windmill-labs/windmill · error

Git ssh identity file must be a string path to a Windmill va

Error message

Git ssh identity file must be a string path to a Windmill variable/secret

What it means

extract_ssh_identity throws this when an element of the `git_ssh_identity` array is not a YAML string. Each element must be a string naming a Windmill variable/secret containing an SSH identity file; numbers, booleans, maps, or nested lists inside the array trigger this error.

Source

Thrown at backend/parsers/windmill-parser-yaml/src/lib.rs:612

    let mut out_str = String::new();
    let mut emitter = YamlEmitter::new(&mut out_str);

    for i in 1..docs.len() {
        emitter.dump(&docs[i])?;
    }
    Ok((logs, Some(ret), out_str))
}

fn extract_ssh_identity(value: &Yaml, ret: &mut Vec<String>) -> anyhow::Result<()> {
    let Yaml::Array(indentities) = value else {
        return Err(anyhow!(
            "git_ssh_identity expects an array of windmill variables (or secrets) containing ssh IDs"
        ));
    };

    for r in indentities {
        let Yaml::String(file_name) = r else {
            return Err(anyhow!(
                "Git ssh identity file must be a string path to a Windmill variable/secret"
            ));
        };

        ret.push(file_name.clone());
    }
    Ok(())
}

fn extract_delegate_to_git_repo_details(value: &Yaml) -> Option<DelegateToGitRepoDetails> {
    if let Yaml::Hash(v) = value {
        if let Some(resource) = v
            .get(&Yaml::String("resource".to_string()))
            .and_then(|s| s.as_str())
            .map(|s| s.to_string())
        {
            let playbook = v
                .get(&Yaml::String("playbook".to_string()))

View on GitHub (pinned to e474e8803c)

Solutions

1. Make every list item a quoted or plain string path to a Windmill variable/secret
2. Quote items that could be misparsed as numbers/booleans (e.g. '0123', 'yes')
3. Remove empty list entries
4. Verify no accidental nested list under git_ssh_identity

Example fix

# before
git_ssh_identity:
  -

# after
git_ssh_identity:
  - u$ssh_identity_var

fn validate_ssh_identity_items(value: &Yaml) -> Result<(), String> {
    if let Yaml::Array(items) = value {
        for (i, it) in items.iter().enumerate() {
            if !matches!(it, Yaml::String(_)) {
                return Err(format!("git_ssh_identity[{}] is not a string", i));
            }
        }
    }
    Ok(())
}

fn is_string(v: &Yaml) -> bool {
    matches!(v, Yaml::String(_))
}

When it happens

Trigger: parse_ansible_reqs or parse_delegate_to_git_repo iterating a `git_ssh_identity` array encounters a non-string element (e.g. an unquoted value that YAML parses as an integer/boolean, a nested map, or a null `-` entry).

Common situations: Unquoted variable references starting with characters YAML treats specially; a list item left empty (`-`); accidentally nesting another list; pasting the variable's value instead of its path.

Related errors

• git_ssh_identity expects an array of windmill variables (or
• git_repos field expects an array of repos
• Failed to parse git repo: {e}
• Should be a Map
• Expected `url` field

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/d8b189dfd573860a. Report an issue: GitHub.