starred/act

Fork 0

mirror of https://github.com/nektos/act.git synced 2026-04-26 09:25:54 +03:00

[GH-ISSUE #1412] Setting `NODE_AUTH_TOKEN` does not authenticate with npm #743

New issue

Closed

opened 2026-03-01 21:46:00 +03:00 by kerem · 4 comments

kerem commented

2026-03-01 21:46:00 +03:00

Owner

Originally created by @haseebnaseem on GitHub (Oct 26, 2022).
Original GitHub issue: https://github.com/nektos/act/issues/1412

Bug report info

act version:            0.2.31
GOOS:                   darwin
GOARCH:                 arm64
NumCPU:                 10
Docker host:            DOCKER_HOST environment variable is unset/empty.
Sockets found:
        /var/run/docker.sock
Config files:           
        /Users/haseeb/.actrc:
                -P ubuntu-latest=catthehacker/ubuntu:act-latest
                -P ubuntu-22.04=catthehacker/ubuntu:act-22.04
                -P ubuntu-20.04=catthehacker/ubuntu:act-20.04
                -P ubuntu-18.04=catthehacker/ubuntu:act-18.04
Build info:
        Go version:            go1.19
        Module path:           command-line-arguments
        Main version:          
        Main path:             
        Main checksum:         
        Build settings:
                -compiler:            gc
                -ldflags:             -X main.version=0.2.31
                CGO_ENABLED:          1
                CGO_CFLAGS:           
                CGO_CPPFLAGS:         
                CGO_CXXFLAGS:         
                CGO_LDFLAGS:          
                GOARCH:               arm64
                GOOS:                 darwin
Docker Engine:
        Engine version:        20.10.17
        Engine runtime:        runc
        Cgroup version:        2
        Cgroup driver:         cgroupfs
        Storage driver:        overlay2
        Registry URI:          https://index.docker.io/v1/
        OS:                    Docker Desktop
        OS type:               linux
        OS version:            
        OS arch:               aarch64
        OS kernel:             5.10.104-linuxkit
        OS CPU:                5
        OS memory:             7851 MB
        Security options:
                name=seccomp,profile=default
                name=cgroupns

Command used with act

act -j format -s GITHUB_TOKEN

Describe issue

The same workflow successfully installs dependencies, while with act it does not.
Setting the same variable in .npmrc works.
run: echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> .npmrc && npm ci --ignore-scripts --no-audit --no-progress --prefer-offline

Link to GitHub repository

No response

Workflow content

format:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          persist-credentials: false
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          cache: 'npm'
          node-version: 16
          registry-url: https://npm.pkg.github.com
      - env:
          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        name: Install dependencies
        run: npm ci --ignore-scripts --no-audit --no-progress --prefer-offline
      - name: Format
        run: npm run format

Relevant log output

[Continuous Integration/Format]   ✅  Success - Main Setup Node.js
[Continuous Integration/Format] ⭐ Run Main Install dependencies
[Continuous Integration/Format]   🐳  docker exec cmd=[bash --noprofile --norc -e -o pipefail /var/run/act/workflow/2] user= workdir=
| npm WARN deprecated @types/graphql@14.5.0: This is a stub types definition. graphql provides its own type definitions, so you do not need this installed.
| npm WARN deprecated @types/bson@4.2.0: This is a stub types definition. bson provides its own type definitions, so you do not need this installed.
| npm ERR! code E401
| npm ERR! 401 Unauthorized

Additional information

No response

Originally created by @haseebnaseem on GitHub (Oct 26, 2022). Original GitHub issue: https://github.com/nektos/act/issues/1412 ### Bug report info ```plain text act version: 0.2.31 GOOS: darwin GOARCH: arm64 NumCPU: 10 Docker host: DOCKER_HOST environment variable is unset/empty. Sockets found: /var/run/docker.sock Config files: /Users/haseeb/.actrc: -P ubuntu-latest=catthehacker/ubuntu:act-latest -P ubuntu-22.04=catthehacker/ubuntu:act-22.04 -P ubuntu-20.04=catthehacker/ubuntu:act-20.04 -P ubuntu-18.04=catthehacker/ubuntu:act-18.04 Build info: Go version: go1.19 Module path: command-line-arguments Main version: Main path: Main checksum: Build settings: -compiler: gc -ldflags: -X main.version=0.2.31 CGO_ENABLED: 1 CGO_CFLAGS: CGO_CPPFLAGS: CGO_CXXFLAGS: CGO_LDFLAGS: GOARCH: arm64 GOOS: darwin Docker Engine: Engine version: 20.10.17 Engine runtime: runc Cgroup version: 2 Cgroup driver: cgroupfs Storage driver: overlay2 Registry URI: https://index.docker.io/v1/ OS: Docker Desktop OS type: linux OS version: OS arch: aarch64 OS kernel: 5.10.104-linuxkit OS CPU: 5 OS memory: 7851 MB Security options: name=seccomp,profile=default name=cgroupns ``` ### Command used with act ```sh act -j format -s GITHUB_TOKEN ``` ### Describe issue The same workflow successfully installs dependencies, while with act it does not. Setting the same variable in `.npmrc` works. `run: echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" >> .npmrc && npm ci --ignore-scripts --no-audit --no-progress --prefer-offline` ### Link to GitHub repository _No response_ ### Workflow content ```yml format: name: Format runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v3 with: persist-credentials: false ref: ${{ github.event.pull_request.head.sha || github.sha }} - name: Setup Node.js uses: actions/setup-node@v3 with: cache: 'npm' node-version: 16 registry-url: https://npm.pkg.github.com - env: NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} name: Install dependencies run: npm ci --ignore-scripts --no-audit --no-progress --prefer-offline - name: Format run: npm run format ``` ### Relevant log output ```sh [Continuous Integration/Format] ✅ Success - Main Setup Node.js [Continuous Integration/Format] ⭐ Run Main Install dependencies [Continuous Integration/Format] 🐳 docker exec cmd=[bash --noprofile --norc -e -o pipefail /var/run/act/workflow/2] user= workdir= | npm WARN deprecated @types/graphql@14.5.0: This is a stub types definition. graphql provides its own type definitions, so you do not need this installed. | npm WARN deprecated @types/bson@4.2.0: This is a stub types definition. bson provides its own type definitions, so you do not need this installed. | npm ERR! code E401 | npm ERR! 401 Unauthorized ``` ### Additional information _No response_

