Function _git_diff_range

plugins/security-guidance/hooks/gitutil.py:193–210

`git diff -p base head` as text on success, None on error. Distinguishing failure from success-with-empty-diff matters: the push-sweep caller marks the tail reviewed when the diff is empty (nothing to review), but on failure (timeout, non-zero exit, missing git) it must NOT mark the

(repo_root, base, head="HEAD")

def _git_diff_range(repo_root, base, head="HEAD"):
    """`git diff -p base head` as text on success, None on error.

    Distinguishing failure from success-with-empty-diff matters: the push-sweep
    caller marks the tail reviewed when the diff is empty (nothing to review),
    but on failure (timeout, non-zero exit, missing git) it must NOT mark
    them reviewed — otherwise unreviewed commits get permanently silenced.
    """
    try:
        r = subprocess.run(
            [*GIT_CMD, "diff", "-p", "--no-color", "--no-ext-diff", base, head],
            cwd=repo_root, capture_output=True, timeout=30,
        )
        if r.returncode != 0:
            return None
        return r.stdout.decode("utf-8", errors="replace")
    except (subprocess.TimeoutExpired, FileNotFoundError, OSError):
        return None


def _detect_main_branch(repo_root):