Renovate exits because of "token is not a valid HTTP header" response from Github API

[dellison-castlight]

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitlab platform, Renovate version 37.399.8

Please tell us more about your question or problem

We started trying to use the osvVulnerabilityAlerts and dependencyDashboardOSVVulnerabilitySummary settings, but started recieving errors when the call to api.github.com was being made for the OSV data. The error message is token **redacted** is not a legal HTTP header value, but this is strange because we have configured GITHUB_COM_TOKEN to not be rate-limited when making requests to Github, and this seems to work fine elsewhere. But for some reason the request for the OSV data isn't using the token in the same way or something.

I thought this might be similar to #26991 and may need similar changes to fix it, but I'm not sure.

Logs (if relevant)

Logs

 INFO: Renovate is exiting with a non-zero code due to the following logged errors
       "loggerErrors": [
         {
           "name": "renovate",
           "level": 50,
           "logContext": "kc3ypVfXfsrRZ6-ffVU_O",
           "repository": "[redacted]",
           "err": {
             "name": "HttpError",
             "status": 500,
             "request": {
               "method": "GET",
               "url": "https://api.github.com/repos/renovatebot/osv-offline/releases",
               "headers": {
                 "accept": "application/vnd.github.v3+json",
                 "user-agent": "octokit-rest.js/20.1.1 octokit-core.js/5.2.0 Node.js/18.20.3 (linux; x64)",
                 "authorization": "***********"
               },
               "request": {"fetch": "[function]", "hook": "[function]"}
             },
             "message": "token **redacted** is not a legal HTTP header value",
             "stack": "HttpError: token **redacted** is not a legal HTTP header value\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@octokit/request/dist-node/index.js:157:11\n    at tryDownloadDb (/usr/local/renovate/node_modules/.pnpm/@[email protected][email protected]/node_modules/@renovatebot/osv-offline/dist/lib/download.js:46:26)\n    at OsvOffline.initialize (/usr/local/renovate/node_modules/.pnpm/@[email protected][email protected]/node_modules/@renovatebot/osv-offline/dist/lib/osv-offline.js:14:24)\n    at Function.create (/usr/local/renovate/node_modules/.pnpm/@[email protected][email protected]/node_modules/@renovatebot/osv-offline/dist/lib/osv-offline.js:26:9)\n    at Vulnerabilities.initialize (/usr/local/renovate/lib/workers/repository/process/vulnerabilities.ts:59:23)\n    at Function.create (/usr/local/renovate/lib/workers/repository/process/vulnerabilities.ts:64:5)\n    at getDashboardMarkdownVulnerabilities (/usr/local/renovate/lib/workers/repository/dependency-dashboard.ts:508:32)\n    at ensureDependencyDashboard (/usr/local/renovate/lib/workers/repository/dependency-dashboard.ts:421:16)\n    at Object.renovateRepository (/usr/local/renovate/lib/workers/repository/index.ts:103:9)\n    at attributes.repository (/usr/local/renovate/lib/workers/global/index.ts:218:11)\n    at start (/usr/local/renovate/lib/workers/global/index.ts:203:7)\n    at /usr/local/renovate/lib/renovate.ts:18:22"
           },
           "msg": "Repository has unknown error"
         }
       ]

[dellison-castlight]

@rarkins apologies, I found similar errors for ERR_INVALID_CHAR when calls were being made to Github to get Changelogs, it's just that those errors didn't cause the process to fail and exit so we hadn't noticed them.

For anyone in the future running into similar error messages, check the secret you're passing to GITHUB_COM_TOKEN to see if any newline characters are present