使用GITHUB_TOKEN时Github Actions发布到Github包仓库突报401错误

我所在组织名下的仓库，原本正常运行的GitHub Actions工作流，近期突然在将包发布到GitHub Package Registry时抛出401未授权错误。工作流使用semantic-release工具完成发布，GITHUB_TOKEN的权限自初始设置后未做修改，且仅依赖公共NuGet源，按官方文档GITHUB_TOKEN应满足权限要求。

相关配置 #

工作流文件（./github/workflow.yml） #

name: ci

on:
  push:
    branches: [ main, dev ]
    paths: 
      - src/**

jobs:

  build:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      issues: write

    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-dotnet@v2
        with:
          dotnet-version: '6.x.x'

      - name: Build that shit
        run: dotnet build ./src/project.csproj --configuration Release --nologo

      - uses: actions/setup-node@v3
        with:
          node-version: 'lts/*'

      - name: Release that shit
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npm ci && npx semantic-release

semantic-release配置（./.releaserc） #

{
  "branches": [
    "main",
    {
      "name": "dev",
      "prerelease": "dev"
    }
  ],
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    "@semantic-release/github",
    [
      "@semantic-release/exec", {
        "prepareCmd": "dotnet pack ./src/project.csproj --no-restore --nologo --configuration Release /p:Version=${nextRelease.version}",
        "publishCmd": "dotnet nuget push ./src/bin/Release/project.${nextRelease.version}.nupkg --source https://nuget.pkg.github.com/MY_ORG/index.json --api-key ${process.env.GH_TOKEN}"
      }
    ]
  ]
}

错误日志 #

[11:05:13 AM] [semantic-release] › ℹ  Start step "publish" of plugin "@semantic-release/exec"
[11:05:13 AM] [semantic-release] [@semantic-release/exec] › ℹ  Call script dotnet nuget push ./src/bin/Release/project.2.8.6.nupkg --source https://nuget.pkg.github.com/MY_ORG/index.json --api-key [secure]
error: Unable to load the service index for source https://nuget.pkg.github.com/MY_ORG/index.json.
error:   Response status code does not indicate success: 401 (Unauthorized).

• NuGet认证缺少用户名参数：GitHub NuGet Registry要求认证时必须提供用户名（可以是任意非空值，比如nuget或你的GitHub用户名），但dotnet nuget push默认不会自动传递用户名。修改.releaserc里的publishCmd，加上--username参数：

  "publishCmd": "dotnet nuget push ./src/bin/Release/project.${nextRelease.version}.nupkg --source https://nuget.pkg.github.com/MY_ORG/index.json --api-key ${process.env.GH_TOKEN} --username nuget"
  

  或者更省心的方式：在工作流的Release that shit步骤里添加NUGET_AUTH_TOKEN环境变量，dotnet会自动用这个变量作为认证令牌，无需手动指定--api-key和--username：

  - name: Release that shit
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      NUGET_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    run: npm ci && npx semantic-release
  

  同时把.releaserc里的publishCmd简化为：

  "publishCmd": "dotnet nuget push ./src/bin/Release/project.${nextRelease.version}.nupkg --source https://nuget.pkg.github.com/MY_ORG/index.json"
  

• 组织级权限策略变更：即使仓库的GITHUB_TOKEN权限没改，组织管理员可能调整了GitHub Packages的全局权限。检查组织设置：进入组织的Settings > Packages > Package settings，确认当前仓库拥有发布到组织包注册表的权限，且允许使用GITHUB_TOKEN进行认证。

• 环境变量传递异常：semantic-release的exec插件偶尔会出现环境变量传递不完整的情况。可以临时在publishCmd里添加打印命令（测试后删除），确认GH_TOKEN是否正确注入：

  "publishCmd": "echo ${process.env.GH_TOKEN} && dotnet nuget push ./src/bin/Release/project.${nextRelease.version}.nupkg --source https://nuget.pkg.github.com/MY_ORG/index.json --api-key ${process.env.GH_TOKEN}"
  

• Dotnet版本兼容性问题：你使用的actions/setup-dotnet@v2和6.x.x版本范围可能自动更新了Dotnet SDK，而新版本的NuGet客户端对GitHub Registry的认证逻辑有变化。尝试升级actions/setup-dotnet到v4，并指定具体的Dotnet版本（比如6.0.417），避免版本波动：

  - uses: actions/setup-dotnet@v4
    with:
      dotnet-version: '6.0.417'
  

内容的提问来源于stack exchange，提问作者baouss