GoogleContainerTools/skaffold · error

tagging policy 'sha256' can not be used when 'tryImportMissi

Error message

tagging policy 'sha256' can not be used when 'tryImportMissing' is enabled

What it means

The sha256 tagger always uses the 'latest' tag, which conflicts with build.local.tryImportMissing (which relies on previously built images). If both are configured, validateTaggingPolicy records this error with the location of the sha256 tagger.

Source

Thrown at pkg/skaffold/schema/validation/validation.go:145

	errs = append(errs, validateCustomActionsExecModes(runCtx)...)

	if len(errs) == 0 {
		return nil
	}
	var messages []string
	for _, err := range errs {
		messages = append(messages, err.Error())
	}
	return errors.New(strings.Join(messages, " \n "))
}

// validateTaggingPolicy checks that the tagging policy is valid in combination with other options.
func validateTaggingPolicy(cfg *parser.SkaffoldConfigEntry, bc latest.BuildConfig) (cfgErrs []ErrorWithLocation) {
	if bc.LocalBuild != nil {
		// sha256 just uses `latest` tag, so tryImportMissing will virtually always succeed (#4889)
		if bc.LocalBuild.TryImportMissing && bc.TagPolicy.ShaTagger != nil {
			cfgErrs = append(cfgErrs, ErrorWithLocation{
				Error:    errors.New("tagging policy 'sha256' can not be used when 'tryImportMissing' is enabled"),
				Location: cfg.YAMLInfos.Locate(cfg.Build.TagPolicy.ShaTagger),
			})
		}
	}
	return
}

// validateImageNames makes sure the artifact image names are unique and valid base names,
// without tags nor digests.
func validateImageNames(configs parser.SkaffoldConfigSet) (errs []ErrorWithLocation) {
	seen := make(map[string]string)
	arMap := make(map[string]*latest.Artifact)

	for _, c := range configs {
		for i, a := range c.Build.Artifacts {
			curLines := c.YAMLInfos.Locate(c.Build.Artifacts[i])
			if prevSource, found := seen[a.ImageName]; found {
				prevLines := c.YAMLInfos.Locate(arMap[c.Build.Artifacts[i].ImageName])

View on GitHub (pinned to a1189de023)

Solutions

1. Switch the tag policy to gitCommit or envTemplate (or another non-sha256 tagger) when tryImportMissing is enabled.
2. Set build.local.tryImportMissing: false if sha256 tagging is required.
3. Remove the explicit sha256 tagPolicy so a compatible policy is used.

Example fix

# before
build:
  local:
    tryImportMissing: true
  tagPolicy:
    sha256: {}
# after
build:
  local:
    tryImportMissing: true
  tagPolicy:
    gitCommit: {}

func sha256WithTryImport(bc latest.BuildConfig) bool {
    return bc.LocalBuild != nil && bc.LocalBuild.TryImportMissing && bc.TagPolicy.ShaTagger != nil
}

if bc.LocalBuild != nil && bc.LocalBuild.TryImportMissing && bc.TagPolicy.ShaTagger != nil { /* invalid combo */ }

errs := validation.ProcessToErrorWithLocation(cfg)
for _, e := range errs {
    if strings.Contains(e.Error.Error(), "sha256") && strings.Contains(e.Error.Error(), "tryImportMissing") {
        // switch tag policy or disable tryImportMissing
    }
}

When it happens

Trigger: skaffold.yaml with build.local.tryImportMissing: true and build.tagPolicy.sha256 set; reported via ProcessToErrorWithLocation.

Common situations: Users enabling tryImportMissing to reuse images while keeping the default/selected sha256 tagger, then running validation.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• cannot add an empty image value
• response must be a number, or empty
• strings.Join(messages, "\n")
• strings.Join(messages, " \n ")
• INIT_DOCKER_NETWORK_INVALID_MODE

AI-assisted analysis of GoogleContainerTools/skaffold@a1189de023 (2026-09-05). Data as JSON: /api/errors/eabad57c2e8bd29e. Report an issue: GitHub.