@oid_pattern ~r/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/

  @ref_pattern ~r|\Arefs/[A-Za-z0-9][A-Za-z0-9._/-]{0,200}\z|

  @segment_pattern ~r/\A[A-Za-z0-9][A-Za-z0-9._-]{0,63}\z/

  # The most ancestry pairs one `containing/3` read may ask git for. A read

  # path that spawns a subprocess per pair needs a ceiling, and this one is

  # generous for the question it answers: a handful of commits against a

  # window of recent release revisions.

  @ancestry_pair_limit 64

  @committer_name "OpenAgents Forge"

  @committer_email "forge@openagents.com"

    end

  end

  @doc """

  For each commit in `ancestors`, which of `candidates` contain it.

  `ancestor?/3` answers one pair and pays one WAL freshness check for it.

  A caller asking "which release carried this work" holds several commits and

  several release revisions at once, and paying a freshness check per pair

  would make the answer cost a network round trip per cell of a matrix that

  is mostly zeroes. This runs the check once and then one

  `merge-base --is-ancestor` per pair.

  The matrix is bounded at #{@ancestry_pair_limit} pairs. A caller that asks

  for more gets `{:error, :too_many_pairs}` rather than an unbounded scan,

  because the bound is what keeps a read path a read path.

  A candidate this repository does not have does not contain anything: git

  answers "not an ancestor" for a revision it cannot resolve, and so does

  this. The question is "did this ship", and a revision the forge never saw

  did not ship it.

  """

  @spec containing(String.t(), [String.t()], [String.t()]) ::

          {:ok, %{String.t() => [String.t()]}} | {:error, term()}

  def containing(repo, ancestors, candidates)

      when is_binary(repo) and is_list(ancestors) and is_list(candidates) do

    if length(ancestors) * length(candidates) > @ancestry_pair_limit do

      {:error, :too_many_pairs}

    else

      with :ok <- Sync.ensure_fresh(repo) do

        {:ok,

         Map.new(ancestors, fn ancestor ->

           {ancestor, Enum.filter(candidates, &contained_by?(repo, ancestor, &1))}

         end)}

      end

    end

  end

  def containing(_repo, _ancestors, _candidates), do: {:error, :not_found}

  defp contained_by?(repo, ancestor, candidate) do

    with :ok <- check_rev(ancestor),

         :ok <- check_rev(candidate) do

      match?(

        {_output, 0},

        git(repo, ["merge-base", "--is-ancestor", "--end-of-options", ancestor, candidate])

      )

    else

      _unreadable -> false

    end

  end

  @doc "The best common ancestor of two commits, or `{:error, :no_merge_base}`."

  def merge_base(repo, rev_a, rev_b) do

    with :ok <- check_rev(rev_a),

  target, and deployment receipts. No new work record, no new linkage table, and

  no new repository authority: the repository is checked once and the thread

  authority is composed rather than restated.

  `receipts` answers for the exact commit and stops there, which leaves the

  last question a reader actually has unanswered: a fleet target is matched by

  comparing shas, and a release is almost never promoted at the commit that

  closed the issue. `releases` closes that gap through

  `OpenAgents.Issues.Releases`, which asks the commit graph whether the

  release's revision contains the issue's commits. It reads the same closing

  references this module already reads, so the two halves of the answer can

  never disagree about which commits the issue claims.

  """

  alias OpenAgents.Accounts.User

  alias OpenAgents.Forge

  alias OpenAgents.Issues.{ClosingReferences, Issue}

  alias OpenAgents.Issues.{ClosingReferences, Issue, Releases}

  alias OpenAgents.Repositories

  alias OpenAgents.Repositories.Repository

  alias OpenAgents.Threads

  @doc """

  The threads and receipts that name `issue` and that `reader` may read.

  The threads, receipts, and releases that name `issue` and that `reader` may

  read.

  Returns `%{threads: [...], receipts: [...]}`. An issue with no closing

  references or no matching receipts returns an empty `:receipts` list, and an

  issue with no readable threads returns an empty `:threads` list.

  Returns `%{threads: [...], receipts: [...], releases: %{...}}`. An issue with

  no closing references or no matching receipts returns an empty `:receipts`

  list, an issue with no readable threads returns an empty `:threads` list, and

  an issue no release carried returns `OpenAgents.Issues.Releases.empty/0`.

