GitHub Actions job container credentials invalid

By Kaveh Alemi·Latchkey

A job-level container that pulls from a private registry uses container.credentials. If the username/password (or token) is wrong, empty, or lacks pull access, the runner cannot pull the image and the job fails before any step runs.

What this error means

A job using container: with credentials fails to pull the image with an authentication/credentials error.

Error: failed to pull image 'ghcr.io/org/app:latest'
unauthorized: invalid credentials provided for container.credentials.

Common causes

Wrong or empty credentials

container.credentials.username/password resolve to an empty secret or a token without pull rights.

Missing packages: read for GHCR

Pulling from GHCR with GITHUB_TOKEN needs packages: read permission.

How to fix it

Provide valid pull credentials

1. Set container.credentials to a secret with registry pull access.
2. For GHCR with GITHUB_TOKEN, grant permissions: packages: read.
3. Verify the secret is non-empty in this context (not a fork PR).

container:
  image: ghcr.io/org/app:latest
  credentials:
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

How to prevent it

• Grant the minimal registry permission the pull needs.
• Confirm credential secrets exist in the run context before relying on them.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions