{"record":{"id":"3e59d9faabc5a1f2","repo":"hashicorp/packer","slug":"request-github-oidc-token-w","errorCode":null,"errorMessage":"request GitHub OIDC token: %w","messagePattern":"request GitHub OIDC token: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":345,"sourceCode":"\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parse GitHub OIDC request URL: %w\", err)\n\t}\n\tquery := parsedURL.Query()\n\tif query.Get(\"audience\") == \"\" {\n\t\tquery.Set(\"audience\", \"sigstore\")\n\t\tparsedURL.RawQuery = query.Encode()\n\t}\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, parsedURL.String(), nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"create GitHub OIDC request: %w\", err)\n\t}\n\treq.Header.Set(\"Authorization\", \"Bearer \"+requestToken)\n\n\tclient := &http.Client{Timeout: 30 * time.Second}\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"request GitHub OIDC token: %w\", err)\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode/100 != 2 {\n\t\treturn \"\", fmt.Errorf(\"request GitHub OIDC token: unexpected status %s\", resp.Status)\n\t}\n\n\tvar payload struct {\n\t\tValue string `json:\"value\"`\n\t}\n\tif err := json.NewDecoder(resp.Body).Decode(&payload); err != nil {\n\t\treturn \"\", fmt.Errorf(\"decode GitHub OIDC token response: %w\", err)\n\t}\n\treturn strings.TrimSpace(payload.Value), nil\n}\n","sourceCodeStart":327,"sourceCodeEnd":361,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L327-L361","documentation":"The HTTP GET to GitHub's OIDC token endpoint failed at the transport level (client.Do returned an error) — connection refused/reset, DNS failure, TLS error, or the 30-second client timeout expired. The request never received an HTTP response.","triggerScenarios":"resolveGitHubActionerIDToken's client.Do call fails while fetching the workflow OIDC token: unreachable ACTIONS_ID_TOKEN_REQUEST_URL host, network egress blocked in the CI job, proxy interference, or >30s latency exceeding the hardcoded http.Client timeout.","commonSituations":"Firewalled or air-gapped runners that block egress to the token endpoint; a misconfigured ACTIONS_ID_TOKEN_REQUEST_URL pointing at a down proxy; transient GitHub outages or slow runners hitting the 30s timeout.","solutions":["Check the wrapped cause for timeout vs connection-refused to distinguish latency from reachability.","Verify the runner can reach the OIDC endpoint (curl the URL without the bearer token to test connectivity).","If behind a proxy, set HTTPS_PROXY correctly for the job.","Retry the signing step — transient network blips are the most common cause.","Alternatively pre-fetch the token and pass it via SIGSTORE_ID_TOKEN to skip this HTTP call."],"exampleFix":"// before\nidToken, err := resolveAmbientIDToken(ctx, env) // fails on transient network error\n// after\nvar idToken string\nvar err error\nfor i := 0; i < 3; i++ {\n    idToken, err = resolveAmbientIDToken(ctx, env)\n    if err == nil {\n        break\n    }\n    time.Sleep(2 * time.Second)\n}","handlingStrategy":"retry","validationCode":"// reachability pre-check (no auth needed)\nif raw := strings.TrimSpace(env[\"ACTIONS_ID_TOKEN_REQUEST_URL\"]); raw != \"\" {\n    conn, err := net.DialTimeout(\"tcp\", hostPort(raw), 5*time.Second)\n    if err != nil {\n        return fmt.Errorf(\"OIDC endpoint unreachable: %w\", err)\n    }\n    _ = conn.Close()\n}","typeGuard":"func errors.IsTimeoutOrNetwork(err error) bool {\n    var netErr net.Error\n    return errors.As(err, &netErr) || errors.Is(err, context.DeadlineExceeded)\n}","tryCatchPattern":"var signer Signer\nvar err error\nfor attempt := 0; attempt < 3; attempt++ {\n    signer, err = newKeylessSigner(ctx, cfg)\n    if err == nil || !errors.IsTimeoutOrNetwork(err) {\n        break\n    }\n    select {\n    case <-time.After(time.Duration(1<<attempt) * time.Second):\n    case <-ctx.Done():\n        return ctx.Err()\n    }\n}","preventionTips":["Retry transient network failures with exponential backoff.","Verify runner egress/firewall allows the OIDC endpoint before signing jobs.","Watch for the 30s hardcoded client timeout on slow networks; pre-fetch tokens when latency is high.","Configure HTTPS_PROXY correctly on proxied runners."],"tags":["go","network","http","github-actions","oidc"],"backgroundTag":"http-request-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}