  """

  @spec for_issue(Issue.t(), User.t() | nil) :: %{

          threads: [Threads.Thread.t()],

          receipts: [map()]

          receipts: [map()],

          releases: Releases.t()

        }

  def for_issue(%Issue{} = issue, %User{} = reader), do: do_for_issue(issue, reader)

  def for_issue(%Issue{} = issue, _reader), do: do_for_issue(issue, nil)

    repository = visible_repository(issue, reader)

    threads = if reader, do: Threads.list_for_issue(issue, reader), else: []

    receipts =

    {receipts, releases} =

      if repository do

        issue |> ClosingReferences.for_issue() |> receipts_for_references(repository)

        {issue |> ClosingReferences.for_issue() |> receipts_for_references(repository),

         Releases.for_issue(repository, issue)}

      else

        []

        {[], Releases.empty()}

      end

    %{threads: threads, receipts: receipts}

    %{threads: threads, receipts: receipts, releases: releases}

  end

  defp visible_repository(%Issue{repository_id: repository_id}, reader) do

defmodule OpenAgents.Issues.Releases do

  @moduledoc """

  Which release carried an issue.

  The chain from an issue to its receipts already existed and already joined,

  but it joined on an exact revision. `OpenAgents.Issues.Evidence` binds an

  issue to the receipts that evaluated the precise commit its work produced,

  and `OpenAgents.Forge.receipts_for/2` matches a fleet target by comparing

  shas. That is the right rule for a build receipt, which evaluated one tree

  and no other. It is the wrong rule for a release: a release is promoted at

  the revision the fleet should converge to, and the commit that closed an

  issue is almost never that revision. It is an ancestor of it.

  So a reader could see that an issue's commit was pushed and built, and

  could not see that it shipped. This module answers the missing half by

  asking git the question the sha comparison cannot: is the issue's commit

  contained in the release's revision.

  ## What it reads

  Two records, both of which already exist:

    * `issue_closing_references` — the commits that say they close the issue.

      `OpenAgents.Issues.ClosingReferences` verified the pusher could write

      the issue and required the commit to be reachable from the default

      branch before recording one, so a topic branch claims nothing here.

    * `forge_fleet_targets` — the operator-approved revisions the fleet was

      told to converge to, with the deploy-lane status each reached.

  It writes nothing. There is no issue-to-release table, because there is no

  fact to store: containment is a property of the commit graph the forge

  already holds, and a stored copy of it would be a second authority that

  could disagree with git.

  ## Why only closing references

  `forge_assignments.terminal_commit` is the other commit-to-issue source the

  evidence chain reads, and this module deliberately does not. An attempt's

  self-reported revision is the executor's claim rather than a merge, and the

  evidence chain gates it behind `OpenAgents.Transparency.WorkDisclosure`

  because a branch name and a revision an attempt produced can restate private

  repository content. Everything this module returns is derived from commits

  on the default branch of a repository the caller has already been admitted

  to read, so it needs no second disclosure ladder — and a module that needed

  one would be the wrong place to add it.

  ## What it bounds

  A read path that spawns a git subprocess per pair needs a ceiling in both

  directions: at most four claiming commits and at most twelve recent release

  targets, which is inside the pair limit

  `OpenAgents.Forge.GitPlane.containing/3` enforces. `truncated` says the

  window cut something off, so a caller can tell "nothing shipped it" from

  "the window did not reach far enough".

  """

  import Ecto.Query

  require Logger

  alias OpenAgents.Forge.{GitPlane, Target}

  alias OpenAgents.Issues.{ClosingReferences, Issue}

  alias OpenAgents.Repo

  alias OpenAgents.Repositories.Repository

  # The newest claiming commits and the newest release targets this read looks

  # at. Their product stays inside `GitPlane.containing/3`'s pair limit.

  @commit_limit 4

  @target_limit 12

  @typedoc "One release target that contains a commit, projected."

  @type release :: %{

          id: binary(),

          sha: String.t(),

          status: String.t(),

          promoted_at: DateTime.t(),

          settled_at: DateTime.t()

        }

  @typedoc """

  The release answer for one issue.

  `released_in` is the oldest release that reached `live` and contains every

  claiming commit in the window — the first release that shipped the whole of

  what the issue asked for. It is `nil` when no such release is in the window,

  including when only some of the commits shipped.

  """

  @type t :: %{

          commits: [

            %{

              sha: String.t(),

              verb: String.t() | nil,

              referenced_at: DateTime.t(),

              releases: [release()]

            }

          ],

          released_in: release() | nil,

          truncated: boolean()

        }

  @doc """

  The releases that carried `issue`, resolved through the commit graph.

