Fix ghs_ token regex: rebuild lib/ bundle and add missing hyphen

src/artifact-scanner.test.ts

@@ -23,6 +23,9 @@ test("makeTestToken", (t) => {
   t.is(makeTestToken(255).length, 255);
 });
 
+const NEW_FORMAT_GHS_TOKEN =
+  "ghs_abc123.def456.ghi789_abc123.def456.ghi789";
+
 test("isAuthToken", (t) => {
   // Undefined for strings that aren't tokens
   t.is(isAuthToken("some string"), undefined);
@@ -32,9 +35,10 @@ test("isAuthToken", (t) => {
   // Token types for strings that are tokens.
   t.is(isAuthToken(`ghp_${makeTestToken()}`), TokenType.PersonalAccessClassic);
   t.is(isAuthToken(`ghp_${makeTestToken()}`), TokenType.PersonalAccessClassic);
+  t.is(isAuthToken(NEW_FORMAT_GHS_TOKEN), TokenType.ServerToServer);
   t.is(
     isAuthToken(`ghs_${makeTestToken(255)}`),
-    TokenType.AppInstallationAccess,
+    TokenType.ServerToServer,
   );
   t.is(
     isAuthToken(`github_pat_${makeTestToken(22)}_${makeTestToken(59)}`),
@@ -52,6 +56,15 @@ test("isAuthToken", (t) => {
     ]),
     undefined,
   );
+  t.is(
+    isAuthToken(NEW_FORMAT_GHS_TOKEN, [
+      {
+        type: TokenType.AppInstallationAccess,
+        pattern: /ghs_[A-Za-z0-9._-]{36,}/g,
+      },
+    ]),
+    TokenType.AppInstallationAccess,
+  );
 });
 
 const testTokens = [
@@ -76,16 +89,12 @@ const testTokens = [
   },
   {
     type: TokenType.ServerToServer,
-    value: `ghs_${makeTestToken()}`,
+    value: NEW_FORMAT_GHS_TOKEN,
   },
   {
     type: TokenType.Refresh,
     value: `ghr_${makeTestToken()}`,
   },
-  {
-    type: TokenType.AppInstallationAccess,
-    value: `ghs_${makeTestToken(255)}`,
-  },
 ];
 
 for (const { type, value, checkPattern } of testTokens) {

src/artifact-scanner.ts

@@ -55,15 +55,15 @@ const GITHUB_TOKEN_PATTERNS: TokenPattern[] = [
   },
   {
     type: TokenType.ServerToServer,
-    pattern: /\bghs_[a-zA-Z0-9]{36}\b/g,
+    pattern: /ghs_[A-Za-z0-9._-]{36,}/g,
   },
   {
     type: TokenType.Refresh,
     pattern: /\bghr_[a-zA-Z0-9]{36}\b/g,
   },
   {
     type: TokenType.AppInstallationAccess,
-    pattern: /\bghs_[a-zA-Z0-9]{255}\b/g,
+    pattern: /ghs_[A-Za-z0-9._-]{36,}/g,
   },
 ];
 
@@ -109,16 +109,27 @@ function scanFileForTokens(
   logger: Logger,
 ): TokenFinding[] {
   const findings: TokenFinding[] = [];
+  const seenMatches = new Set<number>();
   try {
     const content = fs.readFileSync(filePath, "utf8");
 
     for (const { type, pattern } of GITHUB_TOKEN_PATTERNS) {
-      const matches = content.match(pattern);
-      if (matches) {
-        for (let i = 0; i < matches.length; i++) {
-          findings.push({ tokenType: type, filePath: relativePath });
+      const regex = new RegExp(pattern.source, pattern.flags);
+      let matchCount = 0;
+
+      for (const match of content.matchAll(regex)) {
+        const index = match.index;
+        if (index === undefined || seenMatches.has(index)) {
+          continue;
         }
-        logger.debug(`Found ${matches.length} ${type}(s) in ${relativePath}`);
+
+        seenMatches.add(index);
+        findings.push({ tokenType: type, filePath: relativePath });
+        matchCount++;
+      }
+
+      if (matchCount > 0) {
+        logger.debug(`Found ${matchCount} ${type}(s) in ${relativePath}`);
       }
     }