DX Audit app / github
demo
observation github:branch-creation-two-calls

Low-level branch creation composed a ref lookup and ref creation

Creating a branch through the Git data REST API used two documented operations: GET /repos/{owner}/{repo}/git/ref/heads/main to resolve the source commit SHA, then POST /repos/{owner}/{repo}/git/refs with the full refs/heads/ prefix and that SHA. Both models executed the sequence correctly on the first attempt. Resolving an exact object before mutating a ref is deliberate low-level API composition, not a failed or recovery path. A higher-level endpoint accepting a branch name and source branch could be a convenience, but the audit measured only one additional deterministic read and no task failure.

How can I reproduce this?

Requires: GitHub PAT with repo contents access and a test repository

  1. Attempt a single-call branch creation: POST /repos/{owner}/{repo}/git/refs with { "ref": "refs/heads/test", "sha": "main" }.
  2. Try a higher-level endpoint: POST /repos/{owner}/{repo}/branches.
  3. Use the two-call path: GET /repos/{owner}/{repo}/git/ref/heads/main for the HEAD SHA, then POST /repos/{owner}/{repo}/git/refs with the full refs/heads/ prefix and the 40-character SHA.

Expected: The symbolic ref returns 422 "At least 40 characters are required; only 4 were supplied"; POST .../branches returns 404 (no such endpoint); the documented Git data path succeeds after resolving the source SHA. GraphQL createRef likewise accepts a resolved GitObjectID.

Evidence · transcript moments

Opus Audit run

Sonnet Audit run