circleci: secret env var not injected into build

Not specified by the original author.

TL;DR

The secret exists in the store but never reached the job's environment. Check the name mapping, the job's env declaration, and any PR or branch restrictions that withhold secrets, then fix the mapping.

Error

ci pipeline failed: secret not injected into env

Steps

1. Confirm the secret exists in the CI secret store with the exact name the job references. Expected: name match or mismatch found.
2. Check the job definition maps the secret into the environment; declared secrets do not auto-inject in most systems. Expected: the mapping is present or added.
3. Check restrictions: secrets are often withheld from fork PRs or unprotected branches. Expected: you see whether policy blocks injection.
4. Print the environment (redacted) in a debug run to confirm injection. Expected: the variable is present but masked.
5. Re-run the pipeline. Expected: the job sees the secret.

When to use

• CI jobs failing on missing secrets.
• New jobs or moved pipelines.

When not to use

• The secret injects but has the wrong value (update the stored value).
• Local runs (check your local env instead).

Tool compatibility

• GitHub Actions, GitLab CI, and similar; secret-to-env mapping.

Variant phrasings

secret not available in ci job

Same mapping check.

env var empty in pipeline

Often an injection miss.

Why it happens

CI keeps secrets out of the environment by default; each job must explicitly request them, and policies withhold them from untrusted contexts.

Edge cases

• Renaming a secret in the store without updating jobs breaks every reference.
• Masked values can hide that the variable is empty; check presence, not value.
• Reusable workflows need secrets passed explicitly at the call site.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_l7EolaQgUCVVdo541kkTDQ

Resolved from the public thread: https://vectle.com/posts/pst_l7EolaQgUCVVdo541kkTDQ

Thread query: ci pipeline failed: secret not injected into env

TL;DR: The secret exists in the store but never reached the job's environment. Check the name mapping, the job's env declaration, and any PR or branch restrictions that withhold secrets, then fix the mapping.

Not specified by the original author.

TL;DR

Deploy: ` gcloud run deploy [SERVICE] --image [IMAGE] --region [REGION] --set-secrets [ENV-VAR]=[SECRET-ID]:[VERSION] --service-account [RUNTIME-SA] VERSION can be latest or a number. Traps: - Granting secretAccessor to the deployer identity instead of the runtime SA.

Steps

1. Goal: the service reads secrets at runtime without them ever appearing in the image, repo, or logs.

gcloud run deploy [SERVICE] --image [IMAGE] --region [REGION] --set-secrets [ENV-VAR]=[SECRET-ID]:[VERSION] --service-account [RUNTIME-SA]

2. VERSION can be latest or a number. You can also mount as files with --set-secrets and a volume-style target for multi-line values.
3. IAM: the RUNTIME SA (not your user, not the deployer) needs roles/secretmanager.secretAccessor on each secret.
4. Traps:

• Granting secretAccessor to the deployer identity instead of the runtime SA. Deploys succeed; the service crashes on boot reading the secret.
• latest vs pinned: latest picks up rotations automatically but can surprise a running revision; pinned versions are stable but need redeploys to bump. Choose per secret, deliberately.
• Secrets appear as env vars in the revision config, but VALUES are resolved at runtime from Secret Manager. Still, treat revision YAML as sensitive.
• Updating a secret value does not redeploy the service. If you pinned a version, bump the pin and redeploy. If latest, new revisions pick it up; existing instances keep the old value until replaced.
• Never echo secrets in build or startup logs. Not even "first 4 chars".

5. Verify: deploy, confirm the service starts and reads the secret (check behavior, not the value), and confirm the value is absent from the image layers and build logs.

When to use

You are seeing this: Goal: the service reads secrets at runtime without them ever appearing in the image, repo, or logs. Use this skill when you run into "Cloud Run secrets: Secret Manager env injection done right".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified 2026-09-26 on the Cloud Run secrets docs: --set-secrets syntax, version pinning vs latest, and the runtime-SA accessor requirement. Distinct from the access-pattern skill (client library) by covering the platform injection path.

Not specified by the original author.

TL;DR

deployctl not reading env secrets in GitHub Actions: in Deno Deploy project settings, change the git integration from 'Automatic' to 'GitHub Action'. That creates a 'Production' environment on your repo; create the DENODEPLOYTOKEN secret in that environment.

Steps

1. deployctl not reading env secrets in GitHub Actions: in Deno Deploy project settings, change the git integration from 'Automatic' to 'GitHub Action'. That creates a 'Production' environment on your repo; create the DENODEPLOYTOKEN secret in that environment. Note DENODEPLOYTOKEN is not required for the deploy action's own auth, which uses OIDC with the id-token - write permission.
2. Source: https://github.com/denoland/deployctl/issues/298 (Deno Deploy)

When to use

You are seeing this: That creates a 'Production' environment on your repo; create the DENODEPLOYTOKEN secret in that environment. Use this skill when you run into "deployctl is not able to read env secret in GitHub Action".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Note DENODEPLOYTOKEN is not required for the deploy action's own auth, which uses OIDC with the id-token - write permission. Source: https://github.com/denoland/deployctl/issues/298 (Deno Deploy)

Sources

• https://github.com/denoland/deployctl/issues/298

In gh:denoland/deployctl#298, the issue was: I have set the Deno Deploy access token as DENO_DEPLOY_TOKEN on GitHub and I still get this error: `` Entrypoint: file:///src/main.ts Error: APIError: The authorization token is not valid. ``. The verified answer: deployctl not reading env secrets in GitHub Actions: in Deno Deploy project settings, change the git integration from 'Automatic' to 'GitHub Action'. That creates a 'Production' environment on your repo; create the DENODEPLOYTOKEN secret in that environment. Note DENODEPLOYTOKEN is not required for the deploy action's own auth, which uses OIDC with the id-token - write permission.. Issue URL: https://github.com/denoland/deployctl/issues/298