Repository navigation
Fix misleading cloud secrets error with K6_CLOUD_PUSH_REF_ID - #6096
Merged
Merged
Conversation
ankur22
temporarily deployed
to
azure-trusted-signing
June 19, 2026 13:48 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
ankur22
temporarily deployed
to
azure-trusted-signing
June 19, 2026 13:50 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
ankur22
temporarily deployed
to
azure-trusted-signing
June 19, 2026 14:50 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
ankur22
temporarily deployed
to
azure-trusted-signing
June 19, 2026 14:52 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
ankur22
commented
Jun 19, 2026
| // env vars; otherwise the generic 'k6 cloud run --local-execution' guidance applies (#6050). | ||
| func (cs *SecretSource) notConfiguredError() error { | ||
| const prefix = "cloud secrets not configured: no secrets configuration available. " | ||
| if cs.params.Environment["K6_CLOUD_PUSH_REF_ID"] != "" { |
Contributor
Author
There was a problem hiding this comment.
Not sure about this, would it be better with conf.PushRefID?
When a test run is reused via K6_CLOUD_PUSH_REF_ID, k6 skips CreateTestRun (#5814) to avoid orphan runs. That response is the only place the cloud secret source is configured from the cloud API, so secrets.get() failed with a message telling the user to use 'k6 cloud run --local-execution' -- which they already were. The cloud secret source now reads K6_CLOUD_PUSH_REF_ID from its params and, when set, points users to K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT instead. The generic message is unchanged for all other cases. Resolves: #6050
ankur22
force-pushed
the
fix/cloud-secrets-pushrefid-6050
branch
from
June 19, 2026 14:58
b174e90 to
c39bbf6
Compare
ankur22
temporarily deployed
to
azure-trusted-signing
June 19, 2026 15:04 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
ankur22
marked this pull request as ready for review
June 19, 2026 15:05
ankur22
requested review from
codebien and
oleiade
and removed request for
a team
June 19, 2026 15:05
ankur22
temporarily deployed
to
azure-trusted-signing
June 19, 2026 15:06 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
ankur22
requested review from
a team
and removed request for
codebien and
oleiade
July 17, 2026 10:36
mstoykov
approved these changes
Jul 21, 2026
ankur22
requested review from
a team,
joanlopez and
szkiba
and removed request for
a team
July 22, 2026 11:12
szkiba
approved these changes
Jul 22, 2026
3 of 4 tasks
social4hyq
pushed a commit
to social4hyq/homebrew-core
that referenced
this pull request
Sep 20, 2026
k6 2.2.0 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre>k6 `v2.2.0` is here 🎉! This release includes: - `k6 cloud run --local-execution` now streams k6's logs to Grafana Cloud, so the test run's log view works for local execution too. - `chromium.connectOverCDP()`, which connects browser tests to an already-running Chromium instance. - `TextEncoder` and `TextDecoder` available as globals, and `WritableStream` support in `k6/experimental/streams`. - A `k6 cloud load-zone list` command. - Two new experimental feature flags: `merge-run-tags` and `freeze-env`. ## Breaking changes There are no breaking changes in this release. ## New features ### `k6 cloud run --local-execution` streams logs to Grafana Cloud [#6171](grafana/k6#6171) When a cloud test runs locally with `k6 cloud run --local-execution`, k6's logs now stream to the Grafana Cloud test run, so the run's log view is populated the same way it is for cloud execution. Previously, local-execution logs stayed on the machine running k6 and never reached the cloud. Work with Grafana's secrets management to safely work with secrets and redact them if they're accidentally leaked into logs are pushed. Use the new `--no-cloud-logs` flag opts out to opt out of streaming of logs when working with `--local-execution`: ```shell k6 cloud run --local-execution script.js k6 cloud run --local-execution --no-cloud-logs script.js ``` ### Connect to a running browser with `chromium.connectOverCDP()` [#6165](grafana/k6#6165) The browser module can now attach to an existing Chromium-based browser over the Chrome DevTools Protocol, mirroring Playwright's `browserType.connectOverCDP()`. Pass the browser's WebSocket endpoint and k6 manages the returned browser's connection — it's auto-closed at the end of the iteration, though you can call `close()` earlier to release the connection on demand. ```js import { chromium } from 'k6/browser'; export