Guard git ref resolution against an empty revision

sha.startswith(rev) matched the first reference unconditionally when
rev was an empty string, returning a bogus branch/tag tuple for any
caller that passed in an uninitialised SHA. Return early when rev is
empty.

https://claude.ai/code/session_01KKvrvnVvsBChohuxbRRmzA

Author: claude

CHANGELOG.rst

@@ -4,6 +4,7 @@ Release 0.14.1 (unreleased)
 * Fix ``dfetch import`` mangling the namespace of a generic VCS URL whose path contains ``.git`` other than as a suffix
 * Fix ``Version`` comparison raising ``AttributeError`` when compared against a non-``Version`` object
 * Fix ``dfetch add`` matching a remote whose base URL is only a string prefix (not a path prefix) of the project URL
+* Fix git ref resolution spuriously matching the first reference for an empty revision
 
 Release 0.14.0 (released 2026-06-14)
 ===========================

dfetch/vcs/git.py

@@ -277,6 +277,8 @@ def _find_branch_tip_or_tag_from_sha(
     ) -> tuple[str, str]:
         """Check all branch tips and tags and see if the sha is one of them."""
         branch, tag = "", ""
+        if not rev:
+            return (branch, tag)
         for reference, sha in info.items():
             if sha.startswith(rev):  # Also allow for shorter SHA's
                 if reference.startswith("refs/tags/"):

tests/test_git_vcs.py

@@ -318,6 +318,15 @@ def test_ls_remote():
         assert info == expected
 
 
+def test_find_branch_tip_or_tag_from_sha_empty_rev_matches_nothing():
+    """An empty revision must not spuriously match the first reference."""
+    info = {
+        "refs/heads/master": "33d11e10699bae03ba2a58a280e92494f4fa0d82",
+        "refs/tags/v1.0": "0e3b216c7ab365b67765e94aeb45085c4db029e0",
+    }
+    assert GitRemote._find_branch_tip_or_tag_from_sha(info, "") == ("", "")
+
+
 @pytest.mark.parametrize(
     "name, env_ssh, git_config_ssh, expected",
     [