GitHub Actions工作流中pip安装私有仓库失败求助

问题场景 #

使用GitHub Actions工作流，通过GitHub App Token尝试安装组织内的私有Python仓库时失败。原工作流代码如下：

name: CI

on:
  push:
    branches:
      - testing-app-token-generator

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repo A
        uses: actions/checkout@v4

      - name: Generate GitHub App Token
        id: app_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ vars.TOKEN_GENERATOR_APP_ID }}
          private-key: ${{ secrets.TOKEN_GENERATOR_APP_PRIVATE_KEY }}

      - name: Debug Token Output
        run: |
          echo "Token Length: ${#GITHUB_TOKEN}"
        env:
          GITHUB_TOKEN: ${{ steps.app_token.outputs.token }}

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          architecture: "x64"

      - name: Configure Git to Use GitHub Token
        env:
          GITHUB_TOKEN: ${{ steps.app_token.outputs.token }}
        run: |
          git config --global url.https://${GITHUB_TOKEN}@github.com/.insteadOf https://github.com/
          git config --global credential.helper store


      - name: Install internal-project (Private Repo)
        env:
          GITHUB_TOKEN: ${{ steps.app_token.outputs.token }}
        run: |
          pip install git+https://${GITHUB_TOKEN}@github.com/OrgName/internal-project.git

      - name: Install dependencies
        run: pip install -e .

执行后触发的报错信息：

Collecting git+https://****@github.com/OrgName/internal-project.git
  Cloning https://****@github.com/OrgName/internal-project.git to /tmp/pip-req-build-ecm4ocoz
  Running command git clone --filter=blob:none --quiet 'https://****@github.com/OrgName/internal-project.git' /tmp/pip-req-build-ecm4ocoz
  fatal: could not read Password for 'https://***@github.com': No such device or address
  error: subprocess-exited-with-error
  
  × git clone --filter=blob:none --quiet 'https://****@github.com/OrgName/internal-project.git' /tmp/pip-req-build-ecm4ocoz did not run successfully.
  │ exit code: 128
  ╰─> See above for output.
  
  note: This error originates from a subprocess, and is likely not a problem with pip.

Notice:  A new release of pip is available: 25.0 -> 25.0.1
Notice:  To update, run: pip install --upgrade pip
error: subprocess-exited-with-error

× git clone --filter=blob:none --quiet 'https://****@github.com/OrgName/internal-project.git' /tmp/pip-req-build-ecm4ocoz did not run successfully.
│ exit code: 128
╰─> See above for output.

note: This error originates from a subprocess, and is likely not a problem with pip.
Error: Process completed with exit code 1.

已知GitHub App已安装到整个组织，且拥有目标私有仓库的读取权限。

解决方案 #

1. 调整Git配置，避免交互式凭证请求 #

原配置中的credential.helper store会让Git尝试读取本地存储的凭证，在CI环境中反而触发交互式请求失败。修改为缓存凭证并禁用交互式提示：

git config --global url.https://${GITHUB_TOKEN}@github.com/.insteadOf https://github.com/
git config --global credential.helper 'cache --timeout=3600'
git config --global core.askPass ""

2. 简化pip安装命令 #

既然已经配置了Git的URL替换规则，无需在pip命令中显式携带token，直接使用普通仓库地址即可，避免token传递时的格式问题：

pip install git+https://github.com/OrgName/internal-project.git

3. 验证Token的有效性与权限 #

在工作流中添加Debug步骤，确认生成的Token能正常访问目标私有仓库：

curl -H "Authorization: token ${GITHUB_TOKEN}" https://api.github.com/repos/OrgName/internal-project

如果返回仓库的JSON数据，说明Token权限正常；若返回403/404，需检查GitHub App的权限设置或安装范围。

4. 可选：改用requirements.txt管理依赖 #

将私有仓库依赖写入requirements.txt：

git+https://github.com/OrgName/internal-project.git

然后执行pip install -r requirements.txt，同样依赖Git的URL替换规则自动注入token。

修正后的完整Workflow示例 #

name: CI

on:
  push:
    branches:
      - testing-app-token-generator

jobs:
  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repo A
        uses: actions/checkout@v4

      - name: Generate GitHub App Token
        id: app_token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ vars.TOKEN_GENERATOR_APP_ID }}
          private-key: ${{ secrets.TOKEN_GENERATOR_APP_PRIVATE_KEY }}

      - name: Debug Token & Verify Repository Access
        env:
          GITHUB_TOKEN: ${{ steps.app_token.outputs.token }}
        run: |
          echo "Token Length: ${#GITHUB_TOKEN}"
          # 验证Token能否访问目标私有仓库
          curl -H "Authorization: token ${GITHUB_TOKEN}" https://api.github.com/repos/OrgName/internal-project

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          architecture: "x64"

      - name: Configure Git for Private Repo Access
        env:
          GITHUB_TOKEN: ${{ steps.app_token.outputs.token }}
        run: |
          git config --global url.https://${GITHUB_TOKEN}@github.com/.insteadOf https://github.com/
          git config --global credential.helper 'cache --timeout=3600'
          git config --global core.askPass ""

      - name: Install internal-project (Private Repo)
        run: |
          pip install git+https://github.com/OrgName/internal-project.git

      - name: Install dependencies
        run: pip install -e .

内容的提问来源于stack exchange，提问作者AGS