  Never raises. A repository whose bare cache cannot be read, a WAL that is

  unreachable, and an issue no commit claims all answer the same way: an empty

  list, which is the honest reading of "nothing here says this shipped".

  """

  @spec for_issue(Issue.t()) :: t()

  def for_issue(%Issue{repository_id: repository_id} = issue) do

    case Repo.get(Repository, repository_id) do

      %Repository{} = repository -> for_issue(repository, issue)

      nil -> empty()

    end

  end

  @doc """

  The releases that carried `issue` in a repository the caller already

  resolved.

  `repository` must be the issue's own repository; a caller that passes

  another one gets `empty/0` rather than another repository's releases.

  """

  @spec for_issue(Repository.t(), Issue.t()) :: t()

  def for_issue(%Repository{id: repository_id} = repository, %Issue{} = issue) do

    if issue.repository_id == repository_id do

      resolve(repository, issue)

    else

      empty()

    end

  rescue

    error ->

      Logger.warning("issue_releases_failed code=#{OpenAgents.OperationalLog.code(error)}")

      empty()

  end

  @doc "The answer for an issue nothing claims: no commits, no release."

  @spec empty() :: t()

  def empty, do: %{commits: [], released_in: nil, truncated: false}

  # ── internals ────────────────────────────────────────────────────────────

  defp resolve(%Repository{} = repository, %Issue{} = issue) do

    references = issue |> ClosingReferences.for_issue() |> Enum.uniq_by(& &1.commit_sha)

    kept = Enum.take(references, @commit_limit)

    targets = targets(repository)

    truncated? = length(references) > @commit_limit or length(targets) == @target_limit

    containment = containment(repository, kept, targets)

    commits =

      Enum.map(kept, fn reference ->

        %{

          sha: reference.commit_sha,

          verb: reference.verb,

          referenced_at: reference.inserted_at,

          releases: containment |> Map.get(reference.commit_sha, []) |> Enum.map(&release/1)

        }

      end)

    %{

      commits: commits,

      released_in: released_in(kept, containment),

      truncated: truncated?

    }

  end

  # A target names its repository by string, and two strings reach the same

  # repository: the storage key the git plane reads and the repository name a

  # promotion may have been recorded under. Both are read, and neither is

  # allowed to reach a repository other than this one.

  defp targets(%Repository{} = repository) do

    keys =

      [repository.storage_key, repository.name]

      |> Enum.reject(&(is_nil(&1) or &1 == ""))

      |> Enum.uniq()

    Target

    |> where([target], target.repo in ^keys)

    |> order_by([target], desc: target.inserted_at, desc: target.id)

    |> limit(@target_limit)

    |> Repo.all()

  end

  defp containment(_repository, [], _targets), do: %{}

  defp containment(_repository, _references, []), do: %{}

  defp containment(%Repository{} = repository, references, targets) do

    commits = Enum.map(references, & &1.commit_sha)

    by_sha = Enum.group_by(targets, & &1.sha)

    shas = Map.keys(by_sha)

    case GitPlane.containing(repository.storage_key, commits, shas) do

      {:ok, matrix} ->

        Map.new(matrix, fn {commit, matched} ->

          {commit,

           matched

           |> Enum.flat_map(&Map.get(by_sha, &1, []))

           |> Enum.sort_by(& &1.inserted_at, DateTime)}

        end)

      # An unreachable WAL, a cache this node cannot read, and a matrix past

      # the pair bound are all "this read cannot answer", which is not the

      # same fact as "nothing shipped it" — but the caller sees the same empty

      # list either way, because an issue page that guessed would be worse

      # than one that says nothing.

      {:error, reason} ->

        Logger.debug(

          "issue_releases_containment_unavailable code=#{OpenAgents.OperationalLog.code(reason)}"

        )

        %{}

    end

  end

  # The first release that carried the whole issue: the oldest `live` target

  # that contains every claiming commit in the window. A target that carried

  # some of them is on each of those commits' own lists and is not this.

  defp released_in([], _containment), do: nil

  defp released_in([first | rest], containment) do

    carried = Map.get(containment, first.commit_sha, [])

    shared =

      Enum.reduce(rest, MapSet.new(carried, & &1.id), fn reference, acc ->

        MapSet.intersection(

          acc,

          containment |> Map.get(reference.commit_sha, []) |> MapSet.new(& &1.id)

