Uh oh!
There was an error while loading. Please reload this page.
fix: expand commit hash regex to support SHA-256 (64-char) hashes - #4347
Merged
Conversation
- update WellKnownRegularExpressions to match both 40-char (SHA-1) and 64-char (SHA-256) hex strings - add CommitHash constant as canonical name while keeping SHA1 for backward compatibility - remove dead _validSha1 field in RepositoryPlugin v1.0 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Add dedicated test class covering: - 40-char SHA-1 match (regression guard) - 64-char SHA-256 match (new behavior) - 63/65-char boundary rejection - Mixed-case matching (IgnoreCase) - SHA1 and CommitHash keys return same regex instance - Unknown key returns null Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Allow CommitHash to be either 40 chars (SHA-1) or 64 chars (SHA-256). Add hex format validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the runner’s well-known commit-hash regular expression to recognize both SHA-1 (40 hex) and SHA-256 (64 hex) commit IDs, and updates checkout plugins to use a new canonical CommitHash key while preserving the existing SHA1 key for compatibility.
Changes:
- Add
CommitHashwell-known regex key and map bothSHA1andCommitHashto the updated commit-hash regex. - Expand commit-hash regex from 40-hex to 40-or-64-hex.
- Update repository checkout plugins (v1.0/v1.1) to use
CommitHash, and add L0 tests for the new behavior.
Show a summary per file
| File | Description |
|---|---|
| src/Sdk/DTPipelines/Pipelines/Expressions/WellKnownRegularExpressions.cs | Adds CommitHash key and updates the commit-hash regex to allow 40 or 64 hex chars. |
| src/Runner.Plugins/Repository/v1.0/RepositoryPlugin.cs | Removes unused local SHA1 regex field and uses CommitHash key for hash detection. |
| src/Runner.Plugins/Repository/v1.1/RepositoryPlugin.cs | Uses CommitHash key for hash detection during checkout input handling. |
| src/Test/L0/Sdk/WellKnownRegularExpressionsL0.cs | Adds unit tests validating key behavior and 40/64-char matching. |
Copilot's findings
- Files reviewed: 5/5 changed files
- Comments generated: 4
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
salmanmkc
approved these changes
Apr 30, 2026
Uh oh!
There was an error while loading. Please reload this page.
github-actionsBot
pushed a commit
to johngeorgewright/actions-runner
that referenced
this pull request
May 18, 2026
…tions#4347) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixeshttps://github.com/github/actions-runtime/issues/5475
Fixeshttps://github.com/github/actions-runtime/issues/5483
Fixeshttps://github.com/github/actions-runtime/issues/5484
Summary
Expand runner commit-hash handling to support both SHA-1 (40-char) and SHA-256 (64-char) commit hashes, preparing the runner for Git's SHA-256 transition.
Changes
WellKnownRegularExpressions.cs: Update the commit-hash regex from\b[0-9a-f]{40}\bto\b(?:[0-9a-f]{40}|[0-9a-f]{64})\b; addCommitHashas the canonical key while keepingSHA1as a backward-compatible alias.RepositoryPlugin.cs(v1.0/v1.1): Update repository plugin callers to useWellKnownRegularExpressions.CommitHashinstead of the legacySHA1key; remove the unused v1.0_validSha1field.WellKnownRegularExpressionsL0.cs: Add coverage for 40-char SHA-1, 64-char SHA-256, 63/65-char boundaries, mixed-case matching, alias compatibility, and unknown keys.ConstantGenerationL0.cs: Fold in the former test: update CommitHash length assertion for SHA-256 support #4348 assertion update so generatedCommitHashmay be either 40-char SHA-1 or 64-char SHA-256 and is hex-only.ActionManagerL0.cs: Add validation for 64-character resolved SHAs in action archive cache and symlink cache paths.Validation
dotnet test src/Test/Test.csproj --filter "FullyQualifiedName~WellKnownRegularExpressionsL0|FullyQualifiedName~ConstantGenerationL0" --no-restoredotnet test src/Test/Test.csproj --filter "FullyQualifiedName~ActionManagerL0" --no-restore --logger "console;verbosity=minimal"PR consolidation
Context
Automated by
project-board-agents-pluginvia/project-board-agents:leadBoard: https://github.com/orgs/github/projects/24272/views/1
Item: [P0] Fix core SHA-1 regex in actions/runner WellKnownRegularExpressions.cs
Run: sha256-p0-runner-00050