Hmbown/CodeWhale · error · Error

GitHub tag ref did not include an object SHA

Error message

GitHub tag ref ${tag} did not include an object SHA

What it means

resolveTagCommitSha fetches /git/ref/tags/<tag> from the GitHub API and expects an object with object.sha and object.type. If the API response lacks these fields, the tag ref could not be resolved and the script aborts.

Solutions

1. Verify the tag exists: git ls-remote --tags origin <tag> or check GitHub releases page
2. Correct the tag name/version passed to the verification script
3. Ensure the API endpoint is the real GitHub API and GITHUB_TOKEN is valid
4. Re-push the tag if it was deleted

const res = await fetch(`https://api.github.com/repos/${repo}/git/ref/tags/${tag}`, { headers: ghHeaders });
const ref = await res.json();
if (!ref || !ref.object || !ref.object.sha || !ref.object.type) {
  throw new Error(`Tag ${tag} not resolvable via GitHub API (HTTP ${res.status}); check tag exists and token is valid`);
}

try { sha = await tagSha(repo, tag); } catch (e) { if (/did not include an object SHA/.test(e.message)) { console.error(`Tag ${tag} missing or API response invalid; verify with gh api`); throw e; } throw e; }

When it happens

Trigger: tagSha() calls resolveTagCommitSha for a release tag and the API returns a body without object.sha/type — e.g. tag does not exist (empty/error body), truncated response, or non-GitHub API response from a proxy.

Common situations: Verifying a release whose git tag was pushed but not yet visible via API; typo in tag name; proxy returning an HTML error page instead of JSON with 200.

Understand the failure class

Background: "invalid response format", "malformed payload", "missing data field": when an API returns 200 but the response shape is wrong — this error's family across 23 libraries.

Related errors

• Annotated tag did not peel to a commit SHA
• GitHub tag ref points at , not a commit or annotated tag
• baseline provenance must identify a clean source tree
• baseline provenance needs an exact source SHA
• Cargo metadata contains duplicate workspace package names

AI-assisted analysis of Hmbown/CodeWhale@433685b202 (2026-09-15). Data as JSON: /api/errors/05bda1c100c63dec. Report an issue: GitHub.

Appendix: source

Thrown at npm/codewhale/scripts/verify-release-assets.js:202

          resolve(parsed);
        });
      })
      .on("error", reject);
  });
}

function githubApiUrl(repo, path) {
  return `https://api.github.com/repos/${repo}${path}`;
}

async function githubApi(repo, path) {
  return downloadJson(githubApiUrl(repo, path));
}

async function resolveTagCommitSha(repo, tag) {
  const ref = await githubApi(repo, `/git/ref/tags/${encodeURIComponent(tag)}`);
  if (!ref.object || !ref.object.sha || !ref.object.type) {
    throw new Error(`GitHub tag ref ${tag} did not include an object SHA`);
  }
  if (ref.object.type === "commit") {
    return ref.object.sha;
  }
  if (ref.object.type !== "tag") {
    throw new Error(`GitHub tag ref ${tag} points at ${ref.object.type}, not a commit or annotated tag`);
  }
  const tagObject = await githubApi(repo, `/git/tags/${ref.object.sha}`);
  if (!tagObject.object || tagObject.object.type !== "commit" || !tagObject.object.sha) {
    throw new Error(`Annotated tag ${tag} did not peel to a commit SHA`);
  }
  return tagObject.object.sha;
}

async function findReleaseWorkflowRun(repo, tag, tagSha, api = githubApi) {
  const runs = await api(repo, "/actions/workflows/release.yml/runs?per_page=100");
  const candidates = (runs.workflow_runs || [])
    .filter((run) => run.head_sha === tagSha)

View on GitHub (pinned to 433685b202)