::error::Bad credentials - https://docs.github.com/rest

[ruben-herold]

hi,

using version 0.35.0 on gitea. We didn't change something on our workflow files. But since today we get:

Determining the default branch
Retrieving the default branch name
Bad credentials - https://docs.github.com/rest
Waiting 19 seconds before trying again
Retrieving the default branch name
Bad credentials - https://docs.github.com/rest
Waiting 11 seconds before trying again
Retrieving the default branch name
::remove-matcher owner=checkout-git::
::error::Bad credentials - https://docs.github.com/rest
  ❌  Failure - Main Checkout install script
exitcode '1': failure
  ❌  Failure - Main Install Trivy
exitcode '1': failure
  ❌  Failure - Main Trivy filesystem scan (blocking)
exitcode '1': failure

Workflow jobs:

      - name: Trivy filesystem scan (blocking)
        uses: aquasecurity/trivy-action@0.35.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          ignore-unfixed: true 
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          format: 'table'

      - name: Trivy image scan (blocking)
        uses: aquasecurity/trivy-action@0.35.0
        with:
          image-ref: 'dkim-api:ci'
          severity: 'CRITICAL,HIGH'
          ignore-unfixed: true
          exit-code: '1'
          format: 'table'

[DmitriyLewen]

Hi @ruben-herold ,
Thank you for reporting this.

We've investigated and confirmed that the 0.35.0 tag was not modified.

The error Bad credentials - https://docs.github.com/rest suggests that your Gitea instance is unable to authenticate against GitHub API when fetching the action. This is likely caused by an expired or missing GitHub token configured in your Gitea instance for fetching actions from GitHub.

Please check your Gitea configuration for the token used to access GitHub (usually configured under [actions] section in app.ini). This would explain why it worked before and stopped working today — independently of our changes.

Regards, Dmitriy

[ruben-herold]

@DmitriyLewen there was never any github token configured on the gitea instance or runners. All other actions also run find only the trivy action failed...

[ruben-herold]

If this helps:

old output:

Running trivy with options: trivy fs  --format table --exit-code  1 --ignore-unfixed --vuln-type  os,library --severity  CRITICAL,HIGH .
Global options:  
2026-03-17T07:42:12Z	INFO	Need to update DB
2026-03-17T07:42:12Z	INFO	Downloading DB...	repository="ghcr.io/aquasecurity/trivy-db:2"
19.39 MiB / 87.95 MiB [------------->_______________________________________________] 22.04% ? p/s ?40.86 MiB / 87.95 MiB [---------------------------->________________________________] 46.45% ? p/s ?61.69 MiB / 87.95 MiB [------------------------------------------>__________________] 70.14% ? p/s ?82.60 MiB / 87.95 MiB [-------------------------------------------->__] 93.91% 105.35 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [--------------------------------------------->] 100.00% 105.35 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [--------------------------------------------->] 100.00% 105.35 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 99.13 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 99.13 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 99.13 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 92.73 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 92.73 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 92.73 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 86.75 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 86.75 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 86.75 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 81.15 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 81.15 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 81.15 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [---------------------------------------------->] 100.00% 75.92 MiB p/s ETA 0s87.95 MiB / 87.95 MiB [-------------------------------------------------] 100.00% 23.25 MiB p/s 4.0s2026-03-17T07:42:17Z	INFO	Vulnerability scanning is enabled
2026-03-17T07:42:17Z	INFO	Secret scanning is enabled
2026-03-17T07:42:17Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-03-17T07:42:17Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2026-03-17T07:42:17Z	INFO	Number of language-specific files	num=1
2026-03-17T07:42:17Z	INFO	[pip] Detecting vulnerabilities...
failed to remove container: Error response from daemon: removal of container be4bb0ef4d165f5c2f41dc3d04d03861664e16bcb66282572e2b0196f533ed8c is already in progress

now:

