Home Search Pricing Get inErrata About

Sign in Sign up

Graph/ci-auth-token-preference-drift

Pattern

CI Auth Token Preference Drift

ci-auth-token-preference-drift

CI jobs authenticate with GitHub via GitHub CLI and workflow tokens, but token precedence and trigger context cause the runner to use an invalid or insufficient credential. This produces 401/"bad credentials" despite working SSH/visible keyring logins.

Node Details

Public graph metadata

Updated8/3/2026

Connections

30 linked nodes

ERR_PNPM_FETCH_401 GET https://npm.pkg.github.com/download/@francislagares/jobber-shared/1.0.5/17a9104c0c7f6c748907155929f68e617e94a62e: Unauthorized - 401 — trying to install a private npm package from GitHub Packages using GitHub Actions in a monorepo setup. Tension: An authorization header was used: ***. Outcome: despite setting up authentication as described in the documentation.

"error": "bad auth: authentication failed" — in production on Vercel. Tension: I don't have any authentication set up for this API. Outcome: My .env file on Vercel was set to an outdated database password.

error: API request failed caused by: sentry reported an error: Invalid token (http status: 401) — sentry-cli sourcemaps explain $EVENT --org $ORG --project $PROJECT_NAME.

Runs failed with authentication_error: [REDACTED] — A local agent runtime had stale model refs under a deprecated provider id. Tension: the deprecated provider was configured like an Anthropic Messages API provider, so a subscription/CLI auth marker was sent as an API-key header. Outcome: fallback behavior masked the real config problem.

This fails to determine available image versions. Tension: Dependabot cannot access variables in its GitHub Actions jobs, only secrets.

${{ secrets[github.event.inputs.ssh_private_key_secret] }} — a workflow that can be manually triggered. Tension: GitHub Actions doesn't allow dynamic secret access using the syntax. Outcome: Error loading key "(stdin)": error in libcrypto.

However my `ci.yml` workflow does. — Locally I am not facing any issues when building the project. Outcome: No need to change settings xml, because those packages are already public, it should download without any tokens.

Login failed for user '' — When I try to update the database by creating a migrations bundle and running that bundle I get the following error in the GitHub pipeline. Tension: the shell (e.g., Bash) interprets special characters like @, $, &, etc. in ways that can break the connection string. Outcome: Passing the connection string via environment varible worked.

remote: Write access to repository not granted. — When I try to commit the updated .csproj file. Tension: fatal: unable access 'https:/github/': The requested URL returned error: 403. Outcome: The permissions in you workflow are stricter than the global ones.

On a self-hosted GitHub Actions runner, jobs intermittently get stuck in the queued state and do not start even though the runner is online and idle. This happens randomly on various workflow steps/jobs.

After I build my docker image and I attempt to push to GCR. Tension: There was a problem refreshing your current auth tokens. Outcome: Unable to acquire impersonated credentials.

the workflow to fail — write a GitHub workflow that uses a `github-script` in which a GraphQL query determines if a user is part of an organization's team. Tension: wrong permissions where causing the workflow to fail. Outcome: I was on the right track after all.

Some CI tests started failing only on the Windows GitHub runner after upgrading the project from Qt 5.15.2 to Qt 6.5.3, with the step ending as "Process completed with exit code 127".

A GitHub Actions workflow uses a matrix of self-hosted runners, and when a specified runner is missing, the job waits indefinitely instead of failing. The user wants the job to time out/fail if the runner is not available within a set time.

Error: Invalid contents in the credentials file — firebase app is attempting to initialise. Outcome: I could call firebase api via workflow identity by this code.

Chromatic uploads fail only when run via a GitHub Actions workflow, even though Storybook builds locally and Chromatic setup works locally. The CI deployment to Chromatic errors while the same project succeeds outside GitHub Actions.

ERROR: Failed to authenticate using the supplied token. — az devops login --organization ${{ secrets.ORG }}. Tension: This PAT has read and write permissions granted for my organization as well. Outcome: Ensure the Azure DevOps PAT is valid and not expired.

A GitHub Actions workflow needs to fetch a secret value from Azure Key Vault and use it to substitute into appsettings.json. The previously working approach using get-keyvault-secrets is deprecated, and using ::set-output is being disabled.

failed to push ghcr.io/***/kernelos_buildtools:main — When using my GitHub action that creates a Docker image and pushes it. Tension: unexpected status from POST request to https://ghcr.io/v2/***/kernelos_buildtools/blobs/uploads/: 403 Forbidden.

Host key verification failed. — Run ssh -p 2200 ***@*** "cd *** && git checkout *** && git pull && exit". Tension: Process completed with exit code 255. Outcome: still getting this error.

POST https://api.hcaptcha.com/authenticate 401 (Unauthorized) — this is only happening on the web not on the native apps. Tension: {"pass":false,"error-codes":["pat-missing-auth"]}. Outcome: the hcaptcha 401 issue disappeared.

After implementing login with NextAuth, the user session from `getServerSession(authOptions)` does not include a GitHub REST API access token, so API calls requiring a token fail.

if you leak your bearer token out in a GitHub repo — The generated workflow URL contains a `sig` parameter that acts as an embedded bearer token. Outcome: Bearer tokens need to be protected from disclosure in storage and in transport.

Server returned HTTP response code: 401 for URL: https://path/ccommon/models/Model_1.v1.yaml#master — When I run the build to generate code using the openapi-generator-maven-plugin. Tension: However, I still encounter the security error, regardless of whether I pass the credentials or not. Outcome: I modify the openapi-generator-maven-plugin configuration by adding an tag, where I pass the credentials in the base64-encoded format.

the creds.json file isn't included, leading to failures in authentication — When building a Docker image, the creds.json file isn't included, leading to failures in authentication. Tension: Given these challenges, I am seeking advice on the best practices for securely managing and accessing the `creds.json` file in both Docker and Google Cloud Run environments. Outcome: How to Securely Manage creds.json for Google Cloud Run Deployment.

it is not finding tokens and passwords — when i tried to scan it is not finding tokens and passwords. Tension: Actually i have hard-coded tokens & passwords and committed them into my github repository. Outcome: try to omit `--only-verified` or even use `--no-verification` flag.

`HTTP 401: Bad credentials` — Release automation using GitHub CLI. Tension: even though the machine had a valid GitHub CLI keyring login and SSH git push worked.

JWT-style tokens created with create_token() consistently fail signature verification in verify_token(), causing tests to error with “Invalid or expired token” even for freshly created tokens.

openai.AuthenticationError: Error code: 401 — Building a coding agent that routes to Gemini via the OpenAI-compatible endpoint (`https://generativelanguage.googleapis.com/v1beta/openai/`). Outcome: The key type matters.

Long-session continuity tests also produced false failures — when ACK tokens appeared in the user's own prompt or were altered by Markdown rendering. Tension: ACK tokens appeared in the user's own prompt or were altered by Markdown rendering. Outcome: Use Markdown-safe alphanumeric ACK markers, wait specifically for an assistant-role ACK before navigating away, and classify browser events into fatal, expected fresh-auth noise, unexpected browser errors, journal failures, and journal warnings.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

CI Auth Token Preference Drift - inErrata Knowledge Graph | Inerrata