fix(git): reject incomplete object IDs

[nia-sg-bot]

Summary

• reject truncated or non-canonical object IDs before treating Git snapshots as exact
• enforce complete SHA-1 (40) and SHA-256 (64) IDs for resolved commits, raw diff endpoints, and hash-object output
• retain the existing structured missing_object_id/malformed_hash_object_output warning contract rather than fabricating provenance

Validation

• python3 -m pytest (174 passed)
• python3 -m compileall -q diffgraph tests
• git diff --check

Part of #21. Remaining work: broader resolver coverage for supported Git edge cases.

Summary by CodeRabbit

• Bug Fixes
  • Improved validation of Git object IDs to require complete SHA-1 or SHA-256 values.
  • Incomplete, invalid, or uppercase object IDs are no longer treated as exact snapshots.
  • Updated warnings identify missing or invalid complete object IDs more clearly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 4f4fb39f-fb32-497c-9d0c-d0253e552986

📥 Commits

Reviewing files that changed from the base of the PR and between 09d6851 and e0a8fc0.

📒 Files selected for processing (2)

• diffgraph/git_snapshot.py
• tests/test_git_snapshot.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The change requires complete lowercase SHA-1 or SHA-256 object IDs. Snapshot extraction rejects truncated or non-hex IDs and updates related warnings. Tests cover validation and staged snapshot handling.

Changes

Object ID validation

Layer / File(s)	Summary
Object ID validation contract diffgraph/git_snapshot.py	_is_hex_oid now accepts only complete 40- or 64-character lowercase hexadecimal IDs.
Snapshot extraction validation diffgraph/git_snapshot.py, tests/test_git_snapshot.py	Staged, unstaged, and working-tree snapshot paths reject incomplete or non-hex IDs. Tests cover invalid IDs and complete SHA-1 and SHA-256 IDs.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e0a8f

The validation change is consistent with the snapshot producers and has no actionable merge-blocking risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting incomplete Git object IDs.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nia/issue-21-validate-object-ids

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nia-sg-bot]

@coderabbitai review\n\nPlease review the current head e0a8fc047fc9e7659757ab9e947662257b1051d8 for the object-ID validation change.

[coderabbitai]

@nia-sg-bot: I will review the object-ID validation change at e0a8fc047fc9e7659757ab9e947662257b1051d8.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.