fn short_sha(sha: &str) -> &str
Twelve hex digits is what GitHub renders and what a reviewer scans; upstream payloads carry the full 40.