From 20d37d280693b1646e3bd33ab3d8a0a947830a8e Mon Sep 17 00:00:00 2001
From: Aleksandr Nogikh <nogikh@google.com>
Date: Thu, 15 Jan 2026 16:27:44 +0100
Subject: pkg/vcs: be more strict in BaseForDiff

Do not tolerate unknown blob hashes - it means that we are unable to
find the correct base commit given the repository.
Explicitly ignore newly added files - we definitely won't find their
hashes.
Explicitly skip malformed patches that won't have any blob hashes -
otherwise we could end up with too many candidates and waste too much
time.
---
 pkg/vcs/git_test.go | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

(limited to 'pkg/vcs/git_test.go')

diff --git a/pkg/vcs/git_test.go b/pkg/vcs/git_test.go
index 5b5a3e14b..855587263 100644
--- a/pkg/vcs/git_test.go
+++ b/pkg/vcs/git_test.go
@@ -551,8 +551,8 @@ func TestBaseForDiff(t *testing.T) {
 		assert.Equal(t, commit4.Hash, base[0].Hash)
 		assert.Equal(t, commit2.Hash, base[1].Hash)
 	})
-	t.Run("ignore unknown objects", func(t *testing.T) {
-		// It's okay if the diff contains unknown hashes.
+	t.Run("unknown objects", func(t *testing.T) {
+		// It's not okay if the diff contains unknown hashes.
 		diff2 := `
 diff --git a/b.txt b/b.txt
 deleted file mode 100644
@@ -561,9 +561,36 @@ index f70f10e..0000000
 +++ /dev/null
 @@ -1 +0,0 @@
 -A`
+		twoDiffs := append(append([]byte{}, diff...), diff2...)
+		base, err := repo.repo.BaseForDiff(twoDiffs, &debugtracer.TestTracer{T: t})
+		require.NoError(t, err)
+		require.Nil(t, base)
+	})
+	t.Run("ignore new files", func(t *testing.T) {
+		diff2 := `
+diff --git a/a.txt b/a.txt
+new file mode 100644
+index 0000000..fa49b07
+--- /dev/null
++++ b/a.txt
+@@ -0,0 +1 @@
++new file
+diff --git a/a.txt b/a.txt
+index fa49b07..01c887f 100644
+--- a/a.txt
++++ b/a.txt
+@@ -1 +1 @@
+-new file
++edit file
+`
 		twoDiffs := append(append([]byte{}, diff...), diff2...)
 		base, err := repo.repo.BaseForDiff(twoDiffs, &debugtracer.TestTracer{T: t})
 		require.NoError(t, err)
 		require.Len(t, base, 2)
 	})
+	t.Run("empty patch", func(t *testing.T) {
+		base, err := repo.repo.BaseForDiff([]byte{}, &debugtracer.TestTracer{T: t})
+		require.NoError(t, err)
+		require.Nil(t, base)
+	})
 }
-- 
cgit mrf-deployment