        )

      end)

    carried

    |> Enum.filter(&(&1.status == "live" and MapSet.member?(shared, &1.id)))

    |> Enum.min_by(& &1.inserted_at, DateTime, fn -> nil end)

    |> case do

      %Target{} = target -> release(target)

      nil -> nil

    end

  end

  defp release(%Target{} = target) do

    %{

      id: target.id,

      sha: target.sha,

      status: target.status,

      promoted_at: target.inserted_at,

      settled_at: target.updated_at

    }

  end

end

    %{

      threads: Enum.map(activity.threads, &thread_json(&1, url_base)),

      receipts: Enum.map(activity.receipts, &receipt_json/1)

      receipts: Enum.map(activity.receipts, &receipt_json/1),

      releases: releases_json(Map.get(activity, :releases))

    }

  end

  # The release half of the activity answer. `receipts` matches a receipt to

  # the exact commit; this says which release revision contains that commit,

  # which is the question "did this ship" actually asks.

  defp releases_json(nil), do: releases_json(OpenAgents.Issues.Releases.empty())

  defp releases_json(releases) do

    %{

      commits:

        Enum.map(releases.commits, fn commit ->

          %{

            sha: commit.sha,

            verb: commit.verb,

            referenced_at: commit.referenced_at,

            releases: Enum.map(commit.releases, &release_json/1)

          }

        end),

      released_in: release_json(releases.released_in),

      truncated: releases.truncated

    }

  end

  defp release_json(nil), do: nil

  defp release_json(release) do

    %{

      id: release.id,

      sha: release.sha,

      status: release.status,

      promoted_at: release.promoted_at,

      settled_at: release.settled_at

    }

  end

    end

  end

  describe "containing/3" do

    test "answers the whole matrix in one read", %{

      base_commit: base_commit,

      b1: b1,

      b2: b2,

      c1: c1,

      trunk_x: trunk_x

    } do

      assert {:ok, matrix} = GitPlane.containing(@repo, [b1, trunk_x], [b2, c1, trunk_x])

      assert matrix[b1] == [b2, c1]

      assert matrix[trunk_x] == [trunk_x]

      assert {:ok, %{^base_commit => carried}} =

               GitPlane.containing(@repo, [base_commit], [b2, trunk_x])

      assert carried == [b2, trunk_x]

    end

    test "a revision the repository does not have contains nothing", %{b2: b2} do

      absent = String.duplicate("a", 40)

      assert {:ok, matrix} = GitPlane.containing(@repo, [absent, b2], [b2, absent])

      assert matrix[absent] == []

      assert matrix[b2] == [b2]

    end

    test "refuses a matrix past the pair bound rather than scanning it", %{b2: b2} do

      candidates = List.duplicate(b2, 65)

      assert {:error, :too_many_pairs} = GitPlane.containing(@repo, [b2], candidates)

      assert {:ok, _matrix} = GitPlane.containing(@repo, [b2], Enum.take(candidates, 64))

    end

    test "an empty ask is an empty answer", %{b2: b2} do

      assert {:ok, %{}} = GitPlane.containing(@repo, [], [b2])

      assert {:ok, %{^b2 => []}} = GitPlane.containing(@repo, [b2], [])

      assert {:error, :not_found} = GitPlane.containing(@repo, b2, [b2])

    end

  end

  describe "merge_base/3" do

    test "finds the common ancestor of diverged branches", %{base_commit: base_commit} do

      assert {:ok, ^base_commit} = GitPlane.merge_base(@repo, "layer-1", "main")

defmodule OpenAgents.Issues.ReleasesTest do

  @moduledoc """

  #10, the half of the traceability chain a sha comparison cannot answer.

  An issue's closing commit is an ancestor of the revision a release was

  promoted at, never that revision itself, so `OpenAgents.Forge.receipts_for/2`

  — which matches a fleet target by comparing shas — finds nothing for the

  commit that actually shipped. These tests run against a real bare forge

  repository with a real commit graph and real promoted targets, because the

  only thing that makes the answer true is git's own containment relation.

