{"record":{"id":"eccea988ebb230f5","repo":"windmill-labs/windmill","slug":"secret-value-looks-already-encrypted-pushing-it-a","errorCode":null,"errorMessage":"Secret value looks already-encrypted; pushing it as-is. If it is a plaintext secret, re-run with --plain-secrets so it gets encrypted.","messagePattern":"Secret value looks already-encrypted; pushing it as-is\\. If it is a plaintext secret, re-run with --plain-secrets so it gets encrypted\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/src/commands/variable/variable.ts","lineNumber":239,"sourceCode":"  // A secret value in a single-file push is authored by the user and is\n  // therefore plaintext that must be encrypted server-side — unless it has the\n  // shape of workspace ciphertext (a value round-tripped from `sync pull`).\n  // Pushing plaintext as already-encrypted would brick the variable. An explicit\n  // --plain-secrets always forces the plaintext (encrypt) path.\n  let plainSecrets = opts.plainSecrets ?? false;\n  if (opts.plainSecrets === undefined && local.is_secret) {\n    if (!looksLikeWorkspaceCiphertext(local.value)) {\n      log.info(\n        colors.yellow(\n          \"Secret value is not in encrypted form; pushing as plaintext to be encrypted server-side (pass --plain-secrets to silence).\"\n        )\n      );\n      plainSecrets = true;\n    } else {\n      // The value has the shape of workspace ciphertext, so it's stored as-is.\n      // A plaintext secret that coincidentally looks like ciphertext (e.g. a\n      // base64 token) would be stored unreadable, so surface the assumption.\n      log.warn(\n        \"Secret value looks already-encrypted; pushing it as-is. If it is a plaintext secret, re-run with --plain-secrets so it gets encrypted.\"\n      );\n    }\n  }\n\n  await pushVariable(\n    workspace.workspaceId,\n    remotePath,\n    undefined,\n    local,\n    plainSecrets,\n    undefined,\n    true // single-file push is authoritative: allow secret->non-secret downgrade\n  );\n  log.info(colors.bold.underline.green(`Variable ${remotePath} pushed`));\n}\n\nasync function add(","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/commands/variable/variable.ts#L221-L257","documentation":"Heuristic branch in variable push: --plain-secrets was not passed and the secret's value matches the shape of workspace ciphertext (looksLikeWorkspaceCiphertext), so it is pushed verbatim as already-encrypted instead of being encrypted server-side. The warning flags the risk that a plaintext secret merely looking like ciphertext would be stored unencrypted.","triggerScenarios":"Thrown at cli/src/commands/variable/variable.ts:239 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["If the value is plaintext, re-run the push with --plain-secrets so it gets encrypted","If it genuinely is ciphertext round-tripped from `sync pull`, no action needed","Avoid hand-writing secret values that mimic ciphertext formats"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}