Pulumi "passphrase must be set with PULUMI_CONFIG_PASSPHRASE" in CI

The stack uses the passphrase secrets provider, so Pulumi needs a passphrase to open its encrypted config. In CI nothing supplies one, so PULUMI_CONFIG_PASSPHRASE (or PULUMI_CONFIG_PASSPHRASE_FILE) is empty and Pulumi refuses to construct the secrets manager.

What this error means

A pulumi up, pulumi preview, or even pulumi stack select step fails immediately with "error: getting secrets manager" and a line naming PULUMI_CONFIG_PASSPHRASE. It works locally because the passphrase is cached there.

error: getting secrets manager: passphrase must be set with
PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE environment variables

Common causes

The passphrase secret is not exposed to the step

The stack was initialized with the passphrase secrets provider, but the CI job never sets PULUMI_CONFIG_PASSPHRASE, so Pulumi has nothing to decrypt config with.

The variable is set at the wrong scope

The passphrase is defined for one step or job but the Pulumi command runs in another where the environment does not carry over.

How to fix it

Provide the passphrase from a secret

1. Store the stack passphrase as a repository or organization secret.
2. Set PULUMI_CONFIG_PASSPHRASE in the environment of every Pulumi step.
3. Re-run so the secrets manager can construct itself.

env:
  PULUMI_CONFIG_PASSPHRASE: ${{ secrets.PULUMI_CONFIG_PASSPHRASE }}

Use a passphrase file if the value is multiline

Write the passphrase to a file and point PULUMI_CONFIG_PASSPHRASE_FILE at it instead of embedding it inline.

printf '%s' "${{ secrets.PULUMI_CONFIG_PASSPHRASE }}" > /tmp/pass
export PULUMI_CONFIG_PASSPHRASE_FILE=/tmp/pass

How to prevent it

• Set the passphrase env var at the job level so every Pulumi step sees it.
• Keep the passphrase in CI secrets, never committed to the repo.
• Consider a cloud KMS secrets provider for CI to avoid a shared passphrase.

Related guides