fix(init): only accept an object ID as the resolved revision

A malformed HEAD or loose ref was copied into the zcompdump metadata as
though it had resolved, so a corrupt file could make #omz revision:
differ from git rev-parse HEAD instead of taking the fallback.

Fold the three resolution paths into one exit and check the result is a
40 or 64 character hex object ID, so symbolic refs, malformed files and
missed packed entries all fall through to git.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

oh-my-zsh.sh

@@ -110,9 +110,62 @@ if [[ -z "$ZSH_COMPDUMP" ]]; then
   ZSH_COMPDUMP="${ZDOTDIR:-$HOME}/.zcompdump-${SHORT_HOST}-${ZSH_VERSION}"
 fi
 
-# Construct zcompdump OMZ metadata
-zcompdump_revision="#omz revision: $(builtin cd -q "$ZSH"; git rev-parse HEAD 2>/dev/null)"
+# Resolve the commit $ZSH is checked out at into $REPLY by reading the git
+# directory, so that no git process is forked on every startup.
+# Handles .git files (worktrees, submodules), worktree common dirs, detached
+# HEADs and packed refs. Returns 1 if anything is unexpected.
+_omz_git_head() {
+  local gitdir="$ZSH/.git" common head ref
+  local -a lines
+  REPLY=
+
+  # .git may be a file pointing at the real git dir
+  if [[ -f "$gitdir" ]]; then
+    read -r head 2>/dev/null < "$gitdir" || return 1
+    gitdir="${head#gitdir: }"
+    [[ "$gitdir" = /* ]] || gitdir="$ZSH/$gitdir"
+  fi
+
+  # worktrees keep their refs in the common git dir
+  common="$gitdir"
+  if [[ -f "$gitdir/commondir" ]]; then
+    read -r common 2>/dev/null < "$gitdir/commondir" || return 1
+    [[ "$common" = /* ]] || common="$gitdir/$common"
+  fi
+
+  [[ -r "$gitdir/HEAD" ]] || return 1
+  read -r head 2>/dev/null < "$gitdir/HEAD" || return 1
+
+  if [[ "$head" = ref:\ * ]]; then
+    ref="${head#ref: }"
+    if [[ -r "$common/$ref" ]]; then
+      read -r REPLY 2>/dev/null < "$common/$ref" || return 1
+    elif [[ -r "$common/packed-refs" ]]; then
+      lines=("${(@f)$(<"$common/packed-refs")}")
+      REPLY="${lines[(r)* ${(b)ref}]%% *}"
+    else
+      return 1
+    fi
+  else
+    # detached HEAD: the file holds the commit itself
+    REPLY="$head"
+  fi
+
+  # only an object ID is a usable answer: a symbolic ref, a malformed file or
+  # a missed packed entry all fall through to the git fallback instead
+  [[ -n "$REPLY" && -z "${REPLY//[0-9a-f]/}" ]] \
+    && (( ${#REPLY} == 40 || ${#REPLY} == 64 ))
+}
+
+# Construct zcompdump OMZ metadata. The helper reports through $REPLY, so
+# call it in a scope that keeps that out of the global namespace.
+() {
+  local REPLY
+  _omz_git_head || REPLY="$(builtin cd -q "$ZSH"; git rev-parse HEAD 2>/dev/null)"
+  typeset -g zcompdump_revision="#omz revision: $REPLY"
+}
 zcompdump_fpath="#omz fpath: $fpath"
+unset -f _omz_git_head
 
 # Delete the zcompdump file if OMZ zcompdump metadata changed
 if ! command grep -q -Fx "$zcompdump_revision" "$ZSH_COMPDUMP" 2>/dev/null \

plugins/git/git.plugin.zsh

@@ -1,25 +1,6 @@
 # Git version checking
 autoload -Uz is-at-least
-# Running `git version` forks on every startup, so cache the result for a day
-# in $ZSH_CACHE_DIR, keyed on the git command path, mtime, and exec path.
-() {
-  local cache="$ZSH_CACHE_DIR/git-version" key exec_path
-  local -a stat lines
-  zmodload -F zsh/stat b:zstat
-  zstat -A stat +mtime -- "$commands[git]" 2>/dev/null
-  exec_path="$(git --exec-path 2>/dev/null)"
-  key="$commands[git] $stat[1] $exec_path"
-
-  lines=("$cache"(Nm-1))
-  (( $#lines )) && lines=("${(@f)$(<"$cache")}")
-  if [[ "$lines[1]" = "$key" ]]; then
-    git_version="$lines[2]"
-    return
-  fi
-
-  git_version="${${(As: :)$(git version 2>/dev/null)}[3]}"
-  [[ ! -w "$ZSH_CACHE_DIR" ]] || print -rl -- "$key" "$git_version" >| "$cache"
-}
+git_version="${${(As: :)$(git version 2>/dev/null)}[3]}"
 
 #
 # Functions Current