Skip to main content

​
What the check does

For a non-SHA uses: ref, checks whether that name exists in the upstream repository as both a branch and a tag. If so, the reference is ambiguous.

​
Why it matters

When a ref name is overloaded, GitHub’s resolution order decides which one uses: picks — and that order can be exploited. An attacker who can push a branch named the same as a trusted tag may be able to shadow the intended tag, running their branch’s code instead. Even without malice, an overloaded ref makes it impossible to know which commit runs.

​
Safe alternative

Pin the action to a full commit SHA so resolution is unambiguous, or reference a ref name that isn’t overloaded: