fix(ci): strip CR/LF from registry secrets so the push/release steps work #6

wtclaude · 2026-07-14T17:10:07Z

wtclaude commented

2026-07-14 17:10:07 +00:00

Problem

The release run now builds cleanly (both targets) and packages artifacts — it fails at "Commit version bump and push tag":

warning: url contains a newline in its username component: https://Whitlocktech
:***@gitea.whitlocktech.com/UOM/link.git/
fatal: credential url cannot be parsed: https://Whitlocktech ...
fatal: remote helper 'https' aborted session

The REGISTRY_USER secret carries a trailing newline (Whitlocktech\n), so the remote URL the step assembles from ${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_TOKEN }} is malformed. The release step feeds the same token into a curl Authorization: token header, which a newline would break too.

(The bump commit the runner printed was local only and not pushed; the release step was skipped — origin is clean, no stray tag/commit.)

Fix

Pass the secrets via env: and strip line breaks before use:

CI_USER="$(printf '%s' "${REGISTRY_USER}" | tr -d '\r\n')"
CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"

Applied in both the push step (remote URL) and the release step (auth header). Using env instead of inline ${{ }} also prevents a newline from breaking the shell script itself.

Verification

YAML still parses end-to-end.
Reproduced the trim: REGISTRY_USER=$'Whitlocktech\n' → CI_USER=Whitlocktech → https://Whitlocktech:TOKEN@host/UOM/link.git (single line, valid).

Note (still untested downstream)

This unblocks URL/header construction, but the push + tag + release steps have never completed a real run yet. They still require:

REGISTRY_TOKEN to have write:repository scope, and
main to accept a direct push from that CI user (branch-protection exception).

If the next run gets past the URL and then 403s on the push, that's the remaining config item — not a workflow bug. Fixing the secret value itself (re-save REGISTRY_USER without a trailing newline) is also worth doing, but this makes the workflow robust regardless.

🤖 Generated with Claude Code

## Problem The release run now builds cleanly (both targets) and packages artifacts — it fails at **"Commit version bump and push tag"**: ``` warning: url contains a newline in its username component: https://Whitlocktech :***@gitea.whitlocktech.com/UOM/link.git/ fatal: credential url cannot be parsed: https://Whitlocktech ... fatal: remote helper 'https' aborted session ``` The `REGISTRY_USER` secret carries a **trailing newline** (`Whitlocktech\n`), so the remote URL the step assembles from `${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_TOKEN }}` is malformed. The release step feeds the same token into a `curl` `Authorization: token` header, which a newline would break too. (The bump commit the runner printed was local only and **not** pushed; the release step was skipped — origin is clean, no stray tag/commit.) ## Fix Pass the secrets via `env:` and strip line breaks before use: ```bash CI_USER="$(printf '%s' "${REGISTRY_USER}" | tr -d '\r\n')" CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')" ``` Applied in both the push step (remote URL) and the release step (auth header). Using `env` instead of inline `${{ }}` also prevents a newline from breaking the shell script itself. ## Verification - YAML still parses end-to-end. - Reproduced the trim: `REGISTRY_USER=$'Whitlocktech\n'` → `CI_USER=Whitlocktech` → `https://Whitlocktech:TOKEN@host/UOM/link.git` (single line, valid). ## Note (still untested downstream) This unblocks URL/header construction, but the push + tag + release steps have never completed a real run yet. They still require: - `REGISTRY_TOKEN` to have **`write:repository`** scope, and - `main` to accept a **direct push** from that CI user (branch-protection exception). If the next run gets past the URL and then 403s on the push, that's the remaining config item — not a workflow bug. Fixing the secret value itself (re-save `REGISTRY_USER` without a trailing newline) is also worth doing, but this makes the workflow robust regardless. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-14 17:10:09 +00:00

fix(ci): strip CR/LF from registry secrets before use 0550129f8e

The release run built its push URL and auth header directly from
`secrets.REGISTRY_USER` / `REGISTRY_TOKEN`. A trailing newline in
REGISTRY_USER produced a malformed remote:

    warning: url contains a newline in its username component
    fatal: credential url cannot be parsed

Pass the secrets through `env:` and strip CR/LF (`tr -d '\r\n'`) before
building the URL (push step) and the `Authorization: token` header (release
step). Using env instead of inline `${{ }}` also stops a newline from
breaking the shell script itself. Verified the file still parses and the
trim turns `Whitlocktech\n` into a clean single-line URL.

Underlying cause is secret hygiene (the value was saved with a trailing
newline); this makes the workflow robust to it either way.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114TpmrNW4wNXsHq5CR72jQ

whitlocktech merged commit 4d21ef0b63 into main

2026-07-14 17:10:44 +00:00

whitlocktech deleted branch fix/release-secret-newline

2026-07-14 17:10:45 +00:00

whitlocktech referenced this issue from a commit

2026-07-14 17:10:45 +00:00

Merge pull request 'fix(ci): strip CR/LF from registry secrets so the push/release steps work' (#6) from fix/release-secret-newline into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/link#6