401 Error running API call through github-script

[fiddlermikey]

Edit: link to first failure
I am getting 401 “Bad Credentials” trying to run some api calls through github-script. This was working on Monday (Jan 9) but stopped working on Tuesday (Jan 10)

I have contacted GitHub Support and they have been able to reproduce the error. They say it is most likely due to the 3rd party action, "github-script" (6.3.3) causing this issue.
https://support.github.com/ticket/enterprise/15636/1960901

Steps to reproduce

1. Create PAT with Admin access (r/w) to repos and org/teams
   

2. Set an Org secret using the value from my PAT
   

3. Run the workflow manually (or from a push)
   

4. Failure with 401 error
   

Expected to produce a list of repositories
I have pared down the workflow to isolate the issue. Attached is the workflow (list-repo-status.yml) and the debug log
list-repo-status.yml
list-repo-status.debug.log.txt

Last successful run can be found:
https://github.com/teamkfinteg/reportscripts/actions/runs/3878744215

First failure (only difference was trying to replace trigger with cron
https://github.com/teamkfinteg/reportscripts/actions/runs/3885391826

I used Postman with the same token to test and it works as expected.

Desktop (please complete the following information):

• OS: Win10
• Browser: Firefox
• Version: 108.0.2 (64-bit)

[fiddlermikey]

I tried specifying v6.3.2 and the sha 0306a3c1de9987bfd34b47af6926b0e96e399e2
Both attempts failed with the same error.

[joshmgross]

👋 @fiddlermikey, this action is a thin wrapper around Octokit and the GitHub API. The action itself isn't modifying that token or doing anything differently from an authentication perspective.

Are you able to use the same token on your local machine to call that REST API?

https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#list-organization-repositories

You can use curl or the gh CLI with your token:

curl \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer <YOUR-TOKEN>"\
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/orgs/ORG/repos

# GitHub CLI api
# https://cli.github.com/manual/gh_api

gh api \
  -H "Accept: application/vnd.github+json" \
  /orgs/ORG/repos

[midalias]

@fiddlermikey,

I found this issue while googling the same error message. Note that I am using the GH API not https://github.com/actions/github-script. The cause of the error was a space between $ and {{. Perhaps in your case it is something similar.

GITHUB_TOKEN: $ {{ secrets.GH_API_SCAN }}