Support SHA-2 subject digests#446
Merged
Merged
Conversation
bdehamer
force-pushed
the
bdehamer/sha2-subject-digests
branch
2 times, most recently
from
July 15, 2026 00:15
7cc6e54 to
74bce5a
Compare
Signed-off-by: Brian DeHamer <[email protected]>
bdehamer
force-pushed
the
bdehamer/sha2-subject-digests
branch
from
July 15, 2026 21:55
74bce5a to
0138e39
Compare
bdehamer
marked this pull request as ready for review
July 15, 2026 21:56
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request expands the action’s subject-digest input validation to support multiple SHA-2 algorithms (beyond SHA-256) with strict parsing and per-algorithm hex-length checks, and updates tests to cover valid/invalid digest formats.
Changes:
- Added
parseSubjectDigestand a supported SHA-2 algorithm/length allowlist to validatesubject-digest. - Updated subject digest handling to use the parsed algorithm/digest pair.
- Expanded unit and integration tests to cover accepted algorithms and rejection cases; updated the bundled
dist/index.js.
Show a summary per file
| File | Description |
|---|---|
src/subject.ts |
Adds SHA-2 allowlist + parseSubjectDigest and switches subject-digest parsing to the new validator. |
dist/index.js |
Updates the generated bundle to include the new parsing/validation logic. |
__tests__/unit/subject.test.ts |
Adds table-driven tests for accepted SHA-2 algorithms and additional negative cases for invalid digests. |
__tests__/integration/main.test.ts |
Adds integration coverage around non-SHA256 digests with/without push-to-registry. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/4 changed files
- Comments generated: 2
- Review effort level: Low
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request strengthens and expands validation for the
subject-digestinput, ensuring only canonical SHA-2 algorithms with correct hex lengths are accepted, and improves test coverage for both valid and invalid digest formats. The changes introduce a new parsing function, update error handling for various invalid cases, and add comprehensive tests for supported and unsupported digest formats.Closes #309