Cloud Build中解析Secret失败，镜像构建遇401未授权问题

本地构建Docker镜像时，通过--build-arg传入GITHUB_TOKEN能正常下载GitHub私有npm包，但在Cloud Build环境中配置Secret传递token后，出现401未授权错误。

现有配置 #

cloudbuild.yaml #

substitutions:
  _IMAGE: ''
  _IMAGE_VERSION: ''

options:
  logging: CLOUD_LOGGING_ONLY

steps:

  # Build image
  - name: 'gcr.io/cloud-builders/docker'
    args:
      [
        'build',
        '--build-arg', 'GITHUB_TOKEN=$$GITHUB_TOKEN',
        '-t', '$_IMAGE:$_IMAGE_VERSION',
        '.'
      ]
    secretEnv: ['GITHUB_TOKEN']

# 以下写法也得到同样错误：

#  # Build image
#  - name: 'gcr.io/cloud-builders/docker'
#    entrypoint: 'bash'
#    args:
#      [
#        '-c',
#        'docker build --build-arg GITHUB_TOKEN=$$GITHUB_TOKEN -t $_IMAGE:$_IMAGE_VERSION .'
#      ]
#    secretEnv: ['GITHUB_TOKEN']

availableSecrets:
  secretManager:
    - versionName: projects/${PROJECT_ID}/secrets/GITHUB_TOKEN/versions/latest
      env: GITHUB_TOKEN

错误日志 #

401 Unauthorized - GET https://npm.pkg.github.com/download/****** - unauthenticated: User cannot be authenticated with the token provided.

Dockerfile（本地构建正常） #

FROM node:20-alpine3.20 AS homepage
RUN apk update && apk add bash

ARG GITHUB_TOKEN
ENV GITHUB_NPM_PAT=${GITHUB_TOKEN}

WORKDIR /homepage

COPY web/homepage/.npmrc ./
COPY web/homepage/*.json ./
RUN npm i

COPY web/homepage/ ./
RUN npm run build

GitHub Actions触发配置（build.yaml） #

- name: Prepare substitutions
  # 注意：替换变量用逗号分隔：KEY1=VAL1,KEY2=VAL2
  run: |
    echo -n '_IMAGE=${{ env.IMAGE }},' > .substitutions
    echo -n '_IMAGE_VERSION=${{ env.IMAGE_VERSION }}' >> .substitutions
    cat .substitutions

- name: Cloud Build
  run: |      
    gcloud builds submit . --substitutions=$(cat .substitutions)

解决步骤 #

• 检查Secret Manager中的token有效性：确认存储的GITHUB_TOKEN已开启read:packages权限，本地手动用该token登录npm并尝试安装私有包，验证token可用。
• 简化替换变量传递方式：避免用文件传递替换变量，直接在GitHub Actions的Cloud Build步骤中传入：

  - name: Cloud Build
    run: |      
      gcloud builds submit . --substitutions="_IMAGE=${{ env.IMAGE }},_IMAGE_VERSION=${{ env.IMAGE_VERSION }}"
  

• 验证token是否正确传入Docker构建：在Dockerfile中添加临时调试命令，输出token长度（避免泄露完整内容），查看Cloud Build日志确认token已传递：

  ARG GITHUB_TOKEN
  RUN echo "Token length: ${#GITHUB_TOKEN}"
  ENV GITHUB_NPM_PAT=${GITHUB_TOKEN}
  

• 核对.npmrc变量名：确保.npmrc中引用的变量名和Dockerfile里的GITHUB_NPM_PAT完全一致，示例：

  @your-org:registry=https://npm.pkg.github.com/
  //npm.pkg.github.com/:_authToken=${GITHUB_NPM_PAT}
  

• 避免变量名冲突：Cloud Build会自动解析$_开头的变量，可将Dockerfile中的token变量名改为GH_TOKEN之类的非冲突名称，避免被误替换。

内容的提问来源于stack exchange，提问作者Stefan Falk