hashicorp/packer · error

parse GitHub OIDC request URL: %w

Error message

parse GitHub OIDC request URL: %w

What it means

url.Parse rejected the value of ACTIONS_ID_TOKEN_REQUEST_URL while resolving a GitHub Actions OIDC token. This means the URL injected into the CI environment is malformed (control characters, spaces, or an invalid scheme). Rare, because GitHub normally injects a valid URL.

Source

Thrown at internal/attestation/sign_keyless.go:328

		return token, nil
	}
	if token, err := resolveGitHubActionsIDToken(ctx, env); err == nil && token != "" {
		return token, nil
	}

	return "", fmt.Errorf("signing_mode %q requires an ambient OIDC token; set SIGSTORE_ID_TOKEN, use a CI-provided OIDC token, or switch to signing_mode=\"none\" or a key-backed mode", SigningModeKeyless)
}

func resolveGitHubActionsIDToken(ctx context.Context, env map[string]string) (string, error) {
	requestURL := strings.TrimSpace(env["ACTIONS_ID_TOKEN_REQUEST_URL"])
	requestToken := strings.TrimSpace(env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"])
	if requestURL == "" || requestToken == "" {
		return "", nil
	}

	parsedURL, err := url.Parse(requestURL)
	if err != nil {
		return "", fmt.Errorf("parse GitHub OIDC request URL: %w", err)
	}
	query := parsedURL.Query()
	if query.Get("audience") == "" {
		query.Set("audience", "sigstore")
		parsedURL.RawQuery = query.Encode()
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, parsedURL.String(), nil)
	if err != nil {
		return "", fmt.Errorf("create GitHub OIDC request: %w", err)
	}
	req.Header.Set("Authorization", "Bearer "+requestToken)

	client := &http.Client{Timeout: 30 * time.Second}
	resp, err := client.Do(req)
	if err != nil {
		return "", fmt.Errorf("request GitHub OIDC token: %w", err)
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Print and inspect ACTIONS_ID_TOKEN_REQUEST_URL (careful: never log the request token) for stray whitespace or invalid characters.
2. Trim the value before setting it, or fix the workflow/runner configuration that injects it.
3. If overriding for testing, use a well-formed absolute URL such as https://example.com/tokens.
4. Set SIGSTORE_ID_TOKEN directly to bypass the GitHub OIDC endpoint resolution entirely.

Example fix

// before
env["ACTIONS_ID_TOKEN_REQUEST_URL"] = baseURL + "%zz"
// after
env["ACTIONS_ID_TOKEN_REQUEST_URL"] = strings.TrimSpace(baseURL + "/tokens")

raw := env["ACTIONS_ID_TOKEN_REQUEST_URL"]
if raw != "" {
    if _, err := url.Parse(strings.TrimSpace(raw)); err != nil {
        return fmt.Errorf("ACTIONS_ID_TOKEN_REQUEST_URL is malformed: %w", err)
    }
}

func isValidURL(raw string) bool {
    u, err := url.Parse(strings.TrimSpace(raw))
    return err == nil && u.Scheme != "" && u.Host != ""
}

signer, err := newKeylessSigner(ctx, cfg)
if err != nil && strings.Contains(err.Error(), "parse GitHub OIDC request URL") {
    return fmt.Errorf("ACTIONS_ID_TOKEN_REQUEST_URL is malformed; fix or unset it and set SIGSTORE_ID_TOKEN: %w", err)
}

When it happens

Trigger: resolveGitHubActionsIDToken (via resolveAmbientIDToken during newKeylessSigner) encounters ACTIONS_ID_TOKEN_REQUEST_URL set to a string that url.Parse cannot parse, e.g. containing whitespace, newline, or invalid percent-encoding.

Common situations: Manually overriding ACTIONS_ID_TOKEN_REQUEST_URL to point at a mock/proxy with a malformed value; trailing whitespace or newline from shell/env interpolation; self-hosted runner misconfiguration.

Related errors

• create GitHub OIDC request: %w
• request GitHub OIDC token: %w
• request GitHub OIDC token: unexpected status %s
• signing_mode %q requires an ambient OIDC token; set SIGSTORE
• decode GitHub OIDC token response: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/e864ea129bc94474. Report an issue: GitHub.