and check the authorization token in http.https://github.com/.extraheader=AUTHORIZATION: basic .

Because this is happening on a self-hosted runner I assume I should have this configuration on the machine that hosts the actions-runner. Is that correct?

I suspect it is the credential stored for your git client (on your self-hosted runner machine) caused Permission denied issue when try to install your private repo.
The actions/checkout@v2 will persist the auth in a git extraheader config in default. If you set persis-credentials: false , there will no extraheader in git config .
So I want you to run git config --local -l to see whether there is the local git config of extraheader. You need to change working directory to the work folder of the self-hosted runner .

runner git770×650 31.9 KB

If there is no extraheader in your git config, could you please run
npm install git+https://:x-oauth-basic@github.com/my-org/my-private-repo.git in your local machine under the work folder of your runner? What’s the result?

self-runner836×706 29.2 KB

Surprisingly, this worked:

Could you please run npm install command directly in a run script? You could store your PAT in secrets.

Here’s the output from the build step:

image1355×430 60.1 KB

After this, I didn’t try npm install git+https://:x-oauth-basic@github.com/my-org/my-private-repo.git in my local machine under the work folder of the runner. After the above output, I expect it to be successful.

Here’s the output of git config --local -l from the action-runner/_work/my-project/my-project folder:

$ git config --local -l
core.repositoryformatversion=0
core.filemode=true
core.bare=false
core.logallrefupdates=true
remote.origin.url=https://github.com/akoskm/my-project
remote.origin.fetch=+refs/heads/*:refs/remotes/origin/*
gc.auto=0
branch.develop.remote=origin
branch.develop.merge=refs/heads/develop