Lesstep
GitHub Actions · actions policy · Checked November 5, 2026

"The action actions/cache@v4 is not allowed in … because all actions must be pinned to a full-length commit SHA": the nested action, how to pin, and where the setting is

The message comes from the actions policy "Require actions to be pinned to a full-length commit SHA", which can be turned on for a repository, an organization or an enterprise. Once it is on, any action used by a tag or a branch stops the job in Set up job, and that includes the actions that a composite action calls inside, which is why a workflow whose every uses: line is already pinned can still fail. About 690 GitHub issues and pull requests mentioned the phrase between August 1 and November 5, 2026.

What it looks like

Error: The action actions/cache@v4 is not allowed in DefinedNet/mobile_nebula because all actions must be pinned to a full-length commit SHA.

(mobile_nebula #415, where every Android and iOS job failed in Set up job.) With several actions it lists them all: "The actions actions/checkout@v5, oven-sh/setup-bun@v2, and actions/upload-artifact@v4 are not allowed in …" (hci-museum #149). A workflow that only runs on release can fail long after CI went green: in gom-jabbar #110 the deploy was refused before it started, while CI on the development branch never ran the deploy workflow.

Where the setting is

Pinning your own lines

gh api repos/actions/checkout/commits/v6 --jq .sha

prints the commit the tag points to. Put it in place of the tag and keep the version in a comment, such as uses: actions/checkout@<40-character SHA> # v6. GitHub's guidance is to check that the SHA is from the action's own repository and not from a fork.

Some actions use the branch name as an input. dtolnay/rust-toolchain@nightly picks the toolchain from the ref (shaq #175 hit exactly this). Pinned by SHA, it needs toolchain: nightly as an input, and its README asks for a SHA from the history of its master branch, because other commits are eventually garbage-collected.

When the action is not in your file

If the message names an action you never wrote, a composite action you use calls it. Open that action's action.yml (or action.yaml) at the version you pinned and look for uses:.

Telling it apart

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, so after the setting is turned on you can see which workflows stop in Set up job, including the release ones that rarely run, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

GitHub and GitHub Actions are trademarks of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc. or JetBrains.

More: "lockfile missing pin" · "Unable to resolve action" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語