The GitHub Actions provider decoded the response body without checking the
status code, so a failing OIDC endpoint surfaced as a raw json error:
fetching ambient OIDC credentials: invalid character 'u' looking for
beginning of value
Check the status code first and report it along with a truncated body, and
wrap decode failures with the provider name:
fetching ambient OIDC credentials: identity token request to provider
github-actions failed with status 502 Bad Gateway: "upstream connect
error or disconnect/reset before headers"
Fixes#4438
Signed-off-by: Eugene Kalinin <e.v.kalinin@gmail.com>
The GitHub Actions OIDC token provider uses Header.Add inside a retry
loop. On each retry iteration, an additional Authorization header is
appended to the request. By the third attempt, three identical headers
are sent. Some servers and proxies reject requests with duplicate
Authorization headers, causing retries to fail when they should
succeed.
Replace Header.Add with Header.Set so only one Authorization header
is ever present, regardless of how many retries occur.
Add a test that forces two retries via connection hijack and asserts
exactly one Authorization header is received on every attempt.
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
