{"record":{"id":"facf219122b49e8d","repo":"windmill-labs/windmill","slug":"error-reading-variable-path-to-check-for-secret","errorCode":null,"errorMessage":"Error reading variable ${path} to check for secrets","messagePattern":"Error reading variable (.+?) to check for secrets","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cli/src/commands/sync/sync.ts","lineNumber":2188,"sourceCode":"          try {\n            o = JSON.parse(content);\n          } catch (error) {\n            log.error(`Failed to parse JSON variable content at path: ${path}`);\n            throw error;\n          }\n        } else {\n          try {\n            o = yamlParseContent(path, content);\n          } catch (error) {\n            log.error(`Failed to parse YAML variable content at path: ${path}`);\n            throw error;\n          }\n        }\n        if (o[\"is_secret\"]) {\n          continue;\n        }\n      } catch (e) {\n        log.warn(`Error reading variable ${path} to check for secrets`);\n      }\n    }\n\n    // Handle workspace-specific path mapping after all filtering\n    if (cachedWsName && isCurrentWorkspaceFile(path, cachedWsName)) {\n      // This is a workspace-specific file for current branch\n      const currentBranch = cachedWsName;\n      const basePath = fromWorkspaceSpecificPath(path, currentBranch);\n\n      // Only use workspace-specific files if the item type IS configured as branch-specific\n      // AND matches the pattern. Otherwise, skip and use base file instead.\n      if (!isItemTypeConfigured(basePath, specificItems)) {\n        // Type not configured as branch-specific - skip, use base file instead\n        continue;\n      }\n      if (!isSpecificItem(basePath, specificItems)) {\n        // Type configured but doesn't match pattern - skip\n        continue;","sourceCodeStart":2170,"sourceCodeEnd":2206,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/commands/sync/sync.ts#L2170-L2206","documentation":"A warning logged when the CLI tries to read a remote variable during sync to determine whether it is a secret (so secrets can be filtered out of the sync), and the read throws. The variable is treated as non-skipped default handling rather than crashing the sync.","triggerScenarios":"During `wmill sync pull` (or push diff), for each variable the CLI fetches its content to check `is_secret`; the API call fails — variable was deleted concurrently, missing permission to read the variable (read-only token without variable read access), or transient network/API error.","commonSituations":"Using a token that lacks variable read permission; a teammate deleted the variable while the sync diff was running; variable path contains characters causing a lookup failure; API server temporarily unreachable.","solutions":["Regenerate or broaden the CLI token/workspace permissions so variables can be read (variable: read).","Re-run the sync; if the variable was deleted concurrently, the next run won't reference it.","Verify the variable exists with `wmill variable list` / `wmill variable get <path>`.","If the network was transient, retry later; the warning is non-fatal either way."],"exampleFix":"// before: token without variable read\nwmill token create --scope-only scripts\n// after: include variable scope\nwmill token create --scope-only scripts,variables","handlingStrategy":"validation","validationCode":"// ensure the token can read variables before syncing\nimport { VariableService } from \"windmill-client\";\nconst vs = new VariableService(token);\nawait vs.listVariables(); // throws early if scope is missing","typeGuard":"function tokenCanReadVariables(scopes: string[]): boolean {\n  return scopes.includes(\"variables\") || scopes.includes(\"*\");\n}","tryCatchPattern":"try {\n  await wmill.sync.pull(...);\n} catch (e) {\n  // non-fatal: secret check failed for a variable; decide policy\n  console.warn(\"Secret scan incomplete; verify no secret was synced:\", e);\n}","preventionTips":["Grant the sync token variable read scope when syncing variables.","Avoid deleting variables while a sync diff is running in CI.","Regularly verify with `wmill variable list` that referenced variables exist.","Retry syncs after transient API/network failures."],"tags":["cli","variables","permissions","sync"],"backgroundTag":"secret-scan-read-failed","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}