Troubleshoot 'authentication failed' errors with `actions/checkout` in GitHub Actions on Ubuntu 22.04. Resolve common `GITHUB_TOKEN` permission issues and PAT misconfigurations.
When your GitHub Actions workflow fails during the actions/checkout step with an authentication error on an Ubuntu 22.04 LTS runner, it typically indicates that the workflow lacks the necessary permissions or the provided credentials (e.g., GITHUB_TOKEN or a Personal Access Token) are invalid or insufficient to access the repository. This issue can abruptly halt your CI/CD pipeline, preventing code deployment, testing, or build processes. This guide provides a detailed analysis and step-by-step resolution for these common authentication failures.
Symptom & Error Signature
The most common symptom is a workflow job failing at the actions/checkout step. You will observe error messages in the workflow run logs similar to these:
Run actions/checkout@v4
with:
repository: my-org/my-private-repo
token: ***
fetch-depth: 1
env:
# ...
Error: The process '/usr/bin/git' failed with exit code 128
Error: fatal: could not read Username for 'https://github.com': No such device or address
Or, a more direct authentication failure message:
Run actions/checkout@v4
with:
repository: my-org/my-private-repo
token: ***
fetch-depth: 1
env:
# ...
Error: The process '/usr/bin/git' failed with exit code 128
Error: fatal: Authentication failed for 'https://github.com/my-org/my-private-repo/'
These errors indicate that the Git client, running on the Ubuntu 22.04 LTS runner, was unable to authenticate successfully with GitHub to clone or fetch the repository.
Root Cause Analysis
The underlying reasons for actions/checkout authentication failures are typically tied to credential or permission misconfigurations within the GitHub Actions workflow context.
- Insufficient
GITHUBTOKENPermissions: The defaultGITHUBTOKENprovided to each workflow run has limited permissions. If the workflow attempts to perform actions requiring elevated privileges (e.g., fetching a deep history (fetch-depth: 0) on a private repository, checking out specific branches, or pushing changes back to the repository), the default token might not suffice. - Incorrect
tokenParameter Usage: - * Sometimes, users attempt to use a custom Personal Access Token (PAT) but either misconfigure the
tokeninput foractions/checkoutor provide an invalid secret name. - Using
GITHUB_TOKENdirectly for operations that it isn't designed for, such as checking out another* private repository. - Attempting to Check Out Another Private Repository: The
GITHUBTOKENis scoped only to the repository where the workflow is running. If your workflow needs tocheckouta different private repository, theGITHUBTOKENwill always fail, and a Personal Access Token (PAT) with appropriate scopes is required. - Expired or Revoked Personal Access Token (PAT): If a custom PAT is used, it might have expired, been revoked, or its permissions (scopes) are insufficient for the required Git operations.
- Repository Visibility/Existence: The target repository might be private, not exist, or the workflow's configured credentials simply do not have access to it due to organizational settings or repository deletion.
Step-by-Step Resolution
Follow these steps to diagnose and resolve the GitHub Actions checkout authentication failure.
1. Verify and Adjust Workflow permissions for GITHUB_TOKEN
The GITHUB_TOKEN is a temporary credential generated for each workflow run. By default, it has read-only access to contents and packages. For many checkout scenarios, particularly those involving private repositories or specific Git operations, you might need to explicitly grant additional permissions.
- Understanding
GITHUB_TOKENPermissions: - *
contents: read(default): Sufficient for cloning public repositories or your own private repository if you only need to read files. - *
contents: write: Required if your workflow needs to push branches, create tags, or performgit checkoutoperations that involve modifying the local repository state in a way that implies potential writes (e.g.,fetch-depth: 0on a private repo might sometimes require write permission for internal Git operations related to ref updates, thoughreadis often sufficient forfetch-depth > 0).
To set or elevate permissions, add a permissions block at the workflow level or job level in your .github/workflows/*.yml file.
Example: Granting contents: read at the workflow level:
# .github/workflows/your-workflow.yml
on: [push, pull_request]
permissions: contents: read # Explicitly grant read access to repository contents
jobs:
build:
runs-on: ubuntu-22.04
steps:
– name: Checkout repository
uses: actions/checkout@v4
– name: Your build steps…
run: |
echo "Building…"
`
Example: Granting contents: write (if needed) at the job level:
# .github/workflows/your-workflow.yml
on: push: branches: – main
jobs:
update_docs:
runs-on: ubuntu-22.04
permissions:
contents: write # Grant write access for this job
steps:
– name: Checkout repository
uses: actions/checkout@v4
# If pushing changes, ensure the token is correct for the push operation
# e.g., git config user.name "github-actions[bot]"
# git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
# git commit -am "Update documentation"
# git push
– name: Your steps that modify/push to the repository…
run: |
echo "Performing write operations…"
`
[!IMPORTANT] Always grant the minimum necessary permissions. Giving
contents: writewhen onlyreadis needed increases the security risk if your workflow is compromised.
