{"record":{"id":"6f68c2f40536a57e","repo":"nektos/act","slug":"failed-to-interpolate-credentials-password","errorCode":null,"errorMessage":"failed to interpolate credentials.password","messagePattern":"failed to interpolate credentials\\.password","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/runner/run_context.go","lineNumber":1145,"sourceCode":"}\n\nfunc (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[string]string) (username, password string, err error) {\n\tif creds == nil {\n\t\treturn\n\t}\n\tif len(creds) != 2 {\n\t\terr = fmt.Errorf(\"invalid property count for key 'credentials:'\")\n\t\treturn\n\t}\n\n\tee := rc.NewExpressionEvaluator(ctx)\n\tif username = ee.Interpolate(ctx, creds[\"username\"]); username == \"\" {\n\t\terr = fmt.Errorf(\"failed to interpolate credentials.username\")\n\t\treturn\n\t}\n\n\tif password = ee.Interpolate(ctx, creds[\"password\"]); password == \"\" {\n\t\terr = fmt.Errorf(\"failed to interpolate credentials.password\")\n\t\treturn\n\t}\n\n\treturn\n}\n\n// GetServiceBindsAndMounts returns the binds and mounts for the service container, resolving paths as appropriate\nfunc (rc *RunContext) GetServiceBindsAndMounts(svcVolumes []string) ([]string, map[string]string) {\n\tif rc.Config.ContainerDaemonSocket == \"\" {\n\t\trc.Config.ContainerDaemonSocket = \"/var/run/docker.sock\"\n\t}\n\tbinds := []string{}\n\tif rc.Config.ContainerDaemonSocket != \"-\" {\n\t\tdaemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)\n\t\tbinds = append(binds, fmt.Sprintf(\"%s:%s\", daemonPath, \"/var/run/docker.sock\"))\n\t}\n\n\tmounts := map[string]string{}","sourceCodeStart":1127,"sourceCodeEnd":1163,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/runner/run_context.go#L1127-L1163","documentation":"Interpolating a service container's `credentials.password` produced an empty string — the password half of handleServiceCredentials. The map passed the two-key check but the password value evaluates to empty, so the service cannot authenticate to its registry.","triggerScenarios":"`services.<id>.credentials.password:` references a secret not provided to act or is an empty literal value.","commonSituations":"Same class as the username case: missing local secrets, name typos, CI-only credentials.","solutions":["Supply the secret (`-s` / `--secret-file`).","Fix secret-name mismatches.","Remove the credentials block if the image is publicly pullable."],"exampleFix":"# before\npassword: ${{ secrets.PG_PWD }}  # unset\n# after\nact push -s PG_PWD=secret","handlingStrategy":"validation","validationCode":"act --secret-file .secrets --dryrun","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provide every secret referenced anywhere in the workflow, including services.","Keep a local .secrets template file in the repo (values blank) as documentation."],"tags":["services","credentials","secrets","expressions"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}