProvider(ctx, stackName, \"passphrase\",\n    &auto.ChangeSecretsProviderOptions{NewPassphrase: &passphrase})","handlingStrategy":"validation","validationCode":"if newProvider == \"passphrase\" && (opts == nil || opts.NewPassphrase == nil || *opts.NewPassphrase == \"\") {\n    return errors.New(\"NewPassphrase is required when switching to the passphrase provider\")\n}","typeGuard":"func passphraseOptsProvided(opts *auto.ChangeSecretsProviderOptions) bool {\n    return opts != nil && opts.NewPassphrase != nil && *opts.NewPassphrase != \"\"\n}","tryCatchPattern":"if err := ws.ChangeStackSecretsProvider(ctx, stack, \"passphrase\", opts); err != nil {\n    if err.Error() == \"new passphrase must be provided\" {\n        return fmt.Errorf(\"bug in caller: supply ChangeSecretsProviderOptions.NewPassphrase\")\n    }\n    return err\n}","preventionTips":["Always construct ChangeSecretsProviderOptions when targeting the passphrase provider","Read the passphrase from an env var or secret manager, never hardcode","Branch your migration code on the provider type to require the right options"],"tags":["go","automation-api","secrets","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}