fix: resolve clone failure when HEAD file exists in repository (#13)

add -- separator to git show commands to prevent command injection

Author: l-qing

image/git-init/git/git.go

@@ -185,7 +185,7 @@ func Fetch(logger *zap.SugaredLogger, spec FetchSpec) error {
 		return fmt.Errorf("error parsing %s after fetching refspec %s", checkoutParam, spec.Refspec)
 	}
 
-	if _, err := run(logger, "", "checkout", "-f", checkoutParam); err != nil {
+	if _, err := run(logger, "", "checkout", "-f", checkoutParam, "--"); err != nil {
 		return err
 	}
 
@@ -208,15 +208,15 @@ func Fetch(logger *zap.SugaredLogger, spec FetchSpec) error {
 
 // ShowCommit calls "git show ..." to get the commit SHA for the given revision
 func ShowCommit(logger *zap.SugaredLogger, revision, path string) (string, error) {
-	output, err := run(logger, path, "show", "-q", "--pretty=format:%H", revision)
+	output, err := run(logger, path, "show", "-q", "--pretty=format:%H", revision, "--")
 	if err != nil {
 		return "", err
 	}
 	return strings.TrimSuffix(output, "\n"), nil
 }
 
 func showRef(logger *zap.SugaredLogger, revision, path string) (string, error) {
-	output, err := run(logger, path, "show", "-q", "--pretty=format:%D", revision)
+	output, err := run(logger, path, "show", "-q", "--pretty=format:%D", revision, "--")
 	if err != nil {
 		return "", err
 	}