{"record":{"id":"7a4f071244f984f5","repo":"GoogleContainerTools/skaffold","slug":"failed-to-clone-repo-s-trouble-resetting-branch","errorCode":null,"errorMessage":"failed to clone repo %s: trouble resetting branch to origin/%s; run 'git clone <REPO>; stat <DIR/SUBDIR>' to verify credentials: %w","messagePattern":"failed to clone repo (.+?): trouble resetting branch to origin/(.+?); run 'git clone <REPO>; stat <DIR/SUBDIR>' to verify credentials: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/skaffold/git/gitutil.go","lineNumber":172,"sourceCode":"\t\t// if sync property is false, then skip fetching latest from remote and resetting the branch.\n\t\tif g.Sync != nil && !*g.Sync {\n\t\t\treturn repoCacheDir, nil\n\t\t}\n\n\t\t// if sync is turned off via flag `--sync-remote-cache`, then skip fetching latest from remote and resetting the branch.\n\t\tif opts.SyncRemoteCache.FetchDisabled() {\n\t\t\treturn repoCacheDir, nil\n\t\t}\n\n\t\ttryUpdateRemoteOriginFetchURL(ctx, r, g.RepoCloneURI)\n\n\t\tif _, err = r.Run(ctx, \"fetch\", \"origin\", ref); err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to clone repo %s: unable to find any matching refs %s; run 'git clone <REPO>; stat <DIR/SUBDIR>' to verify credentials: %w\", g.Repo, ref, err)\n\t\t}\n\n\t\t// Sync option is either nil or true, so we are resetting the repo\n\t\tif _, err := r.Run(ctx, \"reset\", \"--hard\", fmt.Sprintf(\"origin/%s\", ref)); err != nil {\n\t\t\treturn \"\", fmt.Errorf(\"failed to clone repo %s: trouble resetting branch to origin/%s; run 'git clone <REPO>; stat <DIR/SUBDIR>' to verify credentials: %w\", g.Repo, ref, err)\n\t\t}\n\t}\n\treturn repoCacheDir, nil\n}\n\n// gitCmd runs git commands in a git repo.\ntype gitCmd struct {\n\t// Dir is the directory the commands are run in.\n\tDir string\n}\n\n// Run runs a git command.\n// Omit the 'git' part of the command.\nfunc (g *gitCmd) Run(ctx context.Context, args ...string) ([]byte, error) {\n\tp, err := findGit()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"no 'git' program on path: %w\", err)\n\t}","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/GoogleContainerTools/skaffold/blob/a1189de023efc32d4b8e11f395acc678aa555011/pkg/skaffold/git/gitutil.go#L154-L190","documentation":"syncRepo cloned/updated a remote git repo and, after a successful `git fetch origin <ref>`, failed to run `git reset --hard origin/<ref>` in the cached working copy. The wrap means the underlying git command returned a non-zero exit (auth, missing remote branch, corrupt cache, or git binary issues). Skaffold suggests manually cloning the repo and checking the target subdirectory to verify credentials and ref availability.","triggerScenarios":"Any Skaffold feature that syncs a remote git repo (e.g. remote config manifests / git dependency sync) when `git fetch origin <ref>` succeeds but `git reset --hard origin/<ref>` fails — typically because the ref exists on the remote but no local `origin/<ref>` tracking branch was created (fetching a raw SHA or tag), the cache directory is corrupt, or credentials are valid for fetch but the checkout fails.","commonSituations":"Referencing a commit SHA or tag instead of a branch name (so origin/<ref> doesn't exist); expired or rotated credentials causing partial fetch; a stale/corrupted repo cache in ~/.skaffold/cache; restricted CI environments where the reset is blocked by file locks or read-only mounts.","solutions":["Manually run `git clone <REPO>` and `stat <DIR/SKAFFOLD_SUBDIR>` to confirm credentials and that the ref resolves.","Use a real branch name for the ref (e.g. 'main') instead of a tag or commit SHA, since the code resets to origin/<ref>.","Delete the cached repo directory (default under ~/.skaffold/cache) so the next run performs a fresh clone.","Run `git reset --hard origin/<ref>` inside the cached directory to see the raw git error (permissions, lock files, corruption)."],"exampleFix":"// before (skaffold config remote ref as a tag/SHA)\ngit: { repo: https://github.com/org/repo.git, ref: v1.2.3 }\n// after (use a branch name so origin/<ref> exists)\ngit: { repo: https://github.com/org/repo.git, ref: main }","handlingStrategy":"try-catch","validationCode":"// Pre-check ref type: must be a branch for reset --hard origin/<ref> to work\nfunc isBranchRef(ref string) bool {\n\treturn ref != \"\" && !strings.ContainsAny(ref, \"~^: \")\n}","typeGuard":null,"tryCatchPattern":"repoDir, err := syncRepo(ctx, repo, ref)\nif err != nil {\n\tif strings.Contains(err.Error(), \"trouble resetting branch\") {\n\t\t// clear the corrupted/stale cache and retry once\n\t\tos.RemoveAll(repoCacheDir)\n\t\trepoDir, err = syncRepo(ctx, repo, ref)\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"verify credentials: git clone %s && stat %s: %w\", repo, subdir, err)\n\t}\n}","preventionTips":["Always reference a real branch name (main/master) for git remote deps, not tags or SHAs","Validate credentials with a manual `git ls-remote <REPO>` before automating syncs","Periodically clear the Skaffold repo cache to avoid stale checkouts","Pin CI images to include a working git client"],"tags":["git","network","credentials"],"backgroundTag":"git-clone-failed","analyzedSha":"a1189de023efc32d4b8e11f395acc678aa555011","analyzedAt":"2026-09-05T12:09:27.064Z","contentChangedAt":"2026-09-05T12:09:27.064Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}