sql-diff-explainer 0.1.3__tar.gz → 0.1.4__tar.gz

{sql_diff_explainer-0.1.3 → sql_diff_explainer-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sql-diff-explainer
-Version: 0.1.3
+Version: 0.1.4
 Summary: Explain SQL schema and migration differences
 Author: zmodz1010
 License: MIT
@@ -20,7 +20,7 @@ SQL Diff Explainer compares the structure of two `SELECT` queries and returns
 the changes with a static risk signal, so reviews focus on query behavior rather
 than formatting.
 
-[![PyPI version](https://img.shields.io/pypi/v/sql-diff-explainer)](https://pypi.org/project/sql-diff-explainer/)
+[![PyPI version](https://img.shields.io/pypi/v/sql-diff-explainer?cacheSeconds=60)](https://pypi.org/project/sql-diff-explainer/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://pypi.org/project/sql-diff-explainer/)
 [![License: MIT](https://img.shields.io/pypi/l/sql-diff-explainer)](LICENSE)
 
@@ -29,6 +29,7 @@ than formatting.
 - [Quick start](#quick-start)
 - [Command-line usage](#command-line-usage)
 - [Directory comparison](#directory-comparison)
+- [Git-aware pull-request comparison](#git-aware-pull-request-comparison)
 - [SARIF and HTML reports](#sarif-and-html-reports)
 - [What it compares](#what-it-compares)
 - [Use cases](#use-cases)
@@ -141,6 +142,59 @@ result = compare_sql_directories("models/main", "models/review")
 print(result.to_dict())
 ```
 
+### Git-aware pull-request comparison
+
+Compare SQL paths Git reports as changed between a base ref and the current
+worktree. Modified files and SQL-to-SQL renames are compared semantically;
+added or removed SQL files are reported explicitly as high risk. Untracked
+files are not included. The base can be a branch, tag, or commit:
+
+```console
+sql-diff-explainer --git-base origin/main --format json
+sql-diff-explainer --git-base "$GITHUB_BASE_REF" --format sarif --output sql-diff.sarif
+sql-diff-explainer --git-base origin/main --fail-on-risk high
+```
+
+For GitHub Actions, fetch the base history and use the pull request's base
+commit. This example checks out the pull-request worktree, installs this
+repository's source (so the CLI includes the feature), emits SARIF, and fails
+the job on high-risk changes:
+
+```yaml
+name: SQL review
+on:
+  pull_request:
+
+jobs:
+  sql-diff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install .
+      - name: Analyze changed SQL
+        run: >-
+          sql-diff-explainer
+          --git-base "${{ github.event.pull_request.base.sha }}"
+          --format sarif
+          --output sql-diff.sarif
+          --fail-on-risk high
+      - name: Upload SQL findings
+        if: always() && hashFiles('sql-diff.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: sql-diff.sarif
+```
+
+An unresolved base ref, Git failure, unreadable SQL, or invalid SQL exits with
+status `2` and a diagnostic. Renames appear in every report; a rename does not
+raise risk by itself, while semantic changes in its content retain their
+normal risk level.
+
 ### SARIF and HTML reports
 
 Emit SARIF 2.1.0 results for GitHub code scanning integrations, or generate a

{sql_diff_explainer-0.1.3 → sql_diff_explainer-0.1.4}/README.md

@@ -6,7 +6,7 @@ SQL Diff Explainer compares the structure of two `SELECT` queries and returns
 the changes with a static risk signal, so reviews focus on query behavior rather
 than formatting.
 
-[![PyPI version](https://img.shields.io/pypi/v/sql-diff-explainer)](https://pypi.org/project/sql-diff-explainer/)
+[![PyPI version](https://img.shields.io/pypi/v/sql-diff-explainer?cacheSeconds=60)](https://pypi.org/project/sql-diff-explainer/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://pypi.org/project/sql-diff-explainer/)
 [![License: MIT](https://img.shields.io/pypi/l/sql-diff-explainer)](LICENSE)
 
@@ -15,6 +15,7 @@ than formatting.
 - [Quick start](#quick-start)
 - [Command-line usage](#command-line-usage)
 - [Directory comparison](#directory-comparison)
+- [Git-aware pull-request comparison](#git-aware-pull-request-comparison)
 - [SARIF and HTML reports](#sarif-and-html-reports)
 - [What it compares](#what-it-compares)
 - [Use cases](#use-cases)
@@ -127,6 +128,59 @@ result = compare_sql_directories("models/main", "models/review")
 print(result.to_dict())
 ```
 
