@actions/http-client proxy auth token not properly encoded

[bdehamer]

When using the octokit client from the @actions/github library to make requests through an authenticated proxy, the user/password creds are not properly encoded in the Proxy-Authorization header.

If I have an env var like the following:

https_proxy=http://username:password@hostname:port/

And sniff the outgoing network request, I can see that the Proxy-Authorization header is set to the following:

Proxy-Authorization: username:password

The correct value should be a base64-encoded basic auth value:

Proxy-Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

The issue is with the following line:

toolkit/packages/http-client/src/index.ts

Line 729 in faf9cb2

token: `${proxyUrl.username}:${proxyUrl.password}`

The token value being passed to the ProxyAgent is the un-encoded username/password pair. However, according to the documentation for the undici library (https://undici.nodejs.org/#/docs/api/ProxyAgent?id=example-basic-proxy-request-with-authentication), the supplied token needs to be pre-encoded:

token: `Basic ${Buffer.from('username:password').toString('base64')}`