{"record":{"id":"2497e94572fc4c9c","repo":"microsoft/aspire","slug":"secret-store-storename-references-a-manifest-at-manifestpath-2497e9","errorCode":null,"errorMessage":"Secret store '{storeName}' references a manifest at '{manifestPath}' that is malformed YAML with an unbalanced mapping. Provide a single well-formed encrypted Bitnami SealedSecret document.","messagePattern":"Secret store '(.+?)' references a manifest at '(.+?)' that is malformed YAML with an unbalanced mapping\\. Provide a single well-formed encrypted Bitnami SealedSecret document\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs","lineNumber":602,"sourceCode":"                        manifestPath,\n                        \"uses YAML anchors or explicit tags. Provide a plain SealedSecret manifest without anchors, aliases, merge keys, or tags.\");\n                }\n\n                RegisterNodeWithParent(storeName, manifestPath, yamlEvent, stack);\n            }\n\n            if (yamlEvent is MappingStart)\n            {\n                stack.Push(new MappingFrame());\n            }\n            else if (yamlEvent is MappingEnd)\n            {\n                // A well-formed stream always pairs MappingStart/MappingEnd, but guard the pop so a\n                // malformed or out-of-sync event stream fails as ASPIRERADIUS044 rather than escaping\n                // ValidateStructure as a raw InvalidOperationException from Stack.Pop() on an empty stack.\n                if (stack.Count == 0)\n                {\n                    throw CreateInvalidManifestException(\n                        storeName,\n                        manifestPath,\n                        \"is malformed YAML with an unbalanced mapping. Provide a single well-formed encrypted Bitnami SealedSecret document.\");\n                }\n\n                stack.Pop();\n            }\n            else if (yamlEvent is SequenceStart)\n            {\n                stack.Push(MappingFrame.s_sequence);\n            }\n            else if (yamlEvent is SequenceEnd)\n            {\n                if (stack.Count == 0)\n                {\n                    throw CreateInvalidManifestException(\n                        storeName,\n                        manifestPath,","sourceCodeStart":584,"sourceCodeEnd":620,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/SealedSecretManifest.cs#L584-L620","documentation":"The structural validator tracks MappingStart/MappingEnd pairs on a stack. Receiving a MappingEnd without a matching open mapping means the YAML event stream is unbalanced (malformed), so the code fails with this explicit error instead of a raw Stack.Pop() InvalidOperationException.","triggerScenarios":"ReadMetadataFromYaml -> ValidateStructure pops a MappingFrame on SequenceEnd... rather on MappingEnd when the stack is empty — an extra mapping close from a corrupted or truncated document stream.","commonSituations":"Manifest truncated or corrupted in transit; a parser misconfiguration producing mismatched events; file encoding or BOM issues breaking event pairing; programmatic YAML emission with mismatched start/end writes.","solutions":["Validate the YAML with a standard parser (e.g. `yq .` or yamllint) to find the unbalanced mapping and fix indentation/structure","Re-export or regenerate the manifest as a single well-formed SealedSecret document","Check the file wasn't truncated or concatenated (paste of multiple documents, stray characters at EOF)"],"exampleFix":"// before (extra closing mapping)\nkind: SealedSecret\n}\n// after\nkind: SealedSecret\nmetadata:\n  name: mystore","handlingStrategy":"validation","validationCode":"try { new YamlDotNet.RepresentationModel.YamlStream().Load(new StringReader(File.ReadAllText(manifestPath))); }\ncatch (Exception ex) { throw new InvalidOperationException($\"{manifestPath} is not well-formed YAML: {ex.Message}\"); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Parse the manifest with a YAML parser before handing it to the app host","Avoid manual edits/concatenation of YAML documents","Check file integrity after transfer (no truncation, BOM, or stray characters)"],"tags":["yaml","malformed","structure","sealed-secrets"],"backgroundTag":"yaml-parse-error","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}