ASP.NET Core user-secrets "InvalidDataException" / missing secrets in CI
The Secret Manager (user-secrets) stores values in a per-user file outside the project, meant only for local development. On a CI runner that file does not exist, so any value expected from user-secrets is missing. Provide those values via environment variables instead.
What this error means
A value that comes from user-secrets locally is null in CI, or the secrets provider throws "System.FormatException" / "InvalidDataException" reading a malformed secrets.json, causing a startup or test failure.
System.InvalidOperationException: A named connection string was used, but the name
'Default' was not found (it was provided by user-secrets locally, which are not
present on the CI runner).Common causes
user-secrets do not exist on the runner
Secret Manager stores values under the user profile, not in the repo, so CI has no access to them and the keys resolve to null.
A malformed secrets.json
If a secrets file is copied in, invalid JSON can throw an InvalidDataException/FormatException when the provider parses it.
How to fix it
Supply the values via environment variables in CI
- Identify which keys came from user-secrets.
- Set them as env vars (colon becomes double underscore) from CI secrets.
- The environment configuration provider overrides file-based sources.
env:
ConnectionStrings__Default: ${{ secrets.DB_CONNECTION }}
Jwt__Signing__Key: ${{ secrets.JWT_KEY }}Only add user-secrets in Development
Gate the user-secrets provider to the Development environment so CI never depends on it.
if (builder.Environment.IsDevelopment())
builder.Configuration.AddUserSecrets<Program>();How to prevent it
- Treat user-secrets as local-dev only; provide CI values via environment variables.
- Gate the user-secrets provider to the Development environment.
- Store CI secrets in the CI secret store, not in committed or copied files.