Fix ghs_ redaction pattern to support new token format

[hpsin]

Updates the ghs_ token regex to support the new token format which allows dots and underscores ([A-Za-z0-9._]) and variable length (no longer fixed at 36 chars).

See the changelog: https://github.blog/changelog/2026-05-15-github-app-installation-tokens-per-request-override-header/

[Copilot]

Pull request overview

Updates the default redaction pattern for ghs_ tokens to match GitHub’s new installation token format (allowing . and _ and variable length), and adjusts specs to ensure the new format is properly redacted.

Changes:

• Expand the ghs_ default regex to allow [A-Za-z0-9._] and variable length.
• Update the existing ghs_ spec to expect full-token redaction.
• Add a new spec case covering ghs_ tokens containing dots and underscores.

Show a summary per file

File	Description
spec/lib/redacting_logger_spec.rb	Updates/extends redaction test cases to validate the new ghs_ token formats are fully redacted.
lib/patterns/default.rb	Broadens the default ghs_ redaction regex to match the new allowed character set and variable length.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 1

[GrantBirki]

@hpsin you will also want to bump the version file and cut a new release:

redacting-logger/lib/version.rb

Line 5 in 4fff5a4

VERSION = "1.5.1"

[hpsin]

@github/authentication-reviewers — FYI, this draft PR updates the ghs_ token regex to support the new stateless token format. Please review when ready. Part of github/authentication#6826.

[hagould]

@GrantBirki Pushed, could you help us with the release process? Also would like to know how many downstream services are dependent on this for log redaction - we're currently in the early stages of rolling out the new token format.

[GrantBirki]

@hagould simply merging this PR should kick off the release process and publish to RubyGems since you bumped the version.rb file -> https://github.com/github/redacting-logger/blob/main/.github/workflows/release.yml

I don't work at GitHub any more and I won't comment publicly on the services at GitHub that use this Gem 😉.

[GrantBirki]

If this is still early on, I might consider adding some unit tests for this new redaction pattern as well -> https://github.com/github/redacting-logger/blob/main/spec/lib/redacting_logger_spec.rb

[hagould]

@GrantBirki Should be ready for another review

[hagould]

@GrantBirki Do you know the appropriate team to add for a write access review?

[GrantBirki]

@nobe4 or @northrup might be able to help here. Might want to also remove me from the CODEOWNERS file ->

redacting-logger/.github/CODEOWNERS

Line 1 in 4fff5a4

* @GrantBirki

[nobe4]

Thanks for this @hpsin 🙏