+### Git-aware pull-request comparison
+
+Compare SQL paths Git reports as changed between a base ref and the current
+worktree. Modified files and SQL-to-SQL renames are compared semantically;
+added or removed SQL files are reported explicitly as high risk. Untracked
+files are not included. The base can be a branch, tag, or commit:
+
+```console
+sql-diff-explainer --git-base origin/main --format json
+sql-diff-explainer --git-base "$GITHUB_BASE_REF" --format sarif --output sql-diff.sarif
+sql-diff-explainer --git-base origin/main --fail-on-risk high
+```
+
+For GitHub Actions, fetch the base history and use the pull request's base
+commit. This example checks out the pull-request worktree, installs this
+repository's source (so the CLI includes the feature), emits SARIF, and fails
+the job on high-risk changes:
+
+```yaml
+name: SQL review
+on:
+  pull_request:
+
+jobs:
+  sql-diff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install .
+      - name: Analyze changed SQL
+        run: >-
+          sql-diff-explainer
+          --git-base "${{ github.event.pull_request.base.sha }}"
+          --format sarif
+          --output sql-diff.sarif
+          --fail-on-risk high
+      - name: Upload SQL findings
+        if: always() && hashFiles('sql-diff.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: sql-diff.sarif
+```
+
+An unresolved base ref, Git failure, unreadable SQL, or invalid SQL exits with
+status `2` and a diagnostic. Renames appear in every report; a rename does not
+raise risk by itself, while semantic changes in its content retain their
+normal risk level.
+
 ### SARIF and HTML reports
 
 Emit SARIF 2.1.0 results for GitHub code scanning integrations, or generate a

{sql_diff_explainer-0.1.3 → sql_diff_explainer-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sql-diff-explainer"
-version = "0.1.3"
+version = "0.1.4"
 description = "Explain SQL schema and migration differences"
 readme = "README.md"
 requires-python = ">=3.10"

{sql_diff_explainer-0.1.3 → sql_diff_explainer-0.1.4}/src/sql_diff_explainer/__init__.py

@@ -11,6 +11,7 @@ from .core import (
     SQLParser,
     UnsupportedSQL,
     compare_sql_directories,
+    compare_sql_git,
     explain_diff,
     explain_sql_change,
 )
@@ -27,9 +28,10 @@ __all__ = [
     "SqlglotParser",
     "UnsupportedSQL",
     "compare_sql_directories",
+    "compare_sql_git",
     "explain_diff",
     "explain_sql_change",
     "render_html_report",
     "to_sarif",
 ]
-__version__ = "0.1.3"
+__version__ = "0.1.4"

{sql_diff_explainer-0.1.3 → sql_diff_explainer-0.1.4}/src/sql_diff_explainer/cli.py

@@ -10,6 +10,7 @@ from .core import (
     SQLDiffResult,
     SQLDirectoryDiffResult,
     compare_sql_directories,
+    compare_sql_git,
     explain_sql_change,
 )
 from .reports import render_html_report, to_sarif
@@ -31,6 +32,11 @@ def main() -> int:
         metavar=("BEFORE_DIR", "AFTER_DIR"),
         help="Recursively compare matching .sql files in two directories",
     )
+    parser.add_argument(
+        "--git-base",
+        metavar="REF",
+        help="Compare Git-reported .sql changes from REF to the current worktree",
+    )
     parser.add_argument("--dialect", help="sqlglot dialect used to parse both files")
     parser.add_argument(
         "--format",
@@ -47,13 +53,22 @@ def main() -> int:
     args = parser.parse_args()
 
