nektos/act · error

failed to interpolate container.credentials.password

Error message

failed to interpolate container.credentials.password

What it means

Interpolating `container.credentials.password` produced an empty string — the password counterpart of the username check. The two-key map is validated first, then each value is interpolated; an empty password result aborts job container creation.

Source

Thrown at pkg/runner/run_context.go:1117

	password := rc.Config.Secrets["DOCKER_PASSWORD"]

	container := rc.Run.Job().Container()
	if container == nil || container.Credentials == nil {
		return username, password, nil
	}

	if container.Credentials != nil && len(container.Credentials) != 2 {
		err := fmt.Errorf("invalid property count for key 'credentials:'")
		return "", "", err
	}

	ee := rc.NewExpressionEvaluator(ctx)
	if username = ee.Interpolate(ctx, container.Credentials["username"]); username == "" {
		err := fmt.Errorf("failed to interpolate container.credentials.username")
		return "", "", err
	}
	if password = ee.Interpolate(ctx, container.Credentials["password"]); password == "" {
		err := fmt.Errorf("failed to interpolate container.credentials.password")
		return "", "", err
	}

	if container.Credentials["username"] == "" || container.Credentials["password"] == "" {
		err := fmt.Errorf("container.credentials cannot be empty")
		return "", "", err
	}

	return username, password, nil
}

func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[string]string) (username, password string, err error) {
	if creds == nil {
		return
	}
	if len(creds) != 2 {
		err = fmt.Errorf("invalid property count for key 'credentials:'")
		return

View on GitHub (pinned to 4f41128141)

Solutions

1. Provide the secret: `act -s REG_PWD=...` or `--secret-file`.
2. Align the secret name in the workflow with what you pass on the command line.
3. If the registry needs no auth locally, remove the whole `credentials:` block instead of leaving an empty password.

Example fix

# before
password: ${{ secrets.REGISTRY_TOKEN }}   # not passed -> empty
# after
act push --secret-file <(echo REGISTRY_TOKEN=ghp_xxx)

act --secret-file .secrets --dryrun && echo 'secrets resolvable'

When it happens

Trigger: `jobs.<id>.container.credentials.password:` references a secret that was not provided to act (`secrets.X` missing), or is empty in the workflow.

Common situations: Secrets supplied for CI but not locally; secret name mismatch (REG_PWD vs REG_PASSWORD); password stored in an env var act does not load.

Related errors

• failed to interpolate container.credentials.username
• failed to interpolate credentials.username
• failed to interpolate credentials.password
• invalid property count for key 'credentials:'
• container.credentials cannot be empty

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/386938d7288d15d8. Report an issue: GitHub.