Function computePolicyHash

pkg/workflow/cache_integrity.go:29–40

computePolicyHash computes a deterministic 8-character hex hash of the allow-only policy. Returns noPolicySentinel when the GitHub tool has no guard policy (i.e., min-integrity is unset). The hash is computed over the canonical form of all policy fields so that: - Same policy in different order → s

(github *GitHubToolConfig)

//   - Any policy field change → new hash → cache miss (correct isolation)
//   - Workflows without policy → sentinel value "nopolicy" (consistent key format)
func computePolicyHash(github *GitHubToolConfig) string {
	if github == nil || github.MinIntegrity == "" {
		cacheIntegrityLog.Print("No guard policy configured, using nopolicy sentinel")
		return noPolicySentinel
	}

	canonical := buildCanonicalPolicy(github)
	hash := sha256.Sum256([]byte(canonical))
	result := hex.EncodeToString(hash[:])[:8]
	cacheIntegrityLog.Printf("Computed policy hash: %s (min-integrity=%s)", result, github.MinIntegrity)
	return result
}

// buildCanonicalPolicy builds the normalized string representation of the allow-only policy.
// All fields are always present (empty if unset), sorted and deduplicated, so the result