windmill-labs/windmill · warning

Error reading variable ${path} to check for secrets

Error message

Error reading variable ${path} to check for secrets

What it means

A warning logged when the CLI tries to read a remote variable during sync to determine whether it is a secret (so secrets can be filtered out of the sync), and the read throws. The variable is treated as non-skipped default handling rather than crashing the sync.

Source

Thrown at cli/src/commands/sync/sync.ts:2188

          try {
            o = JSON.parse(content);
          } catch (error) {
            log.error(`Failed to parse JSON variable content at path: ${path}`);
            throw error;
          }
        } else {
          try {
            o = yamlParseContent(path, content);
          } catch (error) {
            log.error(`Failed to parse YAML variable content at path: ${path}`);
            throw error;
          }
        }
        if (o["is_secret"]) {
          continue;
        }
      } catch (e) {
        log.warn(`Error reading variable ${path} to check for secrets`);
      }
    }

    // Handle workspace-specific path mapping after all filtering
    if (cachedWsName && isCurrentWorkspaceFile(path, cachedWsName)) {
      // This is a workspace-specific file for current branch
      const currentBranch = cachedWsName;
      const basePath = fromWorkspaceSpecificPath(path, currentBranch);

      // Only use workspace-specific files if the item type IS configured as branch-specific
      // AND matches the pattern. Otherwise, skip and use base file instead.
      if (!isItemTypeConfigured(basePath, specificItems)) {
        // Type not configured as branch-specific - skip, use base file instead
        continue;
      }
      if (!isSpecificItem(basePath, specificItems)) {
        // Type configured but doesn't match pattern - skip
        continue;

View on GitHub (pinned to e474e8803c)

Solutions

1. Regenerate or broaden the CLI token/workspace permissions so variables can be read (variable: read).
2. Re-run the sync; if the variable was deleted concurrently, the next run won't reference it.
3. Verify the variable exists with `wmill variable list` / `wmill variable get <path>`.
4. If the network was transient, retry later; the warning is non-fatal either way.

Example fix

// before: token without variable read
wmill token create --scope-only scripts
// after: include variable scope
wmill token create --scope-only scripts,variables

// ensure the token can read variables before syncing
import { VariableService } from "windmill-client";
const vs = new VariableService(token);
await vs.listVariables(); // throws early if scope is missing

function tokenCanReadVariables(scopes: string[]): boolean {
  return scopes.includes("variables") || scopes.includes("*");
}

try {
  await wmill.sync.pull(...);
} catch (e) {
  // non-fatal: secret check failed for a variable; decide policy
  console.warn("Secret scan incomplete; verify no secret was synced:", e);
}

When it happens

Trigger: During `wmill sync pull` (or push diff), for each variable the CLI fetches its content to check `is_secret`; the API call fails — variable was deleted concurrently, missing permission to read the variable (read-only token without variable read access), or transient network/API error.

Common situations: Using a token that lacks variable read permission; a teammate deleted the variable while the sync diff was running; variable path contains characters causing a lookup failure; API server temporarily unreachable.

Related errors

• Error reading dir: ${localP}, ${e}
• Failed to pull shared UI folder: ${e}
• This workspace has folder default_permissioned_as rules that
• Workspace folder not found, are you in the right directory?
• Not a fileset resource path: ${changePath}

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/facf219122b49e8d. Report an issue: GitHub.