From e85c033ebc94b3870e6cb9bb2903a94d121509df Mon Sep 17 00:00:00 2001
From: Mattias L <156665038+mulmat@users.noreply.github.com>
Date: Wed, 17 Dec 2025 16:29:06 +0100
Subject: [PATCH] Support hashes in requirement files for version-file (#287)

---
 .github/workflows/test.yml                    |  20 ++++++++++++++++++
 __tests__/fixtures/requirements-with-hash.txt |   2 ++
 dist/ruff-action/index.js                     | Bin 1563979 -> 1563882 bytes
 src/utils/pyproject.ts                        |  12 +++++------
 4 files changed, 27 insertions(+), 7 deletions(-)
 create mode 100644 __tests__/fixtures/requirements-with-hash.txt

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7ad7d80..85df554 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -236,6 +236,25 @@ jobs:
           fi
         env:
           RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
+  test-default-version-from-requirements-with-hash:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Use default version from requirements-with-hash.txt
+        id: ruff-action
+        uses: ./
+        with:
+          src: __tests__/fixtures/python-project
+          version-file: __tests__/fixtures/requirements-with-hash.txt
+      - name: Correct version gets installed
+        run: |
+          if [ "$RUFF_VERSION" != "0.9.0" ]; then
+            exit 1
+          fi
+        env:
+          RUFF_VERSION: ${{ steps.ruff-action.outputs.ruff-version }}
   test-semver-range:
     runs-on: ubuntu-latest
     steps:
@@ -383,6 +402,7 @@ jobs:
       - test-default-version-from-pyproject-poetry
       - test-default-version-from-pyproject-optional-dependencies
       - test-default-version-from-requirements
+      - test-default-version-from-requirements-with-hash
       - test-semver-range
       - test-pep440-version-specifier
       - test-checksum
diff --git a/__tests__/fixtures/requirements-with-hash.txt b/__tests__/fixtures/requirements-with-hash.txt
new file mode 100644
index 0000000..0f1394f
--- /dev/null
+++ b/__tests__/fixtures/requirements-with-hash.txt
@@ -0,0 +1,2 @@
+ruff==0.9.0 \
+    --hash=sha256:badc0de
diff --git a/dist/ruff-action/index.js b/dist/ruff-action/index.js
index 8a0bd20094209c537b1d70540db6c109e4ecdd51..4d8b6155e315e94fbf09c8413f938d88b052fc3f 100644
GIT binary patch
delta 225
zcmX@TEB@8a_=Xn77N!>F7M2#)7Pc1l7LFFq7OocV7M>Q~7QPn#7J(MQ7NHj5Eh4tj
z(>L5>WMxvYoxU$hM9fOBq$o32LsKs|u_QS|LqD#lG%YQrSj*NHNN7aI#T3WH#A<8m
zYg%(DKtX1jf(A(S^aL#?vFQthm{_MDuodCfRwzp?D$dN$Q^?FyC`v6X%`8gIP0cGQ
zR!GatNwrc?sRmmSZ5UgdFnN8y7zd0yec~)ev1tn!*{82H5aDg_ixB~0Q6LuE-WMaj
Gw*dfAWJ?wR

delta 317
zcmaF0Gye3h_=Xn77N!>F7M2#)7Pc1l7LFFq7OocV7M>Q~7QPn#7J(MQ7NHj5Eh4tj
zyhWvHX<?~F#hLke3bxbtMTv;jb15JJz1+l-<O~h{IFLe(=r~8+C<9$fy?EVNZ9Oeb
z6@5*6y=cQ&R4pY%nYkL8)^NehGzASLd+ha!OA?Dpio-KYGBlKIZIv`N6{_Ki6(+}@
z<q}3xu2-CsnVhO&G<l=B==5#2BBIlGMT_v*6jT-z<!7ZPm*|z`=jK=`s8l2AsZBt#
iz9_Y%v?xyjNqX|edBW`qF(N=L3dCaD6=K9sH2?sE4q-O{

diff --git a/src/utils/pyproject.ts b/src/utils/pyproject.ts
index 21aa84e..cf17f4b 100644
--- a/src/utils/pyproject.ts
+++ b/src/utils/pyproject.ts
@@ -10,14 +10,12 @@ function getRuffVersionFromAllDependencies(
   );
 
   if (ruffVersionDefinition) {
-    const ruffVersion = ruffVersionDefinition
-      .match(/^ruff([^A-Z0-9._-]+.*)$/)?.[1]
-      .trim();
-    if (ruffVersion?.startsWith("==")) {
-      return ruffVersion.slice(2);
+    const match = ruffVersionDefinition.trim().match(/^ruff\s*==\s*([^\s\\]+)/);
+
+    if (match) {
+      core.info(`Found ruff version in requirements file: ${match[1]}`);
+      return match[1];
     }
-    core.info(`Found ruff version in pyproject.toml: ${ruffVersion}`);
-    return ruffVersion;
   }
 
   return undefined;