pulumi/pulumi · error

unmarshaling deployment: %w

Error message

unmarshaling deployment: %w

What it means

Wraps an error from stack.UnmarshalUntypedDeployment during `pulumi config refresh`. The exported deployment JSON could not be deserialized, so the secrets provider could not be restored into the local config.

Source

Thrown at pkg/cmd/pulumi/config/config.go:632

			ps.Config = latest.Config

			// If the backend is returning envs, then we want to use them.
			//
			// We don't overwrite unconditionally because we don't want to to remove environments from users
			// that are using a non-cloud backend.
			if len(latest.Environments) > 0 {
				ps.Environment = workspace.NewEnvironment(latest.Environments)
			}

			// Also restore the secrets provider from state
			untypedDeployment, err := backend.ExportStackDeployment(ctx, s)
			if err != nil {
				return fmt.Errorf("getting deployment: %w", err)
			}
			deployment, err := stack.UnmarshalUntypedDeployment(ctx, untypedDeployment)
			if err != nil {
				return fmt.Errorf("unmarshaling deployment: %w", err)
			}
			if deployment.SecretsProviders != nil {
				// TODO: It would be really nice if the format of secrets state in the config file matched
				// what we kept in the statefile. That would go well with the pluginification of secret
				// providers as well, but for now just switch on the secret provider type and ask it to fill in
				// the config file for us.
				switch deployment.SecretsProviders.Type {
				case passphrase.Type:
					err = passphrase.EditProjectStack(ps, deployment.SecretsProviders.State)
				case cloud.Type:
					err = cloud.EditProjectStack(ps, deployment.SecretsProviders.State)
				default:
					// Anything else assume we can just clear all the secret bits
					ps.EncryptionSalt = ""
					ps.SecretsProvider = ""
					ps.EncryptedKey = ""
				}

View on GitHub (pinned to 793f7b2e16)

Solutions

1. Verify the CLI version is current (`pulumi version`; upgrade) so the deployment schema matches.
2. Inspect the exported deployment (`pulumi stack export`) for malformed JSON; if corrupt, restore from a checkpoint backup.
3. For object-storage backends, check the stored deployment file for truncation and re-upload from a good backup.
4. As a workaround, run refresh with --config-file and/or manually set the secretsprovider fields in the stack config, skipping state restore.

Example fix

// before (corrupt state)
pulumi config refresh  # unmarshaling deployment: ...
// after
pulumi version                      # upgrade CLI if outdated
pulumi stack export > check.json    # inspect/repair deployment JSON
pulumi stack import --file check.json
pulumi config refresh

# validate deployment JSON parses before refreshing
pulumi stack export --stack "$STACK" | jq -e . > /dev/null || { echo "deployment state is corrupt"; exit 1; }

if ! pulumi config refresh; then
  echo "refresh failed; restore state from backup before retrying"
  pulumi stack import --file backup.json
fi

When it happens

Trigger: Run `pulumi config refresh` when the deployment blob returned by the backend is not valid untyped-deployment JSON: corrupted or truncated state in the backend, state written by a much older/newer incompatible CLI version, or manual edits to backend storage.

Common situations: State corruption after interrupted writes to object-storage backends; importing state hand-edited or migrated across versions; backend storage holding a partial deployment export.

Related errors

• failed to read overrides file: %w
• failed to parse overrides file: %w
• failed to verify integrity of destination snapshot: %w
• failed to verify integrity of source snapshot: %w
• source stack has no resources

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/aef9b8bdfe3ba0e5. Report an issue: GitHub.