ci/cd · SEV-3

401 from a private package registry, but only inside CI

scroll to render

How to confirm it

Does the agent have any identity?
```
gcloud auth list --format='value(account,status)' && gcloud auth application-default print-access-token >/dev/null 2>&1 && echo 'ADC ok' || echo 'NO ADC'
```
Works locally, fails in CI is almost always this: the developer has application-default credentials and the runner does not.
Is it auth, or the wrong repository?
```
curl -s -o /dev/null -w '%{http_code}\n' -H "Authorization: Bearer $(gcloud auth print-access-token)" https://REGION-python.pkg.dev/PROJECT/REPO/simple/
```
401 is credentials. 403 is credentials that are valid but lack the role. 404 is the wrong repository path — three different fixes.
Mint a scoped, short-lived token
```
gcloud auth print-access-token --lifetime=900
```
Fifteen minutes, scoped to the build. Long-lived secrets in CI are the version of this fix that hurts you later.

Builds ran with no credential path to the registry. Local developers had application-default credentials; the agents did not.

Mint a short-lived token at gate start and scope it to the build. Long-lived secrets in CI are the version of this fix that hurts you later.

Part of this work

CI Quality Gate at Scale ↗

A parallel, advisory-first quality gate fronting a 200+ repository estate.

Next incident

Pipeline step aborts with exit 2 and no error message ↗