nektos/act · error

Unable to resolve action `%s`, the provided ref `%s` is the

Error message

Unable to resolve action `%s`, the provided ref `%s` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `%s` instead

What it means

Cloning a remote action failed with git.ErrShortRef: the ref in `uses:` is an abbreviated commit SHA (e.g. 7-character 'abc1234'). GitHub Actions only accepts full 40-char SHAs for commit pinning; act's go-git clone path likewise cannot resolve a short SHA to a commit and asks for the full SHA, exposing the resolved full SHA in the message via err.(*git.Error).Commit().

Source

Thrown at pkg/runner/step_action_remote.go:120

			}

			actionModel, err := sar.readAction(ctx, sar.Step, sar.resolvedSha, sar.remoteAction.Path, remoteReader(ctx), os.WriteFile)
			sar.action = actionModel
			return err
		}

		actionDir := fmt.Sprintf("%s/%s", sar.RunContext.ActionCacheDir(), safeFilename(sar.Step.Uses))
		gitClone := stepActionRemoteNewCloneExecutor(git.NewGitCloneExecutorInput{
			URL:         sar.remoteAction.CloneURL(),
			Ref:         sar.remoteAction.Ref,
			Dir:         actionDir,
			Token:       github.Token,
			OfflineMode: sar.RunContext.Config.ActionOfflineMode,
		})
		var ntErr common.Executor
		if err := gitClone(ctx); err != nil {
			if errors.Is(err, git.ErrShortRef) {
				return fmt.Errorf("Unable to resolve action `%s`, the provided ref `%s` is the shortened version of a commit SHA, which is not supported. Please use the full commit SHA `%s` instead",
					sar.Step.Uses, sar.remoteAction.Ref, err.(*git.Error).Commit())
			} else if errors.Is(err, gogit.ErrForceNeeded) { // TODO: figure out if it will be easy to shadow/alias go-git err's
				ntErr = common.NewInfoExecutor("Non-terminating error while running 'git clone': %v", err)
			} else {
				return err
			}
		}

		remoteReader := func(_ context.Context) actionYamlReader {
			return func(filename string) (io.Reader, io.Closer, error) {
				f, err := os.Open(filepath.Join(actionDir, sar.remoteAction.Path, filename))
				return f, f, err
			}
		}

		return common.NewPipelineExecutor(
			ntErr,
			func(ctx context.Context) error {

View on GitHub (pinned to 4f41128141)

Solutions

1. Replace the short SHA with the full 40-character commit SHA of the same commit (the error message suggests the resolved full SHA to use).
2. Get the full hash via `git ls-remote https://github.com/org/action` or the repo's commit page.
3. Or pin to a tagged release (e.g. @v4) if exact-commit pinning is not required.

Example fix

# before
- uses: actions/checkout@8f4b7f8   # short SHA
# after
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3

# ensure SHAs used for pinning are 40 hex chars
python3 - <<'EOF'
import re,sys
src=open('.github/workflows/ci.yml').read()
for m in re.finditer(r'uses:\s*\S+@([0-9a-f]+)', src):
    if 0 < len(m.group(1)) < 40:
        sys.exit(f'short SHA {m.group(1)} — use full 40-char SHA')
EOF

func isFullSHA(ref string) bool {
  m, _ := regexp.MatchString(`^[0-9a-f]{40}$`, ref)
  return m
}

When it happens

Trigger: `uses: org/action@abc1234` where abc1234 is a truncated commit hash rather than a tag/branch; go-git tries to resolve it as a ref, detects ambiguity/shortness, and returns ErrShortRef.

Common situations: Copying a short SHA from `git log --oneline` output; tools that emit abbreviated SHAs; trying to 'pin' an action with minimum characters like some ecosystems allow.

Related errors

• Expected format {org}/{repo}[/path]@ref. Actual '%s' Input s
• HEAD sha1 could not be resolved
• failed to identify reference (tag/branch) for the checked-ou
• remote '%s' exists but has no URL
• `uses` key references invalid workflow path '%s'. Must start

AI-assisted analysis of nektos/act@4f41128141 (2026-08-15). Data as JSON: /api/errors/388dbb5715997f6c. Report an issue: GitHub.