Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Commit reference formatters can emit bare SHAs that parseReferences rejects

Aperta
  • Qualcosa non va?
#240 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@kuldeepsinh19 ci sta già lavorando.

Dal 28/10/2026.

  • #258 di @kuldeepsinh19 — aperta

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

bug help wanted
🐛 The bug

referenceFor() can emit a same-repository commit reference that parseReferences() rejects.

The shared parser accepts bare hexadecimal SHAs of 7–40 characters only when they contain both a letter (a–f) and a decimal digit. This prevents ordinary numbers and hexadecimal words from becoming false-positive commit references. The formatters truncate SHAs without checking that condition.

This is existing behaviour in GitHub and GitLab, not a Tangled-only regression. PR #238 adds the same formatting pattern for Tangled.

Confirmed from source:

  • GitHub's shared githubShapedWeb() formatter in src/web.ts emits seven characters.
  • GitLab's formatter in src/gitlab/web.ts emits eight characters.
  • Tangled's formatter in src/tangled/web.ts emits seven characters.

For example, a SHA beginning deadbeef1… produces deadbee on GitHub/Tangled and deadbeef on GitLab. Both are rejected as bare references, even though a longer prefix would contain a digit. The same mismatch occurs with a digits-only prefix followed by a letter.

Repository-qualified references such as acme/widgets@deadbee use a separate parsing rule and do not require mixed letters and digits.

🛠️ To reproduce

Use this minimal example from the repository root. No forge API requests or real commits are required; these APIs operate on reference text.

import { github } from './src/github/index.ts'
import { gitlab } from './src/gitlab/index.ts'

for (const provider of [github(), gitlab()]) {
  const repo = {
    forge: provider.forge,
    instance: provider.instance,
    owner: 'acme',
    name: 'widgets',
  }
  const ref = {
    forge: provider.forge,
    instance: provider.instance,
    repo,
    sha: 'deadbeef1234567890abcdef1234567890abcdef12',
  }

  const text = provider.referenceFor(ref, { from: repo })!
  console.log(provider.forge, text, provider.parseReferences(text, { from: repo }))
}

Current results, derived from source inspection:

  • GitHub: deadbee, then [].
  • GitLab: deadbeef, then [].

This example has not been executed in the review sandbox. No hosted reproduction is available.

🌈 Expected behaviour

Align commit-reference formatting and parsing across affected providers.

When referenceFor() emits a bare commit reference, parseReferences() should recognise that reference in the same repository context.

One possible approach is to extend the prefix until it satisfies the parser's existing rules. If no acceptable prefix exists, use an explicit repository-qualified reference or a supported commit URL instead. Keep the parser's protection against ordinary numbers and hexadecimal words.

A URL fallback is not a parseReferences() round trip: that API deliberately excludes URLs. If a formatter uses a URL fallback, verify it with parseUrl().

Acceptance criteria:

  • Cover letter-only prefixes followed by a digit and digit-only prefixes followed by a letter.
  • Define and test the fallback for full SHAs containing only digits or only hexadecimal letters.
  • Keep normal mixed-character short SHAs working.
  • Keep repository-qualified commit references working, including prefixes that contain only letters or only digits.
  • Preserve the existing negative parsing tests for ordinary numbers and hexadecimal words.
  • Apply a consistent policy across affected providers and add regression coverage.
ℹ️ Additional context

Affected areas:

  • src/web.ts: isBareSha(), commit rules in rulesFor(), and githubShapedWeb().
  • src/gitlab/web.ts and src/tangled/web.ts: commit-reference formatting.
  • test/unit/references.test.ts: parsing and round-trip coverage.
  • Audit other formatters before deciding the final scope. Source inspection also found SHA truncation in SourceHut and Bitbucket, and shared githubShapedWeb() use by Forgejo, Gitee, and Pushin. Their full behaviour has not been verified here.

Track this as a cross-provider follow-up rather than requiring a Tangled-only fix in #238.

Requested by @serhalp.

Lingua principale
TypeScript
Stelle
123
Fork
7
Merge medio
9h 15m
PR unite (30g)
188

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di danielroe/forges

Tutte le issue di danielroe/forges

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.