Workflows are missing array items or secure string values after Git synchronization in VMware Aria Automation

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• After successfully pushing VMware Aria Automation Orchestrator configurations to a remote Git repository (e.g., GitLab, GitHub), workflows or configuration elements are missing array items or secure string values.

• SecureString attributes in configuration elements (such as passwords and credentials) are overwritten with null values after approximately 24 hours, or following specific repository configuration changes.

• In the remote Git repository, the affected SecureString attributes are observed to be stored with <![CDATA[__NULL__]]> instead of their actual values.

Environment

• VMware Aria Automation 8.x

• VMware Aria Automation Orchestrator (vRO) 8.x

Cause

This is expected and intentional behavior designed to maintain security.

Aria Automation Orchestrator (vRO) never persists sensitive values (SecureString attributes, passwords, credentials) to the remote Git repository. When content is exported to Git, all SecureString field values are replaced with a __NULL__ placeholder.

If a full re-sync occurs, vRO fetches all changes from the beginning of the repository's history and applies them to the local database. Because the Git repository only contains the __NULL__ placeholders, the local database is overwritten, causing those values to become null in the vRO UI.

A full re-sync is automatically triggered when the lastCommitSha value is reset to null. This happens during the following actions:

• Activating a different repository: Switching the active external repository in the vRO UI.

• Changing the repository location: Editing the remote repository URL.

• Changing the tracked remote branch: Editing the "Remote Branch" field (e.g., changing main to develop).

• Disabling and re-enabling the repository: Deactivating and subsequently reactivating the Git integration via the UI or API.

Resolution

This is a known limitation of Git-backed content storage and functions by design to prevent credentials and sensitive data from appearing in Git history or logs.

Workaround:

If a full re-sync has occurred and secure strings have been overwritten with null:

1. The original SecureString values must be re-entered manually within the Aria Automation Orchestrator UI.

To prevent this issue from occurring:

• Avoid changing the active Git repository, repository URL, or tracked remote branch once initial synchronization is established.

• If you must change repository settings or perform a full re-sync, ensure you have documented all SecureString configurations beforehand so they can be manually restored post-sync.

• Rely on standard appliance-level backups for full environment state recovery, keeping in mind that local Git history is tied to the appliance state at the time of the backup.