     directory_mode = args.compare_dirs is not None
-    if directory_mode and (args.before is not None or args.after is not None):
-        parser.error("Use either --compare-dirs or the two SQL file arguments, not both")
-    if not directory_mode and (args.before is None or args.after is None):
-        parser.error("Provide two SQL files or use --compare-dirs BEFORE_DIR AFTER_DIR")
+    git_mode = args.git_base is not None
+    selected_modes = sum((directory_mode, git_mode))
+    if selected_modes and (args.before is not None or args.after is not None):
+        parser.error("Use only one of --git-base, --compare-dirs, or the two SQL file arguments")
+    if selected_modes > 1:
+        parser.error("Use either --git-base or --compare-dirs, not both")
+    if not selected_modes and (args.before is None or args.after is None):
+        parser.error(
+            "Provide two SQL files, use --compare-dirs BEFORE_DIR AFTER_DIR, or use --git-base REF"
+        )
 
     try:
-        if directory_mode:
+        if git_mode:
+            result = compare_sql_git(args.git_base, dialect=args.dialect)
+            report_path = ""
+        elif directory_mode:
             result: SQLDiffResult | SQLDirectoryDiffResult = compare_sql_directories(
                 args.compare_dirs[0],
                 args.compare_dirs[1],
@@ -87,6 +102,10 @@ def main() -> int:
             file_results = [(item.path, item.result) for item in result.files]
             lines.extend(f"Removed SQL file: {path}" for path in result.unmatched_before)
             lines.extend(f"Added SQL file: {path}" for path in result.unmatched_after)
+            lines.extend(
+                f"Renamed SQL file: {before} -> {after}"
+                for before, after in result.renamed_files
+            )
         for file_path, file_result in file_results:
             if file_path and file_result.changes:
                 lines.append(f"{file_path}:")
@@ -112,7 +131,7 @@ def main() -> int:
         bool(result.changes)
         if isinstance(result, SQLDiffResult)
         else any(item.result.changes for item in result.files)
-        or bool(result.unmatched_before or result.unmatched_after)
+        or bool(result.unmatched_before or result.unmatched_after or result.renamed_files)
     )
     if (
         args.fail_on_risk is not None

{sql_diff_explainer-0.1.3 → sql_diff_explainer-0.1.4}/src/sql_diff_explainer/core.py

@@ -2,11 +2,13 @@
 
 from __future__ import annotations
 
+import os
+import subprocess
 from abc import ABC, abstractmethod
 from collections import Counter
 from dataclasses import dataclass, field
 from difflib import unified_diff
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from typing import Any
 
 
@@ -122,6 +124,7 @@ class SQLDirectoryDiffResult:
     files: list[SQLFileDiff] = field(default_factory=list)
     unmatched_before: list[str] = field(default_factory=list)
     unmatched_after: list[str] = field(default_factory=list)
+    renamed_files: list[tuple[str, str]] = field(default_factory=list)
 
     @property
     def risk(self) -> str:
@@ -143,8 +146,13 @@ class SQLDirectoryDiffResult:
     def summary(self) -> str:
         changed = sum(bool(item.result.changes) for item in self.files)
         unmatched = len(self.unmatched_before) + len(self.unmatched_after)
-        if not changed and not unmatched:
+        if not changed and not unmatched and not self.renamed_files:
             return f"No structural SQL changes detected across {len(self.files)} file(s)."
+        if self.renamed_files:
+            return (
+                f"{changed} changed SQL file(s), {unmatched} unmatched SQL file(s), "
+                f"{len(self.renamed_files)} renamed SQL file(s); overall risk is {self.risk}."
+            )
         return (
             f"{changed} changed SQL file(s), {unmatched} unmatched SQL file(s); "
             f"overall risk is {self.risk}."
@@ -158,6 +166,9 @@ class SQLDirectoryDiffResult:
             "files": [item.to_dict() for item in self.files],
             "unmatched_before": list(self.unmatched_before),
             "unmatched_after": list(self.unmatched_after),
+            "renamed_files": [
+                {"before": before, "after": after} for before, after in self.renamed_files
+            ],
         }
 
 
@@ -461,6 +472,137 @@ def compare_sql_directories(
     )
 
