{"record":{"id":"386938d7288d15d8","repo":"nektos/act","slug":"failed-to-interpolate-container-credentials-passwo","errorCode":null,"errorMessage":"failed to interpolate container.credentials.password","messagePattern":"failed to interpolate container\\.credentials\\.password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/runner/run_context.go","lineNumber":1117,"sourceCode":"\tpassword := rc.Config.Secrets[\"DOCKER_PASSWORD\"]\n\n\tcontainer := rc.Run.Job().Container()\n\tif container == nil || container.Credentials == nil {\n\t\treturn username, password, nil\n\t}\n\n\tif container.Credentials != nil && len(container.Credentials) != 2 {\n\t\terr := fmt.Errorf(\"invalid property count for key 'credentials:'\")\n\t\treturn \"\", \"\", err\n\t}\n\n\tee := rc.NewExpressionEvaluator(ctx)\n\tif username = ee.Interpolate(ctx, container.Credentials[\"username\"]); username == \"\" {\n\t\terr := fmt.Errorf(\"failed to interpolate container.credentials.username\")\n\t\treturn \"\", \"\", err\n\t}\n\tif password = ee.Interpolate(ctx, container.Credentials[\"password\"]); password == \"\" {\n\t\terr := fmt.Errorf(\"failed to interpolate container.credentials.password\")\n\t\treturn \"\", \"\", err\n\t}\n\n\tif container.Credentials[\"username\"] == \"\" || container.Credentials[\"password\"] == \"\" {\n\t\terr := fmt.Errorf(\"container.credentials cannot be empty\")\n\t\treturn \"\", \"\", err\n\t}\n\n\treturn username, password, nil\n}\n\nfunc (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[string]string) (username, password string, err error) {\n\tif creds == nil {\n\t\treturn\n\t}\n\tif len(creds) != 2 {\n\t\terr = fmt.Errorf(\"invalid property count for key 'credentials:'\")\n\t\treturn","sourceCodeStart":1099,"sourceCodeEnd":1135,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/runner/run_context.go#L1099-L1135","documentation":"Interpolating `container.credentials.password` produced an empty string — the password counterpart of the username check. The two-key map is validated first, then each value is interpolated; an empty password result aborts job container creation.","triggerScenarios":"`jobs.<id>.container.credentials.password:` references a secret that was not provided to act (`secrets.X` missing), or is empty in the workflow.","commonSituations":"Secrets supplied for CI but not locally; secret name mismatch (REG_PWD vs REG_PASSWORD); password stored in an env var act does not load.","solutions":["Provide the secret: `act -s REG_PWD=...` or `--secret-file`.","Align the secret name in the workflow with what you pass on the command line.","If the registry needs no auth locally, remove the whole `credentials:` block instead of leaving an empty password."],"exampleFix":"# before\npassword: ${{ secrets.REGISTRY_TOKEN }}   # not passed -> empty\n# after\nact push --secret-file <(echo REGISTRY_TOKEN=ghp_xxx)","handlingStrategy":"validation","validationCode":"act --secret-file .secrets --dryrun && echo 'secrets resolvable'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["List required secrets in a Makefile target for act invocations.","Never leave password expressions referencing secrets you don't pass locally."],"tags":["container","credentials","secrets","expressions"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}