[GH-ISSUE #2392] actions/checkout fails `with:` `ref: ${{ github.event.pull_request.head.sha }}` with un-pushed commits

kerem commented

2026-03-01 21:48:53 +03:00

Owner

Originally created by @brianjmurrell on GitHub (Jul 9, 2024).
Original GitHub issue: https://github.com/nektos/act/issues/2392

Bug report info

act version:            0.2.64
GOOS:                   linux
GOARCH:                 amd64
NumCPU:                 12
Docker host:            unix:///run/user/1001/podman/podman.sock
Sockets found:
        /var/run/docker.sock(broken)
        $XDG_RUNTIME_DIR/podman/podman.sock
Config files:           
        /home/brian/.config/act/actrc:
                -P ubuntu-latest=catthehacker/ubuntu:act-latest
                -P ubuntu-22.04=catthehacker/ubuntu:act-22.04
                -P ubuntu-20.04=catthehacker/ubuntu:act-20.04
                -P ubuntu-18.04=catthehacker/ubuntu:act-18.04
Build info:
        Go version:            go1.22.4
        Module path:           github.com/nektos/act
        Main version:          (devel)
        Main path:             github.com/nektos/act
        Main checksum:         
        Build settings:
                -buildmode:           pie
                -compiler:            gc
                -trimpath:            true
                DefaultGODEBUG:       httplaxcontentlength=1,httpmuxgo121=1,tls10server=1,tlsrsakex=1,tlsunsafeekm=1
                CGO_ENABLED:          1
                GOARCH:               amd64
                GOOS:                 linux
                GOAMD64:              v1
Docker Engine:
        Engine version:        5.1.1
        Engine runtime:        crun
        Cgroup version:        2
        Cgroup driver:         systemd
        Storage driver:        overlay
        Registry URI:          
        OS:                    fedora
        OS type:               linux
        OS version:            40
        OS arch:               amd64
        OS kernel:             6.9.6-200.fc40.x86_64
        OS CPU:                12
        OS memory:             63943 MB
        Security options:
                name=seccomp,profile=default
                name=rootless
                name=selinux

Command used with act

act

Describe issue

It appears that act does some kind of override when it encounters:

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

where it copies the local directory to where the workflow is being run:

[Linting/ShellCheck] ⭐ Run Main Checkout code
[Linting/ShellCheck]   🐳  docker cp src=/foo/actions-lib/. dst=/foo/actions-lib
[Linting/ShellCheck]   ✅  Success - Main Checkout code

This seems reasonable/

This override does not seem to happen though when one adds:

        with:
          ref: ${{ github.event.pull_request.head.sha }}

to the actions/checkout step.

While it seems reasonable not to invoke the override when one specifies a ref:, I think when the ref is ${{ github.event.pull_request.head.sha }}, one expects the job to act on the current directory the same as if the ref: was not specified.

Link to GitHub repository

No response

Workflow content

name: Linting

# Always run on Pull Requests as then these checks can be marked as required.
on:
  push:
    branches:
      - master
  pull_request:

permissions: {}

jobs:
  shell-check:
    name: ShellCheck
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Add error parser
        run: echo -n "::add-matcher::shellcheck-matcher.json"
      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@2.0.0
        with:
          format: gcc

  linting-summary:
    name: Linting Summary
    runs-on: ubuntu-22.04
    needs: [shell-check]
    if: (!cancelled())
    steps:
      - name: Check if any job failed
        run: |
          if [[ -z "$(echo "${{ join(needs.*.result, '') }}" | sed -e 's/success//g')" ]]; then
            echo "All jobs succeeded"
          else
            echo "One or more jobs did not succeed"
            exit 1
          fi

Relevant log output

I suspect this is not really necessary.  If it is, I can add it.

