oven-sh/bun · error · Error

Azure secret not found: ${name}

Error message

Azure secret not found: ${name}

What it means

getConfig()'s env() helper on CI resolves config from the secret store: getSecret(name, { required: !fallback }). For required keys (AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID — the ones without fallbacks) a missing/unreadable secret is caught and re-thrown with this message. Off CI it reads process.env and never throws this.

Source

Thrown at scripts/azure.mjs:25

 * @typedef {Object} AzureConfig
 * @property {string} tenantId
 * @property {string} clientId
 * @property {string} clientSecret
 * @property {string} subscriptionId
 * @property {string} resourceGroup
 * @property {string} location
 * @property {string} galleryName
 */

/** @returns {AzureConfig} */
function getConfig() {
  const env = (name, fallback) => {
    if (isCI) {
      try {
        return getSecret(name, { required: !fallback }) || fallback;
      } catch {
        if (fallback) return fallback;
        throw new Error(`Azure secret not found: ${name}`);
      }
    }
    return process.env[name] || fallback;
  };

  return {
    tenantId: env("AZURE_TENANT_ID"),
    clientId: env("AZURE_CLIENT_ID"),
    clientSecret: env("AZURE_CLIENT_SECRET"),
    subscriptionId: env("AZURE_SUBSCRIPTION_ID"),
    resourceGroup: env("AZURE_RESOURCE_GROUP", "BUN-CI"),
    location: env("AZURE_LOCATION", "eastus2"),
    galleryName: env("AZURE_GALLERY_NAME", "bunCIGallery2"),
  };
}

let _config;
function config() {

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Add the named AZURE_* secret to the CI secret store with the exact expected name
2. Grant the CI identity read (get) permission on that secret
3. Run with a fallback value where the key supports one (e.g. AZURE_LOCATION has 'eastus2')
4. For local runs, ensure isCI is false so plain env vars are used

Example fix

// before
const tenantId = env('AZURE_TENANT_ID'); // throws if secret missing on CI

// after
// provide the secret, or supply a fallback when a default is acceptable
const location = env('AZURE_LOCATION', 'eastus2');

const required = ['AZURE_TENANT_ID', 'AZURE_CLIENT_ID', 'AZURE_CLIENT_SECRET', 'AZURE_SUBSCRIPTION_ID'];
const missing = required.filter(k => !process.env[k]);
if (missing.length) {
  console.error('azure config incomplete, missing:', missing.join(', '));
  process.exit(1);
}

When it happens

Trigger: Running an azure.mjs command with isCI true while the AZURE_* secret is absent from the store or the runtime identity lacks read permission on it; keys with fallbacks (resourceGroup, location) never trigger this.

Common situations: New CI environment never seeded with the Azure secrets; secret renamed; managed identity / workload identity missing the KeyVault GET secret permission.

Related errors

• Buildkite token not found: set BUILDKITE_AGENT_TOKEN or gran
• [azure] Unsupported OS: ${os}
• Azure auth failed: ${response.status}
• GITHUB_TOKEN environment variable is required
• [azure] Auth failed: ${response.status} ${await response.tex

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/860c193a7f2334ff. Report an issue: GitHub.