windmill-labs/windmill · error · Error

Cannot make variable "${args.path}" secret without a value:

Error message

Cannot make variable "${args.path}" secret without a value: it currently holds an empty one, so there would be nothing to encrypt. Pass the value it should hold.

What it means

Converting a non-secret variable to secret requires a value to encrypt. If the variable currently holds an empty string and no new value is supplied, there is nothing to encrypt, so the deploy would be invalid; this error surfaces that constraint up front.

Source

Thrown at frontend/src/lib/components/copilot/chat/global/core.ts:4688

	}
	const is_secret = args.is_secret ?? base?.variable.is_secret ?? false
	// '' is the sentinel for "nothing staged" in a secret draft, so it cannot also mean
	// "set the secret to empty". Refusing it matters because a model reaching for a
	// placeholder — the habit this schema change removes — would otherwise wipe the secret.
	if (is_secret && args.value === '') {
		throw new Error(
			`An empty string is not a valid value for secret variable "${args.path}". Omit value to keep the stored secret, or pass the real new one.`
		)
	}
	// Securing one needs a value too when it holds none: the deploy would send no `value`
	// (nothing is staged) and the backend refuses an is_secret change without one. Saying
	// so here keeps the model from having to interpret that error.
	if (
		is_secret &&
		base?.variable.is_secret === false &&
		(args.value ?? base.variable.value) === ''
	) {
		throw new Error(
			`Cannot make variable "${args.path}" secret without a value: it currently holds an empty one, so there would be nothing to encrypt. Pass the value it should hold.`
		)
	}
	// Un-securing always needs a new plaintext value. An `$encrypted:` marker is no
	// help: the deploy endpoints only decrypt it while the target stays secret, so
	// carrying it into a non-secret variable would store the marker as the value.
	if (is_secret === false && base?.variable.is_secret === true && args.value === undefined) {
		throw new Error(
			`Cannot turn secret variable "${args.path}" into a non-secret one without a value: its stored value cannot be read, so it would be replaced by an empty one. Pass the new plaintext value, or leave is_secret unset to keep it secret.`
		)
	}
	return {
		is_secret,
		value: args.value ?? base?.variable.value ?? '',
		description: args.description ?? base?.variable.description ?? ''
	}
}

View on GitHub (pinned to e474e8803c)

Solutions

1. Pass the value the variable should hold along with is_secret: true
2. If the variable should stay empty, keep it non-secret

Example fix

// before
writeVariable({ path: 'u/admin/TOKEN', is_secret: true }) // currently holds ''
// after
writeVariable({ path: 'u/admin/TOKEN', is_secret: true, value: 'real-token' })

if (args.is_secret && !existingIsSecret && (args.value ?? current) === '') {
  throw new Error('provide a value to encrypt');
}

function canMakeSecret(args, base) { return args.is_secret !== true || typeof args.value === 'string' && args.value !== ''; }

try { writeVariable(args) } catch (e) { if (e.message.includes('nothing to encrypt')) addValue(args); }

When it happens

Trigger: A write_variable call with is_secret=true (explicitly or resolved) where the base variable is_secret is false and (args.value ?? base.variable.value) === '' — i.e. switching an empty non-secret variable to secret without providing a value.

Common situations: The model hardens an empty placeholder variable into a secret without staging a value first.

Related errors

• An empty string is not a valid value for secret variable "${
• Cannot turn secret variable "${args.path}" into a non-secret
• Draft variable "${draftValue.path}" is secret but stages no
• Variable "${args.path}" does not exist yet, so creating it r
• A variable was created at ${path} while this setup was runni

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/64f9027c18018f4b. Report an issue: GitHub.