@benchcutlogic/reg-keygen-plugin

A deterministic reg-suit key generator for GitHub Actions.

Unlike reg-keygen-git-hash-plugin, it does not inspect every local and remote branch to choose a merge base. It uses the commit SHAs supplied by the workflow, avoiding stale or missing baselines in repositories with many long-lived branches.

Install

npm install --save-dev @benchcutlogic/reg-keygen-plugin

Configure

Add the plugin to regconfig.json:

{
	"plugins": {
		"@benchcutlogic/reg-keygen-plugin": {}
	}
}

On pull request workflows, expose the head and base commit SHAs:

env:
  GITHUB_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
  GITHUB_BASE_SHA: ${{ github.event.pull_request.base.sha }}

GITHUB_EVENT_NAME and GITHUB_SHA are already provided by GitHub Actions.

Key selection

| Run | Actual key | Expected key | | --------------------------------------- | ------------------------------------ | ------------------------------------------ | | pull_request or pull_request_target | GITHUB_HEAD_SHA, then GITHUB_SHA | REG_EXPECTED_SHA, then GITHUB_BASE_SHA | | push or workflow_dispatch | GITHUB_SHA | No expected key; publish-only | | Outside GitHub Actions | git rev-parse HEAD | First parent of HEAD~1 |

REG_EXPECTED_SHA is optional. Set it when a separate resolver has selected a published baseline commit. Every environment-derived key must be a full 40-character hexadecimal Git commit SHA; abbreviated SHAs are not valid object prefixes.

When no valid expected key exists, the plugin rejects the lookup using reg-suit's no-baseline path. Consumers should ensure their comparison or approval policy does not silently accept an empty baseline.

Requirements

• Node.js 18 or newer
• reg-suit 0.14.x

License

Apache License 2.0