Could not authenticate against github.com

[chrisan]

 - Syncing xxx/yyy (va.b.c) into cache
    Failed to download xxx/yyy from dist: Could not authenticate against github.com
    Now trying to download from source

I'm getting the error for a bunch of public open source packages with composer install using either tools: composer:v2 or COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }} or both

Is there something silly I am missing? This example is using both, but as I said above I had the same issue using one or the other

name: Deploy App
on:
  push: # Run the workflow for each push event (i.e commit)
    branches:
      - master
jobs:
  test-deploy:
    name: Test & Deploy
    runs-on: ubuntu-20.04
    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_DATABASE: test
          MYSQL_ROOT_PASSWORD: root
        ports:
          - 3306
        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
    steps:
      - uses: actions/checkout@v1

      - name: Update Apt
        run: sudo apt update

      - name: Notify Slack
        run: |
          echo '${{toJSON(github.event.commits)}}'
          commits='${{toJSON(github.event.commits)}}'
          authorsText=''
          readarray -d '' authors < <(jq -j '[.[].author.name] | unique | .[] + "\u0000"' <<<"${commits}")
          for author in "${authors[@]}"
          do
            authorsText="$authorsText$author "
          done

          commitsText=" • ${{join(github.event.commits.*.message, '\n • ')}}"

          json='{
          "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "Testing the below commits.  If there is no squirrel then the code is not live"
            }
          },
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "commitsText"
            }
          },
          {
            "type": "context",
            "elements": [
            {
              "type": "mrkdwn",
              "text": "*Author(s):* authorsText"
            }
            ]
          }
          ]
          }'

          json=${json/commitsText/$commitsText}
          json=${json/authorsText/$authorsText}

          curl -X POST -H 'Content-type: application/json' --data "$json" https://hooks.slack.com/services/${{ secrets.SLACK_CI_WEBHOOK }}

      - name: Verify MySQL connection from host
        run: |
          mysql --host 127.0.0.1 --port ${{ job.services.mysql.ports['3306'] }} -uroot -proot -e "SHOW DATABASES"
      - name: Setup SSH
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "$SSH_CONFIG" > ~/.ssh/config
          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
          echo "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
          chmod 600 ~/.ssh/*
        shell: bash
        env:
          SSH_CONFIG: ${{secrets.SSH_CONFIG}}
          SSH_KNOWN_HOSTS: ${{secrets.SSH_KNOWN_HOSTS}}
          SSH_PRIVATE_KEY: ${{secrets.SSH_PRIVATE_KEY}}

      - name: Copy Laravel env for CI
        run: php -r "file_exists('.env') || copy('.env.ci', '.env');"

      - name: Add api localhost to CI
        run: sudo -- sh -c "echo '127.0.0.1 api.localhost' >> /etc/hosts"

      - name: Setup PHP
        uses: shivammathur/setup-php@v2 # https://github.com/shivammathur/setup-php
        with:
          php-version: 8.1 # Use your PHP version
          extensions: bcmath, ctype, curl, fileinfo, intl, json, mbstring, openssl, pdo, redis, simplexml, tokenizer, xml, zip # Setup any required extensions for tests
          tools: composer:v2
        env:
          COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Get Composer Cache Directory
        id: composer-cache
        run: echo "::set-output name=dir::$(composer config cache-files-dir)"

      - name: Cache dependencies
        uses: actions/cache@v1
        with:
          path: ${{ steps.composer-cache.outputs.dir }}
          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
          restore-keys: ${{ runner.os }}-composer-

      - name: Add HTTP basic auth credentials
        run: echo '${{ secrets.COMPOSER_AUTH_JSON }}' > $GITHUB_WORKSPACE/auth.json

      - name: Composer install
        run: composer install --no-ansi --no-interaction --no-scripts --prefer-dist

      - name: Generate Laravel key
        run: php artisan key:generate

      - name: Run Tests
        run: ./vendor/bin/phpunit
        env:
          DB_PORT: ${{ job.services.mysql.ports[3306] }}

      - name: Deploy App
        run: ./vendor/bin/dep deploy prod.v2.console

      - name: Notify Slack
        run: |
          json='{
          "blocks": [
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": ":shipit: All tests passed, a new build has been shipped!"
            }
          },
          ]
          }'

          curl -X POST -H 'Content-type: application/json' --data "$json" https://hooks.slack.com/services/${{ secrets.SLACK_CI_WEBHOOK }}
      - name: Sentry Release
        uses: getsentry/action-release@v1.0.0
        env:
          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
          SENTRY_ORG: myorg
          SENTRY_PROJECT: myapp
        with:
          environment: production

[shivammathur]

I tested this and we are setting the token correctly in composer.
https://github.com/shivammathur/test-setup-php/actions/runs/2173578851/workflow

Please try with a Personal Access Token instead of ${{ secrets.GITHUB_TOKEN }}.
https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token

[chrisan]

Appears to be same result with API limiting. I created a token with the repo full permissions (just in case) and created a PERSONAL_ACCESS_TOKEN secret in https://github.com/myorg/myapp/settings/secrets/actions

      - name: Setup PHP
        uses: shivammathur/setup-php@v2 # https://github.com/shivammathur/setup-php
        with:
          php-version: 8.1 # Use your PHP version
          extensions: bcmath, ctype, curl, fileinfo, intl, json, mbstring, openssl, pdo, redis, simplexml, tokenizer, xml, zip # Setup any required extensions for tests
          tools: composer:v2
        env:
          COMPOSER_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
      - run: composer config --global github-oauth.github.com

In the actions log the output for the composer config is just ***, I assume github is automatically hiding any detected keys?

I also added another step - run: composer config --global github-oauth.github.com ${{ secrets.PERSONAL_ACCESS_TOKEN }} to try and manually set it but still get could not authenticate

[chrisan]

Alright, I found the root cause. The config setting is ignored by composer when using an auth.json for private repository access. We are using laravel-enlightn.com and they require a username/password to access the repository.

I added github-oauth to auth.json and now it is working without rate limiting

{
  "http-basic": {
    "satis.laravel-enlightn.com": {
      "username": "you@example.com",
      "password": "xxx"
    }
  },
  "github-oauth": {
    "github.com": "ghp_your_personal_access_token_for_ci"
  }
}

I suppose instead of

      - name: Add HTTP basic auth credentials
        run: echo '${{ secrets.COMPOSER_AUTH_JSON }}' > $GITHUB_WORKSPACE/auth.json

I should be passing to the command line like you do in the source