Accept SHA-256 Git object IDs in corpus workflows

[abhinavgautam01]

Closes #33

Summary

• accept full 40-character SHA-1 and 64-character SHA-256 object IDs in the CI corpus workflow
• update the corpus refresh workflow to validate both object ID formats
• update corpusgen to support SHA-256 commit IDs
• add tests covering valid SHA-1 and SHA-256 IDs, invalid lengths and non-hexadecimal values

Testing

• go build -v ./...
• go test -v -race ./...
• go vet ./...
• golangci-lint run
• actionlint .github/workflows/ci.yml .github/workflows/refresh-corpus.yml
• verified that the regenerated corpus matches the tracked corpus
• verified exact ScanCode conformance: 1,535/1,786 passed (85.95%), matching the existing baseline

[Copilot]

Pull request overview

This PR updates the corpus workflows and corpusgen to accept both 40-character SHA-1 and 64-character SHA-256 Git object IDs, addressing failures when running against SHA-256 repositories (Closes #33).

Changes:

• Update corpusgen’s CORPUS_VERSION parsing to accept 40- and 64-character commit/object IDs.
• Expand GitHub Actions workflow validation to allow both object ID lengths.
• Add tests covering valid SHA-1/SHA-256 IDs and invalid formats.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
cmd/corpusgen/main.go	Accepts 40- or 64-character object IDs and validates via hex decoding.
cmd/corpusgen/main_test.go	Adds coverage for SHA-1/SHA-256 lengths and invalid commit IDs.
.github/workflows/refresh-corpus.yml	Updates commit/pinned commit validation to accept 40 or 64 characters.
.github/workflows/ci.yml	Updates pinned commit validation to accept 40 or 64 characters.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[andrew]

The new uppercase validation path is incomplete. Both workflows and readSourceVersion accept uppercase object IDs, while verifyCheckout compares the value byte-for-byte with the lowercase output from git rev-parse HEAD. Running corpusgen with the uppercase spelling of the checked-out commit returns a commit mismatch. Please normalize parsed IDs to lowercase before verification and storage, or restrict validation and tests to lowercase, and cover the chosen behavior through run.

[abhinavgautam01]

Thanks, Fixed
uppercase object IDs are now normalized to lowercase before workflow comparison, checkout verification and corpus storage. Added run coverage for both SHA-1 and SHA-256 repositories; the full race and lint suites pass.

[andrew]

Thanks, the normalization and run coverage address the earlier review.