windmill-labs/windmill · warning

Skipping ${relPath}: a local secrets file is not part of the

Error message

Skipping ${relPath}: a local secrets file is not part of the dbt project — dbt reads its values from the environment, so set them in the script's environment variables or the descriptor's `env`

What it means

When reading a dbt module's project from disk for bundling, wmill refuses to include local secrets files (e.g. .env). A .env swept into the bundle would store the credential in every version of the script and hand it back on pull, so the file is skipped loudly instead of being uploaded.

Source

Thrown at cli/src/commands/script/script.ts:837

        // A configured `target-path` may be nested (`build/target`), so the
        // comparison is on the project-relative path, not the entry name.
        if (skipDirs.size > 0 && isUnderGeneratedDir(relPath, skipDirs)) continue;
        readDir(fullPath, relPath);
        // `.lock` is the script's own lockfile in a `__mod` bundle (the `lock`
        // field on ScriptModule) — but a dbt project's files are its author's,
        // and one may legitimately be named `uv.lock`. Dropping it would break
        // the unmodified-project round trip this bundle exists to keep.
      } else if (
        entry.isFile() &&
        (verbatim || !entry.name.endsWith(".lock")) &&
        !isEntryPointFile(entry.name, isTopLevel)
      ) {
        if (verbatim) {
          // Secrets stay on the machine that holds them. Skipped before the
          // read, and loudly: a `.env` swept into the bundle is a credential
          // stored in every version of the script and handed back on pull.
          if (isLocalSecretFile(entry.name)) {
            log.warn(
              `Skipping ${relPath}: a local secrets file is not part of the dbt project — ` +
                `dbt reads its values from the environment, so set them in the script's ` +
                `environment variables or the descriptor's \`env\``,
            );
            continue;
          }
          // A dbt project's authored files are text. A binary one -- an image
          // under `docs/`, a `.DS_Store`, a parquet seed -- would be read as
          // mojibake and, if it carries a NUL, rejected by Postgres with an
          // opaque `unsupported Unicode escape sequence`, which the push then
          // reports as success. Skip it, loudly: dbt does not read it either.
          //
          // Asked BEFORE reading: the predicate only stats the file and reads
          // its first 8 KB, so a multi-gigabyte seed next to the project costs
          // that rather than being loaded whole just to be rejected.
          const exclusion = moduleFileExclusion(fullPath);
          if (exclusion !== undefined) {
            // Over the limit but readable as text — a large seed CSV is the

View on GitHub (pinned to e474e8803c)

Solutions

1. Remove/rename the .env from the dbt project folder (e.g. keep it outside the synced directory)
2. Set the values as the script's environment variables in wmill instead
3. Put the secrets in the descriptor's `env` field so dbt receives them at run time
4. Add the secrets file to a location excluded from sync if you must keep it locally

Example fix

// before
my_dbt_project/
  dbt_project.yml
  .env          # skipped with warning
// after
my_dbt_project/
  dbt_project.yml
# secrets set as wmill script environment variables or descriptor `env`

if (files.some(f => /^\.env/.test(path.basename(f)))) throw new Error('remove secrets from dbt project');

When it happens

Trigger: Running `wmill push`/sync on a script whose dbt project folder contains a local secrets file (`.env`, `.env.local`, etc.) next to the dbt_project.yml or in the traversed directory.

Common situations: Developers keeping a .env in the dbt project root for local `dbt run`; committing project scaffolding that includes .env examples; switching between local dbt CLI workflows and wmill deployment.

Related errors

• Config contains sensitive fields (license_key, jwt_secret).
• Use --show-secrets to include them, or press Y to show them
• No encryption key found, skipping encryption. Recommend sett
• Skipping ${relPath}: not a text file, so it is not part of t
• ${relPath} is ${Math.ceil(size / 1024 / 1024)} MB, over the

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/eb1fbd5cd0d38c87. Report an issue: GitHub.