title: Github actions, 401 unauthorized when installing a Github Package with npm or yarn
body: <p>When I try to install my <code>npm</code> modules from a GitHub action I get the following error:</p>
  <pre><code>npm ERR! 401 Unauthorized - GET https://npm.pkg.github.com/@xxxx%2fxxxx-analytics - Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
  </code></pre>
  <p>Before you comment, I have configured the .npmrc correctly with the scope and access token, and everything works fine when installing the private package locally.</p>
  <p>Here is my GitHub workflow action:</p>
  <pre><code>name: JavaScript workflow
  
  on: [push]
  
  jobs:
    test:
      runs-on: ubuntu-latest
  
      steps:
        - uses: actions/checkout@v1
        - name: Use Node.js 12.x
          uses: actions/setup-node@v1
          with:
            node-version: '12.x'
        - name: npmrc
          run: cat .npmrc
        - name: npm install
          run: |
            npm install
          env:
            CI: true
            NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
  
  </code></pre>
  <p>here is my .npmrc</p>
  <pre><code>@fortawesome:registry=https://npm.fontawesome.com/
  //npm.fontawesome.com/:_authToken=XXXXXXXXX
  @colonynetworks:registry=https://npm.pkg.github.com
  //npm.pkg.github.com:_authToken=XXXXXXXXX
  always-auth=true
  @react-admin:registry=https://registry.marmelab.com
  //registry.marmelab.com:
  _auth=XXXXXXXXX
  email=software@XXXXXXXXX.com
  always-auth=true
  
  </code></pre>
  <p>It's a private repo and the authTokens are currently hardcoded in the .npmrc file.</p>
  <p>However while trying to find a solution for this, I did come across this random comment from a Github staff member: <a href="https://github.community/t/netlify-getting-401-from-github-package-registry-with-auth-token/16415/3" rel="noreferrer">https://github.community/t/netlify-getting-401-from-github-package-registry-with-auth-token/16415/3</a></p>
  <p>It's a bit vague, but it sounds like it doesn't accept a hardcoded authToken in the .npmrc file.</p>
  <p>So first thing I tried was to use our env variable instead like so:</p>
  <pre><code>@xxxx=https://npm.pkg.github.com
  //npm.pkg.github.com:_authToken=${NPM_AUTH_TOKEN}
  
  </code></pre>
  <p>The env variable is correct in our Github repo secrets, and supplied by the workflow.</p>
  <p>However this still resulted in the same 401 Unauthorized error.</p>
  <p>From looking at other solutions I then tried to generate the .npmrc manually inside the Github action before the <code>install</code> step, like so:</p>
  <pre><code>- name: npmrcgen
          run: |
            echo &quot;//npm.pkg.github.com/:_authToken=XXXXXXX&quot; &gt; .npmrc
            echo &quot;@xxxxx=https://npm.pkg.github.com/&quot; &gt;&gt; .npmrc
            echo &quot;@react-admin:registry=https://registry.marmelab.com&quot; &gt;&gt; .npmrc
            echo &quot;//registry.marmelab.com:&quot; &gt;&gt; .npmrc
            echo &quot;_auth=XXXXXXX&quot; &gt;&gt; .npmrc
            echo &quot;email=software@xxxxx.com&quot; &gt;&gt; .npmrc
            echo &quot;always-auth=true&quot; &gt;&gt; .npmrc
  </code></pre>
  <p>During the logging step I added, it the _authToken (only for Github) still shows up as <code>***</code>, and I still got a 401 Unauthorized error.</p>
  <p>At this point I wanted to confirm the .npmrc was even being used, so I removed the second private registry we used for <code>marmelab.com</code>, and sure enough, I got an error saying it was no longer able to install their <code>ra-realtime</code> package. This proves the .npmrc file is indeed being read and used by my Github action, but it's not accepting my Github personal access token.</p>
  <p>I have tried to generate a new token as well. It has full access to everything under <code>repo:</code> as well as <code>write:packages</code> and <code>read:packages</code> which is what should be required.</p>
  <p>Still 401 Unauthorized in the Github action, and still works fine locally.</p>
  <p>Lastly I have tried to install it with <code>yarn</code> instead of <code>npm</code>. Unsurprisingly this did not fix it either.</p>
  <p>I have seen and tried the following solutions without any success:</p>
  <ul>
  <li><a href="https://stackoverflow.com/questions/58975181/download-private-module-from-github-package-registry-via-yarn-within-a-github-ac">Download private module from Github Package Registry via Yarn within a Github Action? Publishing works, but installing is met with &#39;401 Unauthorized&#39;</a></li>
  <li><a href="https://github.com/FerLuisxd/create-npmrc" rel="noreferrer">https://github.com/FerLuisxd/create-npmrc</a></li>
  <li><a href="https://blog.bitsrc.io/install-npm-private-packages-in-ci-cd-with-github-actions-746db95017cc" rel="noreferrer">https://blog.bitsrc.io/install-npm-private-packages-in-ci-cd-with-github-actions-746db95017cc</a></li>
  </ul>
  <p>One thing I have not tried, as I have seen no recommendations on how or this being a good idea, but I have not done an <code>npm login</code> within the Github action. Since no one else has done this, and somehow have it working, I assume this is not necessary.</p>