Fail on shallow Git clones
When one clones a repository with a limited depth (such as the most extreme git clone [...] --depth=1), every file will be associated with the oldest fetched commit in the shallow clone or newer.
In other words, files that pre-dates the earliest shallow clone's commit will be considered as created at that commit, which is wrong. In the above extreme example, all files are considered created at the shallow clone sole commit.
The only safe way seems to reject shallow clones entirely. Luckily, the shallowness information is accessible since Git 2.15, as explained here.
I agree that rejecting shallow clones seems like the best approach. Not sure what's best if git has version less than 2.15 - should that fail as well to be on the safe side?