Help authenticating to devhub for 2gp nightly build workflow

[kayla-blackthorn]

Hello,
I already have automation that runs CCI flows to create 1gp releases for a managed package. I am trying to set up a workflow to run nightly creations of 2gp package versions, but I am having trouble connecting the the devhub org. I thought that it would work the same as connecting to the package org in my release automation, but that doesn't seem to be the case. I added organization secrets that I've set as environment variables in my yml file to authenticate, but when I get to the step for Install Dependencies I receive an error that "Error: OAuth failed
status_code: 400
content: b'{"error":"invalid_grant","error_description":"expired access/refresh
token"}'"

This is my file:

name: Salesforce Nightly Build

on:
  push:
    branches:
      - PAY-2176

env:
  CUMULUSCI_KEYCHAIN_CLASS: cumulusci.core.keychain.EnvironmentProjectKeychain
  CUMULUSCI_SERVICE_github: ${{ secrets.CUMULUSCI_SERVICE_GITHUB }}
  DEV_HUB_AUTH_URL: ${{ secrets.DEV_HUB_AUTH_URL }}
  DEV_HUB_CLIENT_ID: ${{ secrets.DEV_HUB_CLIENT_ID }}
  DEV_HUB_KEY: ${{ secrets.DEV_HUB_KEY }}
  CUMULUSCI_ORG_devhub: ${{ secrets.CUMULUSCI_ORG_DEVHUB }}

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v2

      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: 3.8

      - name: Install CumulusCI
        run: pip install cumulusci
      
      - name: Install sfdx
        run: |
          mkdir sfdx
          wget -qO- https://developer.salesforce.com/media/salesforce-cli/sfdx/channels/stable/sfdx-linux-x64.tar.xz | tar xJ -C sfdx --strip-components 1
          export PATH="$(pwd)/sfdx/bin"
          echo "$(pwd)/sfdx/bin" >> $GITHUB_PATH

      - name: Install Dependencies
        run: |
          cci flow run dependencies --org devhub

      - name: Build Beta Package
        run: |
          cci task run create_package_version --org devhub --package_type Managed

      - name: Run Beta Test
        run: |
          cci flow run ci_beta 

      - name: Delete Scratch Org
        run: |
          cci org scratch_delete beta
        shell: bash

[James Estevez]

This doesn't read like a bug to me. Have you reviewed the docs, especially the sections on SFDX_CLIENT_ID and SFDX_HUB_KEY?