defensive check for 0 shas in resource_match