{"record":{"id":"e864ea129bc94474","repo":"hashicorp/packer","slug":"parse-github-oidc-request-url-w","errorCode":null,"errorMessage":"parse GitHub OIDC request URL: %w","messagePattern":"parse GitHub OIDC request URL: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":328,"sourceCode":"\t\treturn token, nil\n\t}\n\tif token, err := resolveGitHubActionsIDToken(ctx, env); err == nil && token != \"\" {\n\t\treturn token, nil\n\t}\n\n\treturn \"\", fmt.Errorf(\"signing_mode %q requires an ambient OIDC token; set SIGSTORE_ID_TOKEN, use a CI-provided OIDC token, or switch to signing_mode=\\\"none\\\" or a key-backed mode\", SigningModeKeyless)\n}\n\nfunc resolveGitHubActionsIDToken(ctx context.Context, env map[string]string) (string, error) {\n\trequestURL := strings.TrimSpace(env[\"ACTIONS_ID_TOKEN_REQUEST_URL\"])\n\trequestToken := strings.TrimSpace(env[\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\"])\n\tif requestURL == \"\" || requestToken == \"\" {\n\t\treturn \"\", nil\n\t}\n\n\tparsedURL, err := url.Parse(requestURL)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"parse GitHub OIDC request URL: %w\", err)\n\t}\n\tquery := parsedURL.Query()\n\tif query.Get(\"audience\") == \"\" {\n\t\tquery.Set(\"audience\", \"sigstore\")\n\t\tparsedURL.RawQuery = query.Encode()\n\t}\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, parsedURL.String(), nil)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"create GitHub OIDC request: %w\", err)\n\t}\n\treq.Header.Set(\"Authorization\", \"Bearer \"+requestToken)\n\n\tclient := &http.Client{Timeout: 30 * time.Second}\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"request GitHub OIDC token: %w\", err)\n\t}","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L310-L346","documentation":"url.Parse rejected the value of ACTIONS_ID_TOKEN_REQUEST_URL while resolving a GitHub Actions OIDC token. This means the URL injected into the CI environment is malformed (control characters, spaces, or an invalid scheme). Rare, because GitHub normally injects a valid URL.","triggerScenarios":"resolveGitHubActionsIDToken (via resolveAmbientIDToken during newKeylessSigner) encounters ACTIONS_ID_TOKEN_REQUEST_URL set to a string that url.Parse cannot parse, e.g. containing whitespace, newline, or invalid percent-encoding.","commonSituations":"Manually overriding ACTIONS_ID_TOKEN_REQUEST_URL to point at a mock/proxy with a malformed value; trailing whitespace or newline from shell/env interpolation; self-hosted runner misconfiguration.","solutions":["Print and inspect ACTIONS_ID_TOKEN_REQUEST_URL (careful: never log the request token) for stray whitespace or invalid characters.","Trim the value before setting it, or fix the workflow/runner configuration that injects it.","If overriding for testing, use a well-formed absolute URL such as https://example.com/tokens.","Set SIGSTORE_ID_TOKEN directly to bypass the GitHub OIDC endpoint resolution entirely."],"exampleFix":"// before\nenv[\"ACTIONS_ID_TOKEN_REQUEST_URL\"] = baseURL + \"%zz\"\n// after\nenv[\"ACTIONS_ID_TOKEN_REQUEST_URL\"] = strings.TrimSpace(baseURL + \"/tokens\")","handlingStrategy":"validation","validationCode":"raw := env[\"ACTIONS_ID_TOKEN_REQUEST_URL\"]\nif raw != \"\" {\n    if _, err := url.Parse(strings.TrimSpace(raw)); err != nil {\n        return fmt.Errorf(\"ACTIONS_ID_TOKEN_REQUEST_URL is malformed: %w\", err)\n    }\n}","typeGuard":"func isValidURL(raw string) bool {\n    u, err := url.Parse(strings.TrimSpace(raw))\n    return err == nil && u.Scheme != \"\" && u.Host != \"\"\n}","tryCatchPattern":"signer, err := newKeylessSigner(ctx, cfg)\nif err != nil && strings.Contains(err.Error(), \"parse GitHub OIDC request URL\") {\n    return fmt.Errorf(\"ACTIONS_ID_TOKEN_REQUEST_URL is malformed; fix or unset it and set SIGSTORE_ID_TOKEN: %w\", err)\n}","preventionTips":["Never hand-set ACTIONS_ID_TOKEN_REQUEST_URL with untrimmed shell output.","Strip whitespace/newlines from env values injected via scripts.","Validate override URLs are absolute (scheme + host).","Fall back to SIGSTORE_ID_TOKEN when overriding the GitHub endpoint."],"tags":["go","url-parsing","github-actions","oidc"],"backgroundTag":"malformed-url","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}