{"record":{"id":"2da171cb928e69ca","repo":"docker/compose","slug":"failed-to-scan-compose-file-s-w","errorCode":null,"errorMessage":"failed to scan compose file %s: %w","messagePattern":"failed to scan compose file (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/publish.go","lineNumber":699,"sourceCode":"\t\t\tallFindings[serviceName] = bindMounts\n\t\t}\n\t}\n\treturn allFindings\n}\n\nfunc (s *composeService) checkForSensitiveData(ctx context.Context, project *types.Project) ([]secrets.DetectedSecret, error) {\n\tvar allFindings []secrets.DetectedSecret\n\tscan := scanner.NewDefaultScanner()\n\t// Check all compose files\n\tfor _, file := range project.ComposeFiles {\n\t\tin, err := composeFileAsByteReader(ctx, file, project)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tfindings, err := scan.ScanReader(in)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to scan compose file %s: %w\", file, err)\n\t\t}\n\t\tallFindings = append(allFindings, findings...)\n\t}\n\tfor _, service := range project.Services {\n\t\t// Check env files\n\t\tfor _, envFile := range service.EnvFiles {\n\t\t\tif _, statErr := os.Stat(envFile.Path); statErr != nil {\n\t\t\t\tif !os.IsNotExist(statErr) {\n\t\t\t\t\treturn nil, fmt.Errorf(\"failed to access env file %s: %w\", envFile.Path, statErr)\n\t\t\t\t}\n\t\t\t\tif envFile.Required {\n\t\t\t\t\treturn nil, fmt.Errorf(\"env file %s not found\", envFile.Path)\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tfindings, err := scan.ScanFile(envFile.Path)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to scan env file %s: %w\", envFile.Path, err)","sourceCodeStart":681,"sourceCodeEnd":717,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/publish.go#L681-L717","documentation":"Thrown by checkForSensitiveData when the secret scanner fails while reading a compose file's re-serialized YAML content. The compose file is loaded unresolved, marshalled back to YAML, and fed to ScanReader; any scanner-level failure (malformed input, reader error) produces this wrapped error.","triggerScenarios":"Publishing a project where ScanReader returns an error on one of project.ComposeFiles — typically YAML that cannot be re-marshalled cleanly or content that breaks the scanner's parser.","commonSituations":"Unusual or malformed YAML constructs that parse individually but fail re-serialization, binary junk in a compose file, or corrupted files on disk. Rare in practice; most malformed YAML is caught earlier by the loader.","solutions":["Run docker compose config on the same file set to confirm the files parse and serialize without errors.","Simplify the constructs in the failing file (custom tags, anchors/aliases, merge keys) that may not round-trip through the loader.","Check scanner/CLI version compatibility — update docker compose to the latest release in case the marshalling/scanner pair has a known bug.","If the file is machine-generated, regenerate it with clean YAML."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"res, err := publish(ctx, opts)\nif err != nil && strings.Contains(err.Error(), \"failed to scan compose file\") {\n    // run docker compose config to find the offending construct, simplify YAML, retry\n    return handleScanFailure(err)\n}","preventionTips":["Prefer plain YAML constructs; avoid exotic tags and deep alias chains in files destined for publish.","Machine-generate compose files with a stable serializer and validate round-tripping in CI.","Keep docker compose updated to pick up loader/scanner fixes."],"tags":["compose","publish","secret-scanning","yaml"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}