nektos/act · error

failed to interpolate credentials.password

Error message

failed to interpolate credentials.password

What it means

Interpolating a service container's `credentials.password` produced an empty string — the password half of handleServiceCredentials. The map passed the two-key check but the password value evaluates to empty, so the service cannot authenticate to its registry.

Source

Thrown at pkg/runner/run_context.go:1145

}

func (rc *RunContext) handleServiceCredentials(ctx context.Context, creds map[string]string) (username, password string, err error) {
	if creds == nil {
		return
	}
	if len(creds) != 2 {
		err = fmt.Errorf("invalid property count for key 'credentials:'")
		return
	}

	ee := rc.NewExpressionEvaluator(ctx)
	if username = ee.Interpolate(ctx, creds["username"]); username == "" {
		err = fmt.Errorf("failed to interpolate credentials.username")
		return
	}

	if password = ee.Interpolate(ctx, creds["password"]); password == "" {
		err = fmt.Errorf("failed to interpolate credentials.password")
		return
	}

	return
}

// GetServiceBindsAndMounts returns the binds and mounts for the service container, resolving paths as appropriate
func (rc *RunContext) GetServiceBindsAndMounts(svcVolumes []string) ([]string, map[string]string) {
	if rc.Config.ContainerDaemonSocket == "" {
		rc.Config.ContainerDaemonSocket = "/var/run/docker.sock"
	}
	binds := []string{}
	if rc.Config.ContainerDaemonSocket != "-" {
		daemonPath := getDockerDaemonSocketMountPath(rc.Config.ContainerDaemonSocket)
		binds = append(binds, fmt.Sprintf("%s:%s", daemonPath, "/var/run/docker.sock"))
	}

	mounts := map[string]string{}

View on GitHub (pinned to 4f41128141)

Solutions

1. Supply the secret (`-s` / `--secret-file`).
2. Fix secret-name mismatches.
3. Remove the credentials block if the image is publicly pullable.

Example fix

# before
password: ${{ secrets.PG_PWD }}  # unset
# after
act push -s PG_PWD=secret

act --secret-file .secrets --dryrun

When it happens

Trigger: `services.<id>.credentials.password:` references a secret not provided to act or is an empty literal value.

Common situations: Same class as the username case: missing local secrets, name typos, CI-only credentials.

Related errors

• failed to interpolate credentials.username
• failed to interpolate container.credentials.username
• failed to interpolate container.credentials.password
• failed to handle service %s credentials: %w
• The following format string is invalid: '%s'

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/6f68c2f40536a57e. Report an issue: GitHub.