Analysis
GitHub Disabled SHA-1 in HTTPS. Your Repositories Did Not Change.
GitHub has removed SHA-1 from HTTPS connections to GitHub.com. The change is easy to misread because Git also uses SHA-1 to identify objects. These are separate systems. Your commit hashes did not change.
This retirement applies to TLS signatures and cipher negotiation used by HTTPS clients. Git repositories, object storage, and commit IDs are not being rewritten.
The vulnerable dependency may not be Git
A current Git binary can still fail if it delegates HTTPS to an old operating-system library. Command-line tools may use OpenSSL, Secure Transport, Schannel, or another TLS backend. IDEs, package managers, build appliances, and embedded systems can carry their own libraries. The version printed by git --version is only one piece of the path.
The systems most likely to break are old but quiet: a forgotten deployment host, an appliance fetching configuration, a legacy container image, or an internal mirror that nobody has rebuilt because it still works.
Test the real path, not a synthetic inventory
I would search logs and egress records for traffic to GitHub, then test from the actual runtime identities and images. A successful browser visit from an administrator’s laptop proves nothing about a CI runner or a ten-year-old server.
For HTTPS Git operations, enable verbose curl output in a controlled test and record the TLS backend and negotiated protocol. For APIs and release downloads, exercise the application that owns the request. Replace unsupported operating systems or libraries; weakening a proxy to restore SHA-1 only relocates the problem.
SSH is not an automatic remediation
Switching a remote from HTTPS to SSH may bypass this specific TLS dependency, but it changes credentials, host-key management, firewall rules, and audit behavior. That can be a valid migration, not a drop-in fix.
GitHub Enterprise Server is not part of GitHub.com’s change, so administrators of private instances must follow their own server version and TLS configuration. The distinction matters when an organization uses both endpoints.
The useful lesson is mundane: cryptographic retirements expose hidden clients. Inventory the complete connection stack before the deadline does it for you.