What causes "artifact key %q must not contain empty segments" in argoproj/argo-workflows?

Ensure every interpolated value (namespace, uuid, filename) is non-empty before composing the key.

artifact key %q must not contain empty segments

Error message

artifact key %q must not contain empty segments

What it means

None of the 4 segments may be empty. Empty segments typically arise from duplicate slashes or a missing uuid/filename; because canonical form is also enforced, this catches edge cases like keys ending in '/' or composed with empty interpolated values.

Source

Thrown at server/utils/artifactkey.go:40

	if !strings.HasPrefix(key, prefix) {
		return fmt.Errorf("artifact key %q must start with %q", key, prefix)
	}
	if strings.Contains(key, "..") {
		return fmt.Errorf("artifact key %q must not contain '..'", key)
	}
	if strings.HasPrefix(key, "/") {
		return fmt.Errorf("artifact key %q must not be an absolute path", key)
	}
	if path.Clean(key) != key {
		return fmt.Errorf("artifact key %q is not in canonical form", key)
	}

	parts := strings.Split(key, "/")
	if len(parts) != 4 {
		return fmt.Errorf("artifact key %q must have exactly 4 segments: uploads/{namespace}/{uuid}/{filename}", key)
	}
	if slices.Contains(parts, "") {
		return fmt.Errorf("artifact key %q must not contain empty segments", key)
	}

	uuidSegment := parts[2]
	if _, err := uuid.Parse(uuidSegment); err != nil {
		return fmt.Errorf("artifact key %q must have a valid UUID segment: %w", key, err)
	}

	filename := parts[3]
	if path.Base(filename) != filename {
		return fmt.Errorf("artifact key %q must have a bare filename segment", key)
	}

	return nil
}

View on GitHub (pinned to 35bff19146)

Solutions

Ensure every interpolated value (namespace, uuid, filename) is non-empty before composing the key.
Generate a uuid.NewString() for the third segment and validate the filename is non-empty and a bare base name.
Rebuild the key with path.Join so empty segments are impossible.

Example fix

// before
key := fmt.Sprintf("uploads/%s/%s/%s", ns, id, "") // empty filename
// after
filename := "app.log"
if filename == "" || id == "" { return errors.New("missing key components") }
key := fmt.Sprintf("uploads/%s/%s/%s", ns, id, filename)

Defensive patterns

Strategy: validation

Validate before calling

parts := strings.Split(key, "/")
for _, p := range parts {
	if p == "" { return errors.New("key contains empty segments") }
}

Type guard

func noEmptySegments(key string) bool {
	return !slices.Contains(strings.Split(key, "/"), "")
}

Try / catch

if err := utils.ValidateUploadedArtifactKey(ns, key); err != nil {
	if strings.Contains(err.Error(), "empty segments") {
		// regenerate key: some component was empty
		key = path.Join("uploads", ns, uuid.NewString(), defaultFilename)
	}
}

Prevention

Check all interpolated values (namespace, uuid, filename) are non-empty before composing keys.
Use path.Join so empty parts never create empty segments.
Fail fast when required key components (e.g. job UUID) are missing instead of emitting an empty string.

When it happens

Trigger: Keys like 'uploads/ns//file' (empty uuid segment), 'uploads/ns/uuid/' (trailing slash, empty filename), or empty variables interpolated into the key ('' namespace or filename).

Common situations: Unset UUID or filename variables in templates; string building with empty env vars; trailing slash from URL parsing.

Related errors

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/a48747f0e3a7b9b8. Report an issue: GitHub.