Align alphaNumericRegex() with the documented grouped SHA pattern

[Copilot]

Bug Fix

The alphaNumericRegex() helper in actions/ql/lib/codeql/actions/Bash.qll no longer matched the regex shape documented in the QLDoc after the pinned-SHA example was widened to support either 40 or 64 hex characters. This caused the implementation and documentation to diverge for grouped and optional quantified forms.

What was the bug?

• alphaNumericRegex() only matched a single character class followed by one quantifier:
  • ^[0-9]+$
  • ^[A-Za-z0-9_]{40}$
• It did not match the updated documented form:
  • ^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$

How did you fix it?

• Expanded accepted regex structure

  • Reworked alphaNumericRegex() to build up the accepted pattern in stages:
    • an alphanumeric character class
    • a required quantifier (+ or {n})
    • optional grouping around that quantified term
    • an optional trailing ?
    • repetition of those terms between ^ and $

• Kept the helper aligned with the QLDoc example

  • The implementation now recognizes grouped suffixes such as ([0-9a-zA-Z]{24})?, which is the shape used by the updated pinned-SHA example.

• Minor cleanup

  • Fixed comment formatting in the helper while updating the implementation.

Example

alphaNumericRegex() now matches patterns of this form:

^[0-9a-zA-Z]{40}([0-9a-zA-Z]{24})?$

[Copilot]

Pull request overview

This PR updates the GitHub Actions analysis to recognize pinned commit refs that use either 40-hex (SHA-1) or 64-hex (SHA-256) formats, and aligns the Bash regex-detection helper with the grouped/optional form documented in QLDoc so sanitization patterns are correctly recognized.

Changes:

• Updated the pinned-commit matching regex to accept 40 or 64 hex characters (via an optional 24-hex suffix group).
• Expanded the Bash alphaNumericRegex() helper to recognize grouped and optional quantified alphanumeric-regex checks.
• Updated/added regression fixtures, expected outputs, snippet example, and change notes to reflect the new behavior.

Show a summary per file

File	Description
actions/ql/lib/codeql/actions/Bash.qll	Updates the helper that recognizes “alphanumeric-only” Bash regex validations, including grouped/optional forms.
actions/ql/src/Security/CWE-829/UnpinnedActionsTag.ql	Expands what the query considers a “pinned commit” reference (40 or 64 hex).
actions/ql/examples/snippets/uses_pinned_sha.ql	Updates the example to match the new 40-or-64 hex pinned-SHA regex shape.
actions/ql/test/query-tests/Security/CWE-829/.github/workflows/unpinned_tags.yml	Adds fixtures for 64-hex pinned, 40-hex pinned regression, and invalid-length hex refs.
actions/ql/test/query-tests/Security/CWE-829/UnpinnedActionsTag.expected	Updates expected results to include a newly-flagged invalid-length hex ref case.
actions/ql/test/query-tests/Security/CWE-829/UntrustedCheckoutCritical.expected	Updates expected edges to match the adjusted test fixture structure.
actions/ql/src/change-notes/2026-05-12-sha256-pinned-actions.md	Adds a change note for recognizing 64-character pinned refs in actions/unpinned-tag.
actions/ql/lib/change-notes/2026-05-12-improved-alphanumeric-regex.md	Adds a change note for broader recognition of Bash alphanumeric validation regexes.

Copilot's findings

• Files reviewed: 8/8 changed files
• Comments generated: 1

[michaelnebel]

What if there is only an open or close parenthesis?

[owen-mc]

Wouldn't that make it a malformed regex? I guess you could have just a close parenthesis in a later one.

Do you think this would be better?

Suggested change

	r3 = "\\(?" + r2 + "\\)?" and
	r3 = "(" + r2 + "|\\(" + r2 + "\\)" and

If I do that I should probably include the \\?? at the end, just for the second option, since that should only come after parentheses (a ? directly after a quantifier it makes the quantifier lazy/non-greedy, rather than expressing optionality).

[michaelnebel]

Yes, then it would be malformed.
Maybe just keep the code as it is.