ci(binaries): let checkout do the tap authentication - #66
Merged
Conversation
The first run with the token set failed at git: fatal: unable to access 'https://x-access-token:***@github.com/...': URL rejected: Malformed input to a URL function Splicing a credential into a remote URL is the fragile way to do this -- anything in the token that is not URL-safe takes the whole URL down, and the error names the URL rather than the credential inside it, which is not where anyone looks. actions/checkout authenticates properly and is the well-trodden path; the job now clones the tap that way and pushes back through the same credential. It also checks the token before anything uses it, and reports on it without revealing it: a length, and a yes/no about its character set. A value pasted with a trailing newline looks entirely normal in the secrets UI and fails at first use with a message about URLs. Now it fails immediately with the reason and the command that fixes it. Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first run with
HOMEBREW_TAP_TOKENset failed at git:Splicing a credential into a remote URL is the fragile way to do this — anything in the token that is not URL-safe takes the whole URL down, and the error names the URL rather than the credential inside it, which is not where anyone would look.
actions/checkoutauthenticates properly, so the job now clones the tap that way and pushes back through the same credential.And a check that says which problem it is
The job now validates the token before anything uses it, reporting a length and a yes/no on its character set — no secret material. A value pasted with a trailing newline looks completely normal in the secrets UI:
github_pat_11ABCDEF_abc123XYZSo the next run tells us definitively whether the token needs re-adding or whether the URL splicing was the whole problem — rather than leaving both possible.
All five binary targets were green on that run; only the formula job failed.