[GH-ISSUE #497] Github Enterprise

kerem commented

2026-03-01 21:42:30 +03:00

Owner

Originally created by @MichaelSp on GitHub (Jan 21, 2021).
Original GitHub issue: https://github.com/nektos/act/issues/497

Unfortunately GH Enterprise is not supported.

For actions to work on Enterprise you'll have to mirror the actions (ugly but 🤷). In our enterprise setup this means we'll have to define the official action https://github.com/github/super-linter/
as mirrored in https://<gh-enterprise>/ghcom-actions/github-super-linter
Now additionally we're required to authenticate even for git clone.

This is the current output with -v:

[...]
[CI/lint] ⭐  Run Lint Code Base
[CI/lint]   ☁  git clone 'https://github.com/ghcom-actions/github-super-linter' # ref=v3
[CI/lint]   cloning https://github.com/ghcom-actions/github-super-linter to /Users/<user>/.cache/act/ghcom-actions-github-super-linter@v3
[CI/lint] Unable to clone https://github.com/ghcom-actions/github-super-linter refs/heads/v3: authentication required
DEBU[0016] authentication required

for the following ci.yml

jobs:
  lint:
    runs-on: self-hosted
    steps:
    - name: Lint Code Base
      uses: ghcom-actions/github-super-linter@v3
      env:
        VALIDATE_HTML: false
        DEFAULT_BRANCH: master
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

For that to work we need:

The correct enterprise URL instead of github.com
possibility to do authentication. Ideally inherit authentication from git-cli.

Originally created by @MichaelSp on GitHub (Jan 21, 2021). Original GitHub issue: https://github.com/nektos/act/issues/497 Unfortunately GH Enterprise is not supported. For actions to work on Enterprise you'll have to mirror the actions (ugly but 🤷). In our enterprise setup this means we'll have to define the official action `https://github.com/github/super-linter/` as mirrored in `https://<gh-enterprise>/ghcom-actions/github-super-linter` Now additionally we're required to authenticate even for `git clone`. This is the current output with `-v`: ``` [...] [CI/lint] ⭐ Run Lint Code Base [CI/lint] ☁ git clone 'https://github.com/ghcom-actions/github-super-linter' # ref=v3 [CI/lint] cloning https://github.com/ghcom-actions/github-super-linter to /Users/<user>/.cache/act/ghcom-actions-github-super-linter@v3 [CI/lint] Unable to clone https://github.com/ghcom-actions/github-super-linter refs/heads/v3: authentication required DEBU[0016] authentication required ``` for the following `ci.yml` ```yaml jobs: lint: runs-on: self-hosted steps: - name: Lint Code Base uses: ghcom-actions/github-super-linter@v3 env: VALIDATE_HTML: false DEFAULT_BRANCH: master GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} ``` For that to work we need: 1. The correct enterprise URL instead of `github.com` 2. possibility to do authentication. Ideally inherit authentication from `git-cli`.

kerem

2026-03-01 21:42:30 +03:00

closed this issue
added the
kind/feature-request

needs-work

stale-exempt

area/cli
labels

kerem commented

2026-03-01 21:42:31 +03:00

Author

Owner

@catthehacker commented on GitHub (Feb 8, 2021):

Hi @MichaelSp 👋

The correct enterprise URL instead of github.com

Working on it.

possibility to do authentication. Ideally inherit authentication from git-cli.

Could you clarify which tool you think of?
I never used GitHub Enterprise Server but from the docs it looks like it should be able to handle authentication via PAT

@catthehacker commented on GitHub (Feb 8, 2021): Hi @MichaelSp 👋 > 1. The correct enterprise URL instead of `github.com` Working on it. > 2. possibility to do authentication. Ideally inherit authentication from `git-cli`. Could you clarify which tool you think of? I never used GitHub Enterprise Server but from the docs it looks like it should be able to handle authentication via [PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token)

kerem commented

2026-03-01 21:42:31 +03:00

Author

Owner

@MichaelSp commented on GitHub (Feb 8, 2021):

Could you clarify which tool you think of?

There are two ways to do authentication against GH:

for HTTPS based access: PAT
for SSH based access: SSH-Key

For most cases the git shell command should know which protocol and also which credentials to use (token/key/OS provided cred-helper/...). I think the easiest way would be to reuse these information. TBH: I'm not a go expert, but I'm sure there is some kind of "official"(tm) way to use git clone and reuse the existing client config.

By the way: We have two enterprise instances. One with HTTPS/SSH and one with HTTPS-only.

@MichaelSp commented on GitHub (Feb 8, 2021): > Could you clarify which tool you think of? There are two ways to do authentication against GH: 1. for HTTPS based access: PAT 2. for SSH based access: SSH-Key For most cases the `git` shell command should know which protocol and also which credentials to use (token/key/OS provided cred-helper/...). I think the easiest way would be to reuse these information. TBH: I'm not a go expert, but I'm sure there is some kind of "official"(tm) way to use `git clone` and reuse the existing client config. By the way: We have two enterprise instances. One with HTTPS/SSH and one with HTTPS-only.

kerem commented

2026-03-01 21:42:31 +03:00

Author

Owner

@catthehacker commented on GitHub (Feb 8, 2021):

Oh, ok, you meant git. I thought git-cli is some fancy CLI tool for GitHub or something like that.
https://github.com/catthehacker/act-fork/tree/enterprise-github

@catthehacker commented on GitHub (Feb 8, 2021): Oh, ok, you meant `git`. I thought `git-cli` is some fancy CLI tool for GitHub or something like that. https://github.com/catthehacker/act-fork/tree/enterprise-github

kerem commented

2026-03-01 21:42:31 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Mar 11, 2021):

Issue is stale and will be closed in 14 days unless there is new activity

@github-actions[bot] commented on GitHub (Mar 11, 2021): Issue is stale and will be closed in 14 days unless there is new activity

kerem commented

2026-03-01 21:42:32 +03:00

Author

Owner

@catthehacker commented on GitHub (Mar 11, 2021):

Hi @cplee, could you add stale-exempt label to this issue, please?

