You can do the math and calculate risk of collisions. And then put that in relation to the context: It is a single repository, probably with very few commits si

You can do the math and calculate risk of collisions. And then put that in relation to the context: It is a single repository, probably with very few commits since it is research and not a highly active commercial product. You could probably cut the commit hash to 4 characters and still not have collisions for this application (ie. 1 / 65536 chance of collision @ 4 characters), or even fewer