Fix SHA validation in create_or_update_file

[almaleksia]

Summary

We incorrectly return SHA mismatch for correct updates.

Changes:

1. sha is required for existing file updates
2. drop usage of HEAD + Etag and PUT with If-none-match header - we cannot use this approach
3. sha is taken from the metadata returned by Contents API

Why

Fixes #2133

What changed

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

Prompts tested (tool changes only)

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed
• Updated (README / docs / examples)

[almaleksia]

removing blind update completely

[SamMorrowDrums]

I think it's fair to accept the errors, thought this is probably the most controversial change.

[almaleksia]

I decided if GitHub API requires sha for updates who are we to make it optional :D

[SamMorrowDrums]

Well, I think it's fine to make agent fail, but I don't think it's wrong either way, just different trade-offs.

You still retain a git record of what you changed, so it might be surprising to update a file that has changed since you last checked, but you can at least still work out what happened.

The concern for me was always concurrent updates from different agents and then thinking independently that two things were done, but actually only one was because the other overwrites it. That's not great, and I think it's ok for us to not allow that by accident.

[Copilot]

Pull request overview

Fixes incorrect SHA validation in the create_or_update_file tool by switching from HEAD/ETag-based checks to using the GitHub Contents API’s returned blob SHA, and updates the tool’s behavior/docs accordingly.

Changes:

• Replace conditional HEAD/ETag SHA validation with Contents API metadata (.sha) lookups.
• Require sha when updating an existing file (reject blind overwrites).
• Update unit tests and tool schema snapshot to reflect the new behavior and guidance.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
pkg/github/repositories.go	Reworks create_or_update_file SHA validation/existence checks and updates user-facing guidance.
pkg/github/repositories_test.go	Updates test cases to mock Contents API GET behavior and assert new validation outcomes.
pkg/github/__toolsnaps__/create_or_update_file.snap	Updates tool description/schema snapshot to match new guidance and behavior.

[SamMorrowDrums]

All makes sense.