The oauth token for github.com seems invalid

[liepumartins]

Trying to create self-hosted CI/CD pipeline.
composer install failed Failed to download phpstan/phpstan from dist: Could not authenticate against github.com Now trying to download from source

At first I blamed gitea act_runner, because it sets GITHUB_TOKEN env variable. However passing COMPOSER_AUTH_JSON directly and verifying the contents concludes that I was wrong.

Debugging

name: ci

on:
  push:
    branches:
      - "trunk"

jobs:
  build:
    runs-on: ubuntu-latest
    container: catthehacker/ubuntu:act-latest
    env:
      COMPOSER_AUTH_JSON: ${{ secrets.COMPOSER_AUTH_JSON }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: 8.2
          extensions: json, mbstring, pdo, pdo_sqlsrv, simplexml
          tools: composer:v2, phpunit, phpstan
          coverage: none     
      - name: debug auth.json file content
        run: cat /root/.composer/auth.json # file looks good, same token works on other machine with composer
      - name: Diagnose composer
        run: composer diagnose

{
  "github-oauth": {
    "github.com": "ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
  }
}

composer diagnose

Checking composer.json: OK
Checking platform settings: OK
Checking git settings: OK git version 2.42.0
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK
Checking github.com oauth access: The oauth token for github.com seems invalid, run "composer config --global --unset github-oauth.github.com" to remove it
Checking disk free space: OK
Checking pubkeys: FAIL
Missing pubkey for tags verification
Missing pubkey for dev verification
Run composer self-update --update-keys to set them up
Checking composer version: OK
Composer version: 2.6.6
PHP version: 8.2.13
PHP binary path: /usr/bin/php8.2
OpenSSL version: OpenSSL 3.0.2 15 Mar 2022
cURL version: 7.81.0 libz 1.2.11 ssl OpenSSL/3.0.2
zip: extension present, unzip present, 7-Zip not available

What is wrong here? Same token works on other machine, and composer diagnose does not complain there.

EDIT: also tried composer self-update --update-keys before diagnostics.

::error ::Public keys can not be fetched in non-interactive mode, please run Composer interactively

[shivammathur]

@liepumartins

To fix the keys error, you can add this step before composer diagnose.

- name: Add keys
  run: |
    sudo curl -o ~/.composer/keys.tags.pub -sL https://composer.github.io/releases.pub
    sudo curl -o ~/.composer/dev.tags.pub -sL https://composer.github.io/snapshots.pub

But the invalid GitHub token error is not related to this, please recheck the token and the auth JSON you have saved in the secret.

Also, since you are using a self-hosted runner, please specify env runner as self-hosted.
https://github.com/shivammathur/setup-php?tab=readme-ov-file#self-hosted-setup

Test workflow: https://github.com/shivammathur/test-setup-php/actions/runs/7260138465/workflow

[liepumartins]

Added runner as self-hosted and added keys, but the token still "seems invalid"

Checking github.com oauth access: The oauth token for github.com seems invalid, run "composer config --global --unset github-oauth.github.com" to remove it

Tried new tokens. Both fine-grained and classic
Interesting: new tokens are listed as "never used". Composer never actually tries to use the token, just assumes it is invalid?
But if I place auth.json with token on other machine and run composer, it works, and last used is updated.

Removing composer diagnose goes back to 1st mentioned error during composer install

EDIT: also copy-pasted test workflow - same result.

[liepumartins]

Apparently auth.json is never read, composer diagnose -vvv tells Loading auth config from COMPOSER_AUTH. Curious about content of that, I created following steps (base64 is for bypassing secret output protection)

      - run: env
      - run: echo $COMPOSER_AUTH|jq -r '.["github-oauth"]["github.com"]'|base64
      - run: echo $GITHUB_TOKEN|base64

I added these steps as first steps and after uses: shivammathur/setup-php@v2
Turns out COMPOSER_AUTH gets modified during setup-php and variable GITHUB_TOKEN is installed instead of previous.
On gitea act_runner GITHUB_TOKEN is something used internally.

Workaround is to add env: COMPOSER_AUTH: {{$secrets.COMPOSER_AUTH}} to each step running composer commands. Because the global env or env at setup-php job has no effect on this.

@shivammathur Could COMPOSER_AUTH not be modified if such env variable already is set?

name: ci

on:
  push:
    branches:
      - "trunk"
env:
  COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH_JSON }} # no effect after setup-php overwrites it
jobs:
  build:
    runs-on: ubuntu-latest
    container: catthehacker/ubuntu:act-latest
    steps:
      - run: echo $COMPOSER_AUTH|jq -r '.["github-oauth"]["github.com"]'|base64
      - run: echo $GITHUB_TOKEN|base64
      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: 8.2
          tools: composer:v2
          coverage: none
        env:
          runner: self-hosted
          COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH_JSON }} # no effect
      - name: Add keys
        run: |
          sudo curl -o ~/.composer/keys.tags.pub -sL https://composer.github.io/releases.pub
          sudo curl -o ~/.composer/keys.dev.pub -sL https://composer.github.io/snapshots.pub
      - run: echo $COMPOSER_AUTH|jq -r '.["github-oauth"]["github.com"]'|base64
      - run: echo $GITHUB_TOKEN|base64
      - name: Diagnose composer
        env:
          COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH_JSON }} # only this works
        run: composer diagnose -vvv
      - name: Install dependencies # will not work
        run: composer install        
      - name: Install dependencies
        env:
          COMPOSER_AUTH: ${{ secrets.COMPOSER_AUTH_JSON }} # only this works
        run: composer install # will work