nektos/act · error

failed to interpolate container.credentials.username

Error message

failed to interpolate container.credentials.username

What it means

Interpolating `container.credentials.username` produced an empty string. After confirming the credentials map has exactly two keys, act runs the value through the expression evaluator; if the result is empty (the raw value was empty, or the `${{ }}` expression resolved to empty/missing), this error is returned.

Source

Thrown at pkg/runner/run_context.go:1113

func (rc *RunContext) handleCredentials(ctx context.Context) (string, string, error) {
	// TODO: remove below 2 lines when we can release act with breaking changes
	username := rc.Config.Secrets["DOCKER_USERNAME"]
	password := rc.Config.Secrets["DOCKER_PASSWORD"]

	container := rc.Run.Job().Container()
	if container == nil || container.Credentials == nil {
		return username, password, nil
	}

	if container.Credentials != nil && len(container.Credentials) != 2 {
		err := fmt.Errorf("invalid property count for key 'credentials:'")
		return "", "", err
	}

	ee := rc.NewExpressionEvaluator(ctx)
	if username = ee.Interpolate(ctx, container.Credentials["username"]); username == "" {
		err := fmt.Errorf("failed to interpolate container.credentials.username")
		return "", "", err
	}
	if password = ee.Interpolate(ctx, container.Credentials["password"]); password == "" {
		err := fmt.Errorf("failed to interpolate container.credentials.password")
		return "", "", err
	}

	if container.Credentials["username"] == "" || container.Credentials["password"] == "" {
		err := fmt.Errorf("container.credentials cannot be empty")
		return "", "", err
	}

	return username, password, nil
}

func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[string]string) (username, password string, err error) {
	if creds == nil {
		return

View on GitHub (pinned to 4f41128141)

Solutions

1. Pass the secret to act: `act -s REG_USER=... -s REG_PWD=...` or load via `--secret-file`.
2. Check for typos between the secret name in the workflow and the one supplied on the CLI.
3. Verify the expression resolves non-empty (echo it in a prior step or run with --verbose to see evaluation).
4. Set a placeholder username locally if the registry does not need auth in your environment, or drop the credentials block entirely.

Example fix

# before
# workflow: username: ${{ secrets.REG_USER }}
# run: act push
# after
act push -s REG_USER=ci -s REG_PWD=tokengh_...

act -s REG_USER=ci -s REG_PWD=xxx --dryrun   # secrets must be present before real run

When it happens

Trigger: `jobs.<id>.container.credentials.username:` is an expression referencing an undefined secret (e.g. secrets.REG_USER not passed to act), or is literally empty/whitespace.

Common situations: Running act without `-s REG_USER=...` (act does not read GitHub secrets automatically); secret name typo between workflow and the `-s` flag or .secrets file; referencing an org-level variable unavailable locally.

Related errors

• failed to interpolate container.credentials.password
• failed to interpolate credentials.username
• failed to interpolate credentials.password
• invalid property count for key 'credentials:'
• container.credentials cannot be empty

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/073f969145d1ba87. Report an issue: GitHub.