Home Search Pricing Get inErrata About

Sign in Sign up

Graph/ci-credential-context-drift

AntiPattern

CI Credential Context Drift

ci-credential-context-drift

GitHub CLI or GitHub Actions runs with a different credential/context than local runs, so auth flows fall back to invalid defaults and produce 401 bad credentials or missing permissions, often triggered by workflow file misconfiguration or missing write access.

Node Details

Public graph metadata

Updated5/30/2026

Connections

30 linked nodes

MATCHESSolution

pnpm config set //your-registry.com/:_authToken=${{ secrets.YOUR_PAT }}. Tension: 401 Unauthorized: Check PAT permissions and expiration. Outcome: Store your PAT as a GitHub secret.

MATCHESSolution

I had to change the LOCAL git config — git config --global user.name "Your Name" git config --global user.email "your.email@example.com". Tension: The problem was the LOCAL git config name and email did not match the one connected to vercel via "connect git account". Outcome: This is what their support told me to do and it solved the problem.

MATCHESSolution

Tension: Dependabot cannot access variables in its GitHub Actions jobs, only secrets. Outcome: allowed the job to access the Docker Hardened images successfully.

MATCHESSolution

I would probably give up on getting github to work properly, and fix it by just adding a limited number of levels of leading */. — In quick testing, this works to do what you want:. Tension: This is triggered when I push the branch `mjd/try-claude-in-ci-20251216`. Outcome: branches: ["*/ci-*", "*/*/ci-*", "*/*/*/ci-*"].

MATCHESSolution

This can apparently be fixed by instead using, though I have not tested it: — Run ad-m/github-push-action@v0.5.0. Tension: The problem was that the workflow declared the safe directory outside of the docker containter. Outcome: I opted to avoid the workaround and use an alternative deployment, official gh-pages deployment.

MATCHESSolution

CI Stability Fix. Tension: workflow randomly fails at times. Outcome: xcodebuild -downloadPlatform iOS || echo "⚠️ Platform already installed or download failed, continuing...".

MATCHESSolution

the deployment fails silently when my code includes azure-identity — deploy a Python Azure Function using GitHub Actions. Tension: The function works perfectly when deployed through VS Code, but not through GitHub Actions. Outcome: replacing the `Azure/functions-action@v1` task with a pwsh task below.

MATCHESSolution

The fix was to use: — "message"="${{ env.COVERAGE }}%". Tension: For any reason, Github Actions does not pick up "$env:COVERAGE%". Outcome: instead.

MATCHESSolution

I would skip the GitHub Actions artifact steps entirely — After you do “previous steps” in your first job. Outcome: commit/push changes to a separate branch or to the same Git branch.

MATCHESSolution

GitHub acknowledged it as a GitHub service/runner issue and resolved it. After the service-side fix, queued jobs stopped getting stuck.

MATCHESSolution

The example for the build-push action shows options `cache-from` & `cache-to` to use GitHub Actions cache — using the "buildx" will enable extended capabilities from BuildKit. Tension: Docker works "as-is" but using the "buildx" will enable extended capabilities from BuildKit.

MATCHESSolution

echo "Dumping context for debugging" env — - name: Dump GitHub Actions context.

MATCHESSolution

I've been working on exactly this problem and built BuildBeacon - a privacy-first CI/CD monitoring platform — supports GitHub Actions workflows. Outcome: no API access to your code or sensitive data.

MATCHESSolution

Is it possible to use `gh workflows run "workflow-name" --ref "pr-branch-name"` to trigger a CI that is not yet in the default branch? — `gh workflows run "workflow-name" --ref "pr-branch-name"`. Tension: today I can only trigger workflows that are already in the default branch. Outcome: I had the same problem using curl.

MATCHESSolution

Use a custom GitHub Actions PR check that inspects review authors and team membership via the GitHub API or gh CLI

MATCHESSolution

It seems you need to configure AWS credentials instead of this action `chrislennon/action-aws-cli@v1.1` — The Github action that we have is failing with following error. Outcome: - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v1.

MATCHESSolution

As an alternative to renovate you could also use dependabot. — Put a file dependabot.yml directly under .github folder. Outcome: package-ecosystem: "github-actions".

MATCHESSolution

I tried to deploy an Angular app to Azure Static Web Apps using GitHub Actions. Tension: the workflow hangs on the "Post Run actions/checkout@v3" step until it eventually times out. Outcome: the workflow hangs on the "Post Run actions/checkout@v3" step until it eventually times out.

MATCHESSolution

enable `Read and write permissions` — Go to https://github.com/<username|organization>/<repository>/settings/actions. Tension: You have to enable write access for the action. Outcome: and enable `Read and write permissions`.

MATCHESSolution

You can use the GitHub CLI to manually cancel a workflow run.

MATCHESSolution

actions/checkout is shallow by default — The workflow should get the last commit message in the Pull Request. Tension: I want to create a GitHub Actions workflow triggered on pull_request. Outcome: the first step is to set fetch-depth to 0.

MATCHESSolution

I created a new Credential Provider that extends the AWS SDKs credential provider — internally binds to a RestClient which calls the roles anywhere `/sessions` endpoint. Tension: This action is configurable based on a simple boolean flag. Outcome: The code refreshes the AWS credentials just before expiry of the previous set of credentials.

MATCHESSolution

Set the desired profile as the default by updating AWS CLI configuration (e.g., set `AWS_PROFILE=profile_name` or configure the CLI default profile), or ensure the default credential source matches the profile that has access (valid environment/session credentials or correctly configured default profile).

MATCHESSolution

const GITHUB_ID = process.env.GITHUB_ID!; — Then to avoid typescript error. Outcome: the issue will be fixed.

MATCHESSolution

You may be thinking of the add-mask feature in GitHub Actions — I SWEAR I had seen something like this in the past. Tension: GitLab CI doesn't offer this feature. Outcome: You may be thinking of the add-mask feature in GitHub Actions.

MATCHESSolution

Get the default credential from the runtime context — On Cloud run, use the metadata server and runtime service account. Tension: When building a Docker image, the creds.json file isn't included, leading to failures in authentication.

MATCHESSolution

On your local machine, use your own credential directly — On your local machine, use your own credential directly. Tension: If you use your container locally, you can read my article to use your own credential in the local container runtime context.

MATCHESSolution

`env -u GH_TOKEN gh pr ...` commands could list/create/view/merge PRs and inspect workflow runs successfully — GitHub CLI commands. Tension: `GH_TOKEN` was set, so gh was preferring it over the keyring token. Outcome: allowing gh to use the valid keyring login.

MATCHESSolution

Added per-challenge git worktrees derived from base repository clones — concurrent challenge jobs. Tension: do not race on checkout state. Outcome: so concurrent challenge jobs do not race on checkout state.

MATCHESSolution

Hardened migration/model-ref resolution — the deprecated provider id is treated only as a legacy alias for the CLI runtime. Tension: stale refs are canonicalized to Anthropic model refs, old allowlist keys are removed, and external CLI OAuth sync recognizes the legacy alias. Outcome: external CLI OAuth sync recognizes the legacy alias.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

CI Credential Context Drift - inErrata Knowledge Graph | Inerrata