{"record":{"id":"8ceede11785bd730","repo":"argoproj/argo-workflows","slug":"failed-to-get-file-w","errorCode":null,"errorMessage":"failed to get file: %w","messagePattern":"failed to get file: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"workflow/artifacts/oss/oss.go","lineNumber":156,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn !isTransientOSSErr(ctx, err), err\n\t\t\t}\n\t\t\tbucket, err := osscli.Bucket(bucketName)\n\t\t\tif err != nil {\n\t\t\t\treturn !isTransientOSSErr(ctx, err), err\n\t\t\t}\n\t\t\tobjectName := inputArtifact.OSS.Key\n\t\t\tdirPath := filepath.Dir(path)\n\t\t\terr = os.MkdirAll(dirPath, 0o700)\n\t\t\tif err != nil {\n\t\t\t\treturn false, fmt.Errorf(\"mkdir %s error: %w\", dirPath, err)\n\t\t\t}\n\t\t\torigErr := bucket.GetObjectToFile(objectName, path)\n\t\t\tif origErr == nil {\n\t\t\t\treturn true, nil\n\t\t\t}\n\t\t\tif !IsOssErrCode(origErr, \"NoSuchKey\") {\n\t\t\t\treturn !isTransientOSSErr(ctx, origErr), fmt.Errorf(\"failed to get file: %w\", origErr)\n\t\t\t}\n\t\t\t// If we get here, the error was a NoSuchKey. The key might be a oss \"directory\"\n\t\t\tisDir, err := IsOssDirectory(bucket, objectName)\n\t\t\tif err != nil {\n\t\t\t\treturn !isTransientOSSErr(ctx, err), fmt.Errorf(\"failed to test if %s/%s is a directory: %w\", bucketName, objectName, err)\n\t\t\t}\n\t\t\tif !isDir {\n\t\t\t\t// It's neither a file, nor a directory. Return the original NoSuchKey error\n\t\t\t\treturn false, origErr\n\t\t\t}\n\n\t\t\tif err = GetOssDirectory(ctx, bucket, objectName, path); err != nil {\n\t\t\t\treturn !isTransientOSSErr(ctx, err), fmt.Errorf(\"failed get directory: %w\", err)\n\t\t\t}\n\t\t\treturn true, nil\n\t\t})\n\treturn err\n}","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/workflow/artifacts/oss/oss.go#L138-L174","documentation":"OSS Load's GetObjectToFile failed with an error that is not NoSuchKey, so the driver cannot treat it as 'missing key'; it wraps it as 'failed to get file'. This covers all real transfer failures: auth errors, bucket/endpoint mismatch, network failure, permission denied, throttling.","triggerScenarios":"bucket.GetObjectToFile(objectName, path) returns a non-NoSuchKey error: wrong credentials (AccessDenied), nonexistent bucket name, wrong endpoint region, oversized object, or transient network errors after retries are exhausted.","commonSituations":"Cross-region endpoint vs bucket mismatch; expired STS token mid-run; IAM/RAM policy without oss:GetObject; bucket names with typos; the underlying error is retried via waitutil.Backoff only if isTransientOSSErr says so, so persistent auth errors surface immediately.","solutions":["Inspect the wrapped cause (%w) in logs for the OSS error code — AccessDenied means fix RAM/RAM policy or credentials.","Verify endpoint region matches the bucket's region and the bucket name is correct.","If STS is used, re-issue/refresh the security token; expired tokens are not retried.","For throttling/network codes, the built-in retry already runs — increase connectivity or check OSS status page.","Confirm the pod's credentials actually grant oss:GetObject on the key."],"exampleFix":"// before: endpoint in wrong region\noss:\n  endpoint: http://oss-cn-beijing.aliyuncs.com\n  bucket: my-hangzhou-bucket\n// after\noss:\n  endpoint: http://oss-cn-hangzhou.aliyuncs.com\n  bucket: my-hangzhou-bucket","handlingStrategy":"retry","validationCode":"// preflight: cheap HEAD-style existence + auth check\ncli, err := oss.New(endpoint, ak, sk)\nif err == nil {\n\t_, err = cli.Bucket(bucket).GetObjectMeta(key)\n}\n// non-nil err here predicts 'failed to get file' during Load","typeGuard":"import oerr \"github.com/aliyun/aliyun-oss-go-sdk/oss\"\nfunc isOSSAccessDenied(err error) bool {\n\tvar sr oerr.ServiceError\n\treturn errors.As(err, &sr) && sr.Code == \"AccessDenied\"\n}","tryCatchPattern":"err := driver.Load(ctx, art, path)\nvar isTransient bool\nif errors.As(err, &boolErr{&isTransient}); !isTransient {\n\t// permanent (auth/permission): do not retry, fix credentials or key\n} else {\n\t// retry with backoff\n}","preventionTips":["Match endpoint region to bucket region","Grant oss:GetObject on the exact key prefix in RAM policy","Rotate STS tokens before long workflow runs","Run a preflight GetObjectMeta in canary tests"],"tags":["oss","artifact","object-storage","download","network"],"backgroundTag":"oss-getobject-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}