{"record":{"id":"70890975c99f7601","repo":"dagger/dagger","slug":"failed-to-read-secret-file-q-w","errorCode":null,"errorMessage":"failed to read secret file %q: %w","messagePattern":"failed to read secret file %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/client/secretprovider/file.go","lineNumber":22,"sourceCode":"\t\"context\"\n\t\"fmt\"\n\t\"os\"\n\n\t\"github.com/dagger/dagger/engine/client/pathutil\"\n)\n\nfunc fileProvider(_ context.Context, path string) ([]byte, error) {\n\thomeDir, err := os.UserHomeDir()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tpath, err = pathutil.ExpandHomeDir(homeDir, path)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdata, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to read secret file %q: %w\", path, err)\n\t}\n\treturn data, nil\n}\n","sourceCodeStart":4,"sourceCodeEnd":26,"githubUrl":"https://github.com/dagger/dagger/blob/82ba2681dbe30d3547a1dc50ea495900ab5b6047/engine/client/secretprovider/file.go#L4-L26","documentation":"The file secret provider reads the secret from a local file path. After expanding ~ (home dir), os.ReadFile failed, so this error wraps the underlying os error (file not found, permission denied, is a directory, etc.). It indicates the secret file could not be read from disk.","triggerScenarios":"A secret reference of the form file://<path> where the path does not exist, is unreadable due to permissions, or is a directory; raised in fileProvider when os.ReadFile returns an error after successful home-dir expansion.","commonSituations":"Typo in the path; file created by another user with restrictive permissions; path relative to a different working directory than expected; secret file mounted only inside a container but referenced from the host; using ~ in contexts where homeDir resolution differs.","solutions":["Check the file exists at the expanded path: `ls -l <path>`.","Fix permissions so the user running Dagger can read it (chmod/chown).","Use an absolute path in the file:// URI to avoid working-directory ambiguity.","If the path contains ~, confirm HOME is set correctly for the process."],"exampleFix":"// before\nuri := \"file://secrets/token.txt\" // relative, wrong cwd\n// after\nuri := \"file:///home/me/secrets/token.txt\" // absolute, readable (chmod 600 owned by user)","handlingStrategy":"validation","validationCode":"# shell: check readability before running Dagger\npath=\"$HOME/secrets/token.txt\"\n[ -f \"$path\" ] && [ -r \"$path\" ] || { echo \"secret file missing or unreadable: $path\"; exit 1; }","typeGuard":null,"tryCatchPattern":"data, err := secret.Plaintext(ctx)\nif err != nil {\n    var pathErr *fs.PathError\n    if errors.As(err, &pathErr) && errors.Is(pathErr.Err, fs.ErrNotExist) {\n        return fmt.Errorf(\"create the secret file first: %w\", err)\n    }\n    return err\n}","preventionTips":["Use absolute paths in file:// URIs.","Ensure the file is owned/readable by the user running Dagger (chmod 600).","Mount or copy the secret file into any environment where Dagger runs (CI runners, containers).","Verify HOME is set correctly if the path uses ~."],"tags":["filesystem","secrets","file-not-found","provider-error"],"backgroundTag":"file-read-failed","analyzedSha":"82ba2681dbe30d3547a1dc50ea495900ab5b6047","analyzedAt":"2026-09-05T07:21:37.930Z","contentChangedAt":"2026-09-05T07:21:37.930Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}