While there may not be a known, direct, attack against git, WebKit's SVN repository was demonstrably attacked by the SHA-1 vulnerability, oddly by their own developers today (or yesterday?). That it took that little time from a PoC to an actual production issue leads me to believe it wouldn't take long for a dedicated individual or team to extend the vulnerability to git and it's "mitigation" involving the header.

I prefer not to take the bury my head in the sand approach to this, at least when it comes to public repositories.

Linus talked about all of this and why the way git works makes it even harder, supremely harder, to pull off. Nobody is taking the "bury my head" road and Linus talked about ways forward.