nektos/act · error

container.credentials cannot be empty

Error message

container.credentials cannot be empty

What it means

A defensive re-check after interpolation: the raw (pre-interpolation) `container.credentials` map has an empty username or password value. In practice the earlier empty-after-interpolation checks usually fire first, but if the raw value itself is empty (and interpolation is a no-op on empty strings) this guard rejects it.

Solutions

1. Fill in real values or expressions for both username and password.
2. If auth is not needed, delete the `credentials:` block so handleCredentials returns the config-secret fallback path.
3. Use a secret reference rather than committing empty placeholders.

Example fix

# before
credentials:
  username: ci
  password:        # empty
# after
credentials:
  username: ci
  password: ${{ secrets.REG_PWD }}

grep -RniE 'password:\s*$|username:\s*$' .github/workflows/ && echo 'empty credential value found' || echo ok

When it happens

Trigger: `credentials.username:` or `credentials.password:` is literally empty in the YAML (e.g. `password:` with nothing after it) while the map still has exactly two keys.

Common situations: Placeholder YAML with empty credential values awaiting CI injection; a `${{ }}` string that was stripped from the file; trailing whitespace/indentation mistakes leaving the value nil.

Related errors

• invalid property count for key 'credentials:'
• failed to interpolate container.credentials.password
• failed to interpolate container.credentials.username
• ❌ Error in if-expression: "if
• ErrShortRef

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/b8864166aa031008. Report an issue: GitHub.

Appendix: source

Thrown at pkg/runner/run_context.go:1122

	}

	if container.Credentials != nil && len(container.Credentials) != 2 {
		err := fmt.Errorf("invalid property count for key 'credentials:'")
		return "", "", err
	}

	ee := rc.NewExpressionEvaluator(ctx)
	if username = ee.Interpolate(ctx, container.Credentials["username"]); username == "" {
		err := fmt.Errorf("failed to interpolate container.credentials.username")
		return "", "", err
	}
	if password = ee.Interpolate(ctx, container.Credentials["password"]); password == "" {
		err := fmt.Errorf("failed to interpolate container.credentials.password")
		return "", "", err
	}

	if container.Credentials["username"] == "" || container.Credentials["password"] == "" {
		err := fmt.Errorf("container.credentials cannot be empty")
		return "", "", err
	}

	return username, password, nil
}

func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[string]string) (username, password string, err error) {
	if creds == nil {
		return
	}
	if len(creds) != 2 {
		err = fmt.Errorf("invalid property count for key 'credentials:'")
		return
	}

	ee := rc.NewExpressionEvaluator(ctx)
	if username = ee.Interpolate(ctx, creds["username"]); username == "" {
		err = fmt.Errorf("failed to interpolate credentials.username")

View on GitHub (pinned to 4f41128141)