default async function () { const browser = await chromium.connectOverCDP('ws://localhost:9222/devtools/browser/<id>'); const page = await browser.newPage(); try { await page.goto('https://quickpizza.grafana.com/'); } finally { await page.close(); await browser.close(); } } ``` Unlike the `K6_BROWSER_WS_URL` environment variable, the endpoint is a runtime value — you can, for example, request a fresh session URL from a browser provider's API in `setup()` and connect to it from the iterations. ### `TextEncoder` and `TextDecoder` globals [#6182](grafana/k6#6182) `TextEncoder` and `TextDecoder` are now available as standard globals in both the init and VU contexts, no import required — matching how they are exposed in browsers and other JavaScript runtimes. ```js const encoded = new TextEncoder().encode('Hello, world!'); const decoded = new TextDecoder().decode(encoded); ``` ### `WritableStream` in `k6/experimental/streams` [#6132](grafana/k6#6132) The experimental streams module now implements `WritableStream` and `WritableStreamDefaultWriter` following the WHATWG Streams specification, complementing the existing `ReadableStream` and paving the way for a future `TransformStream` implementation. ```js import { WritableStream } from 'k6/experimental/streams'; export default async function () { const stream = new WritableStream({ write(chunk) { console.log(`wrote ${chunk}`); }, }); const writer = stream.getWriter(); await writer.write('hello'); await writer.close(); } ``` ### `k6 cloud load-zone list` command [#6142](grafana/k6#6142) A new `k6 cloud load-zone list` subcommand lists the load zones — public and private — available in the configured Grafana Cloud k6 stack, mirroring the existing `k6 cloud project list` command. Output defaults to a human-readable table; pass `--json` to emit a JSON array instead. ```console $ k6 cloud load-zone list Load zones for https://example.grafana.net: ID NAME TYPE AVAILABLE amazon:us:ashburn Ashburn, US (Amazon) public yes amazon:sa:cape town Cape Town, SA (Amazon) public yes ``` ### Configurable `handleSummary()` timeout [#5854](grafana/k6#5854) The time budget for the `handleSummary()` callback — previously hardcoded to 120 seconds — is now configurable through the `handleSummaryTimeout` option or the `K6_HANDLE_SUMMARY_TIMEOUT` environment variable, so long-running tests with heavy summaries no longer fail with `handleSummary() execution timed out`. Thanks, @LBaronceli! ```js export const options = { handleSummaryTimeout: '5m', }; ``` ### New experimental feature flags: `merge-run-tags` and `freeze-env` Two new experimental flags join the feature-flag system introduced in v2.1.0: - [#5714](grafana/k6#5714) `merge-run-tags` merges run tags per key across config layers, so `options.tags` in a script is no longer silently discarded when `--tag` or `K6_TAGS` is also used — higher-priority layers win on conflicting keys instead of replacing the whole map. Thanks, @yordis! - [#6032](grafana/k6#6032) `freeze-env` freezes the `__ENV` object, so modifications from script code throw a `TypeError` (in strict mode) instead of silently persisting across iterations and scenarios. Thanks, @lohitkolluri! ```shell k6 run --features merge-run-tags,freeze-env script.js ``` ## UX improvements and enhancements - [#5631](grafana/k6#5631) Makes the browser module's header accessors — `response.allHeaders()`, `headerValue()`, `headerValues()`, and `headersArray()` — return the raw wire headers (including `Set-Cookie` and security-related headers), correctly paired with each hop of a redirect chain instead of Chrome's provisional headers. As part of this, `headerValues()` now matches header names case-insensitively and splits repeated values on newlines rather than commas, and the `browser_data_sent`/`browser_data_received` metrics now include the raw header bytes and no longer vary run-to-run with CDP event ordering. - [#6208](grafana/k6#6208) Makes `k6 cloud` reject the run flags (for example, `--vus`) with an `unknown flag` error and a non-zero exit code. Previously `k6 cloud --vus 10 script.js` accepted the flags, printed the help text, and exited 0 — running tests with `k6 cloud` directly was deprecated in v2.0.0 in favor of `k6 cloud run`. - [#6096](grafana/k6#6096) Points the cloud secrets error at `K6_CLOUD_SECRETS_TOKEN` and `K6_CLOUD_SECRETS_ENDPOINT` when a test run is reused via `K6_CLOUD_PUSH_REF_ID` under `--local-execution`, instead of suggesting the `--local-execution` flag the user is already