kerem

2026-03-01 21:46:00 +03:00

closed this issue
added the
stale

kind/bug
labels

kerem commented

2026-03-01 21:46:01 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 27, 2022):

Issue is stale and will be closed in 14 days unless there is new activity

@github-actions[bot] commented on GitHub (Nov 27, 2022): Issue is stale and will be closed in 14 days unless there is new activity

kerem commented

2026-03-01 21:46:01 +03:00

Author

Owner

@20k-ultra commented on GitHub (Nov 30, 2022):

If I do act -v -s GITHUB_TOKEN with the following workflow I can confirm that the secret is being passed because the char count is equal to the number of chars I'm entering when prompted.

on: push

env:
  NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  format:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - run: echo "$NODE_AUTH_TOKEN" >> testing && grep -c . testing

It seems like an issue with setup-node considering you said this only works when you, yourself echo the variable to .npmrc.

I would try to cat .npmrc after setup-node runs, and if you see //npm.pkg.github.com/:_authToken=**** than you know the asterisks are your secret. If there aren't any, you know the secret was not set in .npmrc.

I'd also try to run your action on Github's runners. If it works there than we can narrow it down to act.

@20k-ultra commented on GitHub (Nov 30, 2022): If I do `act -v -s GITHUB_TOKEN` with the following workflow I can confirm that the secret is being passed because the char count is equal to the number of chars I'm entering when prompted. ``` on: push env: NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} jobs: format: name: Format runs-on: ubuntu-latest steps: - run: echo "$NODE_AUTH_TOKEN" >> testing && grep -c . testing ``` It seems like an issue with setup-node considering you said this only works when you, yourself echo the variable to `.npmrc`. I would try to cat `.npmrc` after setup-node runs, and if you see `//npm.pkg.github.com/:_authToken=****` than you know the asterisks are your secret. If there aren't any, you know the secret was not set in `.npmrc`. I'd also try to run your action on Github's runners. If it works there than we can narrow it down to act.

kerem commented

2026-03-01 21:46:01 +03:00

Author

Owner

@ruben-chainalysis commented on GitHub (Dec 1, 2022):

I hit a similar issue using setup-node and it turned out that the format of the variable NODE_AUTH_TOKEN was just the token. The authToken in the .npmrc file is sometimes (for some private registries at least this is always the case) a base64 encoded string with both your username and token, you might be hitting that problem if the file works but not the input for the job.

@ruben-chainalysis commented on GitHub (Dec 1, 2022): I hit a similar issue using `setup-node` and it turned out that the format of the variable `NODE_AUTH_TOKEN` was just the token. The `authToken` in the `.npmrc` file is sometimes (for some private registries at least this is always the case) a base64 encoded string with both your username and token, you might be hitting that problem if the file works but not the input for the job.

kerem commented

2026-03-01 21:46:01 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 1, 2023):

Issue is stale and will be closed in 14 days unless there is new activity

@github-actions[bot] commented on GitHub (Jan 1, 2023): Issue is stale and will be closed in 14 days unless there is new activity

kerem referenced this issue

2026-03-01 21:51:48 +03:00

[PR #743] [MERGED] fix: warn Apple M1 (arm64) users #1585

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/act#743

No description provided.

Rows
Columns

[GH-ISSUE #1412] Setting NODE_AUTH_TOKEN does not authenticate with npm #743

Bug report info

Command used with act

Describe issue

Link to GitHub repository

Workflow content

Relevant log output

Additional information

[GH-ISSUE #1412] Setting `NODE_AUTH_TOKEN` does not authenticate with npm #743