Treat a missing notes ref as no attestations

[arpitjain099]

Fixes #435.

A repository that has never been attested has no refs/notes/commits, and the fetch for it fails with go-git's "couldn't find remote ref". Both GetRevisionVSA and GetRevisionProvenance turn that into a hard error, so status and the attest flow refuse to run on a fresh repository, and the genesis attestation that would create the ref can never be written. The workaround in the issue is to seed the ref by hand.

Both call sites now treat that specific failure as an empty attestation set, which is what it means, and stop retrying it, since sleeping between attempts cannot make a ref appear.

One wrinkle worth flagging. errors.Is alone is not enough here. The collector reaches the notes ref through vcslocator.CopyFileGroup, which collects per-locator failures into a vcslocator.ErrorList. That type implements Error() but not Unwrap, so the go-git error is not reachable through the chain on that path and only the rendered message survives. The check does the typed comparison first and falls back to the message, and the test covers both shapes plus an unrelated failure that must still be reported. If ErrorList grows an Unwrap() []error upstream, the string half can go.

go test ./pkg/... passes.

[puerco]

Thanks for the fix @arpitjain099 while I've confirmed that the bug is real, it is coming from the collector upstream and it is affecting other projects that collect attestations from git notes. I'll fix it there and pull the fixed release.

[arpitjain099]

Makes sense, upstream is the better place for it. Happy to close this whenever you have the release pinned, or leave it as a stopgap, your call.

One detail worth carrying over: errors.Is on its own will not catch this on the CopyFileGroup path. vcslocator.ErrorList implements Error() but not Unwrap() []error, so go-git's NoMatchingRefSpecError is not reachable through the chain there and only the rendered message survives. That is why the check here has a message fallback. Adding Unwrap to ErrorList would make the typed check work for every consumer.