fix: mark to_raw as unsafe

Author: MikeJerred

src/index.rs

@@ -661,7 +661,7 @@ impl IndexEntry {
     ///
     /// The returned `raw::git_index_entry` contains a pointer to a `CString` path, which is also
     /// returned because it's lifetime must exceed the lifetime of the `raw::git_index_entry`.
-    pub fn to_raw(&self) -> Result<(raw::git_index_entry, CString), Error> {
+    pub(crate) unsafe fn to_raw(&self) -> Result<(raw::git_index_entry, CString), Error> {
         let path = CString::new(&self.path[..])?;
 
         // libgit2 encodes the length of the path in the lower bits of the

src/repo.rs

@@ -2577,11 +2577,11 @@ impl Repository {
         theirs: &IndexEntry,
         opts: Option<&mut MergeFileOptions>,
     ) -> Result<MergeFileResult<'_>, Error> {
-        let (ancestor, _ancestor_path) = ancestor.to_raw()?;
-        let (ours, _ours_path) = ours.to_raw()?;
-        let (theirs, _theirs_path) = theirs.to_raw()?;
-
         unsafe {
+            let (ancestor, _ancestor_path) = ancestor.to_raw()?;
+            let (ours, _ours_path) = ours.to_raw()?;
+            let (theirs, _theirs_path) = theirs.to_raw()?;
+
             let mut ret = mem::zeroed();
             try_call!(raw::git_merge_file_from_index(
                 &mut ret,