 
+def compare_sql_git(
+    base_ref: str,
+    *,
+    cwd: str | Path = ".",
+    dialect: str | None = None,
+    parser: SQLParser | None = None,
+) -> SQLDirectoryDiffResult:
+    """Compare Git-reported SQL changes from a base commit to the current worktree."""
+    working_dir = Path(cwd)
+
+    def run_git(*arguments: str) -> bytes:
+        try:
+            completed = subprocess.run(
+                ["git", *arguments],
+                cwd=working_dir,
+                capture_output=True,
+                check=False,
+            )
+        except OSError as exc:
+            raise SQLDiffError(f"Unable to run git: {exc}") from exc
+        if completed.returncode:
+            message = os.fsdecode(completed.stderr).strip()
+            raise SQLDiffError(f"Git command failed: {message or 'unknown git error'}")
+        return completed.stdout
+
+    root_output = run_git("rev-parse", "--show-toplevel").removesuffix(b"\n").removesuffix(b"\r")
+    root = Path(os.fsdecode(root_output))
+    commit = os.fsdecode(
+        run_git("rev-parse", "--verify", "--end-of-options", f"{base_ref}^{{commit}}")
+    ).strip()
+    if not commit:
+        raise SQLDiffError(f"Git base ref did not resolve to a commit: {base_ref}")
+
+    status_fields = run_git(
+        "diff", "--name-status", "-z", "--find-renames", commit, "--"
+    ).split(b"\0")
+    if status_fields and status_fields[-1] == b"":
+        status_fields.pop()
+
+    changed: list[tuple[str, str, str | None]] = []
+    index = 0
+    while index < len(status_fields):
+        status = os.fsdecode(status_fields[index])
+        index += 1
+        path_count = 2 if status.startswith(("R", "C")) else 1
+        if index + path_count > len(status_fields):
+            raise SQLDiffError("Git returned an incomplete file change record")
+        paths = [os.fsdecode(item) for item in status_fields[index : index + path_count]]
+        index += path_count
+        if path_count == 2:
+            changed.append((status[0], paths[0], paths[1]))
+        else:
+            changed.append(
+                (status[0], paths[0], None if status.startswith("D") else paths[0])
+            )
+
+    def validate_repo_path(path: str) -> None:
+        candidate = PurePosixPath(path)
+        if candidate.is_absolute() or "\\" in path or ".." in candidate.parts:
+            raise SQLDiffError(f"Unsafe path returned by git: {path!r}")
+
+    def read_base(path: str) -> str:
+        validate_repo_path(path)
+        try:
+            return run_git("cat-file", "blob", f"{commit}:{path}").decode("utf-8")
+        except UnicodeDecodeError as exc:
+            raise SQLDiffError(
+                f"Unable to read SQL file as UTF-8 from Git base ({path}): {exc}"
+            ) from exc
+        except SQLDiffError as exc:
+            raise SQLDiffError(f"Unable to read SQL file from Git base ({path}): {exc}") from exc
+
+    def read_worktree(path: str) -> str:
+        validate_repo_path(path)
+        file_path = root.joinpath(*PurePosixPath(path).parts)
+        try:
+            resolved = file_path.resolve(strict=True)
+            if not resolved.is_relative_to(root.resolve()):
+                raise SQLDiffError(f"SQL file path resolves outside the Git repository: {path}")
+            if not resolved.is_file():
+                raise SQLDiffError(f"SQL path is not a file in the worktree: {path}")
+            return resolved.read_text(encoding="utf-8")
+        except UnicodeDecodeError as exc:
+            raise SQLDiffError(f"Unable to read SQL file as UTF-8 ({path}): {exc}") from exc
+        except OSError as exc:
+            raise SQLDiffError(f"Unable to read SQL file from worktree ({path}): {exc}") from exc
+
+    def is_sql(path: str) -> bool:
+        return PurePosixPath(path).suffix.lower() == ".sql"
+
+    files: list[SQLFileDiff] = []
+    removed: list[str] = []
+    added: list[str] = []
+    renamed: list[tuple[str, str]] = []
+    for status, before_path, after_path in changed:
+        if after_path is None:
+            if is_sql(before_path):
+                removed.append(before_path)
+            continue
+
+        before_is_sql = is_sql(before_path)
+        after_is_sql = is_sql(after_path)
+        if status == "A":
+            if after_is_sql:
+                added.append(after_path)
+            continue
+        if before_is_sql and after_is_sql:
+            if before_path != after_path:
+                renamed.append((before_path, after_path))
+            files.append(
+                SQLFileDiff(
+                    after_path,
+                    explain_sql_change(
+                        read_base(before_path), read_worktree(after_path),
+                        dialect=dialect, parser=parser,
+                    ),
+                )
+            )
+        elif before_is_sql:
+            removed.append(before_path)
+        elif after_is_sql:
+            added.append(after_path)
+
+    return SQLDirectoryDiffResult(
+        files=sorted(files, key=lambda item: item.path),
+        unmatched_before=sorted(removed),
+        unmatched_after=sorted(added),
+        renamed_files=sorted(renamed),
+    )
+
+
 def explain_diff(before: str, after: str) -> str:
     """Return a readable unified diff for two SQL documents."""
     lines = unified_diff(

