caseysilver-oai 690995b7c1 Verify Git plugin SHA checkouts (#34644) ...

## Why

Git can interpret a requested commit SHA as a branch name when the remote's
default branch has the same name. This can cause a marketplace plugin source
to materialize a different commit than the one it pinned.

## What changed

Resolve `HEAD` after checking out a SHA-pinned Git plugin source and reject the
source when the resolved commit does not exactly match the requested SHA.
Ref-name checkouts retain their existing behavior.

## Testing

Add a regression test with a default branch named after another commit's SHA
and verify that materialization rejects the mismatched checkout.

GitOrigin-RevId: c19cbd98ee6167dad7b2ee72e283b3bd30b59713

2026-07-22 01:20:13 +00:00

..

src

Verify Git plugin SHA checkouts (#34644)

2026-07-22 01:20:13 +00:00

BUILD.bazel

build: run buildifier from just fmt (#28125)

2026-06-13 21:43:39 -07:00

Cargo.toml

Honor system proxy settings for remote plugins (#34509)

2026-07-21 10:05:06 +00:00