What causes "Secret not found" in theonedev/onedev?

Create the secret with that exact name in the project (Project > Secrets) or a parent project

theonedev/onedev · error · ValidationException

Secret not found

Error message

Secret not found

What it means

Thrown by ParamUtils.validateParamValue when a SecretParam's value is not a literal (@secrets: prefixed) expression and no secret with that name exists in the current project's hierarchy of job secrets. OneDev requires referenced secrets to be defined on the project or an ancestor project.

Source

Thrown at server-core/src/main/java/io/onedev/server/buildspec/param/ParamUtils.java:71

							entry.getKey(), e.getMessage());
					throw new ValidationException(errorMessage);
				}
				
				ParamSpec paramSpec = Preconditions.checkNotNull(paramSpecMap.get(entry.getKey()));
				for (List<String> value: entry.getValue()) 
					validateParamValue(paramSpec, entry.getKey(), value);
			}
		}
	}
	
	private static void validateParamValue(ParamSpec paramSpec, String paramName, List<String> paramValue) {
		try {
			Object object = paramSpec.convertToObject(paramValue);
			if (paramSpec instanceof SecretParam && object != null 
					&& !((String)object).startsWith(SecretInput.LITERAL_VALUE_PREFIX)) {
				if (!Project.get().getHierarchyJobSecrets().stream()
						.anyMatch(it->it.getName().equals(object))) {
					throw new ValidationException("Secret not found");
				}
			}
		} catch (Exception e) {
			if (e.getMessage() == null)
				logger.error("Error validating field value", e);
			
			List<String> displayValue;
			if (paramSpec instanceof SecretParam) {
				displayValue = new ArrayList<>();
				for (String each: paramValue) {
					if (each.startsWith(SecretInput.LITERAL_VALUE_PREFIX))
						displayValue.add(SecretInput.MASK);
					else
						displayValue.add(each);
				}
			} else {
				displayValue = paramValue;
			}

View on GitHub (pinned to d44925c47c)

Solutions

Create the secret with that exact name in the project (Project > Secrets) or a parent project
Fix the typo so the value matches an existing secret name
Prefix the value with @secrets: if it is meant as a literal value, not a secret reference

Example fix

// before
- name: deployKey
  secret: true
  value: deploy-key-typo
// after (secret 'deploy-key' defined in project secrets)
- name: deployKey
  secret: true
  value: deploy-key

Defensive patterns

Strategy: validation

Validate before calling

boolean exists = Project.get().getHierarchyJobSecrets().stream()
    .anyMatch(s -> s.getName().equals(secretName));
if (!exists) throw new IllegalStateException("secret not defined: " + secretName);

Try / catch

try { ParamUtils.validateParamMap(specs, params); } catch (ValidationException e) { if (e.getMessage().contains("Secret not found")) { /* prompt user to create secret */ } }

Prevention

Create referenced secrets in the project or a parent project before using them
Use @secrets: prefix for literal values in secret params
Keep secret names consistent via naming conventions; avoid ad-hoc renames

When it happens

Trigger: A job parameter of type secret is set to a plain string that does not start with SecretInput.LITERAL_VALUE_PREFIX and does not match any secret name returned by Project.get().getHierarchyJobSecrets().

Common situations: Typo in secret name; secret defined in another project not in the hierarchy; secret deleted or renamed after the buildspec referenced it; forgetting the @secrets: prefix when intending a literal value.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/8d86101d6074be0e. Report an issue: GitHub.