{"record":{"id":"301f856ab22016e4","repo":"git-ecosystem/git-credential-manager","slug":"invalid-response-from-github-oidc-token-endpoint-301f85","errorCode":null,"errorMessage":"Invalid response from GitHub OIDC token endpoint: 'value' property is null.","messagePattern":"Invalid response from GitHub OIDC token endpoint: 'value' property is null\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs","lineNumber":150,"sourceCode":"            string error = await response.Content.ReadAsStringAsync();\n            Context.Trace.WriteLine(\n                $\"Failed to acquire GitHub OIDC token [{response.StatusCode:D} {response.StatusCode}]: {error}\");\n            response.EnsureSuccessStatusCode();\n        }\n\n        string json = await response.Content.ReadAsStringAsync();\n\n        try\n        {\n            using JsonDocument jsonDoc = JsonDocument.Parse(json);\n            if (!jsonDoc.RootElement.TryGetProperty(\"value\", out JsonElement tokenElement))\n            {\n                throw new InvalidOperationException(\n                    \"Invalid response from GitHub OIDC token endpoint: 'value' property not found.\");\n            }\n\n            return tokenElement.GetString() ??\n                   throw new InvalidOperationException(\n                       \"Invalid response from GitHub OIDC token endpoint: 'value' property is null.\");\n        }\n        catch (Exception ex)\n        {\n            Context.Trace.WriteException(ex);\n            Context.Trace.WriteLine($\"OIDC token response: {json}\");\n            throw;\n        }\n    }\n}\n","sourceCodeStart":132,"sourceCodeEnd":161,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs#L132-L161","documentation":"A companion to the missing-'value' case: the GitHub OIDC token response did contain a 'value' property but it was JSON null, so GetString() returns null and the ?? throw fires. The endpoint responded 200 but with an empty token value.","triggerScenarios":"GetGitHubOidcToken: jsonDoc.RootElement.TryGetProperty(\"value\", ...) succeeds but tokenElement.GetString() is null because the response contained {\"value\": null} or the property is not a string (e.g. an object), causing null coalescing to throw.","commonSituations":"GitHub returned a malformed/edge-case response; the 'value' property is an unexpected JSON type; intermediate proxies rewrite the response body; rare GitHub service issues.","solutions":["Inspect the traced 'OIDC token response:' payload to confirm what 'value' contained","Re-run the workflow — transient GitHub issues can cause malformed responses","Verify audience and request URL are valid so GitHub returns a real token string","If persistent, pin/update actions and GCM version, and report with the traced payload"],"exampleFix":"// before: assumes value is a string\nreturn tokenElement.GetString() ?? throw ...;\n// after: validate kind first\nif (tokenElement.ValueKind != JsonValueKind.String || string.IsNullOrEmpty(token = tokenElement.GetString()))\n    throw new InvalidOperationException(\"GitHub OIDC token response 'value' is not a non-empty string.\");\nreturn token;","handlingStrategy":"validation","validationCode":"using var doc = JsonDocument.Parse(json);\nif (doc.RootElement.TryGetProperty(\"value\", out var v) && v.ValueKind == JsonValueKind.String && !string.IsNullOrEmpty(v.GetString()))\n    return v.GetString(); // else handle before calling GCM","typeGuard":"bool HasNonNullToken(JsonElement el) => el.ValueKind == JsonValueKind.String && !string.IsNullOrEmpty(el.GetString());","tryCatchPattern":"try { /* entra auth */ }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"'value' property is null\")) { /* inspect traced response, re-run */ }","preventionTips":["Retry transient GitHub OIDC failures with backoff","Confirm audience/request URL parameters are correct","Check for proxy interference altering response bodies"],"tags":["github-actions","oidc","null-value","json"],"backgroundTag":"unexpected-response-shape","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T14:17:13.074Z"}