{"record":{"id":"6fedc21447b85c70","repo":"git-ecosystem/git-credential-manager","slug":"invalid-response-from-github-oidc-token-endpoint","errorCode":null,"errorMessage":"Invalid response from GitHub OIDC token endpoint: 'value' property not found.","messagePattern":"Invalid response from GitHub OIDC token endpoint: 'value' property not found\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs","lineNumber":145,"sourceCode":"        Context.Trace.WriteLine($\"Requesting GitHub OIDC token from '{request.RequestUri}'...\");\n        Context.Trace.WriteLineSecrets(\"OIDC request token: {0}\", new[] { requestToken });\n        using HttpResponseMessage response = await http.SendAsync(request);\n        if (!response.IsSuccessStatusCode)\n        {\n            string error = await response.Content.ReadAsStringAsync();\n            Context.Trace.WriteLine(\n                $\"Failed to acquire GitHub OIDC token [{response.StatusCode:D} {response.StatusCode}]: {error}\");\n            response.EnsureSuccessStatusCode();\n        }\n\n        string json = await response.Content.ReadAsStringAsync();\n\n        try\n        {\n            using JsonDocument jsonDoc = JsonDocument.Parse(json);\n            if (!jsonDoc.RootElement.TryGetProperty(\"value\", out JsonElement tokenElement))\n            {\n                throw new InvalidOperationException(\n                    \"Invalid response from GitHub OIDC token endpoint: 'value' property not found.\");\n            }\n\n            return tokenElement.GetString() ??\n                   throw new InvalidOperationException(\n                       \"Invalid response from GitHub OIDC token endpoint: 'value' property is null.\");\n        }\n        catch (Exception ex)\n        {\n            Context.Trace.WriteException(ex);\n            Context.Trace.WriteLine($\"OIDC token response: {json}\");\n            throw;\n        }\n    }\n}\n","sourceCodeStart":127,"sourceCodeEnd":161,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Authentication/Entra/EntraAuthentication.ConfidentialClient.cs#L127-L161","documentation":"GCM requested a short-lived OIDC token from the GitHub Actions token endpoint (ACTIONS_ID_TOKEN_REQUEST_URL) and the JSON response did not contain a 'value' property, so the token cannot be extracted. This means GitHub did not return the expected token envelope.","triggerScenarios":"GetGitHubOidcToken parses the endpoint's response with JsonDocument.Parse and TryGetProperty(\"value\", ...) fails — e.g. the request URL is wrong, the response is an error object, or permissions/id-token settings are missing so GitHub returns a different shape.","commonSituations":"GitHub Actions workflow lacking 'permissions: id-token: write'; invalid ACTIONS_ID_TOKEN_REQUEST_URL or token; GitHub API returning an error/HTML page instead of the token JSON; proxy injecting an error body.","solutions":["Add 'permissions: id-token: write' to the workflow/job so GitHub issues OIDC tokens","Verify ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN env vars are present and correct in the job","Check the raw response (logged via GCM trace: 'OIDC token response:') to see what the endpoint actually returned","Confirm audience parameter matches what the federation trust expects"],"exampleFix":"# before (.github/workflows/ci.yml)\njobs:\n  build:\n    steps: [ - uses: actions/checkout@v4 ]\n# after\njobs:\n  build:\n    permissions:\n      id-token: write\n      contents: read\n    steps: [ - uses: actions/checkout@v4 ]","handlingStrategy":"try-catch","validationCode":"// in GitHub Actions, fail fast when OIDC is unavailable\nif (!Environment.TryGetEnvironmentVariable(\"ACTIONS_ID_TOKEN_REQUEST_URL\", out _))\n    throw new InvalidOperationException(\"Workflow lacks id-token permission or ACTIONS_ID_TOKEN_REQUEST_URL.\");","typeGuard":"bool LooksLikeOidcTokenResponse(string json) {\n    using var doc = JsonDocument.Parse(json);\n    return doc.RootElement.ValueKind == JsonValueKind.Object && doc.RootElement.TryGetProperty(\"value\", out var v) && v.ValueKind == JsonValueKind.String;\n}","tryCatchPattern":"try { /* entra auth */ }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"GitHub OIDC token endpoint\")) { /* check workflow permissions/id-token config and retry */ }","preventionTips":["Always set 'permissions: id-token: write' in workflows using federation","Validate ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN are injected for the job","Enable GCM_TRACE to capture the raw OIDC response for diagnosis"],"tags":["github-actions","oidc","workload-identity-federation","json"],"backgroundTag":"unexpected-response-shape","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T14:17:13.074Z"}