Detect and warn on abbreviated SHA1s in manifest

[sdboyer]

It's likely that folks will end up putting in an abbreviated commit SHA1 in Gopkg.toml. We need an exact match, not the abbreviation. If we can reasonably detect and warn against this, it would be a benefit.

[carolynvs]

Is this a good first-pr candidate?

[sdboyer]

ah yeah totally

[zknill]

I would like to take this, but would appreciate pointers!
I assume it's somewhere around here https://github.com/golang/dep/blob/master/manifest.go#L171?

[sdboyer]

@zknill awesome! and yes, that's where the actual assignment happens, but we do the warns in validateManifest(). you'll want to look at...func getProjectConstraints(), I think? for patterns to follow on how to sniff revision types from string structure. but my plane is literally wheels off the ground rn, so I can't double check that 😀

[zknill]

Sweet thanks. I'll check it out and come back if I get stuck!