[slimsag]

That won't help you very much. There's no guarantee the commit belongs to the named repository with e.g. raw links[0].

[0] https://twitter.com/slimsag/status/1672421999698903043

[faangsticle]

Of course it will, since you'll either get the commit you wanted at the time you wrote the script, or an error.

[bqmjjx0kac]

Unless someone is very good at finding SHA1 collisions.

[NhanH]

The collisions need to deliver malicious payload as well, making it extra hard

[manwe150]

Those are still very hard to get for a random hash, and GitHub I think warns (or blocks?) you if you try to push a hash with a known vulnerability.

[glandium]

If you clone the repo, it won't be there.