Fix scans of shallow clones such as those made by GitHub Actions

[tarkatronic]

To help us get this pull request reviewed and merged quickly, please be sure to include the following items:

• Tests (if applicable)
• Documentation (if applicable)
• Changelog entry
• A full explanation here in the PR description of the work done

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• CI related changes
• Documentation content changes
• Tests
• Other

Backward Compatibility

Is this change backward compatible with the most recently released version? Does it introduce changes which might change the user experience in any way? Does it alter the API in any way?

• Yes (backward compatible)
• No (breaking changes)

Issue Linking

Fixes #209

What's new?

This slightly changes the way we gather branches and commits so that we can more easily detect when we are in a scenario where there is no history or local branches. When that scenario is detected, we examine the entire current contents of the repository (the HEAD) as though it were a single commit.

In most cases, this code will never be encountered nor run. The primary thing this enables is for tartufo to run natively in an environment created by the actions/checkout GitHub Action. Specifically, an environment with a max-depth=1 meaning no cloned history, and also no local refs or branches, with a detached HEAD.

At this point in time, a few tests still need to be updated, but I wanted to open this PR to show my work so far and get more eyes on it to make sure I'm not missing any obviously glaring points.

[rbailey-godaddy]

Looks good to me.

Out of morbid curiosity, what is the effective difference between this (presumably a scan-local-repo) and scan-folder on the working directory? Probably just that we've instantiated the wrong scanner class by the time you realize this and can't change tracks. ;-)

[tarkatronic]

Looks good to me.

Out of morbid curiosity, what is the effective difference between this (presumably a scan-local-repo) and scan-folder on the working directory? Probably just that we've instantiated the wrong scanner class by the time you realize this and can't change tracks. ;-)

Yeah, I hadn't thought about that, but realistically they're about the same thing. Although the scan-folder would also scan the .git folder and anything listed in the .gitignore, whereas this would not scan either.

Good callout!

[sushantmimani]

LGTM 🦅