[jdx]

https://entire.io/gh/jdx/mise/trails/109

Problem

If a resolved GitHub token contains a character that is illegal in an HTTP header — a newline is the easy way to get one — mise aborts the whole process instead of reporting a bad credential:

$ MISE_MINIMUM_RELEASE_AGE=0 mise up
The application panicked (crashed).
Message:  called `Result::unwrap()` on an `Err` value: InvalidHeaderValue
Location: src/github.rs:924
Aborted (core dumped)

src/github.rs built the Authorization header with HeaderValue::from_str(..).unwrap(), so a malformed token became a SIGABRT with a coredump rather than an error message.

After

$ GITHUB_TOKEN=$'dummy\nvalue' mise latest 'github:jdx/mise@latest'
Error:
   0: invalid GitHub token: it contains characters that cannot be sent in an HTTP header (token redacted)

Exit code 1, no panic, no coredump, and the token is not echoed back.

What changed

• All four Authorization-header sites — two in src/github.rs, one each in src/gitlab.rs and src/forgejo.rs — now go through a shared tokens::bearer_header, which maps InvalidHeaderValue to the redacted error above. The GitLab and Forgejo sites carried an // Avoid panicking here. See #3547. comment directly above the unwrap(); get_headers in those two modules now returns Result<HeaderMap> so the error has somewhere to go.
• bearer_header also calls HeaderValue::set_sensitive(true), so reqwest redacts the credential from its own debug output.
• Tokens read from github_tokens.toml, gitlab_tokens.toml and forgejo_tokens.toml are now trimmed and dropped when blank. The environment-variable sources already did this in env::scoped_var, so a token with a trailing newline worked from GITHUB_TOKEN but panicked from the config file.
• packslip::repo_file_request used github::get_headers(..).ok()?, which would have turned this error into the misleading warning "comes from the source repository, which mise cannot read files from". It returns Result<Option<..>> now, so a real failure propagates and None still means only "unsupported forge".

No behavior change for well-formed tokens: header contents and token-source reporting are unchanged.

Validation

• Added unit tests covering the redacted error (newline, carriage return and NUL tokens), the sensitive flag, the TOML trim, and a regression test that github::get_headers returns an error rather than panicking.
• cargo clippy --workspace --all-features --all-targets -- -D warnings clean; mise run lint clean.
• Unit suite: 4532 passed. 23 tests fail identically on this branch and on unmodified main in my local sandbox (pacman, system::remote*, tera path tests) — pre-existing and unrelated.
• Verified the reporter's exact reproduction no longer aborts, and that a normal mise latest github:jdx/mise@latest still resolves.

Reported in #13471

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5; version: 2.1.236.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches authentication header construction across GitHub, GitLab, and Forgejo download/API paths; behavior change is limited to malformed tokens (error vs panic) but the surface area is security-sensitive.

Overview
Fixes process aborts when a GitHub/GitLab/Forgejo token contains characters illegal in HTTP headers (e.g. a trailing newline in a tokens file).

Authorization headers — Replaces HeaderValue::from_str(..).unwrap() with shared tokens::bearer_header, which returns a redacted error instead of panicking and marks the value sensitive for reqwest debug output. GitLab and Forgejo get_headers now return Result<HeaderMap>; download and API paths in backend/github.rs, spm.rs, and related callers propagate with ?.

Token loading — Tokens from *_tokens.toml are trimmed and whitespace-only entries are dropped, aligning with env-var handling.

Packslip — repo_file_request returns Result<Option<..>> so a malformed token surfaces as a real error instead of the misleading “unsupported forge” warning from .ok()?.

Well-formed tokens behave unchanged. New unit tests cover invalid tokens, TOML trim, and GitHub get_headers error paths.

^{Reviewed by Cursor Bugbot for commit 45902ec. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes

  • Authentication and download errors are now reported instead of being silently ignored or causing unexpected crashes.
  • Invalid access tokens now produce a clear failure without exposing the token value.
  • Repository file and release downloads stop promptly when required request headers cannot be created.
  • Token files now ignore surrounding whitespace and blank entries consistently.

• Tests

  • Added coverage for invalid-token handling, token cleanup, and requests to unrelated hosts.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 0b3040c1-fb0d-447f-8f19-8491ecc21c33

📥 Commits

Reviewing files that changed from the base of the PR and between bdda0d0 and 45902ec.

📒 Files selected for processing (7)

• src/backend/github.rs
• src/backend/spm.rs
• src/forgejo.rs
• src/github.rs
• src/gitlab.rs
• src/packslip.rs
• src/tokens.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Authentication header error propagation

Layer / File(s)	Summary
Token normalization and bearer header helper src/tokens.rs	Token TOML values are trimmed and blank values are removed. bearer_header validates header values, marks them sensitive, and redacts invalid tokens from errors.
Fallible forge header APIs src/github.rs, src/gitlab.rs, src/forgejo.rs	Forge header builders return Result<HeaderMap>. Their callers propagate errors, and tests cover valid, invalid, and cross-origin token cases.
Download and repository request propagation src/backend/github.rs, src/backend/spm.rs, src/packslip.rs	Download, installation, and repository file paths propagate header errors instead of ignoring them or treating them as unsupported forges.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: risu729

Merge Risk: ⚪ Minimal · up to 45902

The authentication changes are mergeable with no identified current-head regression.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 61.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 31 functions across 7 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the invalid-header-character fix and the change from aborting to error handling. It mentions GitHub, while the implementation also covers GitLab and Forgejo, but it rema…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the malformed-token panic is replaced with consistent redacted error propagation without changing valid-token behavior.

Summary

This PR replaces panic-prone forge authorization-header construction with a shared, redacted error path and propagates that failure through affected callers.

• Marks bearer authorization values as sensitive so HTTP debug output redacts credentials.
• Normalizes tokens loaded from forge TOML files by trimming them and dropping blank entries.
• Updates GitLab and Forgejo header APIs and all affected backend callers to propagate malformed-token errors.
• Distinguishes unsupported Packslip source repositories from genuine authorization-header failures.
• Adds focused regression tests for invalid header characters, token redaction, sensitivity, and TOML normalization.

_{Reviews (1) · Last reviewed commit: "fix(github): don't abort when a forge to..."}