tools.deps git dependency "SHA ... could not be resolved" in CI

A :git/url dependency in deps.edn points at a commit that tools.deps could not find, or it could not clone the repository at all. Git deps are fetched into ~/.gitlibs, and a wrong SHA or a private repo without credentials fails there.

What this error means

clj fails while resolving a git dependency with "SHA X could not be resolved" or a git clone error for the :git/url, often on a private repository.

clj

Error building classpath. Unable to resolve 'io.github.example/lib' with coordinate
{:git/url "https://github.com/example/lib.git" :git/sha "abc1234"}:
SHA abc1234 could not be resolved in https://github.com/example/lib.git

Common causes

The pinned SHA is not fetchable

The :git/sha was force-pushed away, is a short SHA that is now ambiguous, or is not on a branch the clone fetched.

A private git repo without credentials

Fetching the repo into ~/.gitlibs needs auth; on the runner there is no token or SSH key with read access, so the clone fails.

How to fix it

Pin a resolvable full SHA

Update :git/sha to a full commit SHA that exists on the default branch.
Add matching :git/tag where you use tag-based coordinates.
Run clojure -P to confirm the git dependency resolves.

deps.edn

{:deps {io.github.example/lib
        {:git/url "https://github.com/example/lib.git"
         :git/sha "abc12340f9e8d7c6b5a4938271605f4e3d2c1b0a"}}}

Provide auth for private git deps

Give the runner a token or SSH key with read access, and use the matching URL scheme so the clone into ~/.gitlibs succeeds.

Terminal

git config --global url."https://${GH_TOKEN}@github.com/".insteadOf "https://github.com/"

How to prevent it

Pin full commit SHAs, not short or moving references.
Cache ~/.gitlibs so resolved git deps persist across runs.
Store git credentials in CI secrets and configure them before resolution.