feat: detect and reject sha256 object format repositories

[mbevc1]

What does this PR change and why?

This PR adds detection and rejection of Git repositories using the sha256 object format, which is not yet supported by the Kosli CLI. The go-git library and Kosli backend do not currently support sha256 commits, so attempting to open such a repository now returns a clear, actionable error message instead of failing later with a cryptic error.

Links to:

• https://github.com/kosli-dev/server/issues/7185
• Unable to attest artifacts when a git worktree exists #898

Changes

• internal/gitview/gitView.go:

  • Added ErrUnsupportedObjectFormat error variable with a user-friendly message
  • Added isUnsupportedObjectFormat() helper to detect sha256 object format errors from go-git
  • Updated New() to check for unsupported object formats and return a wrapped error with context
  • Added TODO comment noting this is a temporary guard pending go-git v6 and Kosli backend support

• internal/gitview/gitView_test.go:

  • Added assertion to existing test ensuring non-existent repos don't return ErrUnsupportedObjectFormat
  • Added TestNewGitViewSha256Repo() test that creates a sha256 repository and verifies the error is properly detected and reported

Checklist

• Docs — no CLI help text changes
• Helm chart — not applicable
• Terraform provider — not applicable

[claude]

Claude finished @mbevc1's task in 1m 49s —— View job

---

Follow-up review — PR #1242

• Checked for a previous Claude review to follow up on
• Diffed BEFORE (a8e40f42) vs AFTER (4cbda6c0) — BEFORE is unreachable (branch was rebased/force-pushed), fell back to gh pr diff
• Reviewed the single commit's changed lines in internal/gitview/gitView.go and internal/gitview/gitView_test.go for bugs/security/regressions
• Checked for prior inline review comments / findings to track status of

Previous findings

None found. The PR has exactly one commit, and the only prior activity on this comment was a stuck "working…" placeholder — no substantive review was ever posted and there are zero inline review comments on the PR (gh api .../pulls/1242/comments returns []). So there is nothing from an earlier review to mark resolved/outstanding.

New review of the changed lines

Walked through the new code in gitView.go:

• isUnsupportedObjectFormat(err) is nil-safe: errors.Is(nil, target) short-circuits to false, so the strings.Contains(err.Error(), ...) on the right side of && is never evaluated when err is nil — no panic risk.
• The New() ordering (check isUnsupportedObjectFormat before the generic err != nil check) is correct and doesn't change behavior for any other error path.
• Wrapping only ErrUnsupportedObjectFormat with %w (and the underlying go-git error with %v) is a reasonable, intentional choice — matches what the new test asserts (errors.Is(err, ErrUnsupportedObjectFormat) + message contains "sha256").

No bugs, security issues, or regressions found in the changed lines — 0 new inline comments posted.

Note: I was unable to run go test ./internal/gitview/... in this environment (Bash tool required approval that wasn't available), so I could not independently execute TestNewGitViewSha256Repo to confirm go-git actually raises ErrUnsupportedExtensionRepositoryFormatVersion/ErrUnknownExtension for sha256 repos at runtime — this relies on CI (the "Main" workflow run was still in progress at review time).
(branch)

[dangrondahl]

Non-blocking comment:
Do we track these somehow?
Otherwise, I fear they just become noise over time. 🤔

[mbevc1]

Not sure, but I do get it highlighted in my editor and sometimes would grep for those 😅