FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

fix: extend GraphQL alias prefix to prevent hash collisions by LuisUrrutia · Pull Request #1134 · semantic-release/github · GitHub

  1. semantic-release
  2. github

Repository navigation

fix: extend GraphQL alias prefix to prevent hash collisions - #1134

Merged
travi merged 2 commits into
semantic-release:masterfrom
LuisUrrutia:fix/graphql-alias-hash-collision
Jan 30, 2026
ConversationCommits (2)ChecksFiles changed
Merged

fix: extend GraphQL alias prefix to prevent hash collisions#1134
travi merged 2 commits into
semantic-release:masterfrom
LuisUrrutia:fix/graphql-alias-hash-collision

Conversation

LuisUrrutia commented Dec 16, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Fixes GraphQL alias collisions in buildAssociatedPRsQuery by extending the commit SHA prefix from 6 to 12 characters
  • Resolves CI pipeline failures in repositories with many commits where SHA prefixes can collide

Fixes #1116

Problem

The buildAssociatedPRsQuery function creates GraphQL aliases using only the first 6 characters of commit SHAs:

return `commit${sha.slice(0, 6)}: object(oid: "${sha}") {

When two commits share the same 6-character prefix (e.g., 429fa60a84f7b59f... and 429fa667b462b60b...), both resolve to alias commit429fa6, causing GraphQL to reject the query:

  Error: Field 'commit429fa6' has an argument conflict:
  {oid:"429fa60a84f7b59f9e4a20bfbea6b0fa977a1e1e"} or {oid:"429fa667b462b60b31769e5268cfbc6835793c14"}

Collision probability increases significantly as repositories grow.

Solution

Extend the SHA prefix from 6 to 12 characters:

Characters Unique values Collision risk
6 ~16.8 million Likely in large repos
7 ~268 million GitHub's standard short SHA
12 ~281 trillion Practically impossible

We chose 12 characters because:

  1. It provides excellent collision resistance while keeping aliases reasonably short
  2. It matches the patch the issue author successfully deployed in their repository: https://github.com/ongov/ontario-design-system/pull/140/files

Credits to @smorrisods

smorrisods commented Dec 16, 2025 •
edited by hearts Bot
Loading

Copy link
Copy Markdown

Thanks @LuisUrrutia for tackling this ❤️!

babblebey reviewed Dec 17, 2025
View reviewed changes

babblebey left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

This looks great @LuisUrrutia.

I wouldn't have ever thought that this would ever occur!

Quick question though, Did you give this a test? 🤔

Cc @smorrisods

LuisUrrutia commented Dec 17, 2025 •
edited by hearts Bot
Loading

Copy link
Copy Markdown
Contributor Author

This looks great @LuisUrrutia.

I wouldn't have ever thought that this would ever occur!

Quick question though, Did you give this a test? 🤔

Cc @smorrisods

I also didn’t expect to run into an issue like this.

It’s hard to know how to reliably reproduce an issue like this. However, even without being able to reproduce it, the tool runs normally in a "standard" repository.

I also noticed that @smorrisods had this issue here:
https://github.com/ongov/ontario-design-system/actions/runs/19302965551/job/55202972489

but then, in the following release (after including the patch using a 12 chars SHA) it appears to have been resolved:
https://github.com/ongov/ontario-design-system/actions/runs/19376674982/job/55446171969

Also, I think GraphQL specification does not impose a specific character limit on aliases, so we could also use the full hash.

smorrisods commented Dec 17, 2025 •
edited by hearts Bot
Loading

Copy link
Copy Markdown

This looks great @LuisUrrutia.
I wouldn't have ever thought that this would ever occur!
Quick question though, Did you give this a test? 🤔
Cc @smorrisods

I also didn’t expect to run into an issue like this.

It’s hard to know how to reliably reproduce an issue like this. However, even without being able to reproduce it, the tool runs normally in a "standard" repository.

Our repository has two cases of SHA collisions at 6 char prefixes. The first collision happened after a few years, the send one happened during a heavy commit phase recently within a few weeks of each other. I was shocked myself because the SHA space is so big it seems highly unlikely to happen within the same release period, but our repo is an example.

I also noticed that @smorrisods had this issue here: https://github.com/ongov/ontario-design-system/actions/runs/19302965551/job/55202972489

but then, in the following release (after including the patch using a 12 chars SHA) it appears to have been resolved: https://github.com/ongov/ontario-design-system/actions/runs/19376674982/job/55446171969

Upon increasing the prefix character length to 12 (and I would have gone longer but I wasn't sure if there was an overall GraphQL rate limit that inspired the original truncation) everything worked as expected in our release, as @LuisUrrutia has surfaced here.

Also, I think GraphQL specification does not impose a specific character limit on aliases, so we could also use the full hash.

When I looked into the original change the 6 character prefix limit showed up out of nowhere as part of a refactoring from using the REST API to use the GraphQL API. I'm not sure why they didn't choose to go with the full SHA.

babblebey approved these changes Jan 28, 2026
View reviewed changes

babblebey left a comment •
edited by hearts Bot
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

It looks good

travi merged commit ea6386d into semantic-release:master Jan 30, 2026
6 checks passed

github-actions Bot commented Jan 30, 2026

Copy link
Copy Markdown

🎉 This PR is included in version 12.0.3 🎉

The release is available on:

Your semantic-release bot 📦🚀

hearts-welcome Bot mentioned this pull request Feb 20, 2026
Open
CataldoMazzilli mentioned this pull request May 26, 2026
Merged
4 tasks done
smorrisods added a commit to ongov/ontario-design-system that referenced this pull request Jun 15, 2026
chore(deps): remove @semantic-release/github patch (upstreamed)
b9e9d43 
The GraphQL alias collision fix (slice(0, 6) → slice(0, 12)) that our
patch applied to lib/success.js was upstreamed in @semantic-release/github
v12.0.3 via semantic-release/github#1134 (commit ea6386d). Since Renovate
has bumped us to v12.0.8, the patch is no longer needed.

Ref: semantic-release/github#1134
Ref: semantic-release/github@ea6386d
smorrisods added a commit to ongov/ontario-design-system that referenced this pull request Jun 15, 2026
chore(deps): remove @semantic-release/github patch (upstreamed)
ae508ea 
The GraphQL alias collision fix (`slice(0, 6)` → `slice(0, 12)`) that our
patch applied to `lib/success.js` was upstreamed in `@semantic-release/github`
v12.0.3 via semantic-release/github#1134 (commit `ea6386d`). Since Renovate
has bumped us to v12.0.8, the patch is no longer needed.

Ref: semantic-release/github#1134
Ref: semantic-release/github@ea6386d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

travi travi approved these changes
babblebey babblebey approved these changes

Assignees

No one assigned

Labels

released

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Hash collisions in GraphQL aliases in success lifecycle

4 participants

Back | FazBrowse Home | New Git URL