Pinned SHA does not exist in upstream repository
Control: Pinned Upstream Actions must exist· Config key: actionRefsMustExistUpstream
📋 What is this?
A workflow pins an action to a SHA that does not exist in the upstream repository's commit history (or in any of its branches/tags).
⚠️ Impact
A typo (the runner silently falls back to the default branch) or a commit that was removed or never pushed upstream, so the pin resolves nowhere. Fires only when the API confirms the commit is absent from a repo Plumber can read; a SHA it cannot verify (private repo, rate limit, network) is left alone, so a valid pin is never mislabeled. It does not detect a fork-network impostor commit (one pushed to a fork of the upstream repo), which GitHub serves as present from the parent.
🔧 How to fix
Resolve the action's current latest release upstream, copy its real SHA, and update the uses: line accordingly.
# .github/workflows/test.yml: ❌ SHA missing upstreamjobs: test: runs-on: ubuntu-latest steps: - uses: owner/repo@deadbeefdeadbeefdeadbeefdeadbeefdeadbeef # ^ not present in owner/repo's history# .github/workflows/test.yml: ✅ SHA resolves upstreamjobs: test: runs-on: ubuntu-latest steps: - uses: owner/repo@a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4 # v2.1.0💡 Tips
- Get the right SHA with
gh api repos/OWNER/REPO/git/refs/tags/vX.Y.Z. - This rule needs upstream lookup: running offline or against a private upstream where the token has no access will report
partialControls(abstain).
⚙️ Configuration
This control is configured in .plumber.yaml under the github section:
github:
controls:
actionRefsMustExistUpstream:
enabled: trueSee the CLI documentation for the full configuration reference.