Revert "[INS-397] Fix git version parser panic on non-numeric patch versions"

[trufflesteeeve]

Reverts #4882

This is a good change overall, but there are a lot of downstream dependency effects that we're running into. So we're going to revert for now and take another pass at this.

---

Note

Medium Risk
Changes the git binary/version validation used by multiple sources and removes the previously-tested parser, which could reintroduce parsing/compatibility issues across environments with nonstandard git --version output.

Overview
Reverts the shared pkg/gitcmd git version parsing helper (and its unit tests) and replaces call sites to use a new git.CmdCheck() under pkg/sources/git.

Adds a separate, detector-local gitCmdCheck() in the Azure APIM repository key verifier, and updates Git/GitHub/GitLab/HuggingFace sources to call the new check before running git commands.

^{Reviewed by Cursor Bugbot for commit f136645. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f136645. Configure here.}

[cursor]

Panic on non-numeric git patch versions re-introduced

High Severity

The regex \d+\.\d+\.\d+ requires three numeric dot-separated segments, but git built from source can report versions like 2.52.gaea8cc3 (non-numeric patch) or 2.20 (no patch). When the regex doesn't match, FindString returns "", then strings.Split("", ".") yields a single-element slice, and accessing versionParts[1] causes an index-out-of-range panic. The deleted pkg/gitcmd/gitcmd.go had fixed this with a (\d+)\.(\d+) regex and proper error handling.

Additional Locations (1)

• pkg/detectors/azureapimanagement/repositorykey/repositorykey.go#L114-L122

 

^{Reviewed by Cursor Bugbot for commit f136645. Configure here.}

[trufflesteeeve]

Bypassing rules because this is a revert, and there are time sensitive requirements.