{"record":{"id":"388dbb5715997f6c","repo":"nektos/act","slug":"unable-to-resolve-action-s-the-provided-ref","errorCode":null,"errorMessage":"Unable to resolve action `%s`, the provided ref `%s` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `%s` instead","messagePattern":"Unable to resolve action `(.+?)`, the provided ref `(.+?)` is the shortened version of a commit SHA, which is not supported\\. Please use the full commit SHA `(.+?)` instead","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/runner/step_action_remote.go","lineNumber":120,"sourceCode":"\t\t\t}\n\n\t\t\tactionModel, err := sar.readAction(ctx, sar.Step, sar.resolvedSha, sar.remoteAction.Path, remoteReader(ctx), os.WriteFile)\n\t\t\tsar.action = actionModel\n\t\t\treturn err\n\t\t}\n\n\t\tactionDir := fmt.Sprintf(\"%s/%s\", sar.RunContext.ActionCacheDir(), safeFilename(sar.Step.Uses))\n\t\tgitClone := stepActionRemoteNewCloneExecutor(git.NewGitCloneExecutorInput{\n\t\t\tURL:         sar.remoteAction.CloneURL(),\n\t\t\tRef:         sar.remoteAction.Ref,\n\t\t\tDir:         actionDir,\n\t\t\tToken:       github.Token,\n\t\t\tOfflineMode: sar.RunContext.Config.ActionOfflineMode,\n\t\t})\n\t\tvar ntErr common.Executor\n\t\tif err := gitClone(ctx); err != nil {\n\t\t\tif errors.Is(err, git.ErrShortRef) {\n\t\t\t\treturn fmt.Errorf(\"Unable to resolve action `%s`, the provided ref `%s` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `%s` instead\",\n\t\t\t\t\tsar.Step.Uses, sar.remoteAction.Ref, err.(*git.Error).Commit())\n\t\t\t} else if errors.Is(err, gogit.ErrForceNeeded) { // TODO: figure out if it will be easy to shadow/alias go-git err's\n\t\t\t\tntErr = common.NewInfoExecutor(\"Non-terminating error while running 'git clone': %v\", err)\n\t\t\t} else {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\n\t\tremoteReader := func(_ context.Context) actionYamlReader {\n\t\t\treturn func(filename string) (io.Reader, io.Closer, error) {\n\t\t\t\tf, err := os.Open(filepath.Join(actionDir, sar.remoteAction.Path, filename))\n\t\t\t\treturn f, f, err\n\t\t\t}\n\t\t}\n\n\t\treturn common.NewPipelineExecutor(\n\t\t\tntErr,\n\t\t\tfunc(ctx context.Context) error {","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/nektos/act/blob/4f411281417e88660bea1c1a1749aa71ae0bd60f/pkg/runner/step_action_remote.go#L102-L138","documentation":"Cloning a remote action failed with git.ErrShortRef: the ref in `uses:` is an abbreviated commit SHA (e.g. 7-character 'abc1234'). GitHub Actions only accepts full 40-char SHAs for commit pinning; act's go-git clone path likewise cannot resolve a short SHA to a commit and asks for the full SHA, exposing the resolved full SHA in the message via err.(*git.Error).Commit().","triggerScenarios":"`uses: org/action@abc1234` where abc1234 is a truncated commit hash rather than a tag/branch; go-git tries to resolve it as a ref, detects ambiguity/shortness, and returns ErrShortRef.","commonSituations":"Copying a short SHA from `git log --oneline` output; tools that emit abbreviated SHAs; trying to 'pin' an action with minimum characters like some ecosystems allow.","solutions":["Replace the short SHA with the full 40-character commit SHA of the same commit (the error message suggests the resolved full SHA to use).","Get the full hash via `git ls-remote https://github.com/org/action` or the repo's commit page.","Or pin to a tagged release (e.g. @v4) if exact-commit pinning is not required."],"exampleFix":"# before\n- uses: actions/checkout@8f4b7f8   # short SHA\n# after\n- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3","handlingStrategy":"validation","validationCode":"# ensure SHAs used for pinning are 40 hex chars\npython3 - <<'EOF'\nimport re,sys\nsrc=open('.github/workflows/ci.yml').read()\nfor m in re.finditer(r'uses:\\s*\\S+@([0-9a-f]+)', src):\n    if 0 < len(m.group(1)) < 40:\n        sys.exit(f'short SHA {m.group(1)} — use full 40-char SHA')\nEOF","typeGuard":"func isFullSHA(ref string) bool {\n  m, _ := regexp.MatchString(`^[0-9a-f]{40}$`, ref)\n  return m\n}","tryCatchPattern":null,"preventionTips":["Pin with full 40-character SHAs only; get them via git ls-remote.","Prefer tags (e.g. @v4) when exact pinning isn't needed.","Let tools like Dependabot manage SHA pins — they emit full SHAs."],"tags":["git","remote-action","sha-pinning","uses"],"backgroundTag":null,"analyzedSha":"4f411281417e88660bea1c1a1749aa71ae0bd60f","analyzedAt":"2026-08-15T09:19:46.307Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}