Matthieu Moy [off-list ref] writes:
Ideally, you would check the list of commits displayed too. If the
commits sha1 are stable, this should be easy to do. If it's too hard to
test, I'd say its not worth the trouble, but others may disagree.
Originally I chose not to check if the SHA-1 were corrects since
check_commits was called right after expand_todo_ids and I thought
that expand_todo_ids checked them, but from what I understand, it
doesn't seem to check if the SHA-1 are commits, I could be wrong
though.
Rémi