Match a hex color
Match a CSS hex color with #[0-9a-fA-F]{6}, add a three digit form with an alternation, and anchor it. Unanchored, #1234567 still matches its first six digits.
A form field should accept #1a2b3c and #fff, and reject a longer string of hex digits.
import re
loose = re.compile(r"#[0-9a-fA-F]{6}")
strict = re.compile(r"#(?:[0-9a-fA-F]{6}|[0-9a-fA-F]{3})")
for s in ["#1a2b3c", "#FFF", "#12345", "#1234567", "1a2b3c", "#ggg111"]:
print(f"{s:9} loose={bool(loose.fullmatch(s))} search={bool(loose.search(s))} strict={bool(strict.fullmatch(s))}")#1a2b3c loose=True search=True strict=True
#FFF loose=False search=False strict=True
#12345 loose=False search=False strict=False
#1234567 loose=False search=True strict=False
1a2b3c loose=False search=False strict=False
#ggg111 loose=False search=False strict=FalseThe class [0-9a-fA-F] is one hex digit and {6} repeats it exactly six times. A search finds the first six digits of #1234567 and calls it a match, which is why validation needs fullmatch or ^...$ anchors, the point made in the re documentation. The non-capturing group in the strict pattern lists the two lengths CSS allows.
CSS also has the four and eight digit forms with an alpha channel, #rgba and #rrggbbaa, so extend the alternation if you accept them. In a pattern with the case-insensitive flag the class can be shortened to [0-9a-f]. A color name or an rgb() function is a different syntax and needs its own pattern.