Dagger "failed to get secret" (op:// / env://) in CI

By Daniel Zoghalchali·Latchkey

Dagger resolves secrets from a URI scheme: env:// reads an environment variable, op:// reads a 1Password item, file:// reads a file. If the referenced source does not exist in the job, the secret lookup fails.

What this error means

dagger fails with "failed to get secret" naming the reference, for example "env://REGISTRY_TOKEN: not found" or an op:// path that could not be read.

Error: input: secret env://REGISTRY_TOKEN: failed to get secret: environment variable "REGISTRY_TOKEN" not set

Common causes

The env:// variable is not set in the job

A secret referenced as env://NAME needs that variable exported to the step. Without it, the lookup fails.

The op:// item or vault is unreachable

An op:// reference needs a configured 1Password service account and a valid item path; a missing token or wrong path fails.

How to fix it

Export the referenced source

1. Set the environment variable a env:// secret reads, from a CI secret.
2. For op://, provide the 1Password service account token and correct item path.
3. Re-run once the secret source resolves.

env:
  REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}

Verify the secret URI

Confirm the scheme and path match a source present in the job (env://, file://, or op://).

dagger call publish --token=env://REGISTRY_TOKEN

How to prevent it

• Export env:// sources from CI secrets before the step.
• Configure the 1Password service account for op:// refs.
• Keep secret URIs in sync with the job environment.

Frequently asked questions

Related guides

References

• Docker documentation
• Docker build cache
• GitHub Actions documentation