2. Ensure Correct token Parameter in actions/checkout
The actions/checkout action has a token input. It's crucial to use the correct secret here.
- Using the built-in
GITHUB_TOKEN: This is the most secure and recommended approach for actions within the same repository.
steps:
- name: Checkout repository with GITHUB_TOKEN
uses: actions/checkout@v4
with:
token: ${{ secrets.GITHUB_TOKEN }}
[!NOTE] > While
actions/checkoutdefaults tosecrets.GITHUB_TOKENif notokenis specified, explicitly defining it can sometimes resolve subtle issues or improve clarity.
- Using a Custom Personal Access Token (PAT): If
GITHUBTOKENis insufficient (e.g., for cross-repository access or highly specific permissions not covered byGITHUBTOKEN), you'll need to create a PAT, add it to your repository secrets, and then reference it.
steps:
- name: Checkout repository with custom PAT
uses: actions/checkout@v4
with:
token: ${{ secrets.MY_REPO_PAT }} # Assuming MY_REPO_PAT is your secret name
[!WARNING] > Never hardcode PATs directly in your workflow file. Always store them as GitHub repository or organization secrets.
3. Handling Cross-Repository Checkout for Private Repositories
If you are trying to check out a different private repository than the one the workflow is running in, the GITHUB_TOKEN will not work. You must use a Personal Access Token (PAT) that has access to the target repository.
Steps:
- Create a Fine-Grained Personal Access Token (Recommended):
- * Navigate to your GitHub profile settings -> Developer settings -> Personal access tokens -> Fine-grained tokens.
- * Click "Generate new token".
- * Give it a descriptive name (e.g.,
ci-checkout-other-repo). - * Set an expiration date.
- * Under "Resource owner", select your user or organization.
- Under "Repository access", choose "Only select repositories" and add the target* private repository you wish to check out.
- * Under "Repository permissions" for the selected target repository, grant
Contents: Readpermission (orContents: Writeif your workflow needs to push to it). - * Generate the token and copy it immediately as it will not be shown again.
- Add PAT to GitHub Secrets:
- * Go to your workflow repository -> Settings -> Secrets and variables -> Actions.
- * Click "New repository secret".
- * Name it (e.g.,
CROSSREPOPAT) and paste the PAT you just generated into the "Secret value" field.
- Use the PAT in your Workflow:
# .github/workflows/cross-repo-checkout.yml
on: [push]
jobs: fetchotherrepo: runs-on: ubuntu-22.04 steps: – name: Checkout current repository (optional) uses: actions/checkout@v4 # No token needed if this is the current repo, or use ${{ secrets.GITHUB_TOKEN }}
- name: Checkout another private repository
- uses: actions/checkout@v4
- with:
- repository: my-org/another-private-repo # Specify the target private repo
- token: ${{ secrets.CROSSREPOPAT }} # Use the PAT with access to 'another-private-repo'
- path: another-repo-dir # Optional: checkout into a specific directory
- – name: List contents of the other repo
- run: |
- ls -la another-repo-dir
-
`
[!IMPORTANT] > Ensure the
CROSSREPOPAThas access tomy-org/another-private-repospecifically. If you use a classic PAT, it might need the fullreposcope, which is less secure than fine-grained tokens.
4. Check Personal Access Token (PAT) Validity and Scope
If you are using a custom PAT, verify its status and permissions:
- Access PATs: Go to your GitHub profile settings -> Developer settings -> Personal access tokens.
- * For Fine-grained tokens: Check the list under "Fine-grained tokens".
- * For Classic tokens: Check the list under "Tokens (classic)".
- Review Expiration & Revocation: Ensure the PAT has not expired or been revoked. If it has, generate a new one.
- Verify Scopes (Classic PATs) / Permissions (Fine-grained PATs):
- * For Classic PATs: The PAT should have at least the
reposcope to access private repositories. For public repositories,public_repomight suffice. - * For Fine-grained PATs: Confirm that the token explicitly grants
Contents: Read(orWriteif needed) permission for the specific repository you are trying to check out.
If any of these are incorrect, update the PAT or generate a new one and update the corresponding secret in GitHub Actions.
5. Confirm Repository Accessibility and Existence
Though less common for an authentication failure specifically, it's a fundamental check:
- Does the repository exist? Double-check the
repository:path in youractions/checkoutstep (e.g.,my-org/my-private-repo). A typo here will lead to access errors. - Is the repository private, and do the credentials have access? If the repository is truly private, ensure that the
GITHUB_TOKEN(with appropriate permissions) or the custom PAT has explicit permission to access it. If the repository was recently made private or moved, permissions might need re-evaluation.
By systematically going through these steps, you should be able to identify and resolve the GitHub Actions checkout action repository authentication failed error, restoring your CI/CD pipeline's functionality.