Additional information

No response

Originally created by @brianjmurrell on GitHub (Jul 9, 2024). Original GitHub issue: https://github.com/nektos/act/issues/2392 ### Bug report info ```plain text act version: 0.2.64 GOOS: linux GOARCH: amd64 NumCPU: 12 Docker host: unix:///run/user/1001/podman/podman.sock Sockets found: /var/run/docker.sock(broken) $XDG_RUNTIME_DIR/podman/podman.sock Config files: /home/brian/.config/act/actrc: -P ubuntu-latest=catthehacker/ubuntu:act-latest -P ubuntu-22.04=catthehacker/ubuntu:act-22.04 -P ubuntu-20.04=catthehacker/ubuntu:act-20.04 -P ubuntu-18.04=catthehacker/ubuntu:act-18.04 Build info: Go version: go1.22.4 Module path: github.com/nektos/act Main version: (devel) Main path: github.com/nektos/act Main checksum: Build settings: -buildmode: pie -compiler: gc -trimpath: true DefaultGODEBUG: httplaxcontentlength=1,httpmuxgo121=1,tls10server=1,tlsrsakex=1,tlsunsafeekm=1 CGO_ENABLED: 1 GOARCH: amd64 GOOS: linux GOAMD64: v1 Docker Engine: Engine version: 5.1.1 Engine runtime: crun Cgroup version: 2 Cgroup driver: systemd Storage driver: overlay Registry URI: OS: fedora OS type: linux OS version: 40 OS arch: amd64 OS kernel: 6.9.6-200.fc40.x86_64 OS CPU: 12 OS memory: 63943 MB Security options: name=seccomp,profile=default name=rootless name=selinux ``` ### Command used with act ```sh act ``` ### Describe issue It appears that `act` does some kind of override when it encounters: ```yaml steps: - name: Checkout code uses: actions/checkout@v4 ``` where it copies the local directory to where the workflow is being run: ``` [Linting/ShellCheck] ⭐ Run Main Checkout code [Linting/ShellCheck] 🐳 docker cp src=/foo/actions-lib/. dst=/foo/actions-lib [Linting/ShellCheck] ✅ Success - Main Checkout code ``` This seems reasonable/ This override does not seem to happen though when one adds: ``` with: ref: ${{ github.event.pull_request.head.sha }} ``` to the `actions/checkout` step. While it seems reasonable not to invoke the override when one specifies a `ref:`, I think when the _ref_ is `${{ github.event.pull_request.head.sha }}`, one expects the job to act on the current directory the same as if the `ref:` was not specified. ### Link to GitHub repository _No response_ ### Workflow content ```yml name: Linting # Always run on Pull Requests as then these checks can be marked as required. on: push: branches: - master pull_request: permissions: {} jobs: shell-check: name: ShellCheck runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha }} - name: Add error parser run: echo -n "::add-matcher::shellcheck-matcher.json" - name: Run ShellCheck uses: ludeeus/action-shellcheck@2.0.0 with: format: gcc linting-summary: name: Linting Summary runs-on: ubuntu-22.04 needs: [shell-check] if: (!cancelled()) steps: - name: Check if any job failed run: | if [[ -z "$(echo "${{ join(needs.*.result, '') }}" | sed -e 's/success//g')" ]]; then echo "All jobs succeeded" else echo "One or more jobs did not succeed" exit 1 fi ``` ### Relevant log output ```sh I suspect this is not really necessary. If it is, I can add it. ``` ### Additional information _No response_

kerem

2026-03-01 21:48:53 +03:00

closed this issue
added the
stale

kind/bug
labels

kerem commented

2026-03-01 21:48:54 +03:00

Author

Owner

@brianjmurrell commented on GitHub (Jul 17, 2024):

Any thoughts on this one? It's kind of defeating the purpose of act to have to keep pushing every tiny change to GitHub.

@brianjmurrell commented on GitHub (Jul 17, 2024): Any thoughts on this one? It's kind of defeating the purpose of `act` to have to keep pushing every tiny change to GitHub.

kerem commented

2026-03-01 21:48:54 +03:00

Author

Owner

@cwrau commented on GitHub (Jul 24, 2024):

Any thoughts on this one? It's kind of defeating the purpose of act to have to keep pushing every tiny change to GitHub.

