Correct! Even though SHA-1 collision were achieved, they are impractical and we can make the assumption that "if two objects has the same hash, they are the sa

Correct! Even though SHA-1 collision were achieved, they are impractical and we can make the assumption that "if two objects has the same hash, they are the same". To have a cycle, both commits involved would need to have the hash of the other, which is impossible: the hash of a commit is based on its content, its content contains the hash of its parent. We could only have a cycle here if we create two commits created after two arbitrary hashes.