checkout a commit by sha