ansible-galaxy collection publish ignores --token argument when custom galaxy server is configured

Author: mshonichevCreated Sep 14, 2023Updated Sep 11, 2026

Labelsbughas_prP3affects_2.15

Summary

When a custom Galaxy servers configured without token in ansible.cfg as follows:

ini

[galaxy]
server_list = private
ignore_certs = yes

[galaxy_server.private]
url = https://MYSERVER.local/api

Then token passed via command line argument is not used at all, e.g. ansible-galaxy collection publish --token <MYTOKEN> <MYCOLLECTION>.tar.gz DOES NOT send Authorization: Token <MYTOKEN> header, that results in 401 authorisation error.

However, token IS sent when server url is also passed via command line argument, e.g.following command completes successfully: ansible-galaxy collection publish --server https://MYSERVER.local/api --token <MYTOKEN> <MYCOLLECTION>.tar.gz

Also, token IS sent when token=<MYTOKEN> is set in the [galaxy_server.private] section, e.g.

ini

[galaxy]
server_list = private
ignore_certs = yes

[galaxy_server.private]
url = https://MYSERVER.local/api
token = <MYTOKEN>

That issue is important for CI integration, because default configuration usually resides in git and secrets are usually passed as either environment variable or command line argument

Issue Type

Bug Report

Component Name

lib/ansible/galaxy

Ansible Version

bash

$ ansible --version

ansible [core 2.15.4]
  config file = /Users/m.shonichev/ansible.cfg
  configured module search path = ['/Users/m.shonichev/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.11/site-packages/ansible
  ansible collection location = /Users/m.shonichev/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.11.4 (main, Jun 20 2023, 16:52:35) [Clang 13.0.0 (clang-1300.0.29.30)] (/usr/local/opt/[email protected]/bin/python3.11)
  jinja version = 3.1.2
  libyaml = True

Configuration

bash

$ ansible-config dump --only-changed -t all
CONFIG_FILE() = /Users/m.shonichev/ansible.cfg
GALAXY_IGNORE_CERTS(/Users/m.shonichev/ansible.cfg) = True
GALAXY_SERVER_LIST(/Users/m.shonichev/ansible.cfg) = ['private']

OS / Environment

Mac OS

Steps to Reproduce

deploy a Galaxy compatible REST API server with token authorization at some URL, e.g. https://galaxy-ng.local/ https://github.com/ansible/galaxy_ng for example
configure server URL in the ANSIBLE_CONFIG. Do NOT configure token in the config.

bash

cat <<EOF >~/ansible.cfg        
[galaxy]
server_list = private
[galaxy_server.private]
url = https://galaxy-ng.local/api
EOF

create a collection

bash

ansible-galaxy collection init my.test
cd my/test
ansible-galaxy collection build

try to publish collection, do NOT specify server URL, only pass authorisation token.

bash

ansible-galaxy collection publish --token MYTOKEN my-test-*.tar.gz

Expected Results

I expect token to be correctly passed to the configured server and collection published successfully

Actual Results

token is not passed, 401 authorization error thrown

bash

Using /Users/m.shonichev/ansible.cfg as config file
Publishing collection artifact '/Users/m.shonichev/my/test/my-test-1.0.0.tar.gz' to private https://galaxy-ng.local/api
ERROR! Error when publishing collection to private (https://galaxy-ng.local/api) (HTTP Code: 401, Message: UNAUTHORIZED Code: Unknown)

Code of Conduct

I agree to follow the Ansible Code of Conduct

Source: ansible/ansible

View original on GitHub View discussion on GitHub