neonctl fails any command when running in GitHub Actions context

[matthewmorek]

Starting today, neonctl stopped working inside the GitHub runners context, despite me rotating API keys, removing/adding NeonDB GH integration, adding keys manually, ensure all required vars are available, etc.

For the sake of consistency, I tried the same commands locally in my terminal, using the same strategy of keeping NEON_API_KEY variable exported inside my environment, and the these commands worked as expected.

Could there be some blocking happening on the NeonDB side?

BTW, majority of my workflows run NeonDB's own GitHub Actions, such as:

• https://github.com/marketplace/actions/neon-database-create-branch-action
• https://github.com/marketplace/actions/neon-database-reset-branch-action
• https://github.com/marketplace/actions/neon-database-delete-branch

The above all fail with the same eror, same as using neonctl directly.

Steps to reproduce

Add the following create_neon_branch workflow and run it via Pull Request

name: Preview

on:
  pull_request:
    types:
      - opened
      - reopened
      - synchronize
      - closed

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

env:
  NEON_DATABASE_USERNAME: ${{ vars.PG_USERNAME }}
  NEON_DATABASE_NAME: ${{ vars.PG_DATABASE }}
  GH_TOKEN: ${{ secrets.GH_TOKEN }}
  NEON_API_KEY: ${{ secrets.NEON_API_KEY }}
  NEON_PROJECT_ID: ${{ vars.NEON_PROJECT_ID }}

jobs:
  setup:
    name: Setup
    outputs:
      branch: ${{ steps.branch_name.outputs.current_branch }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Get branch name
        id: branch_name
        uses: tj-actions/branch-names@v8

  create-branch:
    name: Create Neon DB branch
    needs: setup
    outputs:
      db_url_with_pooler: ${{ steps.create-branch.outputs.db_url_with_pooler }}
      branch_id: ${{ steps.create-branch.outputs.branch_id }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with:
          run_install: false

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: "pnpm"

      - name: Create Neon Branch
        id: create-branch
        uses: neondatabase/create-branch-action@v5
        with:
          project_id: ${{ env.NEON_PROJECT_ID }}
          # parent: dev # optional (defaults to your primary branch)
          branch_name: preview/pr-${{ github.event.number }}-${{ needs.setup.outputs.branch }}
          username: ${{ env.NEON_DATABASE_USERNAME }}
          database: ${{ env.NEON_DATABASE_NAME }}
          api_key: ${{ env.NEON_API_KEY }}

Expected result

Expected to have db_url_with_pooler and branch_id available and successful job completion

Actual result

Warning: Can't add secret mask for empty string in ##[add-mask] command.
branch create out:
branch create err:
ERROR: The request could not be authorized due to an internal error
ERROR: branch creation failed
ERROR: The request could not be authorized due to an internal error
Error: Process completed with exit code 1.

Environment

node: v22.12.0
npm: 10.9.0
yarn: 1.22.22

Logs, links

• https://neon.tech/docs/connect/connection-errors#the-request-could-not-be-authorized-due-to-an-internal-error

[duskpoet]

Hey! Thanks for reporting!
There was a problem on our side. Can you try again now, please?

[fabuzaid21]

FWIW, I'm having the exact same issue. I just tried it again, but it's still not working. The Neon API, however, is working for me.

[matthewmorek]

Mine just went through successfully, thanks for sorting this out!

I would love to get more meaningful error messages from the CLI though, since I though it's my API that was the problem, so I rotated the key everywhere as a result, which wasn't very optimal.

[fabuzaid21]

Hmmm I'm still having a problem, @duskpoet. I'm running these from CircleCI, not GH Actions. Could that be the issue?

[duskpoet]

Mine just went through successfully, thanks for sorting this out!

I would love to get more meaningful error messages from the CLI though, since I though it's my API that was the problem, so I rotated the key everywhere as a result, which wasn't very optimal.

Yea, sorry, we had a misnatch between api and our api client

[duskpoet]

Hmmm I'm still having a problem, @duskpoet. I'm running these from CircleCI, not GH Actions. Could that be the issue?

not sure, maybe something is cached?

[duskpoet]

Can you, please, confirm that issue is resolved, @fabuzaid21 ? I am not familiar with CircleCI at all :(