fix: Don't report check to invalid sha

[russtaylor]

This fixes #460, where a failed git checkout (because of a missing ref, network, or auth issues) would cause a failure to be posted to GitHub for the wrong sha. Most often the last successfully built sha. This can cause confusion when one or more checks was reported as passing only to be unexpectedly changed to failing for an unrelated reason. It looks for cases where the git build data doesn't match the current build and returning an empty string for the sha if that's the case. Otherwise the behavior should remain the same.

Testing done

I added a new test to cover this case and I've tested it both with a manual repro in a sandbox environment and in a production environment (we run approximately 100k PR checks through this plugin on an average day) to confirm that it's working as expected when build failures occur before or during checkout.

Prior to this fix - a failure during git checkout, in this case because of a nonexistent ref, would report the failure to the previous successful sha:

> gh api "repos/$ORG/$REPO/commits/$SHA/check-runs?filter=all" | jq
'.check_runs[] | {name, head_sha, status, conclusion, completed_at}'
{
  "name": "gh-checks-plugin-fix-test",
  "head_sha": "71a1cc8f8b956b11b12036b8687acd7a5fafa868",
  "status": "completed",
  "conclusion": "failure",
  "completed_at": "2026-02-18T15:49:53Z"
}
{
  "name": "gh-checks-plugin-fix-test",
  "head_sha": "71a1cc8f8b956b11b12036b8687acd7a5fafa868",
  "status": "completed",
  "conclusion": "success",
  "completed_at": "2026-02-18T15:48:46Z"
}

And with the fix, the build skipped reporting the failure to the wrong sha:

> gh api "repos/$ORG/$REPO/commits/$SHA/check-runs?filter=all" | jq
'.check_runs[] | {name, head_sha, status, conclusion, completed_at}'
{
  "name": "gh-checks-plugin-fix-test",
  "head_sha": "5dd2fbbbf2d102e0bb72f1ab76e5c00b8b29cf2e",
  "status": "completed",
  "conclusion": "success",
  "completed_at": "2026-02-18T15:58:32Z"
}

The main caveat with this is that we use Freestyle jobs, not Pipeline jobs, so I'm relying on the existing test case to ensure it's still working as expected for pipelines.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[russtaylor]

Seeing more failures coming in - I'll work on fixing them later today!

[timja]

LGTM, tests look sensible

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.64%. Comparing base (803edab) to head (a5e8238).
⚠️ Report is 109 commits behind head on master.

Files with missing lines	Patch %	Lines
...ins/plugins/checks/github/GitSCMChecksContext.java	50.00%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #515      +/-   ##
============================================
- Coverage     71.80%   71.64%   -0.17%     
- Complexity      162      163       +1     
============================================
  Files            16       16              
  Lines           532      536       +4     
  Branches         51       53       +2     
============================================
+ Hits            382      384       +2     
  Misses          124      124              
- Partials         26       28       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.