{"record":{"id":"caf9784855a01132","repo":"docker/compose","slug":"failed-to-scan-config-file-s-w","errorCode":null,"errorMessage":"failed to scan config file %s: %w","messagePattern":"failed to scan config file (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/compose/publish.go","lineNumber":728,"sourceCode":"\t\t\t\tif envFile.Required {\n\t\t\t\t\treturn nil, fmt.Errorf(\"env file %s not found\", envFile.Path)\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tfindings, err := scan.ScanFile(envFile.Path)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to scan env file %s: %w\", envFile.Path, err)\n\t\t\t}\n\t\t\tallFindings = append(allFindings, findings...)\n\t\t}\n\t}\n\n\t// Check configs defined by files\n\tfor _, config := range project.Configs {\n\t\tif config.File != \"\" {\n\t\t\tfindings, err := scan.ScanFile(config.File)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to scan config file %s: %w\", config.File, err)\n\t\t\t}\n\t\t\tallFindings = append(allFindings, findings...)\n\t\t}\n\t}\n\n\t// Check secrets defined by files\n\tfor _, secret := range project.Secrets {\n\t\tif secret.File != \"\" {\n\t\t\tfindings, err := scan.ScanFile(secret.File)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to scan secret file %s: %w\", secret.File, err)\n\t\t\t}\n\t\t\tallFindings = append(allFindings, findings...)\n\t\t}\n\t}\n\n\treturn allFindings, nil\n}","sourceCodeStart":710,"sourceCodeEnd":746,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/compose/publish.go#L710-L746","documentation":"The pre-publish secret scan failed reading a top-level config entry defined by file (configs.<name>.file). Compose scans config file contents for leaked secrets before publishing; a ScanFile error aborts.","triggerScenarios":"Publishing a project with a configs: section where config.File points to an unreadable path, a directory, a dangling symlink, or a file that yields an I/O error during read.","commonSituations":"Config file outside the repo (template generated at deploy time) so CI lacks it; path typos; permission-restricted files; config file replaced concurrently.","solutions":["Confirm the file referenced by configs.<name>.file exists and is readable by the publishing user.","Generate or copy the config file before publishing (add it to the CI pipeline ahead of the publish step).","Fix the path — for mount-relative configs ensure it resolves from the project directory as expected.","If the config content is meant to travel with the artifact, use inline content: instead of file:."],"exampleFix":"# before\nconfigs:\n  nginx-conf:\n    file: /etc/nginx/nginx.conf   # absent or unreadable in CI\n\n# after\nconfigs:\n  nginx-conf:\n    file: ./nginx/nginx.conf       # tracked, readable file","handlingStrategy":"validation","validationCode":"func configFilesPresent(project *types.Project) error {\n\tfor name, cfg := range project.Configs {\n\t\tif cfg.File == \"\" {\n\t\t\tcontinue\n\t\t}\n\t\tif fi, err := os.Stat(cfg.File); err != nil || !fi.Mode().IsRegular() {\n\t\t\treturn fmt.Errorf(\"config %s file %q missing or not a regular file\", name, cfg.File)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := publish(ctx, opts); err != nil {\n    if strings.Contains(err.Error(), \"failed to scan config file\") {\n        // materialize the config file, fix its path, retry\n    }\n    return err\n}","preventionTips":["Track config files in the repo or generate them in a deterministic CI step before publish.","Use inline content: for small configs that must ship with the artifact.","Add CI validation that every configs.<n>.file path resolves."],"tags":["compose","publish","configs","secret-scanning","io"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}