GitHub Actions reusable workflow ref must be a full-length commit SHA (org policy)

Organization actions policy can require that called actions and reusable workflows be pinned to a full-length commit SHA. A reference by tag, branch, or short SHA is rejected before the job runs.

What this error means

A reusable workflow or action call is blocked because its ref is not a full 40-character commit SHA.

github-actions

Error: The workflow is not allowed to use 'org/repo/.github/workflows/deploy.yml@v2'.
Actions and reusable workflows must be pinned to a full-length commit SHA.

Common causes

Org policy enforces SHA pinning

The org requires immutable references, so tags and branches are disallowed for uses.

Short SHA used

An abbreviated SHA is not accepted; the full 40 characters are required.

How to fix it

Pin to the full commit SHA

Resolve the tag or branch to its 40-character commit SHA.
Replace the ref with that SHA, optionally with a comment noting the version.

.github/workflows/ci.yml

jobs:
  deploy:
    uses: org/repo/.github/workflows/deploy.yml@a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 # v2

Automate SHA pinning

Use a tool like Dependabot or pin-github-action to keep SHAs current.
Re-pin when you intend to upgrade the version.

How to prevent it

Pin all uses references to full commit SHAs to satisfy policy and immutability.
Let dependency automation manage SHA upgrades.