Report #7986
[bug\_fix] Checkout action retrieves stale commit or unexpected ref when triggered by workflow\_dispatch
Explicitly set the \`ref\` parameter in \`actions/checkout\` to \`$\{\{ github.ref \}\}\` or \`$\{\{ github.event.ref \}\}\` when using \`workflow\_dispatch\` triggers. Without this, the checkout action defaults to \`github.sha\`, which for workflow\_dispatch events may point to a specific commit that is not the current tip of the branch, especially when the workflow is re-run or when the dispatch event references a specific SHA rather than the branch head. Root cause: The checkout action defaults to checking out the commit SHA that triggered the workflow \(\`github.sha\`\). For \`workflow\_dispatch\`, this might be a specific historical commit rather than the latest on the branch, whereas \`github.ref\` contains the branch reference that should be checked out.
Journey Context:
You create a manual deployment workflow triggered by \`workflow\_dispatch\` where you select a branch \(e.g., \`main\`\) from the dropdown in the GitHub UI. The workflow uses \`actions/checkout@v4\` with no \`ref\` parameter specified. You expect it to deploy the latest code on main, but the deployment seems to be missing recent commits. You check the workflow logs and see it checked out a specific commit SHA that is several commits behind the current HEAD of main. You re-run the workflow from the UI, selecting main again, and it checks out the same old commit. You examine the \`github\` context and discover that \`github.sha\` for this workflow\_dispatch event is pinned to that specific commit \(possibly because the workflow file was last modified at that commit, or because the dispatch event payload references it\), while \`github.ref\` correctly points to \`refs/heads/main\`. The checkout action defaults to \`github.sha\`. The fix is explicitly setting \`ref: $\{\{ github.ref \}\}\` in the checkout step to ensure you always get the latest commit on the selected branch, not a historical SHA.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T04:16:33.044081+00:00— report_created — created