Malformed auth header in global git config causing HTTP 400

[ericsciple]

Yesterday when troubleshooting failing checkout (server returned 400), we discovered a malformed auth header in the global git config to be the root cause.

Simple repro steps (uses local git config steps for simplicity):

$ git clone https://github.com/actions/checkout.git

$ cd checkout

$ git config http.extraheader "AUTHORIZATION: Basic abcdef_abcdefabcdefabcdefabcdefabcdef"

$ git fetch
fatal: unable to access 'https://github.com/actions/checkout.git/': The requested URL returned error: 400

$ echo $?
128

It would be nice to handle this more gracefully in the checkout step. Perhaps something like:

• Warn if we detect any http.extraheader="AUTHORIZATION..." in the global/system git config
  • Drawback: warnings often go unseen
• When an authenticated git command fails (and stdout/stderr contains 400 error?), and we detect an auth header in the global/system git config, print an actionable error message.

[ericsciple]

related: actions/runner#1970 and actions/runner#1971