v0.1.1

A bug fix release. Upgrade with pip install -U substantiate.

Fixed

Fabricated commit SHAs using no digits were not detected. A full-length hex string such as deadbeefdeadbeefdeadbeefdeadbeefdeadbeef was not extracted as a claim at all, so a report citing an invented commit of that shape passed without comment.

The rule that dropped it — a SHA must mix digits and letters — is correct for an abbreviated SHA, where accede and deadbeef are English words and 20190808 is a date. At full length no such ambiguity exists: no word is forty hex characters. And this was the case that mattered most, since a fabricated report reaching for a plausible commit reaches for deadbeef far more often than for a random mix.

Only the digit requirement is lifted, and only at full length. Forty digits is still not a commit, and abbreviated hex words are still rejected.

Also

The test fixture now commits with a fixed identity and timestamp, so its SHA is reproducible. It was random per build, and a test reading it was quietly betting that a twelve-character prefix would contain a hex letter — which failed one CI job in nine.

Known gaps

• #3 — constants assembled by token pasting cannot be resolved without preprocessing
• #4 — tree-sitter drops enum constants near multi-line deprecation macros

Full changelog: v0.1.0...v0.1.1