From 1d30a842cdeeeefc0329cf66b8c22f08f1d1a99c Mon Sep 17 00:00:00 2001
From: "Michael B. Gale" <mbg@github.com>
Date: Tue, 13 Oct 2026 18:05:49 +0100
Subject: [PATCH] Guard against blank `auth` value

This shouldn't be possible, but was previously handled by the library
---
 lib/entry-points.js | 2 +-
 src/api-client.ts   | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/entry-points.js b/lib/entry-points.js
index bd5da1bf6..19f324e0f 100644
--- a/lib/entry-points.js
+++ b/lib/entry-points.js
@@ -170736,7 +170736,7 @@ function createApiClientWithDetails(apiDetails, { allowExternal = false, proxy =
   const retryingOctokit = githubUtils.GitHub.plugin(retry);
   const requestOptions = makeProxyRequestOptions(proxy);
   const opts = {
-    auth: auth2 !== void 0 ? `token ${auth2}` : void 0,
+    auth: auth2 !== void 0 && auth2.trim() !== "" ? `token ${auth2}` : void 0,
     baseUrl: apiDetails.apiURL,
     userAgent: `CodeQL-Action/${getActionVersion()}`,
     log: {
diff --git a/src/api-client.ts b/src/api-client.ts
index 31169480a..4d0a99920 100644
--- a/src/api-client.ts
+++ b/src/api-client.ts
@@ -138,7 +138,8 @@ function createApiClientWithDetails(
   const requestOptions = makeProxyRequestOptions(proxy);
 
   const opts: OctokitOptions = {
-    auth: auth !== undefined ? `token ${auth}` : undefined,
+    auth:
+      auth !== undefined && auth.trim() !== "" ? `token ${auth}` : undefined,
     baseUrl: apiDetails.apiURL,
     userAgent: `CodeQL-Action/${getActionVersion()}`,
     log: {