semaphoreui/semaphore · error
invalid environment secret type
Error message
invalid environment secret type
What it means
Environment.Validate returns this error when an environment secret entry has a Type value outside the known set (EnvironmentSecretVar, EnvironmentSecretEnv, and the password-type checked earlier). The type field of each environment variable entry must be one of the recognized enum values; anything else is rejected as invalid.
Solutions
- Use one of the supported type values in the environment entry (the var/env types for plain values, the password type with a non-empty secret)
- Compare your payload's type values against the EnvironmentSecret* constants in db/Environment.go for the version you run
- Validate the environment JSON with the same switch logic client-side before calling the API
Example fix
// before
{"DEBUG": {"type": "string", "value": "1"}}
// after
{"DEBUG": {"type": "var", "value": "1"}} Defensive patterns
Strategy: validation
Validate before calling
allowed := map[string]bool{"var": true, "env": true, "password": true}
if !allowed[entry.Type] {
return fmt.Errorf("unsupported environment secret type %q", entry.Type)
} Type guard
func isKnownSecretType(t db.EnvironmentSecretType) bool {
switch t {
case db.EnvironmentSecretVar, db.EnvironmentSecretEnv, db.EnvironmentSecretPassword:
return true
}
return false
} Try / catch
if err := env.Validate(); err != nil {
if strings.Contains(err.Error(), "invalid environment secret type") {
return fmt.Errorf("environment rejected: %w", err)
}
return err
} Prevention
- Copy type values from the current Semaphore API docs/constants, not older integrations
- Use the Go constants (db.EnvironmentSecret*) instead of raw literals in code
- Add client-side enum validation before generating environment payloads
When it happens
Trigger: POST/PUT /api/environments with an env-vars JSON payload where an entry's "type" is misspelled, an arbitrary number/string, or from an older/removed enum value, so it matches none of the supported types in the Validate switch.
Common situations: Hand-written environment JSON with a typo in the type field; automation written against an older Semaphore API whose enum values changed; generated payloads emitting numeric enum values that no longer map to valid constants.
Understand the failure class
Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.
Related errors
AI-assisted analysis of semaphoreui/semaphore@1774ccb71a (2026-09-07).
Data as JSON: /api/errors/1338dde03b01d02a.
Report an issue: GitHub.
Appendix: source
Thrown at db/Environment.go:78
// Sync fields are transfer-only; persisted in project__secret_sync.
SyncEnabled bool `db:"-" json:"sync_enabled"`
SyncInterval int `db:"-" json:"sync_interval"`
LastSyncedAt *time.Time `db:"-" json:"last_synced_at,omitempty"`
LastSyncFailedAt *time.Time `db:"-" json:"last_sync_failed_at,omitempty"`
SyncPaths []SecretSyncPath `db:"-" json:"sync_paths"`
}
func (s *EnvironmentSecret) Validate() error {
if s.Type == EnvironmentSecretVar || s.Type == EnvironmentSecretEnv {
return nil
}
if s.Secret == "" {
return errors.New("missing secret")
}
return errors.New("invalid environment secret type")
}
func validateJSON(s string, mustValuesBeScalar bool) error {
if s == "" {
return nil
}
var data map[string]any
err := json.Unmarshal([]byte(s), &data)
if err != nil {
return errors.New("must be valid JSON")
}
for k, v := range data {
if k == "" {
return errors.New("key can not be empty")
}
View on GitHub (pinned to 1774ccb71a)