Update ghs_ token regex for new stateless JWT format

[lpcox]

Problem

GitHub is rolling out a new stateless JWT format for GitHub App installation tokens. The new ghs_ tokens:

• Are ~520 characters long (vs 40 chars for classic tokens)
• Contain dots (.) and underscores (_) (JWT structure: ghs_header.payload.signature)
• Use the character class [A-Za-z0-9._] instead of [a-zA-Z0-9]

Our current DLP and secret redaction patterns assume the old format and will fail to detect or redact the new tokens.

Affected Files

src/dlp.ts (line 55)

regex: 'ghs_[a-zA-Z0-9]{36}'

• Fixed at exactly 36 chars — misses new ~520-char tokens
• Character class excludes . and _ — misses JWT segments

src/redact-secrets.ts (line 13)

.replace(/\b(gh[pousr]_[a-zA-Z0-9]{36,255})/g, '***REDACTED***')

• Upper bound of 255 chars may be too short for ~520-char JWTs
• Character class excludes . and _ — partial match only (would redact up to the first dot)

Recommended Fix

Per GitHub's recommended regex: ghs_[A-Za-z0-9._]{36,}

src/dlp.ts

-    regex: 'ghs_[a-zA-Z0-9]{36}',
+    regex: 'ghs_[A-Za-z0-9._]{36,}',

src/redact-secrets.ts

-    .replace(/\b(gh[pousr]_[a-zA-Z0-9]{36,255})/g, '***REDACTED***')
+    .replace(/\b(gh[pousr]_[A-Za-z0-9._]{36,})/g, '***REDACTED***')

Notes

• The ghu_ token format may also change in the future (changelog mentions "user-to-server tokens used in Copilot code review flows" are next)
• Consider updating all gh*_ patterns preemptively to use the broader character class
• The DLP pattern needs a word boundary or lookahead to avoid over-matching into surrounding text (the trailing . in a sentence could be consumed)
• The rollout affects GitHub.com and GHEC; GHES is not impacted yet

References

• https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/
• https://github.blog/changelog/2026-04-24-notice-about-upcoming-new-format-for-github-app-installation-tokens