{sql_diff_explainer-0.1.3 → sql_diff_explainer-0.1.4}/src/sql_diff_explainer/reports.py

@@ -106,6 +106,18 @@ def to_sarif(
                         properties={"change": action},
                     )
                 )
+        if result.renamed_files:
+            add_rule("sql-file-renamed", "SQL file renamed", "SQL file renamed in the worktree")
+        for before_path, after_path in result.renamed_files:
+            sarif_results.append(
+                _sarif_result(
+                    rule_id="sql-file-renamed",
+                    risk="low",
+                    message=f"SQL file renamed: {before_path} -> {after_path}",
+                    path=after_path,
+                    properties={"change": "renamed", "before": before_path, "after": after_path},
+                )
+            )
 
     return {
         "$schema": _SARIF_SCHEMA,
@@ -169,6 +181,15 @@ def render_html_report(
                 "<td>SQL file added.</td><td><pre></pre></td>"
                 "<td><pre>Present after</pre></td></tr>"
             )
+        for before_path, after_path in result.renamed_files:
+            rows.append(
+                "<tr>"
+                f"<td>{escape(after_path, quote=True)}</td>"
+                '<td class="low">LOW</td>'
+                f"<td>SQL file renamed from {escape(before_path, quote=True)}.</td>"
+                "<td><pre>Present before</pre></td>"
+                "<td><pre>Present after</pre></td></tr>"
+            )
 
     if not rows:
         rows.append('<tr><td colspan="5">No structural SQL changes detected.</td></tr>')

{sql_diff_explainer-0.1.3 → sql_diff_explainer-0.1.4}/tests/test_core.py

@@ -1,4 +1,6 @@
 import json
+import shutil
+import subprocess
 import sys
 
 import pytest
@@ -8,6 +10,7 @@ from sql_diff_explainer import (
     SQLParseError,
     UnsupportedSQL,
     compare_sql_directories,
+    compare_sql_git,
     explain_diff,
     explain_sql_change,
     render_html_report,
@@ -16,6 +19,29 @@ from sql_diff_explainer import (
 from sql_diff_explainer.cli import main as cli_main
 
 
+def _init_git_repo(path):
+    if shutil.which("git") is None:
+        pytest.skip("git executable is not available")
+    path.mkdir()
+    subprocess.run(["git", "init", "-q"], cwd=path, check=True)
+    subprocess.run(
+        ["git", "config", "user.name", "SQL Diff Tests"],
+        cwd=path,
+        check=True,
+    )
+    subprocess.run(
+        ["git", "config", "user.email", "sql-diff-tests@example.invalid"],
+        cwd=path,
+        check=True,
+    )
+    return path
+
+
+def _git_commit(path, message):
+    subprocess.run(["git", "add", "-A"], cwd=path, check=True)
+    subprocess.run(["git", "commit", "-qm", message], cwd=path, check=True)
+
+
 def test_explain_diff_returns_unified_diff() -> None:
     result = explain_diff("CREATE TABLE users;", "CREATE TABLE accounts;")
 
@@ -282,6 +308,124 @@ def test_compare_sql_directories_rejects_invalid_utf8(tmp_path) -> None:
         compare_sql_directories(before_dir, after_dir)
 
