GoGitActionCache failed to fetch %s with ref %s at %s: %w

Error message

GoGitActionCache failed to fetch %s with ref %s at %s: %w

What it means

Fetch performs remote.FetchContext with a single refspec 'ref -> tmpBranch', force=true, depth=1, optional basic auth from a token. This error wraps any go-git fetch failure: network unreachable, HTTP 401/403/404 from the git host, authentication required, ref not found, or context cancellation.

Source

Thrown at pkg/runner/action_cache.go:82

		URLs: []string{
			url,
		},
	})
	if err != nil {
		return "", fmt.Errorf("GoGitActionCache failed to create remote %s with ref %s at %s: %w", url, ref, gitPath, err)
	}
	defer func() {
		_ = gogitrepo.DeleteBranch(branchName)
	}()
	if err := remote.FetchContext(ctx, &git.FetchOptions{
		RefSpecs: []config.RefSpec{
			config.RefSpec(ref + ":" + branchName),
		},
		Auth:  auth,
		Force: true,
		Depth: 1,
	}); err != nil {
		return "", fmt.Errorf("GoGitActionCache failed to fetch %s with ref %s at %s: %w", url, ref, gitPath, err)
	}
	hash, err := gogitrepo.ResolveRevision(plumbing.Revision(branchName))
	if err != nil {
		return "", fmt.Errorf("GoGitActionCache failed to resolve sha %s with ref %s at %s: %w", url, ref, gitPath, err)
	}
	logger.Infof("GoGitActionCache fetch %s with ref %s at %s resolved to %s", url, ref, gitPath, hash.String())
	return hash.String(), nil
}

type GitFileInfo struct {
	name    string
	size    int64
	modTime time.Time
	isDir   bool
	mode    fs.FileMode
}

// IsDir implements fs.FileInfo.

View on GitHub (pinned to 4f41128141)

Solutions

For private actions, pass a token: act -s GITHUB_TOKEN=$(gh auth token).
Verify the ref exists: git ls-remote https://github.com/{owner}/{repo} | grep <ref>.
Check network/proxy: HTTPS_PROXY/HTTPS_CA_INFO settings; ensure github.com is reachable (curl -I https://github.com).
Retry — transient 5xx or rate limits resolve themselves; if cancelled, look for a timeout upstream.

Example fix

# before
act -j build  # fetch fails: authentication required / repository not found

# after
act -s GITHUB_TOKEN="$(gh auth token)" -j build

Defensive patterns

Strategy: retry

Validate before calling

# preflight: can we reach the host and is the token valid?
curl -sS -o /dev/null -w '%{http_code}\n' https://github.com
gh auth status >/dev/null 2>&1 || echo 'no github token'

Try / catch

for i in 1 2 3; do act -j build && break || sleep 5; done  # retries transient fetch failures

Prevention

Always pass -s GITHUB_TOKEN=$(gh auth token) when private actions are referenced.
Pin refs that exist; verify with git ls-remote.
Configure HTTPS_PROXY/CA env for corporate networks before running act.

When it happens

Trigger: Private action repo without a token (act -s GITHUB_TOKEN=... missing); wrong/insufficient token; ref does not exist (deleted branch/tag, typo in @ref); no network; proxy blocking HTTPS; GitHub rate-limiting; ctx cancelled during fetch.

Common situations: First-time run pulling actions/checkout on a corp network with TLS interception; using a private action without passing GITHUB_TOKEN; referencing a tag that was force-deleted; offline environments.

Related errors

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/1e1d2329cb692929. Report an issue: GitHub.