@catthehacker commented on GitHub (Mar 11, 2021): Hi @cplee, could you add `stale-exempt` label to this issue, please?

kerem commented

2026-03-01 21:42:32 +03:00

Author

Owner

@KnisterPeter commented on GitHub (May 5, 2021):

@cplee @catthehacker: We, @ZauberNerd and I are continue working on #658. Currently we want to test the PR against our GHE instance.
A question which is still a bit unclear: Do you have any perference on how the authentication token (probably PAT) should be made available to act? A CLI flag sounds a bit dangerous to me if someone wants to run act e.g. in a CI environment.

@KnisterPeter commented on GitHub (May 5, 2021): @cplee @catthehacker: We, @ZauberNerd and I are continue working on #658. Currently we want to test the PR against our GHE instance. A question which is still a bit unclear: Do you have any perference on how the authentication token (probably PAT) should be made available to `act`? A CLI flag sounds a bit dangerous to me if someone wants to run act e.g. in a CI environment.

kerem commented

2026-03-01 21:42:32 +03:00

Author

Owner

@KnisterPeter commented on GitHub (May 5, 2021):

It might be possible to use the GITHUB_TOKEN defined by github actions as an implicit secret. We could leverage that if you don't mind.

@KnisterPeter commented on GitHub (May 5, 2021): It might be possible to use the `GITHUB_TOKEN` defined by github actions as an implicit secret. We could leverage that if you don't mind.

kerem commented

2026-03-01 21:42:32 +03:00

Author

Owner

@MichaelSp commented on GitHub (May 5, 2021):

My local git client is already fully configured for authenticated enterprise access. Why not re-use that?

In case of SSH, we should use the SSH-Key and in case of PAT, we should either use the key-chain or what ever the OS provides. Or we can do something like:

git config --global url."https://token:\$GITHUB_TOKEN@<ENTERPRISE_HOST>/".insteadOf "https://<ENTERPRISE_HOST>/"

What ever we do, if we rely on git as much as we can, it should pretty much work out of the box without additional configuration or dedicated env-vars (which is obviously preferred)

@MichaelSp commented on GitHub (May 5, 2021): My local `git` client is already fully configured for authenticated enterprise access. Why not re-use that? In case of SSH, we should use the SSH-Key and in case of PAT, we should either use the [key-chain](https://docs.github.com/en/github/getting-started-with-github/updating-credentials-from-the-macos-keychain) or what ever the OS provides. Or we can do something like: ``` git config --global url."https://token:\$GITHUB_TOKEN@<ENTERPRISE_HOST>/".insteadOf "https://<ENTERPRISE_HOST>/" ``` What ever we do, if we rely on `git` as much as we can, it should pretty much work out of the box without additional configuration or dedicated env-vars (which is obviously preferred)

kerem commented

2026-03-01 21:42:32 +03:00

Author

Owner

@KnisterPeter commented on GitHub (May 5, 2021):

Hi @MichaelSp, that might work for you, but not for everyone.
There are environments where no system keychain is setup. Using the username/password in the URL could have security implications by leaking the token to output of the runner.
It might be possible to work around that but that would be more work.

@KnisterPeter commented on GitHub (May 5, 2021): Hi @MichaelSp, that might work for you, but not for everyone. There are environments where no system keychain is setup. Using the username/password in the URL could have security implications by leaking the token to output of the runner. It might be possible to work around that but that would be more work.

kerem commented

2026-03-01 21:42:32 +03:00

Author

Owner

@ZauberNerd commented on GitHub (May 5, 2021):

@MichaelSp that won't work, because act does not use the git binary but instead go-git which does not support global configuration (see: https://github.com/go-git/go-git/blob/master/COMPATIBILITY.md#supported-capabilities).
You could potentially set the local git remote to include username/password or token, but that would then be visible in the log output of act.
We're now using the http.basicAuth authentication in our PR which uses the existing GITHUB_TOKEN, which should always be set for act, because some actions might depend on it.

@ZauberNerd commented on GitHub (May 5, 2021): @MichaelSp that won't work, because `act` does not use the `git` binary but instead `go-git` which does not support global configuration (see: https://github.com/go-git/go-git/blob/master/COMPATIBILITY.md#supported-capabilities). You could potentially set the local git remote to include username/password or token, but that would then be visible in the log output of `act`. We're now using the `http.basicAuth` authentication in our PR which uses the existing `GITHUB_TOKEN`, which should always be set for `act`, because some actions might depend on it.

kerem commented

2026-03-01 21:42:32 +03:00

Author

Owner

@MichaelSp commented on GitHub (May 5, 2021):

sad /me acknowledges 😭 Thanks for taking care of this topic everybody!

@MichaelSp commented on GitHub (May 5, 2021): sad /me acknowledges 😭 Thanks for taking care of this topic everybody!

kerem commented

2026-03-01 21:42:32 +03:00

Author

Owner

@catthehacker commented on GitHub (May 5, 2021):

Integrating with keychain is definitely something too check out sometime but act working with GHE, even with just PAT, should be a good baseline which I'm thankful ❤️ to @ZauberNerd and @KnisterPeter for creating the PR

@catthehacker commented on GitHub (May 5, 2021): Integrating with keychain is definitely something too check out sometime but `act` working with GHE, even with just PAT, should be a good baseline which I'm thankful ❤️ to @ZauberNerd and @KnisterPeter for creating the PR

Rows
Columns

[GH-ISSUE #497] Github Enterprise #340