 
+def test_compare_sql_git_handles_modifications_additions_deletions_and_renames(tmp_path) -> None:
+    repo = _init_git_repo(tmp_path / "repo")
+    models = repo / "models"
+    models.mkdir()
+    (models / "changed; &.sql").write_text("SELECT id FROM users", encoding="utf-8")
+    (repo / "removed.sql").write_text("SELECT id FROM users", encoding="utf-8")
+    (repo / "old name.sql").write_text(
+        "SELECT\n id,\n name,\n email,\n created_at\nFROM users\n"
+        "WHERE active = TRUE\nORDER BY id",
+        encoding="utf-8",
+    )
+    _git_commit(repo, "base")
+    base = subprocess.run(
+        ["git", "rev-parse", "HEAD"], cwd=repo, check=True, capture_output=True, text=True
+    ).stdout.strip()
+
+    (models / "changed; &.sql").write_text("SELECT name FROM users", encoding="utf-8")
+    (repo / "removed.sql").unlink()
+    (repo / "old name.sql").rename(repo / "new name.sql")
+    (repo / "new name.sql").write_text(
+        "SELECT\n id,\n full_name,\n email,\n created_at\nFROM users\n"
+        "WHERE active = TRUE\nORDER BY id",
+        encoding="utf-8",
+    )
+    (repo / "added; &.SQL").write_text("SELECT id FROM orders", encoding="utf-8")
+    (repo / "untracked.sql").write_text("SELECT 1", encoding="utf-8")
+    subprocess.run(
+        [
+            "git",
+            "add",
+            "-A",
+            "--",
+            "models/changed; &.sql",
+            "removed.sql",
+            "old name.sql",
+            "new name.sql",
+            "added; &.SQL",
+        ],
+        cwd=repo,
+        check=True,
+    )
+
+    result = compare_sql_git(base, cwd=repo)
+
+    assert [item.path for item in result.files] == ["models/changed; &.sql", "new name.sql"]
+    assert all(item.result.changes for item in result.files)
+    assert result.unmatched_before == ["removed.sql"]
+    assert result.unmatched_after == ["added; &.SQL"]
+    assert result.renamed_files == [("old name.sql", "new name.sql")]
+    assert result.risk == "high"
+    report = result.to_dict()
+    assert "untracked.sql" not in str(report)
+    assert report["renamed_files"] == [{"before": "old name.sql", "after": "new name.sql"}]
+    assert "new name.sql" in render_html_report(result)
+    sarif = to_sarif(result)
+    assert any(
+        item["ruleId"] == "sql-file-renamed"
+        for item in sarif["runs"][0]["results"]
+    )
+
+
+@pytest.mark.parametrize("output_format", ["text", "json", "sarif", "html"])
+def test_cli_git_mode_supports_reports_and_risk_gate(
+    tmp_path, monkeypatch, capsys, output_format
+) -> None:
+    repo = _init_git_repo(tmp_path / f"repo-{output_format}")
+    (repo / "query.sql").write_text("SELECT id FROM users", encoding="utf-8")
+    _git_commit(repo, "base")
+    base = subprocess.run(
+        ["git", "rev-parse", "HEAD"], cwd=repo, check=True, capture_output=True, text=True
+    ).stdout.strip()
+    (repo / "query.sql").write_text("SELECT name FROM users", encoding="utf-8")
+    monkeypatch.chdir(repo)
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        [
+            "sql-diff-explainer",
+            "--git-base",
+            base,
+            "--format",
+            output_format,
+            "--fail-on-risk",
+            "medium",
+        ],
+    )
+
+    assert cli_main() == 1
+    output = capsys.readouterr().out
+    if output_format == "json":
+        assert json.loads(output)["files"][0]["path"] == "query.sql"
+    elif output_format == "sarif":
+        assert json.loads(output)["runs"][0]["results"]
+    elif output_format == "html":
+        assert "<html" in output and "query.sql" in output
+    else:
+        assert "query.sql:" in output
+
+
+def test_compare_sql_git_reports_invalid_ref_and_non_repository(tmp_path) -> None:
+    repo = _init_git_repo(tmp_path / "repo")
+    with pytest.raises(SQLDiffError, match="Git command failed"):
+        compare_sql_git("not-a-real-ref", cwd=repo)
+    with pytest.raises(SQLDiffError, match="Git command failed"):
+        compare_sql_git("HEAD", cwd=tmp_path)
+
+
+def test_cli_git_mode_rejects_conflicting_arguments(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["sql-diff-explainer", "before.sql", "after.sql", "--git-base", "HEAD"],
+    )
+    with pytest.raises(SystemExit) as exc_info:
+        cli_main()
+    assert exc_info.value.code == 2
+
+
 def test_cli_compare_directories_emits_json_and_applies_risk_gate(
     tmp_path, monkeypatch, capsys
 ) -> None: