Relax Develocity access key format validation (#1061)

Develocity access keys have the format `server=key[;server=key]*`. The
short-lived-token code validated that format with:

```
/^([^;=\s]+=\w+)(;[^;=\s]+=\w+)*$/
```

This is too strict about `key`, and an OIDC token value fails it. There
were two independent problems:

1. `\w+` rejects the `.`, `-`, `_` and `=` padding a JWT contains.
2. Even had the regex passed, `parse` split each entry with
`hostKey.split('=')` and took `pair[1]`, so a key containing `=` would
have been **silently truncated** — a worse failure than rejection, since
the mangled key would then be sent to the server.

## Change

Drop `accessKeyRegexp` and the separate `isValid` gate; validate
structurally in `parse` instead, asserting only what is needed to split
the value:

- split on `;`, then split each entry on its **first** `=` only
- hostname: non-empty and free of whitespace (it cannot contain `=` or
`;` by construction)
- key: non-empty and free of whitespace — nothing else is assumed about
its shape

Two small intentional behaviour deltas beyond the fix:

- The whole value is now trimmed, so a trailing newline on a secret no
longer rejects the key. Internal whitespace still rejects.
- Empty entries (`host=key;`, `;host=key`) still reject, as before.

## Testing

Added cases to `short-lived-token.test.ts`: a JWT-shaped key value,
first-separator-only splitting (`host1=a=b==` → key `a=b==`),
surrounding-whitespace tolerance, a `raw()` round-trip preserving `==`
padding, and a table of nine rejection cases. 32 tests pass; prettier,
eslint and `./build` are clean.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 (1M context) <[email protected]>

sources/test/jest/short-lived-token.test.ts

@@ -1,8 +1,65 @@
 import nock from "nock";
-import {describe, expect, it} from '@jest/globals'
+import {afterEach, beforeEach, describe, expect, it, jest} from '@jest/globals'
 
 import {DevelocityAccessCredentials, getToken, resolveTokenForServer} from "../../src/develocity/short-lived-token";
 
+describe('access key format warnings', () => {
+    // `core.warning` is an ESM export and cannot be spied on, so capture the workflow command it
+    // writes to stdout instead.
+    let stdout: jest.SpiedFunction<typeof process.stdout.write>
+
+    const warnings = (): string[] =>
+        stdout.mock.calls
+            .map(call => String(call[0]))
+            .filter(line => line.startsWith('::warning::'))
+            .map(line => line.substring('::warning::'.length).trim())
+
+    beforeEach(() => {
+        stdout = jest.spyOn(process.stdout, 'write').mockImplementation(() => true)
+    })
+
+    afterEach(() => {
+        stdout.mockRestore()
+    })
+
+    it.each([
+        ['no separator', 'host1', "no '=' separator in the value"],
+        ['a trailing separator', 'host1=key1;', "no '=' separator in entry 2 of 2"],
+        ['a leading separator', ';host1=key1', "no '=' separator in entry 1 of 2"],
+        ['an empty hostname', '=key1', 'empty server name in the value'],
+        ['an empty key', 'host1=', 'empty key in the value'],
+        ['whitespace in the hostname', 'ho st1=key1', 'whitespace in the server name in the value'],
+        ['whitespace in the key', 'host1=ke y1', 'whitespace in the key in the value'],
+        ['whitespace around a separator', 'host1=key1; host2=key2', 'whitespace in the server name in entry 2 of 2'],
+    ])('warns about %s', (_description, rawKey, expectedReason) => {
+        expect(DevelocityAccessCredentials.parse(rawKey)).toBeNull()
+
+        expect(warnings()).toEqual([
+            `Ignoring badly formed Develocity access key: ${expectedReason}. The expected format is 'server=key[;server=key]*'.`
+        ])
+    })
+
+    it('never includes any part of the access key value in the warning', () => {
+        expect(DevelocityAccessCredentials.parse('my-host=my sec ret')).toBeNull()
+
+        const message = warnings()[0]
+        expect(message).not.toContain('my-host')
+        expect(message).not.toContain('sec')
+    })
+
+    it('does not warn for a valid access key', () => {
+        expect(DevelocityAccessCredentials.parse('host1=key1;host2=key2')).not.toBeNull()
+
+        expect(warnings()).toEqual([])
+    })
+
+    it('does not warn for an empty access key', () => {
+        expect(DevelocityAccessCredentials.parse('  ')).toBeNull()
+
+        expect(warnings()).toEqual([])
+    })
+})
+
 describe('short lived tokens', () => {
     it('parse valid access key should return an object', async () => {
         let develocityAccessCredentials = DevelocityAccessCredentials.parse('some-host.local=key1;host2=key2');
@@ -19,6 +76,53 @@ describe('short lived tokens', () => {
         expect(develocityAccessCredentials).toBeNull()
     })
 
+    it('parse access key with an OIDC token value should return an object', async () => {
+        const oidcToken = 'eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJyZXBvOmZvby9iYXI_-x=.c2lnbmF0dXJl=='
+        let develocityAccessCredentials = DevelocityAccessCredentials.parse(`some-host.local=${oidcToken}`);
+
+        expect(develocityAccessCredentials).toStrictEqual(DevelocityAccessCredentials.of([
+            {hostname: 'some-host.local', key: oidcToken}])
+        )
+    })
+
+    it('parse access key splits each entry on the first separator only', async () => {
+        let develocityAccessCredentials = DevelocityAccessCredentials.parse('host1=a=b==;host2=c=d');
+
+        expect(develocityAccessCredentials).toStrictEqual(DevelocityAccessCredentials.of([
+            {hostname: 'host1', key: 'a=b=='},
+            {hostname: 'host2', key: 'c=d'}])
+        )
+    })
+
+    it('parse access key tolerates surrounding whitespace', async () => {
+        let develocityAccessCredentials = DevelocityAccessCredentials.parse(' host1=key1\n');
+
+        expect(develocityAccessCredentials).toStrictEqual(DevelocityAccessCredentials.of([
+            {hostname: 'host1', key: 'key1'}])
+        )
+    })
+
+    it.each([
+        ['no separator', 'host1'],
+        ['a trailing separator', 'host1=key1;'],
+        ['a leading separator', ';host1=key1'],
+        ['an empty hostname', '=key1'],
+        ['an empty key', 'host1='],
+        ['whitespace in the hostname', 'ho st1=key1'],
+        ['whitespace in the key', 'host1=ke y1'],
+        ['whitespace around a separator', 'host1=key1; host2=key2'],
+        ['one invalid entry', 'host1=key1;random'],
+    ])('parse access key with %s should return null', async (_description, rawKey) => {
+        expect(DevelocityAccessCredentials.parse(rawKey)).toBeNull()
+    })
+
+    it('access key with an OIDC token value as raw string', async () => {
+        const rawKey = 'host1=eyJhbGciOiJSUzI1NiJ9.payload.signature==;host2=key2'
+        let develocityAccessCredentials = DevelocityAccessCredentials.parse(rawKey);
+
+        expect(develocityAccessCredentials?.raw()).toBe(rawKey)
+    })
+
     it('parse empty access key should return null', async () => {
         let develocityAccessCredentials = DevelocityAccessCredentials.parse('');