[tooky]

kosli get trail (default table output) panics when a trail's git_commit_info is missing author, timestamp or message, or has them as null. The server already accepts such trails through PUT /api/v2/trails/{org}/{flow}, so this crash can happen today. This PR shows missing fields as N/A instead. Trails with full commit info display exactly as before.

What changed

• printTrailAsTable (cmd/kosli/getTrail.go) no longer uses unchecked type assertions (commitInfo["author"].(string) etc.).
  • Sha1, Author and message go through a new stringOrNA helper, which returns N/A for a missing, null or empty value.
  • The timestamp goes through the existing formattedTimestamp, which already returns N/A for nil.
  • The url row only appears when the URL is a non-empty string. Previously "url": null printed url: %!s(<nil>).
• The markdown Sha1, Author and Message cells now use stringOrNA too. Markdown didn't panic before, but it left blank cells; now both formats show N/A.
• Tests that need no server:
  • TestPrintTrailAsTableCommitInfo covers sha1 only, sha1 + branch, explicit nulls and full commit info, using regexps so it doesn't depend on tabwriter padding.
  • TestPrintTrailAsMarkdownPartialCommitInfo covers sha1-only and missing-sha1 commit info.

Known edge, out of scope: a commit with a url but no sha1 renders [N/A](url) in markdown. The server always sends a sha1.

Merge order

This PR doesn't depend on any server change. It should be released before kosli-dev/server#7994 (draft), which fixes kosli-dev/server#7988 by letting artifacts be reported with sha1-only commit info. A reported artifact creates its trail with the same commit info, so once #7994 ships, ordinary artifact reporting can produce trails that crash this command in CLIs without this fix.

Older CLIs are only partly exposed:

• Today's kosli attest artifact always sends sha1, author, message, branch and timestamp, so trails it creates stay complete.
• Partial commit info comes only from direct API clients and from kosli attest in-toto (feat: add kosli attest in-toto, recording attestations from bundle files #1362) when a bundle carries no commit metadata.
• Even then, only the table output crashes; markdown output was already safe.

Testing

• The new tests pass.
• I built the CLI at the base commit (e6ee2cc) and at 04ff10b and ran get trail against a local stub of the trails API serving sha1-only, all-null, no-author and full commit info. The base binary panics on sha1-only and no-author (interface conversion: interface {} is nil, not string, getTrail.go:372). The fixed binary prints N/A and exits 0, and full commit info renders unchanged.
• f31f718 (Sha1 N/A in markdown) is covered by the markdown test.

The two failing checks, license/snyk (kosli) and security/snyk (kosli), come from a Snyk project setup issue, not from this change. They aren't required on main.

[claude]

Claude finished @tooky's task in 1m 34s —— View job

---

Follow-up review (commits 04ff10b6..f31f718f, equivalent to the stated 110e9ca0..f31f718f range — the PR branch was rebased so the old SHAs aren't reachable, but the content matches)

• Fetch existing review comments/findings
• Diff and identify touched lines
• Evaluate status of each previous finding
• Check touched lines for new bugs/regressions
• Post summary comment

Previous findings — status:

1. Consistency nit (getTrail.go, markdown Author/Message showing "" instead of N/A) — already resolved prior to this push (commit shown as b1a199cf/84b2cec4). Thread is marked resolved on GitHub.
2. Test brittleness nit (getTrail_table_test.go, hard-coded tabwriter padding) — already resolved prior to this push (commit shown as be4078ca/04ff10b6). Thread is marked resolved on GitHub.

Both review threads were already closed/resolved before this push, so nothing needed closing here.

This push's change: getTrail.go:119 now uses mdCell(stringOrNA(commitInfo["sha1"])) instead of mdCell(commitInfo["sha1"]), closing the one remaining inconsistency (markdown Sha1 cell now shows N/A like Author/Message/Timestamp already did), plus a matching regression test (TestPrintTrailAsMarkdownPartialCommitInfo, missing-sha1 case).

New inline comments: 0. The change is a straightforward, correct extension of the existing stringOrNA pattern already used for Author/Message; the new test correctly asserts | Sha1 | N/A | for a commit with no sha1. No new bugs or regressions found in the touched lines.

Note: I was unable to run go test/go vet/golangci-lint in this environment (command execution required approval I don't have), so verification here is by code reading only. The logic is a direct copy of the already-tested stringOrNA usage pattern, so risk is low.
(branch)

[claude]

Follow-up review (commits 8921465b..be4078ca)

Both previous inline findings are resolved:

• Consistency nit (markdown Author/Message showing "" instead of N/A, getTrail.go:127-129) — resolved in b1a199cf: markdown now reuses stringOrNA for Author/Message, with regression test TestPrintTrailAsMarkdownPartialCommitInfo.
• Test brittleness nit (hard-coded tabwriter padding in getTrail_table_test.go) — resolved in be4078ca: assertions switched to require.Regexp with \s+ in place of fixed-width strings.

No new bugs or regressions found in the lines touched by these two commits — 0 new inline comments beyond the two resolution notes above.

[tooky]

Follow-up on the Sha1 consistency nit: done in 110e9ca. The markdown Sha1 cell now uses mdCell(stringOrNA(...)) too, so a missing sha1 shows N/A in both table and markdown output, and the markdown partial-commit test covers a missing sha1.

[mbevc1]

#1368 fixes Snyk tests

[mbevc1]

Left a small nit about n/a capitalisation, but looks good otherwise