Finding fixed Git object ID assumptions before SHA-256 exposes them

说明与用途

git‑sha‑ready 检测并修复 Git 对象 ID 长度假设，确保与 SHA‑256 兼容。

问题

Git integrations often assume object IDs are 40 hex characters, which fails for SHA-256 repositories that use 64 hex characters.

结果

Updating the validator to accept 64‑hex IDs and removing the fixed slice eliminates false findings and ensures compatibility with SHA‑256 repositories.

工作流

• 1. Run git‑sha‑ready on a repository to scan tracked text files.
• 2. The tool searches for patterns: 40‑hex regexes, length checks to 40, fixed 40‑char slices, direct .git/objects access, and 20‑byte ID storage.
• 3. Findings are reported with confidence labels and repair hints.
• 4. Optionally run --probe mode to copy the repo into a temporary SHA‑256 repo, commit, and execute a user‑supplied shell command (e.g., npm test).
• 5. Review probe results and adjust code or configuration accordingly.

证据

I built git-sha-ready after noticing that a Git integration can appear healthy while it assumes every object ID is 40 characters long.

来源

After I let the validator accept 40 or 64 digits and remove the fixed slice, the same scan has no findings.

来源

The default command reads Git tracked text files. It does not execute the target project.

来源

I also added an explicit --probe mode. It copies tracked source and config files into a temporary repository initialized with SHA-256, makes a local commit, and runs a shell command supplied by the user.

来源