How to fix fatal: Authentication failed - CI token expired during long build in Git

# In GitHub Actions, check the job summary
# In GitLab CI, check the pipeline duration
# In Jenkins, check the build time in console output

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # GITHUB_TOKEN is automatically available and refreshes
          token: ${{ secrets.GITHUB_TOKEN }}

      # For operations requiring more permissions
      - name: Push changes
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git push
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

build:
  script:
    - git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/group/repo.git
    # CI_JOB_TOKEN is valid for the entire job duration

steps:
  - checkout: self
    persistCredentials: true
    # System.AccessToken is automatically managed

jobs:
  long-build:
    runs-on: ubuntu-latest
    steps:
      - name: Generate App Token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: actions/checkout@v4
        with:
          token: ${{ steps.app-token.outputs.token }}

      - name: Long running task
        run: |
          # ... your long build steps ...

      # Refresh token before late-stage Git operations
      - name: Refresh Token
        id: refresh-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - name: Late Git Operations
        run: |
          git push origin main
        env:
          GITHUB_TOKEN: ${{ steps.refresh-token.outputs.token }}

#!/bin/bash
# Function to refresh token before Git operations
refresh_git_token() {
  # Call your token generation API/service
  NEW_TOKEN=$(curl -s "https://your-token-service/generate")
  git remote set-url origin "https://x-access-token:${NEW_TOKEN}@github.com/org/repo.git"
}

# Use before critical Git operations
refresh_git_token
git push origin main

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - uses: actions/checkout@v4
      - name: Build
        run: npm run build
      - uses: actions/upload-artifact@v4
        id: upload
        with:
          name: build-output
          path: dist/

  test:
    needs: build
    runs-on: ubuntu-latest
    steps:
      # Fresh token for this job
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: build-output
          path: dist/
      - name: Test
        run: npm test

  deploy:
    needs: test
    runs-on: ubuntu-latest
    steps:
      # Fresh token for deployment
      - uses: actions/checkout@v4
      - name: Deploy
        run: ./deploy.sh

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Setup SSH Key
        uses: webfactory/ssh-agent@v0.9.0
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: Clone via SSH
        run: git clone git@github.com:org/repo.git

      - name: Long running build
        run: |
          # Hours later, SSH still works
          make build-all

      - name: Push changes
        run: |
          cd repo
          git push origin main

before_script:
  - eval $(ssh-agent -s)
  - echo "$SSH_PRIVATE_KEY" | ssh-add -
  - mkdir -p ~/.ssh
  - ssh-keyscan gitlab.com >> ~/.ssh/known_hosts

build:
  script:
    - git clone git@gitlab.com:group/repo.git
    # SSH key has no expiration

# GitHub Actions
- uses: actions/cache@v4
  with:
    path: |
      ~/.npm
      node_modules
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

# GitLab CI
cache:
  paths:
    - node_modules/
    - .npm/

# GitHub Actions matrix
strategy:
  matrix:
    shard: [1, 2, 3, 4]
steps:
  - run: npm test -- --shard=${{ matrix.shard }}/4

# Shallow clone
- uses: actions/checkout@v4
  with:
    fetch-depth: 1  # Only latest commit

# Don't fetch submodules if not needed
- uses: actions/checkout@v4
  with:
    submodules: false

steps:
  # Do ALL Git operations first while token is fresh
  - uses: actions/checkout@v4
  - run: git fetch --all
  - run: git submodule update --init

  # Then do long-running non-Git tasks
  - run: npm install
  - run: npm run build
  - run: npm test

#!/bin/bash
git_with_retry() {
  local max_attempts=3
  local attempt=1

  while [ $attempt -le $max_attempts ]; do
    if "$@"; then
      return 0
    fi

    echo "Git operation failed (attempt $attempt/$max_attempts)"

    # Check if it's an auth error
    if git ls-remote origin 2>&1 | grep -q "Authentication failed"; then
      echo "Authentication error detected, refreshing credentials..."
      # Add your token refresh logic here
      refresh_credentials
    fi

    attempt=$((attempt + 1))
    sleep 5
  done

  echo "Git operation failed after $max_attempts attempts"
  return 1
}

# Usage
git_with_retry git push origin main

- uses: nick-invision/retry@v3
  with:
    timeout_minutes: 10
    max_attempts: 3
    command: |
      git push origin main

import subprocess
import time
from functools import wraps

def retry_git(max_attempts=3, delay=5):
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            for attempt in range(max_attempts):
                try:
                    return func(*args, **kwargs)
                except subprocess.CalledProcessError as e:
                    if "Authentication failed" in str(e.output):
                        print(f"Auth failed, retrying ({attempt + 1}/{max_attempts})")
                        refresh_token()  # Your refresh logic
                        time.sleep(delay)
                    else:
                        raise
            raise Exception("Max retries exceeded")
        return wrapper
    return decorator