fix(upload): prevent Commit.DoesNotExist during upload serialization

[sentry]

This PR addresses a Commit.DoesNotExist error occurring in the /upload/{service}/{repo}/commits/{commit_sha}/reports/{report_code}/uploads endpoint during response serialization.

Root Cause:
The UploadSerializer.get_url() method was attempting to access obj.report.commit.repository which triggered a fresh database lookup for the Commit object via its foreign key. A race condition could occur where the Commit object, which was successfully retrieved earlier in the request by get_commit(), was concurrently deleted from the database (e.g., by a background task or another request) before get_url() executed. Since get_url() had no exception handling for DoesNotExist, this led to an unhandled crash.

Solution:

1. Pass objects via serializer context: In UploadViews.perform_create(), the already-fetched commit and repository objects are now passed into the UploadSerializer's context before create_upload() is called. This ensures these objects are available during serialization.
2. Use context in get_url(): The UploadSerializer.get_url() method has been updated to first attempt to retrieve the commit and repository from self.context. This avoids the problematic fresh database lookup.
3. Add graceful fallback: A try-except block has been added to get_url() as a fallback. If the commit or repository are not found in the context (e.g., if get_url() is called in a different flow) or if the FK lookup still fails, it will now catch any exception and return an empty string, preventing an unhandled error.

This change eliminates the race condition, improves efficiency by avoiding redundant database queries, and makes the upload serialization process more robust.

Legal Boilerplate

Look, I get it. The entity doing business as "Codecov" is owned by Harness, Inc. In 2026 Harness acquired Codecov and as a result Harness is going to need some rights from me in order to utilize my contributions in this PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Harness can use, modify, copy, and redistribute my contributions, under Harness's choice of terms.

Fixes API-ESG

[codecov-notifications]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
apps/codecov-api/upload/serializers.py	75.00%	2 Missing ⚠️

❌ Your patch check has failed because the patch coverage (80.00%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.83%. Comparing base (d8942db) to head (c714336).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
apps/codecov-api/upload/serializers.py	75.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1870      +/-   ##
==========================================
- Coverage   91.83%   91.83%   -0.01%     
==========================================
  Files        1332     1332              
  Lines       51830    51838       +8     
  Branches     1647     1647              
==========================================
+ Hits        47598    47604       +6     
- Misses       3911     3913       +2     
  Partials      321      321              

Flag	Coverage Δ
apiunit	94.74% <80.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.