windmill-labs/windmill · error

Vault ID field expects an array of strings in the format: `l

Error message

Vault ID field expects an array of strings in the format: `label@filename`

What it means

Raised by parse_ansible_reqs in the YAML parser while validating an Ansible playbook's vault_id entries: each entry must be a `label@vault-password-file` string collected in an array, and the YAML value did not match that shape. This fires at script parse/deploy time, not during job execution — the playbook's metadata is the input at fault.

Source

Thrown at backend/parsers/windmill-parser-yaml/src/lib.rs:556

                }
                Yaml::String(key) if key == "inventory" => {
                    ret.inventories.extend(parse_inventories(value)?);
                }
                Yaml::String(key) if key == "additional_inventories" => {
                    ret.additional_inventories
                        .extend(parse_additional_inventories(value)?);
                }
                Yaml::String(key) if key == "vault_password" => {
                    let Yaml::String(filename) = value else {
                        return Err(anyhow!(
                            "Vault Password File expects a String containing the file name"
                        ));
                    };
                    ret.vault_password = Some(filename.to_string());
                }
                Yaml::String(key) if key == "vault_id" => {
                    let Yaml::Array(filenames) = value else {
                        return Err(anyhow!("Vault ID field expects an array of strings in the format: `label@filename`"));
                    };

                    for f in filenames {
                        let Yaml::String(filename) = f else {
                            return Err(anyhow!("The elements of the vault_id field should be strings in the format: `label@filename`"));
                        };
                        validate_vault_id(filename)?;
                        ret.vault_id.push(filename.to_string());
                    }
                }
                Yaml::String(key) if key == "options" => {
                    if let Yaml::Array(opts) = &value {
                        ret.options = parse_ansible_options(opts);
                    }
                }
                Yaml::String(key) if key == "git_repos" => {
                    let Yaml::Array(repos) = &value else {
                        return Err(anyhow!("git_repos field expects an array of repos"));

View on GitHub (pinned to e474e8803c)

Solutions

1. Convert the value to a YAML array: one `- label@filename` entry per vault id.
2. Keep each element a plain string; per-element type errors produce the related element-specific error.
3. Validate with a YAML linter to confirm it parses as a sequence.

Example fix

# before
vault_id: prod@vault-pass.txt
# after
vault_id:
  - prod@vault-pass.txt

fn vault_id_is_array(doc: &Yaml) -> bool {
    matches!(yaml_lookup(doc, "vault_id"), Some(Yaml::Array(_)))
}

fn is_yaml_array(v: &Yaml) -> bool { matches!(v, Yaml::Array(_)) }

match parse_ansible_reqs(content) {
    Ok(r) => r,
    Err(e) if e.to_string().contains("Vault ID field expects an array") => {
        eprintln!("Wrap vault_id entries in a YAML list");
        Err(e)
    }
    Err(e) => Err(e),
}

When it happens

Trigger: parse_ansible_reqs sees `vault_id:` with a scalar or mapping value, e.g. `vault_id: label@file` (a plain string instead of a list).

Common situations: Providing a single vault id without the list dash, or nesting the entries under a wrong key so they parse as a mapping.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Vault Password File expects a String containing the file nam
• The elements of the vault_id field should be strings in the
• Failed to parse yaml: {}
• Invalid inventory definition
• Invalid vault_id `{value}`: expected `label@filename` using

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/77f9fe762786bef9. Report an issue: GitHub.