nektos/act · error

container.credentials cannot be empty

Error message

container.credentials cannot be empty

What it means

A defensive re-check after interpolation: the raw (pre-interpolation) `container.credentials` map has an empty username or password value. In practice the earlier empty-after-interpolation checks usually fire first, but if the raw value itself is empty (and interpolation is a no-op on empty strings) this guard rejects it.

Source

Thrown at pkg/runner/run_context.go:1122

	}

	if container.Credentials != nil && len(container.Credentials) != 2 {
		err := fmt.Errorf("invalid property count for key 'credentials:'")
		return "", "", err
	}

	ee := rc.NewExpressionEvaluator(ctx)
	if username = ee.Interpolate(ctx, container.Credentials["username"]); username == "" {
		err := fmt.Errorf("failed to interpolate container.credentials.username")
		return "", "", err
	}
	if password = ee.Interpolate(ctx, container.Credentials["password"]); password == "" {
		err := fmt.Errorf("failed to interpolate container.credentials.password")
		return "", "", err
	}

	if container.Credentials["username"] == "" || container.Credentials["password"] == "" {
		err := fmt.Errorf("container.credentials cannot be empty")
		return "", "", err
	}

	return username, password, nil
}

func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[string]string) (username, password string, err error) {
	if creds == nil {
		return
	}
	if len(creds) != 2 {
		err = fmt.Errorf("invalid property count for key 'credentials:'")
		return
	}

	ee := rc.NewExpressionEvaluator(ctx)
	if username = ee.Interpolate(ctx, creds["username"]); username == "" {
		err = fmt.Errorf("failed to interpolate credentials.username")

View on GitHub (pinned to 4f41128141)

Solutions

1. Fill in real values or expressions for both username and password.
2. If auth is not needed, delete the `credentials:` block so handleCredentials returns the config-secret fallback path.
3. Use a secret reference rather than committing empty placeholders.

Example fix

# before
credentials:
  username: ci
  password:        # empty
# after
credentials:
  username: ci
  password: ${{ secrets.REG_PWD }}

grep -RniE 'password:\s*$|username:\s*$' .github/workflows/ && echo 'empty credential value found' || echo ok

When it happens

Trigger: `credentials.username:` or `credentials.password:` is literally empty in the YAML (e.g. `password:` with nothing after it) while the map still has exactly two keys.

Common situations: Placeholder YAML with empty credential values awaiting CI injection; a `${{ }}` string that was stripped from the file; trailing whitespace/indentation mistakes leaving the value nil.

Related errors

• invalid property count for key 'credentials:'
• failed to interpolate container.credentials.username
• failed to interpolate container.credentials.password
• ErrShortRef
• failed to handle credentials: %s

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/b8864166aa031008. Report an issue: GitHub.