reverting to the simpler approach

app/models/commit.rb

@@ -26,7 +26,7 @@ class Commit
   DIFF_HARD_LIMIT_LINES = 50000
 
   MIN_SHA_LENGTH = 7
-  COMMIT_SHA_PATTERN = /(?<!\s[~#!@:])\h{#{MIN_SHA_LENGTH},40}/.freeze
+  COMMIT_SHA_PATTERN = /\h{#{MIN_SHA_LENGTH},40}/.freeze
 
   def banzai_render_context(field)
     context = { pipeline: :single_line, project: self.project }

app/models/note.rb

@@ -169,7 +169,13 @@ class Note < ActiveRecord::Base
   end
 
   def cross_reference?
-    system? && matches_cross_reference_regex?
+    return unless system?
+
+    if force_cross_reference_regex_check?
+      matches_cross_reference_regex?
+    else
+      SystemNoteService.cross_reference?(note)
+    end
   end
 
   def diff_note?
@@ -382,4 +388,10 @@ class Note < ActiveRecord::Base
   def set_discussion_id
     self.discussion_id ||= discussion_class.discussion_id(self)
   end
+
+  def force_cross_reference_regex_check?
+    return unless system?
+
+    SystemNoteMetadata::TYPES_WITH_CROSS_REFERENCES.include?(system_note_metadata&.action)
+  end
 end

app/models/system_note_metadata.rb

 class SystemNoteMetadata < ActiveRecord::Base
+  # These notes's action text might contain a reference that is external.
+  # We should always force a deep validation upon references that are found
+  # in this note type.
+  # Other notes can always be safely shown as all its references are
+  # in the same project (i.e. with the same permissions)
+  TYPES_WITH_CROSS_REFERENCES = %w[
+    cross_reference
+    milestone
+  ]
+
   ICON_TYPES = %w[
     commit description merge confidential visible label assignee cross_reference
     title time_tracking branch milestone discussion task moved

app/services/system_note_service.rb

@@ -583,6 +583,10 @@ module SystemNoteService
     create_note(NoteSummary.new(issuable, issuable.project, author, body, action: action))
   end
 
+  def cross_reference?(note_text)
+    note_text =~ /\A#{cross_reference_note_prefix}/i
+  end
+
   private
 
   def notes_for_mentioner(mentioner, noteable, notes)

spec/models/commit_spec.rb

@@ -468,27 +468,4 @@ eos
       expect(described_class.valid_hash?('a' * 41)).to be false
     end
   end
-
-  describe '.reference_pattern' do
-    where(:ref, :matches?) do
-      sha = Digest::SHA1.hexdigest 'thisisacommitid'
-
-      [
-        [sha.first(Commit::MIN_SHA_LENGTH - 1), false],
-        [sha.first(Commit::MIN_SHA_LENGTH), true],
-        [sha, true],
-        ['~' << sha, false], # labels
-        ['!' << sha, false], # merge_request
-        [':' << sha, false], # emoji
-        ['#' << sha, false], # issue
-        ['@' << sha, false], # user
-      ]
-    end
-
-    with_them do
-      it "should match only on commit references" do
-        expect(Commit.reference_pattern.match(ref).present?).to eq(matches?)
-      end
-    end
-  end
 end