{"record":{"id":"53efc742ee0764d2","repo":"docker/compose","slug":"invalid-commit-sha-q","errorCode":null,"errorMessage":"invalid commit sha %q","messagePattern":"invalid commit sha %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/remote/git.go","lineNumber":188,"sourceCode":"}\n\nfunc (g gitRemoteLoader) resolveGitRef(ctx context.Context, path string, ref *gitutil.GitRef) error {\n\tif !commitSHA.MatchString(ref.Ref) {\n\t\tcmd := exec.CommandContext(ctx, \"git\", \"ls-remote\", \"--exit-code\", ref.Remote, ref.Ref)\n\t\tcmd.Env = g.gitCommandEnv()\n\t\tout, err := cmd.CombinedOutput()\n\t\tif err != nil {\n\t\t\tif cmd.ProcessState.ExitCode() == 2 {\n\t\t\t\treturn fmt.Errorf(\"repository does not contain ref %s, output: %q: %w\", path, string(out), err)\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"failed to access repository at %s:\\n %s\", ref.Remote, out)\n\t\t}\n\t\tif len(out) < 40 {\n\t\t\treturn fmt.Errorf(\"unexpected git command output: %q\", string(out))\n\t\t}\n\t\tsha := string(out[:40])\n\t\tif !commitSHA.MatchString(sha) {\n\t\t\treturn fmt.Errorf(\"invalid commit sha %q\", sha)\n\t\t}\n\t\tref.Ref = sha\n\t}\n\treturn nil\n}\n\nfunc (g gitRemoteLoader) checkout(ctx context.Context, path string, ref *gitutil.GitRef) error {\n\terr := os.MkdirAll(path, 0o700)\n\tif err != nil {\n\t\treturn err\n\t}\n\terr = exec.CommandContext(ctx, \"git\", \"init\", path).Run()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tcmd := exec.CommandContext(ctx, \"git\", \"remote\", \"add\", \"origin\", ref.Remote)\n\tcmd.Dir = path","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/docker/compose/blob/ddc4b044b62e9f715212ea4143fa830fac76382f/pkg/remote/git.go#L170-L206","documentation":"The first 40 bytes of `git ls-remote` output did not match `^[a-f0-9]{40}$`, so they cannot be a commit SHA. Like the short-output check, this guards against malformed git responses before caching the resolved ref.","triggerScenarios":"A server returning output that begins with something other than a hex SHA (warning banners, HTML error pages captured by CombinedOutput, annotated tag peeling oddities from non-standard servers).","commonSituations":"Git HTTP endpoints fronted by proxies that inject headers/banners; misconfigured git smart-HTTP on private servers; essentially never occurs with GitHub/GitLab.","solutions":["Reproduce with `git ls-remote <remote> <ref>` and inspect exactly what precedes the SHA","Pin the include to a literal 40-char SHA to avoid parsing ls-remote output","Fix the server/proxy that prepends non-git content to responses"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer SHA-pinned git includes when using non-standard or self-hosted git servers","Investigate any banner/warning text prepended by wrappers to git output in GIT_* env config"],"tags":["compose","git-remote","git-protocol","validation"],"backgroundTag":null,"analyzedSha":"ddc4b044b62e9f715212ea4143fa830fac76382f","analyzedAt":"2026-08-15T13:31:42.319Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}