cpanfile.snapshot should be in repo.
Improved security around git executions
A repo knows about branches.