Similar thing is happening to us, we're trying to test CI without pushing, but act fails with;

| [command]/usr/bin/git branch --list --remote origin/fix/base-cluster/kube-janitor-image
[getChangedCharts/Get changed charts in last commit/getChangedCharts]   💬  ::debug::0
[getChangedCharts/Get changed charts in last commit/getChangedCharts]   💬  ::debug::
| [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules origin +2692876eaaecf95c4ccdc5086f1fda7ec35f3994:refs/remotes/origin/fix/base-cluster/kube-janitor-image
| fatal: remote error: upload-pack: not our ref 2692876eaaecf95c4ccdc5086f1fda7ec35f3994
| The process '/usr/bin/git' failed with exit code 128
| Waiting 19 seconds before trying again
| [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules origin +2692876eaaecf95c4ccdc5086f1fda7ec35f3994:refs/remotes/origin/fix/base-cluster/kube-janitor-image
| fatal: remote error: upload-pack: not our ref 2692876eaaecf95c4ccdc5086f1fda7ec35f3994
| The process '/usr/bin/git' failed with exit code 128
| Waiting 16 seconds before trying again
| [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules origin +2692876eaaecf95c4ccdc5086f1fda7ec35f3994:refs/remotes/origin/fix/base-cluster/kube-janitor-image
| fatal: remote error: upload-pack: not our ref 2692876eaaecf95c4ccdc5086f1fda7ec35f3994

fix/base-cluster/kube-janitor-image being the local and not pushed branch I'm currently working on

@cwrau commented on GitHub (Jul 24, 2024): > Any thoughts on this one? It's kind of defeating the purpose of `act` to have to keep pushing every tiny change to GitHub. Similar thing is happening to us, we're trying to test CI without pushing, but `act` fails with; ``` | [command]/usr/bin/git branch --list --remote origin/fix/base-cluster/kube-janitor-image [getChangedCharts/Get changed charts in last commit/getChangedCharts] 💬 ::debug::0 [getChangedCharts/Get changed charts in last commit/getChangedCharts] 💬 ::debug:: | [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules origin +2692876eaaecf95c4ccdc5086f1fda7ec35f3994:refs/remotes/origin/fix/base-cluster/kube-janitor-image | fatal: remote error: upload-pack: not our ref 2692876eaaecf95c4ccdc5086f1fda7ec35f3994 | The process '/usr/bin/git' failed with exit code 128 | Waiting 19 seconds before trying again | [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules origin +2692876eaaecf95c4ccdc5086f1fda7ec35f3994:refs/remotes/origin/fix/base-cluster/kube-janitor-image | fatal: remote error: upload-pack: not our ref 2692876eaaecf95c4ccdc5086f1fda7ec35f3994 | The process '/usr/bin/git' failed with exit code 128 | Waiting 16 seconds before trying again | [command]/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules origin +2692876eaaecf95c4ccdc5086f1fda7ec35f3994:refs/remotes/origin/fix/base-cluster/kube-janitor-image | fatal: remote error: upload-pack: not our ref 2692876eaaecf95c4ccdc5086f1fda7ec35f3994 ``` `fix/base-cluster/kube-janitor-image` being the local and not pushed branch I'm currently working on

kerem commented

2026-03-01 21:48:54 +03:00

Author

Owner

@barneyjackson commented on GitHub (Sep 5, 2024):

Looking at the same issue. Could the --local-repository flag be helpful?

Will report back any findings...

@barneyjackson commented on GitHub (Sep 5, 2024): Looking at the same issue. Could the `--local-repository` flag be helpful? Will report back any findings...

kerem commented

2026-03-01 21:48:54 +03:00

Author

Owner

@nmarulo commented on GitHub (Sep 17, 2024):

I have the same problem.

@nmarulo commented on GitHub (Sep 17, 2024): I have the same problem.

kerem commented

2026-03-01 21:48:55 +03:00

Author

Owner

@neumachen commented on GitHub (Sep 19, 2024):

I think the issue here is not in act by itself, but in the action/checkout action. I tried the --local-repository, but no dice. Unless we can redirect the clone from Github, to the local copy, or even skip it, I think that would fix this.

@neumachen commented on GitHub (Sep 19, 2024): I think the issue here is not in act by itself, but in the action/checkout action. I tried the --local-repository, but no dice. Unless we can redirect the clone from Github, to the local copy, or even skip it, I think that would fix this.

kerem commented

2026-03-01 21:48:55 +03:00

Author

Owner

@robwhiteston commented on GitHub (Oct 10, 2024):

I am not sure if this is related to this bug, or if its something different, but I started using act today and I am seeing a weird failure related actions/checkout@v4. My action file has 5 jobs in it. In the first job, we checkout the repo with actions/checkout like this:

Increment_Release_Tag:
    runs-on:  ${{ vars.GHA_RUNTIME_IMAGE }}
    outputs:
      NEW_TAG: ${{ steps.calculate_new_tag.outputs.NEW_TAG }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
...