using. - [#6196](grafana/k6#6196) Adds `catch` blocks to the browser examples so a failing iteration reports the original error instead of a subsequent `page.close()` failure. Thanks, @locker95! ## Bug fixes - [#6234](grafana/k6#6234) Classifies HTTP/2 errors by message so the `error_code` metric tag stays correct when k6 is built with Go 1.27 (whose `x/net/http2` delegates to the standard library), and explicitly enables HTTP/2 negotiation on VU transports. - [#6232](grafana/k6#6232) Drains queued log entries in the Loki hook at shutdown so `--out loki` and cloud log streaming no longer lose the final batch, and emits a `k6 dropped N log messages` warning when the cloud log buffer overflows instead of dropping logs silently. - [#6125](grafana/k6#6125) Serializes the first concurrent open of a file in the caching filesystem so parallel `fs.open()` calls on the same file no longer read zero or truncated bytes. - [#6147](grafana/k6#6147) Fixes a data race and inconsistent request-interception state when browser routes are added or removed concurrently. Thanks, @somak2kai! - [#6070](grafana/k6#6070) Flushes buffered file log output once per second so recent logs aren't lost when k6 is killed before shutdown. Thanks, @rohan-patnaik! - [#6205](grafana/k6#6205) Stops sending an invalid `Sec-WebSocket-Protocol` header when tailing Grafana Cloud logs; spec-strict servers rejected the handshake with `websocket: bad handshake`. - [#6200](grafana/k6#6200) Leaves a counter's `rate` unset when the observed duration is zero, instead of computing `+Inf` and spuriously failing `rate` thresholds. Thanks, @samarth70! - [#6195](grafana/k6#6195) Initializes a gauge's maximum from the first sample so all-negative gauge series no longer report `max=0`. Thanks, @Solaris-star! - [#6145](grafana/k6#6145) Prevents the OpenTelemetry output from panicking at startup when basic auth is configured without `K6_OTEL_HEADERS`. Thanks, @lukdz! - [#6140](grafana/k6#6140) Stops `SharedArray` deep-freezing JS primitives, which needlessly wrapped large strings in `String` objects — cutting memory usage in the reported reproduction from roughly 1 GB to 100 MB. ## Maintenance and internal improvements - [#6126](grafana/k6#6126), [#6224](grafana/k6#6224), [#6229](grafana/k6#6229) Adds anonymous extension usage to the k6 usage report: a run reports the Go module path, version, and type of registry-cataloged extensions it actually uses (imported `k6/x/` modules, output extensions selected with `--out`, and `k6 x` subcommands). Private and unlisted extensions are never reported, and the existing `--no-usage-report` opt-out covers it. - [#6183](grafana/k6#6183), [#6218](grafana/k6#6218) Updates Sobek and regexp2, making `W See merge request: Harmonybrew/homebrew-core!16299
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What?
Make the
cloud secrets not configurederror accurate when a test run is reused viaK6_CLOUD_PUSH_REF_IDunderk6 cloud run --local-execution. In that casesecrets.get()now returns a message pointing toK6_CLOUD_SECRETS_TOKEN/K6_CLOUD_SECRETS_ENDPOINT, instead of the misleading "make sure you're usingk6 cloud run --local-execution" text (which the user already is).The cloud secret source selects the message itself by reading the
K6_CLOUD_PUSH_REF_IDenv var from its params (internal/secretsource/cloud/cloud.go); the reuse-specific guidance appears only when that env var is set, and the original generic message is unchanged otherwise. Covered by a unit test ininternal/secretsource/cloud.Why?
#5814 (fixing #5813) made
k6 cloud run --local-executionskipCreateTestRunwhenK6_CLOUD_PUSH_REF_IDis set, to avoid creating orphan test runs. ThatCreateTestRunresponse is the only place the cloud secret source is configured from the cloud API, so reusing a run left the source unconfigured andsecrets.get()failed with a message instructing the user to do what they were already doing (#6050).There is no cloud API to fetch per-run secrets config for an existing run without creating a new one, so secrets in this path must be supplied via
K6_CLOUD_SECRETS_TOKEN/K6_CLOUD_SECRETS_ENDPOINT(the PLZ operator path, which I verified still works). This keeps #5814 intact and makes the error accurate and actionable. The reuse case is detected by reading theK6_CLOUD_PUSH_REF_IDenv var the source already has access to (the documented way to reuse a run), which keeps the change self-contained to the secret source with no cross-package plumbing.Checklist
make check) and all pass.Related PR(s)/Issue(s)