Validate the issue labeler's API key before sending requests (#60964)

Trim surrounding whitespace from `OPENAI_API_KEY` and reject empty values or
characters outside printable, non-space ASCII with `Invalid API key format`.
Use the validated key in the request's `Authorization` header.

GitOrigin-RevId: 61da9b4989b7cfbceb247ffbbeb6f6efd8413598

.github/scripts/issue_labeler.py

@@ -148,12 +148,16 @@ class NoRedirects(HTTPRedirectHandler):
 
 
 def suggest_labels(issue):
+    api_key = os.environ["OPENAI_API_KEY"].strip()
+    if not api_key or not all("!" <= char <= "~" for char in api_key):
+        raise SystemExit("Invalid API key format")
+
     request = Request(
         "https://api.openai.com/v1/responses",
         data=json.dumps(build_request(issue)).encode(),
         headers={
             "Accept": "application/json",
-            "Authorization": "Bearer " + os.environ["OPENAI_API_KEY"],
+            "Authorization": "Bearer " + api_key,
             "Content-Type": "application/json",
         },
     )