Replace ref with absolute git commit in output source_info

src/cve/data_models/input.py

@@ -39,6 +39,7 @@ class SourceDocumentsInfo(HashableModel):
     - type: document type.
     - git_repo: git repo URL where the source documents can be cloned.
     - ref: git reference, such as tag/branch/commit_id
+    - commit: git commit hash
     - include: file extensions to include when indexing the source documents.
     - exclude: file extensions to exclude when indexing the source documents.
     """
@@ -48,6 +49,7 @@ class SourceDocumentsInfo(HashableModel):
     git_repo: typing.Annotated[str, Field(min_length=1)]
     ref: typing.Annotated[str, Field(min_length=1, validation_alias=AliasChoices(
         "ref", "tag"))]  # Support "tag" as alias for backward compatibility
+    commit: str | None = None
 
     include: list[str] = ["*.py", "*.ipynb"]
     exclude: list[str] = []

src/cve/pipeline/input.py

@@ -49,6 +49,7 @@
 from ..stages.pydantic_http_stage import PydanticHttpStage
 from ..utils.document_embedding import DocumentEmbedding
 from ..utils.embedding_loader import EmbeddingLoader
+from ..utils.git_utils import get_commit_hash
 from ..utils.intel_retriever import IntelRetriever
 from ..utils.vulnerable_dependency_checker import VulnerableDependencyChecker
 
@@ -172,6 +173,18 @@ def emit_input_object(subscription: mrc.Subscription) -> typing.Generator[AgentM
 
     pipe.add_stage(build_vdb_stage)
 
+    @stage
+    def add_git_commits(
+            message: AgentMorpheusEngineInput) -> AgentMorpheusEngineInput:
+
+        source_infos = message.input.image.source_info
+        for si in source_infos:
+            si.commit = get_commit_hash(run_config.general.base_git_dir,
+                                        si.git_repo)
+        return message
+
+    pipe.add_stage(add_git_commits(config))
+
     @stage
     def fetch_intel(message: AgentMorpheusEngineInput) -> AgentMorpheusEngineInput:
 

src/cve/utils/git_utils.py

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import logging
+import os
+
+from pathlib import Path
+from pathlib import PurePath
+
+from git import Repo
+
+logger = logging.getLogger(__name__)
+
+
+def get_commit_hash(base_dir: str, git_repo: str = ".git") -> str | None:
+    """
+    Utility function for getting commit hash of Git repo.
+
+    Parameters
+    ----------
+    base_dir : str
+        Path to base directory containing one or more Git repos
+    git_repo : str
+        Relative path to Git repo with base_dir, default is ".git"
+
+    Returns
+    -------
+    str
+        Commit hash of Git repo
+    """
+    commit_hash: str | None = None
+    repo_path = base_dir / PurePath(git_repo)
+    repo_path = Path(repo_path)
+    if os.path.exists(repo_path):
+        repo = Repo(repo_path)
+        commit_hash = repo.commit().hexsha
+
+    return commit_hash