Skip to content

fix: use base64 -w 0 in checkout fetch step to prevent header corruption with long PATs #21068

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 2 commits into from
Mar 15, 2026
Merged

fix: use base64 -w 0 in checkout fetch step to prevent header corruption with long PATs #21068

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
81d9f08
Initial plan
Copilot Mar 15, 2026
b7e9b81
fix: add -w 0 flag to base64 in checkout fetch step to prevent line w…
Copilot Mar 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/smoke-update-cross-repo-pr.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion pkg/workflow/checkout_manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -684,7 +684,7 @@ func generateFetchStepLines(entry *resolvedCheckout, index int) string {
sb.WriteString(" env:\n")
fmt.Fprintf(&sb, " GH_AW_FETCH_TOKEN: %s\n", token)
sb.WriteString(" run: |\n")
sb.WriteString(" header=$(printf \"x-access-token:%s\" \"${GH_AW_FETCH_TOKEN}\" | base64)\n")
sb.WriteString(" header=$(printf \"x-access-token:%s\" \"${GH_AW_FETCH_TOKEN}\" | base64 -w 0)\n")
fmt.Fprintf(&sb, ` %s -c "http.extraheader=Authorization: Basic ${header}" fetch origin %s`+"\n",
gitPrefix, strings.Join(refspecs, " "))
return sb.String()
Expand Down
2 changes: 2 additions & 0 deletions pkg/workflow/checkout_manager_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -714,6 +714,8 @@ func TestGenerateFetchStep(t *testing.T) {
assert.Contains(t, got, "http.extraheader=Authorization:", "should configure credentials via http.extraheader")
// When no custom token set, falls back to the effective GitHub token chain
assert.Contains(t, got, "GH_AW_GITHUB_TOKEN", "should fall back to GH_AW token chain when no checkout token set")
// base64 must use -w 0 to prevent line wrapping with long tokens (e.g. fine-grained PATs)
assert.Contains(t, got, "base64 -w 0", "should use base64 -w 0 to disable line wrapping")
})

t.Run("fetch refs/pulls/open/* uses PR refspec", func(t *testing.T) {
Expand Down
Loading