  The graph every test reads:

      c0 ── c1 ── c2 ── c3      (refs/heads/main = c3)

        └── side                (refs/heads/side, never merged)

  """

  use OpenAgents.DataCase, async: false

  alias OpenAgents.Forge.Repos

  alias OpenAgents.Forge.Targets

  alias OpenAgents.Issues

  alias OpenAgents.Issues.{Activity, ClosingReference, Releases}

  alias OpenAgents.Repo

  alias OpenAgents.Repositories

  @repo "openagents.com"

  setup do

    Ecto.Adapters.SQL.Sandbox.mode(OpenAgents.Repo, {:shared, self()})

    base = Path.join(System.tmp_dir!(), "issue-releases-#{System.unique_integer([:positive])}")

    File.mkdir_p!(base)

    previous_data = Application.get_env(:openagents, :forge_data_dir)

    previous_wal = Application.get_env(:openagents, :forge_wal_dir)

    Application.put_env(:openagents, :forge_data_dir, Path.join(base, "data"))

    Application.put_env(:openagents, :forge_wal_dir, Path.join(base, "wal"))

    on_exit(fn ->

      restore(:forge_data_dir, previous_data)

      restore(:forge_wal_dir, previous_wal)

      File.rm_rf(base)

    end)

    repository = Repositories.get_by_path!("OpenAgentsInc", @repo)

    {:ok, issue} = Issues.create_issue(repository, %{title: "Ship the release link"})

    Map.merge(seed_graph(), %{repository: repository, issue: issue})

  end

  defp restore(key, nil), do: Application.delete_env(:openagents, key)

  defp restore(key, value), do: Application.put_env(:openagents, key, value)

  describe "for_issue/2" do

    test "an issue no commit claims has no commits and no release", context do

      assert Releases.for_issue(context.repository, context.issue) == Releases.empty()

    end

    test "a release promoted at a descendant of the issue's commit carried it", context do

      claim(context, context.c1)

      target = release(context.c2, "live")

      assert %{commits: [commit], released_in: released, truncated: false} =

               Releases.for_issue(context.repository, context.issue)

      assert commit.sha == context.c1

      assert [carried] = commit.releases

      assert carried.sha == context.c2

      assert carried.status == "live"

      assert released.id == target.id

      assert released.sha == context.c2

    end

    test "a release promoted before the commit existed did not carry it", context do

      claim(context, context.c2)

      release(context.c0, "live")

      assert %{commits: [commit], released_in: nil} =

               Releases.for_issue(context.repository, context.issue)

      assert commit.releases == []

    end

    test "a commit that never reached the mainline is carried by nothing", context do

      claim(context, context.side)

      release(context.c3, "live")

      assert %{commits: [commit], released_in: nil} =

               Releases.for_issue(context.repository, context.issue)

      assert commit.releases == []

    end

    test "every release that contains the commit is listed, oldest first", context do

      claim(context, context.c1)

      first = release(context.c2, "live")

      second = release(context.c3, "live")

      assert %{commits: [commit], released_in: released} =

               Releases.for_issue(context.repository, context.issue)

      assert Enum.map(commit.releases, & &1.id) == [first.id, second.id]

      assert released.id == first.id

    end

    test "released_in is the oldest live release that carried every commit", context do

      claim(context, context.c1)

      claim(context, context.c3)

      partial = release(context.c2, "live")

      whole = release(context.c3, "live")

      assert %{commits: commits, released_in: released} =

               Releases.for_issue(context.repository, context.issue)

      by_sha = Map.new(commits, &{&1.sha, &1})

      assert Enum.map(by_sha[context.c1].releases, & &1.id) == [partial.id, whole.id]

      assert Enum.map(by_sha[context.c3].releases, & &1.id) == [whole.id]

      assert released.id == whole.id

    end

    test "a promoted release that never went live is listed but never released_in", context do

      claim(context, context.c1)

      promoted = release(context.c3, "promoted")

      assert %{commits: [commit], released_in: nil} =

               Releases.for_issue(context.repository, context.issue)

      assert [carried] = commit.releases

      assert carried.id == promoted.id

      assert carried.status == "promoted"

    end

    test "the target window is bounded and says so when it cuts something off", context do

      claim(context, context.c1)

      for _each <- 1..13, do: release(context.c3, "live")

      assert %{commits: [commit], truncated: true} =

               Releases.for_issue(context.repository, context.issue)

      assert length(commit.releases) == 12

    end

    test "a repository that is not the issue's own answers with nothing", context do

      claim(context, context.c1)

      release(context.c2, "live")

      other = %{context.repository | id: Ecto.UUID.generate()}

      assert Releases.for_issue(other, context.issue) == Releases.empty()

    end

  end

  describe "the activity read and its JSON" do

    test "activity carries the release that shipped the issue", context do

      claim(context, context.c1)

      target = release(context.c2, "live")

      activity = Activity.for_issue(context.issue)

      assert activity.releases.released_in.id == target.id

      rendered = OpenAgentsWeb.IssueJSON.render("activity.json", %{activity: activity})

      assert %{released_in: %{sha: sha, status: "live"}, truncated: false} = rendered.releases

      assert sha == context.c2

      assert [%{sha: ^sha}] = hd(rendered.releases.commits).releases

    end

    test "an issue nothing shipped renders an empty release answer", context do

      rendered =

        OpenAgentsWeb.IssueJSON.render("activity.json", %{

          activity: Activity.for_issue(context.issue)