::warning::Failed to restore: getCacheEntry failed: connect ETIMEDOUT 172.17.1.2:35027
Cache not found for input keys: trivy-binary-v0.69.3-Linux-X64
::add-matcher::/run/act/actions/9a91f19648de5177a70e789d2b9faaa6fe417044c65ed40b9b0238ec91e81083/dist/problem-matcher.json
Syncing repository: aquasecurity/trivy
Getting Git version info
Working directory is '/workspace/Ops/DKIM-API/trivy'
[command]/usr/bin/git version
git version 2.50.1
Temporarily overriding HOME='/tmp/9a5516da-ef6a-4810-90ff-9d63af5454d9' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
[command]/usr/bin/git config --global --add safe.directory /workspace/Ops/DKIM-API/trivy
Initializing the repository
[command]/usr/bin/git init /workspace/Ops/DKIM-API/trivy
hint: Using 'master' as the name for the initial branch. This default branch name
hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call:
hint:
hint: 	git config --global init.defaultBranch <name>
hint:
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint:
hint: 	git branch -m <name>
hint:
hint: Disable this message with "git config set advice.defaultBranchName false"
Initialized empty Git repository in /workspace/Ops/DKIM-API/trivy/.git/
[command]/usr/bin/git remote add origin https://github.com/aquasecurity/trivy
Disabling automatic garbage collection
[command]/usr/bin/git config --local gc.auto 0
Setting up auth
[command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
[command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
[command]/usr/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
Determining the default branch
Retrieving the default branch name
Bad credentials - https://docs.github.com/rest
Waiting 18 seconds before trying again
Retrieving the default branch name
Bad credentials - https://docs.github.com/rest
Waiting 13 seconds before trying again
Retrieving the default branch name
::remove-matcher owner=checkout-git::
::error::Bad credentials - https://docs.github.com/rest
  ❌  Failure - Main Checkout install script
exitcode '1': failure
  ❌  Failure - Main Install Trivy
exitcode '1': failure
  ❌  Failure - Main Trivy filesystem scan (blocking)
exitcode '1': failure

[ruben-herold]

Switching back to v0.20.0 let it work again.

[DmitriyLewen]

We didn't change something on our workflow files. But since today we get:

It looks like you update trivy-action.

Why it worked before and breaks now:
Your Gitea runner was previously using a old version of trivy-action that predates #406 (merged October 2024). You can see this in your old logs — trivy was downloaded directly from ghcr.io, which is the old installation method.
After bump trivy-action, it uses https://github.com/aquasecurity/setup-trivy to install Trivy.
setup-trivy internally uses actions/checkout to clone https://github.com/aquasecurity/trivy, and for that it uses github.token — which on Gitea is not a valid GitHub credential, hence Bad credentials.

Fix:
Pass a valid GitHub PAT via the token-setup-trivy input (added in #421):

  - uses: aquasecurity/trivy-action@0.35.0
    with:
      scan-type: 'fs'
      token-setup-trivy: ${{ secrets.GITHUB_PAT }}

This is a known limitation when running on non-GitHub hosted environments (GHES, Gitea, etc.) — see aquasecurity/setup-trivy#10 for more context.

[ruben-herold]

thx will try it:

I was now testing version and for example v0.30.0:

Unable to resolve v0.2.2: reference not found
Unable to resolve v0.2.2: reference not found
reference not found
::warning::Failed to restore: getCacheEntry failed: connect ETIMEDOUT 172.17.2.2:45507
Cache not found for input keys: cache-trivy-2026-03-20, cache-trivy-
Running Trivy with options: trivy fs .
/var/run/act/actions/86f028fe5c6f32cb11f77f9396cf5ec78877288af8b311a40c2ed6cbe1505bb9/entrypoint.sh: line 44: trivy: command not found
  ❌  Failure - Main Run Trivy
exitcode '127': command not found, please refer to https://github.com/nektos/act/issues/107 for more information
  ❌  Failure - Main Trivy filesystem scan (blocking)
exitcode '127': command not found, please refer to https://github.com/nektos/act/issues/107 for more information