Git LFS "Object does not exist on the server" in CI

By Daniel Zoghalchali·Latchkey

The LFS server could not return the object: either it was never uploaded, or the token used cannot access it. The message deliberately covers both a missing object and an authorization gap.

What this error means

A fetch prints "Object does not exist on the server or you don't have permissions to access it" for a specific oid and the checkout fails.

[404] Object does not exist on the server or you don't have permissions to access it.
Error downloading object: models/big.onnx (4d3c2b1)
error: failed to fetch some objects

Common causes

The object was never pushed

The pointer exists but the content was not uploaded, so the server truthfully has no such object to serve.

The token is not authorized for the object

For objects hosted in another repository or under stricter access, the CI token cannot read them, and the server reports the ambiguous 404.

How to fix it

Distinguish missing from unauthorized

1. Try the fetch with a token you know can read the object; if it works, it was a permissions gap.
2. If it still 404s with a broad token, the object is genuinely missing and must be re-pushed.
3. Use git lfs push --all origin from a clone that holds the content.

git lfs push --all origin

Authorize the token for cross-repo objects

When the object lives elsewhere, provide a token scoped to that repo through the checkout token input.

- uses: actions/checkout@v4
  with:
    lfs: true
    token: ${{ secrets.LFS_READ_TOKEN }}

Using this in CI

CI checkouts are shallow and detached by default, which changes the answer this command gives you. Commands that read history, branch names, or tags need the checkout configured for it.

- uses: actions/checkout@v4
  with:
    fetch-depth: 0   # history, tags, and git describe all need this

- run: |
    git rev-parse --is-shallow-repository   # expect false
    git rev-parse --abbrev-ref HEAD          # prints HEAD when detached

How to prevent it

• Verify objects are pushed with git lfs fsck before CI depends on them.
• Scope tokens to every repo that hosts referenced objects.
• Avoid --no-verify pushes that can skip the object upload.

Frequently asked questions

Related guides

References

• Git reference manual
• GitHub Actions documentation