        })

      assert rendered.releases == %{commits: [], released_in: nil, truncated: false}

    end

  end

  # ── fixture ──────────────────────────────────────────────────────────────

  # One `Closes #N` reference, written the way `OpenAgents.Issues.ClosingReferences`

  # writes it. What the reference means is proved by `OpenAgents.Forge.PushClosesIssuesTest`;

  # what it is worth here is the commit it names.

  defp claim(%{repository: repository, issue: issue}, sha) do

    %ClosingReference{}

    |> ClosingReference.changeset(%{

      repository_id: repository.id,

      issue_id: issue.id,

      commit_sha: sha,

      repo: @repo,

      principal: "test:releases",

      verb: "closes",

      closed: true

    })

    |> Repo.insert!()

  end

  # One promotion through the real lane, so the sha precondition and the

  # transition table both run. `status` is where the target is left.

  defp release(sha, status) do

    {:ok, target} = Targets.promote(@repo, sha, "operator:releases-test")

    Enum.reduce_while(["building", "built", "deploying", "live"], target, fn step, current ->

      if current.status == status, do: {:halt, current}, else: {:cont, advance(current, step)}

    end)

  end

  defp advance(target, step) do

    {:ok, advanced} = Targets.advance(target.id, step)

    advanced

  end

  defp seed_graph do

    path = Repos.ensure_repo!(@repo)

    c0 = commit(path, [{"f.txt", "zero\n"}], [])

    c1 = commit(path, [{"f.txt", "zero\n"}, {"one.txt", "one\n"}], ["-p", c0])

    c2 = commit(path, [{"f.txt", "zero\n"}, {"two.txt", "two\n"}], ["-p", c1])

    c3 = commit(path, [{"f.txt", "zero\n"}, {"three.txt", "three\n"}], ["-p", c2])

    side = commit(path, [{"f.txt", "zero\n"}, {"side.txt", "side\n"}], ["-p", c0])

    {_output, 0} = Repos.git(path, ["update-ref", "refs/heads/main", c3])

    {_output, 0} = Repos.git(path, ["update-ref", "refs/heads/side", side])

    %{path: path, c0: c0, c1: c1, c2: c2, c3: c3, side: side}

  end

  defp commit(path, files, parents) do

    listing =

      files

      |> Enum.map(fn {name, content} -> "100644 blob #{blob(path, content)}\t#{name}\n" end)

      |> Enum.join()

    {tree, 0} = plumb(path, ["mktree"], listing)

    {sha, 0} =

      plumb(path, ["commit-tree", String.trim(tree)] ++ parents, "commit #{listing}",

        env: [

          {"GIT_AUTHOR_NAME", "Release Test"},

          {"GIT_AUTHOR_EMAIL", "release@example.test"},

          {"GIT_AUTHOR_DATE", "2026-01-01T00:00:00Z"},

          {"GIT_COMMITTER_NAME", "Release Test"},

          {"GIT_COMMITTER_EMAIL", "release@example.test"},

          {"GIT_COMMITTER_DATE", "2026-01-01T00:00:00Z"}

        ]

      )

    String.trim(sha)

  end

  defp blob(path, content) do

    {sha, 0} = plumb(path, ["hash-object", "-w", "--stdin"], content)

    String.trim(sha)

  end

  defp plumb(path, args, stdin, opts \\ []) do

    input = Path.join(System.tmp_dir!(), "plumb-#{System.unique_integer([:positive])}")

    File.write!(input, stdin)

    try do

      System.cmd(

        "sh",

        ["-c", ~s(exec git --git-dir "$GD" "$@" < "$IN"), "sh"] ++ args,

        env: [{"GD", path}, {"IN", input}] ++ Keyword.get(opts, :env, [])

      )

    after

      File.rm(input)

    end

  end

end