actions / actions/toolkit

Occasionally throwing error "Cannot read properties of undefined (reading 'message')" on getIdToken

Open
#1,441 6 comments 11 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
5.9k
Forks
1.8k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
It's related to a error raised in https://github.com/aws-actions/configure-aws-credentials/issues/395 where the OIDC client seems to throw an error which seems to be undefined somehow. We've tracked it down to the getIDToken function where it catches an error and rethrow it, see my comment on https://github.com/aws-actions/configure-aws-credentials/issues/395#issuecomment-1600275819

The strange thing is that it doesn't happen all the time so it's also hard to reproduce or pinpoint it further.

To Reproduce
Steps to reproduce the behavior:

  1. Use the aws-actions/configure-aws-credentials
  2. Configure the OIDC provider
  3. Trigger a couple of workflow to use this action
  4. See error

Expected behavior
No error or a clear one

Screenshots / code

Error: Error message: Cannot read properties of undefined (reading 'message')
/home/runner/work/_actions/aws-actions/configure-aws-credentials/v2/dist/index.js:585
                throw new Error(`Error message: ${error.message}`);

Referencing to this code:

static getIDToken(audience) {
        return __awaiter(this, void 0, void 0, function* () {
            try {
                // New ID Token is requested from action service
                let id_token_url = OidcClient.getIDTokenUrl();
                if (audience) {
                    const encodedAudience = encodeURIComponent(audience);
                    id_token_url = `${id_token_url}&audience=${encodedAudience}`;
                }
                core_1.debug(`ID token url is ${id_token_url}`);
                const id_token = yield OidcClient.getCall(id_token_url);
                core_1.setSecret(id_token);
                return id_token;
            }
            catch (error) {
                throw new Error(`Error message: ${error.message}`); <------ ERROR IS THROWN HERE
            }
        });
    }

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the OidcClient.getIDToken and getCall paths corresponding to /home/runner/work/_actions/aws-actions/configure-aws-credentials/v2/dist/index.js:585, and review the linked configure-aws-credentials report for context. Reproduce the OIDC workflow if possible and verify that failures produce a clear error rather than an exception caused by reading message from an undefined value.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.