fix(releases): handle partial SHAs correctly in commit resolution (#2734)

Fixes commit resolution failures that caused "Unable to fetch commits"
errors in Sentry when using partial SHAs with `sentry-cli releases
set-commits`.
- Partial SHAs like `f915d32` are now passed to the API without padding,
allowing single partial SHAs and ranges of partial SHAs to be
successfully associated with a release.
- Ensures SHAs are >=64 chars long, same as the backend (no validation
for minimum length or hexademical).
- Drop support for specifying commits via branch names (an undocumented
feature that relied on the repo being checked out locally).

Fixes #2064 
Fixes CLI-55
Fixes REPLAY-413

Before (commit associations with partial SHAs fail, as denoted by the
lack of profile pic for the top 2 releases where I used partial SHAs):
<img width="1220" height="425" alt="Screenshot 2025-09-15 at 5 00 46 PM"
src="https://github.com/user-attachments/assets/341864a0-a738-40e8-823c-67cc22498588"
/>

After (commit associations with partial SHAs now work; note the profile
pics for the top 2 releases are now present):
<img width="1220" height="425" alt="Screenshot 2025-09-15 at 5 11 59 PM"
src="https://github.com/user-attachments/assets/eded5a15-5dc0-4579-a122-1c9ddea734b4"
/>

---------

Co-authored-by: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com>

Author: 2 people

src/commands/releases/set_commits.rs

@@ -5,8 +5,9 @@ use clap::{Arg, ArgAction, ArgMatches, Command};
 use lazy_static::lazy_static;
 use regex::Regex;
 
-use crate::api::{Api, NewRelease, NoneReleaseInfo, OptionalReleaseInfo, UpdatedRelease};
+use crate::api::{Api, NewRelease, NoneReleaseInfo, OptionalReleaseInfo, Ref, UpdatedRelease};
 use crate::config::Config;
+use crate::constants::MAX_COMMIT_SHA_LENGTH;
 use crate::utils::args::ArgExt as _;
 use crate::utils::formatting::Table;
 use crate::utils::vcs::{
@@ -53,19 +54,16 @@ pub fn make_command(command: Command) -> Command {
             .short('c')
             .value_name("SPEC")
             .action(ArgAction::Append)
-            .help("Defines a single commit for a repo as \
+            .help(format!("Defines a single commit for a repo as \
                     identified by the repo name in the remote Sentry config. \
-                    If no commit has been specified sentry-cli will attempt \
-                    to auto discover that repository in the local git repo \
-                    and then use the HEAD commit.  This will either use the \
-                    current git repository or attempt to auto discover a \
-                    submodule with a compatible URL.\n\n\
-                    The value can be provided as `REPO` in which case sentry-cli \
-                    will auto-discover the commit based on reachable repositories. \
-                    Alternatively it can be provided as `REPO#PATH` in which case \
-                    the current commit of the repository at the given PATH is \
-                    assumed.  To override the revision `@REV` can be appended \
-                    which will force the revision to a certain value."))
+                    The value must be provided as `REPO@SHA` where SHA is \
+                    at most {MAX_COMMIT_SHA_LENGTH} characters. To specify a range, use `REPO@PREV_SHA..SHA` \
+                    format.\n\n\
+                    Note: You must specify a previous commit when setting commits for the first release.\n\n\
+                    Examples:\
+                    \n  - `my-repo@abc123` (partial SHA)\
+                    \n  - `my-repo@62aaca3ed186edc7671b4cca0ab6ec53cb7de8b5` (full SHA)\
+                    \n  - `my-repo@abc123..def456` (commit range)")))
         // Legacy flag that has no effect, left hidden for backward compatibility
         .arg(Arg::new("ignore-empty")
             .long("ignore-empty")
@@ -83,14 +81,14 @@ fn strip_sha(sha: &str) -> &str {
         sha
     }
 }
+
 pub fn execute(matches: &ArgMatches) -> Result<()> {
     let config = Config::current();
     let api = Api::current();
     let authenticated_api = api.authenticated()?;
     let version = matches.get_one::<String>("version").unwrap();
     let org = config.get_org(matches)?;
     let repos = authenticated_api.list_organization_repos(&org)?;
-    let mut commit_specs = vec![];
 
     let heads = if repos.is_empty() {
         None
@@ -105,30 +103,49 @@ pub fn execute(matches: &ArgMatches) -> Result<()> {
         Some(vec![])
     } else if matches.get_flag("local") {
         None
-    } else {
-        if let Some(commits) = matches.get_many::<String>("commits") {
-            for spec in commits {
-                let commit_spec = CommitSpec::parse(spec)?;
-                if repos
-                    .iter()
-                    .any(|r| r.name.to_lowercase() == commit_spec.repo.to_lowercase())
-                {
-                    commit_specs.push(commit_spec);
-                } else {
-                    bail!("Unknown repo '{}'", commit_spec.repo);
+    } else if let Some(commits) = matches.get_many::<String>("commits") {
+        let mut refs = vec![];
+        for spec in commits {
+            let commit_spec = CommitSpec::parse(spec)?;
+
+            if !repos
+                .iter()
+                .any(|r| r.name.to_lowercase() == commit_spec.repo.to_lowercase())
+            {
+                bail!("Unknown repo '{}'", commit_spec.repo);
+            }
+
+            if commit_spec.rev.len() > MAX_COMMIT_SHA_LENGTH {
+                bail!(
+                    "Invalid commit SHA '{}'. Commit SHAs must be {} characters or less.",
+                    commit_spec.rev,
+                    MAX_COMMIT_SHA_LENGTH
+                );
+            }
+
+            if let Some(ref prev_rev) = commit_spec.prev_rev {
+                if prev_rev.len() > MAX_COMMIT_SHA_LENGTH {
+                    bail!(
+                        "Invalid previous commit SHA '{}'. Commit SHAs must be {} characters or less.",
+                        prev_rev,
+                        MAX_COMMIT_SHA_LENGTH
+                    );
                 }
             }
+
+            refs.push(Ref {
+                repo: commit_spec.repo,
+                rev: commit_spec.rev,
+                prev_rev: commit_spec.prev_rev,
+            });
         }
-        let commits = find_heads(
-            Some(commit_specs),
-            &repos,
-            Some(config.get_cached_vcs_remote()),
-        )?;
-        if commits.is_empty() {
+        if refs.is_empty() {
             None
         } else {
-            Some(commits)
+            Some(refs)
         }
+    } else {
+        None
     };
 
     // make sure the release exists if projects are given

src/constants.rs

@@ -47,5 +47,7 @@ pub const DEFAULT_MAX_DIF_ITEM_SIZE: u64 = 1024 * 1024; // 1MB
 pub const DEFAULT_MAX_DIF_UPLOAD_SIZE: u64 = 35 * 1024 * 1024; // 35MB
 /// Default maximum time to wait for file assembly.
 pub const DEFAULT_MAX_WAIT: Duration = Duration::from_secs(5 * 60);
+/// Maximum length for commit SHA values, enforced in backend.
+pub const MAX_COMMIT_SHA_LENGTH: usize = 64;
 
 include!(concat!(env!("OUT_DIR"), "/constants.gen.rs"));