And that works just fine. But, in the second job, we checkout the repo again like this:

Build_Packages_And_Push_To_Code_Artifact:
    needs: [Increment_Release_Tag]
    runs-on: ${{ vars.GHA_RUNTIME_IMAGE }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ needs.Increment_Release_Tag.outputs.NEW_TAG }}

And this step fails with what looks like an authentication error related to cloning the "actions" repo:

[Release-Creation/Build_Packages_And_Push_To_Code_Artifact] 🐳 docker exec cmd=[node --no-warnings -e console.log(process.execPath)] user= workdir=
[Release-Creation/Build_Packages_And_Push_To_Code_Artifact] ☁ git clone 'https://github.com/actions/checkout' # ref=v4
[Release-Creation/Build_Packages_And_Push_To_Code_Artifact] Unable to clone https://github.com/actions/checkout refs/heads/v4: authentication required

I tried adding an if: ${{ env.ACT }} line to the second job's checkout call to skip it, but, it seems like the step can't be skipped (or I am doing it wrong). Also, if I remove the 'with: ref...' clauses from the checkout step, I get the same error.

@robwhiteston commented on GitHub (Oct 10, 2024): I am not sure if this is related to this bug, or if its something different, but I started using act today and I am seeing a weird failure related `actions/checkout@v4`. My action file has 5 jobs in it. In the first job, we checkout the repo with actions/checkout like this: ``` Increment_Release_Tag: runs-on: ${{ vars.GHA_RUNTIME_IMAGE }} outputs: NEW_TAG: ${{ steps.calculate_new_tag.outputs.NEW_TAG }} steps: - name: Checkout uses: actions/checkout@v4 with: fetch-depth: 0 ... ``` And that works just fine. But, in the second job, we checkout the repo again like this: ``` Build_Packages_And_Push_To_Code_Artifact: needs: [Increment_Release_Tag] runs-on: ${{ vars.GHA_RUNTIME_IMAGE }} steps: - name: Checkout uses: actions/checkout@v4 with: ref: ${{ needs.Increment_Release_Tag.outputs.NEW_TAG }} ``` And this step fails with what looks like an authentication error related to cloning the "actions" repo: >[Release-Creation/Build_Packages_And_Push_To_Code_Artifact] 🐳 docker exec cmd=[node --no-warnings -e console.log(process.execPath)] user= workdir= [Release-Creation/Build_Packages_And_Push_To_Code_Artifact] ☁ git clone 'https://github.com/actions/checkout' # ref=v4 [Release-Creation/Build_Packages_And_Push_To_Code_Artifact] Unable to clone https://github.com/actions/checkout refs/heads/v4: authentication required I tried adding an `if: ${{ env.ACT }}` line to the second job's checkout call to skip it, but, it seems like the step can't be skipped (or I am doing it wrong). Also, if I remove the 'with: ref...' clauses from the checkout step, I get the same error.

kerem commented

2026-03-01 21:48:55 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Apr 9, 2025):

Issue is stale and will be closed in 14 days unless there is new activity

@github-actions[bot] commented on GitHub (Apr 9, 2025): Issue is stale and will be closed in 14 days unless there is new activity

kerem commented

2026-03-01 21:48:55 +03:00

Author

Owner

@surgiie commented on GitHub (Oct 31, 2025):

I have hit very similar issues and tedious roadblocks due to unpushed commits, i opened a feature request ticket; https://github.com/nektos/act/issues/2392

@surgiie commented on GitHub (Oct 31, 2025): I have hit very similar issues and tedious roadblocks due to unpushed commits, i opened a feature request ticket; https://github.com/nektos/act/issues/2392

Rows
Columns

[GH-ISSUE #2392] actions/checkout fails with: ref: ${{ github.event.pull_request.head.sha }} with un-pushed commits #1099

Bug report info

Command used with act

Describe issue

Link to GitHub repository

Workflow content

Relevant log output

Additional information

[GH-ISSUE #2392] actions/checkout fails `with:` `ref: ${{ github.event.pull_request.head.sha }}` with un-pushed commits #1099