goreleaser/goreleaser · error

audit_script is set, but install_enforcement is %s instead o

Error message

audit_script is set, but install_enforcement is %s instead of continuously_enforce

What it means

audit_script is only valid together with continuously_enforce enforcement, because Iru runs it to audit ongoing compliance. validate() rejects an audit_script combined with any other enforcement value before anything is uploaded.

Source

Thrown at internal/pipe/iru/iru.go:206

		}
	}
	if enforcement != "" && !slices.Contains(installEnforcements, enforcement) {
		return fmt.Errorf("invalid install_enforcement: %s", enforcement)
	}
	if unzipKnown && installType != "" {
		if installType == "zip" && unzipLocation == "" {
			return errors.New("install_type is zip, but unzip_location is not set")
		}
		if installType != "zip" && unzipLocation != "" {
			return fmt.Errorf("unzip_location is set, but install_type is %s instead of zip", installType)
		}
	}
	if auditKnown && enforcement != "" {
		if enforcement == "continuously_enforce" && auditScript == "" {
			return errors.New("install_enforcement is continuously_enforce, but audit_script is not set")
		}
		if enforcement != "continuously_enforce" && auditScript != "" {
			return fmt.Errorf(
				"audit_script is set, but install_enforcement is %s instead of continuously_enforce",
				enforcement,
			)
		}
	}
	if enforcement == "no_enforcement" && selfServiceKnown && !selfService {
		return errors.New("install_enforcement is no_enforcement, but show_in_self_service is not enabled")
	}
	if recommendedKnown && recommended && selfServiceKnown && !selfService {
		return errors.New("self_service_recommended is enabled, but show_in_self_service is not enabled")
	}
	if categoryKnown && selfServiceKnown {
		if selfService && categoryID == "" {
			return errors.New("show_in_self_service is enabled, but self_service_category_id is not set")
		}
		if !selfService && categoryID != "" {
			return errors.New("self_service_category_id is set, but show_in_self_service is not enabled")
		}

View on GitHub (pinned to f5edd73956)

Solutions

1. Set iru.install_enforcement to continuously_enforce to use audit_script.
2. Remove iru.audit_script if you don't need continuous enforcement.
3. When updating, drop audit_script by setting it to an explicitly empty value and change enforcement accordingly.

Example fix

# before
iru:
  install_enforcement: "install_once"
  audit_script: "audit.sh"
# after
iru:
  install_enforcement: "continuously_enforce"
  audit_script: "audit.sh"

if cfg.AuditScript != nil && *cfg.AuditScript != "" && cfg.InstallEnforcement != "continuously_enforce" { return errors.New("audit_script requires install_enforcement: continuously_enforce") }

func auditScriptIsConsistent(cfg config.Iru) bool { return cfg.AuditScript == nil || cfg.InstallEnforcement == "continuously_enforce" }

if err := Pipe{}.Publish(ctx); err != nil { if strings.Contains(err.Error(), "audit_script is set") { log.Fatal("set install_enforcement to continuously_enforce or drop audit_script") }; return err }

When it happens

Trigger: `iru.audit_script` set while `iru.install_enforcement` is install_once or no_enforcement (or while creating and enforcement resolves to the default install_once because it was left unset... only when explicitly set to a non-continuously_enforce value, since the check requires enforcement != "").

Common situations: Adding an audit script for compliance without switching enforcement to continuously_enforce; removing enforcement while keeping audit_script; misunderstanding Iru's enforcement model.

Related errors

• 'server' is a required config key
• 'category_id' is a required config key
• no tags provided
• no app_id provided for flatpak
• no runtime provided for flatpak

AI-assisted analysis of goreleaser/goreleaser@f5edd73956 (2026-09-05). Data as JSON: /api/errors/f3e7d17329f9605a. Report an issue: GitHub.