{"record":{"id":"aef9b8bdfe3ba0e5","repo":"pulumi/pulumi","slug":"unmarshaling-deployment-w","errorCode":null,"errorMessage":"unmarshaling deployment: %w","messagePattern":"unmarshaling deployment: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/pulumi/config/config.go","lineNumber":632,"sourceCode":"\n\t\t\tps.Config = latest.Config\n\n\t\t\t// If the backend is returning envs, then we want to use them.\n\t\t\t//\n\t\t\t// We don't overwrite unconditionally because we don't want to to remove environments from users\n\t\t\t// that are using a non-cloud backend.\n\t\t\tif len(latest.Environments) > 0 {\n\t\t\t\tps.Environment = workspace.NewEnvironment(latest.Environments)\n\t\t\t}\n\n\t\t\t// Also restore the secrets provider from state\n\t\t\tuntypedDeployment, err := backend.ExportStackDeployment(ctx, s)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"getting deployment: %w\", err)\n\t\t\t}\n\t\t\tdeployment, err := stack.UnmarshalUntypedDeployment(ctx, untypedDeployment)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"unmarshaling deployment: %w\", err)\n\t\t\t}\n\t\t\tif deployment.SecretsProviders != nil {\n\t\t\t\t// TODO: It would be really nice if the format of secrets state in the config file matched\n\t\t\t\t// what we kept in the statefile. That would go well with the pluginification of secret\n\t\t\t\t// providers as well, but for now just switch on the secret provider type and ask it to fill in\n\t\t\t\t// the config file for us.\n\t\t\t\tswitch deployment.SecretsProviders.Type {\n\t\t\t\tcase passphrase.Type:\n\t\t\t\t\terr = passphrase.EditProjectStack(ps, deployment.SecretsProviders.State)\n\t\t\t\tcase cloud.Type:\n\t\t\t\t\terr = cloud.EditProjectStack(ps, deployment.SecretsProviders.State)\n\t\t\t\tdefault:\n\t\t\t\t\t// Anything else assume we can just clear all the secret bits\n\t\t\t\t\tps.EncryptionSalt = \"\"\n\t\t\t\t\tps.SecretsProvider = \"\"\n\t\t\t\t\tps.EncryptedKey = \"\"\n\t\t\t\t}\n","sourceCodeStart":614,"sourceCodeEnd":650,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/pulumi/config/config.go#L614-L650","documentation":"Wraps an error from stack.UnmarshalUntypedDeployment during `pulumi config refresh`. The exported deployment JSON could not be deserialized, so the secrets provider could not be restored into the local config.","triggerScenarios":"Run `pulumi config refresh` when the deployment blob returned by the backend is not valid untyped-deployment JSON: corrupted or truncated state in the backend, state written by a much older/newer incompatible CLI version, or manual edits to backend storage.","commonSituations":"State corruption after interrupted writes to object-storage backends; importing state hand-edited or migrated across versions; backend storage holding a partial deployment export.","solutions":["Verify the CLI version is current (`pulumi version`; upgrade) so the deployment schema matches.","Inspect the exported deployment (`pulumi stack export`) for malformed JSON; if corrupt, restore from a checkpoint backup.","For object-storage backends, check the stored deployment file for truncation and re-upload from a good backup.","As a workaround, run refresh with --config-file and/or manually set the secretsprovider fields in the stack config, skipping state restore."],"exampleFix":"// before (corrupt state)\npulumi config refresh  # unmarshaling deployment: ...\n// after\npulumi version                      # upgrade CLI if outdated\npulumi stack export > check.json    # inspect/repair deployment JSON\npulumi stack import --file check.json\npulumi config refresh","handlingStrategy":"validation","validationCode":"# validate deployment JSON parses before refreshing\npulumi stack export --stack \"$STACK\" | jq -e . > /dev/null || { echo \"deployment state is corrupt\"; exit 1; }","typeGuard":null,"tryCatchPattern":"if ! pulumi config refresh; then\n  echo \"refresh failed; restore state from backup before retrying\"\n  pulumi stack import --file backup.json\nfi","preventionTips":["Take regular state backups (`pulumi stack export > backup.json`) especially for object-storage backends.","Never hand-edit backend deployment state; use `pulumi stack export/import`.","Keep the Pulumi CLI version consistent across the team and CI to avoid schema mismatches.","Avoid interrupting writes to backend storage; use atomic/versioned buckets."],"tags":["cli","pulumi","state","json","corruption"],"backgroundTag":"state-corruption","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}