Trim the changelog entry and the comments it duplicated

Cut the 2.9.7 section to two bullets: what a user of a patch release needs is the
behavior they will see, not the mechanism behind it.

Reword the comments the entry was echoing so each states a present-tense
invariant, and name the same three statuses in both the cap's rationale and the
upload path rather than two overlapping subsets.

Author: lelia

CHANGELOG.md

@@ -2,29 +2,13 @@
 
 ## 2.9.7
 
-### Fixed: cap the commit message read from the local checkout
-
-- `commit_message` travels in the query string of the full scan request, so an
-  oversized value overflows the edge proxy's request line limit and the scan
-  fails with HTTP 431 before reaching the API. The 200-character cap already
-  applied to `--commit-message`, but a run that omitted the flag backfilled the
-  value straight from the checkout's HEAD commit, uncapped. Repositories whose
-  commit messages carry generated release notes could not be scanned at all.
-- The cap is now an invariant of the parsed configuration and is applied to the
-  git-derived value as well, so every source of `commit_message` lands under the
-  limit.
-- A truncated message now ends in `...` and the notice is logged at INFO instead
-  of DEBUG, so a clipped message in the dashboard is explained by the CI log of
-  the run that produced it. The 200-character ceiling is unchanged; the marker
-  replaces the tail rather than extending past it.
-
-### Changed: name the cause when a full scan request is refused for its size
-
-- Scan metadata travels in the query string of the full scan request, so an
-  oversized value is refused by the proxy in front of the API, which reports 413,
-  414 or 431 depending on which limit it checks. Those responses previously
-  surfaced as the SDK's generic status-code error carrying the proxy's response
-  body. They now name the cause and the flag to change, and remain unretried.
+### Fixed: oversized commit messages no longer fail the scan
+
+- The 200-character cap on the commit message now applies to the value read from the
+  repository, not only to `--commit-message`. A truncated message ends in `...` and the
+  truncation is reported at INFO.
+- A full scan refused for its size (HTTP 413, 414 or 431) now reports which value to
+  shorten.
 
 ## 2.9.6
 

socketsecurity/config.py

@@ -22,7 +22,7 @@ def get_plugin_config_from_env(prefix: str) -> dict:
 # commit_message rides in the query string of POST /v0/orgs/{org}/full-scans, so an
 # oversized message overflows the edge proxy's request line limit before the API ever
 # sees it. The API itself has no length validation on the field; the rejection comes
-# from the proxy, reported as either 413 or 431 depending on which one answers. 200
+# from the proxy, which reports 413, 414 or 431 depending on which limit it checks. 200
 # chars is a conservative ceiling given URL encoding can 2-3x the raw character count.
 MAX_COMMIT_MESSAGE_LENGTH = 200
 
@@ -33,9 +33,9 @@ def get_plugin_config_from_env(prefix: str) -> dict:
 def truncate_commit_message(commit_message: Optional[str]) -> Optional[str]:
     """Cap commit_message to a length the full-scan request line can carry."""
     if commit_message and len(commit_message) > MAX_COMMIT_MESSAGE_LENGTH:
-        # Logged at INFO rather than DEBUG: the scan record keeps the truncated value, and
-        # a CI job that never passes --enable-debug would otherwise have no way to tell why
-        # the message in the dashboard is clipped.
+        # INFO, not DEBUG: the scan keeps the truncated value, so for a CI job that does
+        # not pass --enable-debug this line is the only explanation of why the message in
+        # the dashboard is clipped.
         logging.info(
             f"commit_message truncated from {len(commit_message)} to "
             f"{MAX_COMMIT_MESSAGE_LENGTH} characters to stay within API request size limits"
@@ -229,9 +229,9 @@ class CliConfig:
     config_file: Optional[str] = None
 
     def __post_init__(self):
-        # Capped here rather than at the flag-parsing site so that every source of
-        # commit_message (the --commit-message flag, a config file, the git backfill in
-        # socketcli) lands under the limit.
+        # Capped on construction so that every source of commit_message -- the
+        # --commit-message flag, a config file, the git backfill in socketcli -- lands
+        # under the limit.
         self.commit_message = truncate_commit_message(self.commit_message)
 
     @classmethod

socketsecurity/socketcli.py

@@ -234,8 +234,7 @@ def apply_git_context(config: CliConfig) -> Tuple[bool, Optional[Git]]:
     if not config.committers:
         config.committers = [git_repo.get_formatted_committer()]
     if not config.commit_message:
-        # Capped like the flag-supplied value: a repository's own commit message is
-        # unbounded, and it ships in the full-scan query string.
+        # A repository's commit message is unbounded and ships in the query string.
         config.commit_message = truncate_commit_message(git_repo.commit_message)
     return True, git_repo