getsops/sops · warning

config file not found

Error message

config file not found

What it means

LookupConfigFile walks up to 100 parent directories from the starting path looking for `.sops.yaml` and returns this error when none exists anywhere in the chain. It is a normal 'no configuration found' result, not a parse failure; note `.sops.yml` is intentionally not accepted and only produces a warning.

Source

Thrown at config/config.go:93

			alternatePath := path.Join(filepath, alternateConfigName)
			_, altErr := fs.Stat(alternatePath)
			if altErr == nil {
				foundAlternatePath = alternatePath
			}
		}

		filepath = path.Join(filepath, "..")
	}

	// No config file found
	result := ConfigFileResult{}
	if foundAlternatePath != "" {
		result.Warning = fmt.Sprintf(
			"ignoring %q when searching for config file; the config file must be called %q",
			foundAlternatePath, configFileName)
	}

	return result, fmt.Errorf("config file not found")
}

// FindConfigFile looks for a sops config file in the current working directory and on parent directories, up to the limit defined by the maxDepth constant.
func FindConfigFile(start string) (string, error) {
	result, err := LookupConfigFile(start)
	return result.Path, err
}

type DotenvStoreConfig struct{}

type INIStoreConfig struct{}

type JSONStoreConfig struct {
	Indent int `yaml:"indent"`
}

type JSONBinaryStoreConfig struct {
	Indent int `yaml:"indent"`

View on GitHub (pinned to 13442bb981)

Solutions

1. Create a `.sops.yaml` at the project root (or cd into the directory containing the existing one)
2. Rename `.sops.yml` to `.sops.yaml` — the .yml extension is explicitly ignored with a warning
3. Verify the file is committed/present in CI (not in .gitignore) and that you run sops from within the repo tree
4. Pass the config explicitly if supported by your workflow, or rely on per-file CLI flags instead of config lookup

Example fix

# before
mv .sops.yml .sops.yaml.bak  # wrong name/location
# after
cd /path/to/repo && test -f .sops.yaml || cat > .sops.yaml <<'EOF'
creation_rules:
  - path_regex: .*secrets.*
    age: age1xxxxxxxx
EOF

// before running sops
test -f .sops.yaml || { echo "no .sops.yaml found from $(pwd) upward"; ls ../.sops.yaml 2>/dev/null; }

path, err := config.FindConfigFile(".")
if err != nil {
	if err.Error() == "config file not found" {
		// proceed with CLI-flag-only encryption or create a default .sops.yaml
		return nil
	}
	return err
}

When it happens

Trigger: Calling sops (or FindConfigFile/LookupConfigFile) from a directory tree that contains no `.sops.yaml` in the working directory or any ancestor up to the 100-directory limit.

Common situations: Running sops in a fresh checkout or CI workspace where the config file was never committed, config file named `.sops.yml` (wrong extension) which sops deliberately ignores, running from a subdirectory above the repo root containing the config, file renamed to `sops.yaml` without the leading dot.

Understand the failure class

Background: "Config file not found": what it means and how to fix it in docker-sync, Maven, Vagrant, Turborepo and other tools — this error's family across 60 libraries.

Related errors

• invalid %s key configuration: expected string in list, got %
• invalid %s key configuration: expected string, []string, or
• Could not unmarshal config file: %s
• invalid %s key configuration: %w
• Unknown datatype: %s

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/e5fa7e1b5715042f. Report an issue: GitHub.