GoogleContainerTools/skaffold · error

failed to clone repo %s: trouble resetting branch to origin/

Error message

failed to clone repo %s: trouble resetting branch to origin/%s; run 'git clone <REPO>; stat <DIR/SUBDIR>' to verify credentials: %w

What it means

syncRepo cloned/updated a remote git repo and, after a successful `git fetch origin <ref>`, failed to run `git reset --hard origin/<ref>` in the cached working copy. The wrap means the underlying git command returned a non-zero exit (auth, missing remote branch, corrupt cache, or git binary issues). Skaffold suggests manually cloning the repo and checking the target subdirectory to verify credentials and ref availability.

Source

Thrown at pkg/skaffold/git/gitutil.go:172

		// if sync property is false, then skip fetching latest from remote and resetting the branch.
		if g.Sync != nil && !*g.Sync {
			return repoCacheDir, nil
		}

		// if sync is turned off via flag `--sync-remote-cache`, then skip fetching latest from remote and resetting the branch.
		if opts.SyncRemoteCache.FetchDisabled() {
			return repoCacheDir, nil
		}

		tryUpdateRemoteOriginFetchURL(ctx, r, g.RepoCloneURI)

		if _, err = r.Run(ctx, "fetch", "origin", ref); err != nil {
			return "", fmt.Errorf("failed to clone repo %s: unable to find any matching refs %s; run 'git clone <REPO>; stat <DIR/SUBDIR>' to verify credentials: %w", g.Repo, ref, err)
		}

		// Sync option is either nil or true, so we are resetting the repo
		if _, err := r.Run(ctx, "reset", "--hard", fmt.Sprintf("origin/%s", ref)); err != nil {
			return "", fmt.Errorf("failed to clone repo %s: trouble resetting branch to origin/%s; run 'git clone <REPO>; stat <DIR/SUBDIR>' to verify credentials: %w", g.Repo, ref, err)
		}
	}
	return repoCacheDir, nil
}

// gitCmd runs git commands in a git repo.
type gitCmd struct {
	// Dir is the directory the commands are run in.
	Dir string
}

// Run runs a git command.
// Omit the 'git' part of the command.
func (g *gitCmd) Run(ctx context.Context, args ...string) ([]byte, error) {
	p, err := findGit()
	if err != nil {
		return nil, fmt.Errorf("no 'git' program on path: %w", err)
	}

View on GitHub (pinned to a1189de023)

Solutions

1. Manually run `git clone <REPO>` and `stat <DIR/SKAFFOLD_SUBDIR>` to confirm credentials and that the ref resolves.
2. Use a real branch name for the ref (e.g. 'main') instead of a tag or commit SHA, since the code resets to origin/<ref>.
3. Delete the cached repo directory (default under ~/.skaffold/cache) so the next run performs a fresh clone.
4. Run `git reset --hard origin/<ref>` inside the cached directory to see the raw git error (permissions, lock files, corruption).

Example fix

// before (skaffold config remote ref as a tag/SHA)
git: { repo: https://github.com/org/repo.git, ref: v1.2.3 }
// after (use a branch name so origin/<ref> exists)
git: { repo: https://github.com/org/repo.git, ref: main }

// Pre-check ref type: must be a branch for reset --hard origin/<ref> to work
func isBranchRef(ref string) bool {
	return ref != "" && !strings.ContainsAny(ref, "~^: ")
}

repoDir, err := syncRepo(ctx, repo, ref)
if err != nil {
	if strings.Contains(err.Error(), "trouble resetting branch") {
		// clear the corrupted/stale cache and retry once
		os.RemoveAll(repoCacheDir)
		repoDir, err = syncRepo(ctx, repo, ref)
	}
	if err != nil {
		return fmt.Errorf("verify credentials: git clone %s && stat %s: %w", repo, subdir, err)
	}
}

When it happens

Trigger: Any Skaffold feature that syncs a remote git repo (e.g. remote config manifests / git dependency sync) when `git fetch origin <ref>` succeeds but `git reset --hard origin/<ref>` fails — typically because the ref exists on the remote but no local `origin/<ref>` tracking branch was created (fetching a raw SHA or tag), the cache directory is corrupt, or credentials are valid for fetch but the checkout fails.

Common situations: Referencing a commit SHA or tag instead of a branch name (so origin/<ref> doesn't exist); expired or rotated credentials causing partial fetch; a stale/corrupted repo cache in ~/.skaffold/cache; restricted CI environments where the reset is blocked by file locks or read-only mounts.

Related errors

• failed to lookup %s branch for repo %s: %w
• failed to clone repo %s: trouble getting default branch: %w
• failed to clone repo: %w
• caching remote dependency %s: %w
• CONFIG_REMOTE_REPO_CACHE_NOT_FOUND_ERR

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/7a4f071244f984f5. Report an issue: GitHub.